a5a275214a13b9c611277eb259769d13aa39b6a1fbd5a1774560ee97965a6653

Analysis

user interaction
yes
max time kernel
901s
max time network
465s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ATLAS.Link.Setup-2.0.4.exe
Size 129.3MB
Sample260822-kqlclaxset
SHA256 a5a275214a13b9c611277eb259769d13aa39b6a1fbd5a1774560ee97965a6653
MD5 aad64b6744f4442e52e3135c3a0b9cbc
SHA1 13bf7e37f663aa7ae52a625863c88727ba935792
SHA512 81122da9aeda8b2e1353cb5819bea5c5eed042f6a3af851b9820caf501c04a6df98ee317bd39dc57e0144630b7c7488333c8647cde4987e1ca47b154ae9926d5
SSDEEP 3145728:TYz2C76X6WO1yLb3jBnEfhPQ5ZEIFPXYbp+8+LPOsc7pZMGAPF1YJM:TYz2i6X6Wjf/5ZEgPXYdyLPW7p+DEM
TLSH
T1C958333B326FA22AD176267DFAF9D160087F775590A35C5016E8CCACCF298B42D7D281
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3712	ATLAS.Link.Setup-2.0.4.tmp
692	ATLAS Link.exe

Loads dropped DLL 10 IoCs

pid	Process
3712	ATLAS.Link.Setup-2.0.4.tmp
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe
692	ATLAS Link.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2092	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5756	powershell.exe
3600	powershell.exe
1344	powershell.exe
1476	powershell.exe
5384	powershell.exe
4320	powershell.exe
2164	powershell.exe
1824	powershell.exe
2388	powershell.exe
3108	powershell.exe
1948	powershell.exe
900	powershell.exe
5992	powershell.exe
3304	powershell.exe
3228	powershell.exe
3696	powershell.exe
4352	powershell.exe
3828	powershell.exe
712	powershell.exe
1904	powershell.exe
1096	powershell.exe
4408	powershell.exe
4800	powershell.exe
3700	powershell.exe
3188	powershell.exe
2996	powershell.exe
4428	powershell.exe
6020	powershell.exe
5104	powershell.exe
4844	powershell.exe
5072	powershell.exe
4304	powershell.exe
4404	powershell.exe
4768	powershell.exe
2776	powershell.exe
2156	powershell.exe
2684	powershell.exe
2976	powershell.exe
2884	powershell.exe
4156	powershell.exe
2648	powershell.exe
2020	powershell.exe
3792	powershell.exe
4152	powershell.exe
2020	powershell.exe
616	powershell.exe
6048	powershell.exe
4788	powershell.exe
2996	powershell.exe
1240	powershell.exe
2396	powershell.exe
3360	powershell.exe
4888	powershell.exe
5396	powershell.exe
792	powershell.exe
3176	powershell.exe
3368	powershell.exe
5680	powershell.exe
5408	powershell.exe
3876	powershell.exe
4772	powershell.exe
3204	powershell.exe
3224	powershell.exe
2596	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3128	cmd.exe
956	cmd.exe
2208	cmd.exe
1224	cmd.exe
5640	cmd.exe
3760	cmd.exe
2404	cmd.exe
1960	cmd.exe
3144	cmd.exe
1272	cmd.exe
1584	cmd.exe
3160	cmd.exe
2480	cmd.exe
1324	cmd.exe
5564	cmd.exe
3532	cmd.exe
200	cmd.exe
5852	cmd.exe
6028	cmd.exe
4468	cmd.exe
4128	cmd.exe
1352	cmd.exe
4248	cmd.exe
4680	cmd.exe
2984	cmd.exe
3200	cmd.exe
4740	cmd.exe
2872	cmd.exe
5332	cmd.exe
3424	cmd.exe
2788	cmd.exe
3804	cmd.exe
4152	cmd.exe
6040	cmd.exe
2712	cmd.exe
672	cmd.exe
4544	cmd.exe
868	cmd.exe
4872	cmd.exe
500	cmd.exe
2576	cmd.exe
4968	cmd.exe
2836	cmd.exe
2760	cmd.exe
6056	cmd.exe
4200	cmd.exe
248	cmd.exe
2672	cmd.exe
4516	cmd.exe
416	cmd.exe
2720	cmd.exe
1464	cmd.exe
4876	cmd.exe
5400	cmd.exe
1384	cmd.exe
3212	cmd.exe
5916	cmd.exe
4756	cmd.exe
2492	cmd.exe
4708	cmd.exe
4848	cmd.exe
1808	cmd.exe
756	cmd.exe
988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATLAS.Link.Setup-2.0.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATLAS.Link.Setup-2.0.4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1584	cmd.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3716-1-0x00000000009E0000-0x0000000000AC8000-memory.dmp	innosetup
behavioral2/memory/3716-11-0x00000000009E0000-0x0000000000AC8000-memory.dmp	innosetup
behavioral2/memory/3716-240-0x00000000009E0000-0x0000000000AC8000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3712	ATLAS.Link.Setup-2.0.4.tmp
3712	ATLAS.Link.Setup-2.0.4.tmp
2596	powershell.exe
2596	powershell.exe
2596	powershell.exe
5828	powershell.exe
5828	powershell.exe
5828	powershell.exe
3600	powershell.exe
3600	powershell.exe
3600	powershell.exe
616	powershell.exe
616	powershell.exe
616	powershell.exe
5680	powershell.exe
5680	powershell.exe
5680	powershell.exe
2684	powershell.exe
2684	powershell.exe
1344	powershell.exe
1344	powershell.exe
3304	powershell.exe
3304	powershell.exe
2020	powershell.exe
2020	powershell.exe
6048	powershell.exe
6048	powershell.exe
4304	powershell.exe
4304	powershell.exe
900	powershell.exe
900	powershell.exe
5992	powershell.exe
5992	powershell.exe
4888	powershell.exe
4888	powershell.exe
5408	powershell.exe
5408	powershell.exe
2164	powershell.exe
2164	powershell.exe
3376	powershell.exe
3376	powershell.exe
3188	powershell.exe
3188	powershell.exe
2996	powershell.exe
2996	powershell.exe
4404	powershell.exe
4404	powershell.exe
1476	powershell.exe
1476	powershell.exe
5104	powershell.exe
5104	powershell.exe
4312	powershell.exe
4312	powershell.exe
2976	powershell.exe
2976	powershell.exe
3368	powershell.exe
3368	powershell.exe
3228	powershell.exe
3228	powershell.exe
3700	powershell.exe
3700	powershell.exe
5916	powershell.exe
5916	powershell.exe
5396	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeDebugPrivilege	5828	powershell.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeDebugPrivilege	5680	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	3304	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	5408	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4312	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	3368	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe
Token: SeDebugPrivilege	3700	powershell.exe
Token: SeDebugPrivilege	5916	powershell.exe
Token: SeDebugPrivilege	5396	powershell.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	3204	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	5384	powershell.exe
Token: SeDebugPrivilege	712	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2648	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3712	ATLAS.Link.Setup-2.0.4.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	ATLAS Link.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3712	3716	ATLAS.Link.Setup-2.0.4.exe	89
PID 3712 wrote to memory of 692	3712	ATLAS.Link.Setup-2.0.4.tmp	91
PID 692 wrote to memory of 4876	692	ATLAS Link.exe	92
PID 4876 wrote to memory of 2596	4876	cmd.exe	94
PID 692 wrote to memory of 1584	692	ATLAS Link.exe	95
PID 1584 wrote to memory of 2092	1584	cmd.exe	97
PID 692 wrote to memory of 4740	692	ATLAS Link.exe	99
PID 4740 wrote to memory of 5828	4740	cmd.exe	101
PID 692 wrote to memory of 5040	692	ATLAS Link.exe	102
PID 5040 wrote to memory of 3600	5040	cmd.exe	104
PID 692 wrote to memory of 6056	692	ATLAS Link.exe	105
PID 6056 wrote to memory of 616	6056	cmd.exe	107
PID 692 wrote to memory of 3160	692	ATLAS Link.exe	108
PID 3160 wrote to memory of 5680	3160	cmd.exe	110
PID 692 wrote to memory of 5400	692	ATLAS Link.exe	111
PID 5400 wrote to memory of 2684	5400	cmd.exe	113
PID 692 wrote to memory of 200	692	ATLAS Link.exe	114
PID 200 wrote to memory of 1344	200	cmd.exe	116
PID 692 wrote to memory of 3128	692	ATLAS Link.exe	117
PID 3128 wrote to memory of 3304	3128	cmd.exe	119
PID 692 wrote to memory of 500	692	ATLAS Link.exe	120
PID 500 wrote to memory of 2020	500	cmd.exe	122
PID 692 wrote to memory of 3404	692	ATLAS Link.exe	123
PID 3404 wrote to memory of 6048	3404	cmd.exe	125
PID 692 wrote to memory of 4248	692	ATLAS Link.exe	126
PID 4248 wrote to memory of 4304	4248	cmd.exe	128
PID 692 wrote to memory of 5852	692	ATLAS Link.exe	129
PID 5852 wrote to memory of 900	5852	cmd.exe	131
PID 692 wrote to memory of 6040	692	ATLAS Link.exe	132
PID 6040 wrote to memory of 5992	6040	cmd.exe	134
PID 692 wrote to memory of 956	692	ATLAS Link.exe	135
PID 956 wrote to memory of 4888	956	cmd.exe	137
PID 692 wrote to memory of 6028	692	ATLAS Link.exe	138
PID 6028 wrote to memory of 5408	6028	cmd.exe	140
PID 692 wrote to memory of 2576	692	ATLAS Link.exe	141
PID 2576 wrote to memory of 2164	2576	cmd.exe	143
PID 692 wrote to memory of 1384	692	ATLAS Link.exe	144
PID 1384 wrote to memory of 3376	1384	cmd.exe	146
PID 692 wrote to memory of 4848	692	ATLAS Link.exe	147
PID 4848 wrote to memory of 3188	4848	cmd.exe	149
PID 692 wrote to memory of 2480	692	ATLAS Link.exe	150
PID 2480 wrote to memory of 2996	2480	cmd.exe	152
PID 692 wrote to memory of 2208	692	ATLAS Link.exe	153
PID 2208 wrote to memory of 4404	2208	cmd.exe	155
PID 692 wrote to memory of 2712	692	ATLAS Link.exe	156
PID 2712 wrote to memory of 1476	2712	cmd.exe	158
PID 692 wrote to memory of 2872	692	ATLAS Link.exe	159
PID 2872 wrote to memory of 5104	2872	cmd.exe	161
PID 692 wrote to memory of 4968	692	ATLAS Link.exe	162
PID 4968 wrote to memory of 4312	4968	cmd.exe	164
PID 692 wrote to memory of 1808	692	ATLAS Link.exe	165
PID 1808 wrote to memory of 2976	1808	cmd.exe	167
PID 692 wrote to memory of 4516	692	ATLAS Link.exe	168
PID 692 wrote to memory of 1224	692	ATLAS Link.exe	171
PID 1224 wrote to memory of 3228	1224	cmd.exe	173
PID 692 wrote to memory of 3760	692	ATLAS Link.exe	174
PID 3760 wrote to memory of 3700	3760	cmd.exe	176
PID 692 wrote to memory of 1324	692	ATLAS Link.exe	177
PID 1324 wrote to memory of 5916	1324	cmd.exe	179
PID 692 wrote to memory of 4468	692	ATLAS Link.exe	180
PID 4468 wrote to memory of 5396	4468	cmd.exe	182
PID 692 wrote to memory of 672	692	ATLAS Link.exe	183
PID 672 wrote to memory of 2884	672	cmd.exe	185
PID 692 wrote to memory of 5332	692	ATLAS Link.exe	186

C:\Users\Admin\AppData\Local\Temp\ATLAS.Link.Setup-2.0.4.exe
"C:\Users\Admin\AppData\Local\Temp\ATLAS.Link.Setup-2.0.4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\is-71850112MH.tmp\ATLAS.Link.Setup-2.0.4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-71850112MH.tmp\ATLAS.Link.Setup-2.0.4.tmp" /SL5="$400B8,133875677,888832,C:\Users\Admin\AppData\Local\Temp\ATLAS.Link.Setup-2.0.4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Users\Admin\AppData\Local\ATLAS Link\ATLAS Link.exe
    "C:\Users\Admin\AppData\Local\ATLAS Link\ATLAS Link.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c tasklist /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "IMAGENAME eq FortniteClient-Win64-Shipping.exe"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2092
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4740
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:616
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3160
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5680
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1344
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3304
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:500
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6048
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5852
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:900
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6040
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5992
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:956
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5408
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3188
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4404
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1476
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5104
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2976
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4516
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3368
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1224
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3228
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3700
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5916
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5396
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2884
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:5332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1904
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:3212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4788
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2404
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2996
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:5564
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3204
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:3424
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1040
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2788
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:1960
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:6020
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      PID:5720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3696
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:248
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:3532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      PID:752
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4152
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      PID:4732
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2984
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:3144
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:5640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:792
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:3200
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2776
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      PID:3028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3828
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:868
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5384
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4872
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:712
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:3804
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:5916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:1352
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3108
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:988
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2156
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2672
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4544
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3176
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2836
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      PID:5532
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2648
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4680
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5756
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3876
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2396
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:1272
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4772
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4708
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5072
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:2760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3360
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID $backendNeedles = @( '/assets/backend/lawinserver/index.js', '/assets/backend/neonite_v2/app.js' ) $logRootNeedle = 'atlas_link_backend_' $logNeedles = @('backend-log-terminal.cmd', 'backend-log-terminal.ps1', 'backend.log') $backendExeNames = @('atlas_lawinserver.exe', 'atlas_neonitev2.exe') $candidateFilter = \"Name='node.exe' OR Name='cmd.exe' OR Name='powershell.exe' OR Name='atlas_lawinserver.exe' OR Name='atlas_neonitev2.exe'\" foreach ($process in Get-CimInstance Win32_Process -Filter $candidateFilter) { $targetPid = [int]$process.ProcessId if ($targetPid -eq $ownPid) { continue } $name = ([string]$process.Name).ToLowerInvariant() $commandLine = [string]$process.CommandLine $command = $commandLine.Replace('\', '/').ToLowerInvariant() $kill = $false if ($name -eq 'node.exe') { foreach ($needle in $backendNeedles) { if ($command.Contains($needle)) { $kill = $true } } } foreach ($backendExeName in $backendExeNames) { if ($name -eq $backendExeName) { $kill = $true } } if ($name -eq 'cmd.exe' -or $name -eq 'powershell.exe') { if ($command.Contains($logRootNeedle)) { foreach ($needle in $logNeedles) { if ($command.Contains($needle)) { $kill = $true } } } } if ($kill) { try { taskkill /F /T /PID $targetPid | Out-Null } catch {} } } "
      4⤵
      Executes a command shell one-liner
      PID:4152
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ownPid = $PID
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1380

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ATLAS Link.exe

Path C:\Users\Admin\AppData\Local\ATLAS Link\ATLAS Link.exe
Size 107KB
SHA256 7182cd705f0ea3a7f48cf6c6f11b006b7dd01effa325a2c84689f35841f8d64f
MD5 ce10bca43fcd578dbe2d398f4dd1b190
SHA1 6a616465b5db3c050de6f0e1f1fecd50c894ea1b
SHA512 b3f11eabcc7fe924dc1375e12d14662941fd9d7946278bed97d803b8766500829e87d21ad6da6d7c5aa6c1cbbe65781b8db73b9a6e3afb0f2c302e796ad48896
SSDEEP 3072:VdemrL/i1PnIJHX9U/mg7L+qW1sjX5Dll32DGx2t:V8mPi1vIJHX9U/DeijphZVx
TLSH
T180B3AF16DA2980EBD3598DB8CE534A05DF32FC868BA1A6CF57C05DDB0E169D49F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\d3dcompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\app.so
Size 8.9MB
SHA256 9efb2d7e112283247243c4a02f55adffbbcefb4b390ec380f30735203736c33c
MD5 fabdf211c7eb8ed76c2a49f8d256f34a
SHA1 dc98f35e5e3e72788e8ae7e6debf4e688db8cb25
SHA512 619824f0d180c288c9450069d34dadb2c5d0071ff70d9663115910dc95c2d6ac513438cc323b16421dfb0c4ef96eb0ae5283e005b653259155dcda9631656869
SSDEEP 98304:9mci0CD/hYrQEYdYI68Z8fPrPNP3Tdq8xOKFxL0:fiFD/zvYI68Z8fPrPh3To8xOSL0
TLSH
T1B7961A57C1E54360E432E775F76F6AE69E1434D84F34B68A06C847663E9ACE04ACF232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\AssetManifest.bin
Size 26KB
SHA256 9c53a4a952402381df31511a683e9bd36c11968814e8f4ea90d135fe04b3edeb
MD5 95407bb45323983a79b68d49ddce20c5
SHA1 133d508236d10b19d4ed3188a85cedf2a97a4bbf
SHA512 a2d47bd24df6055fabf4e74007253d3964a9a56370a68f32b23e03552e8c73852245d98977260aa2b2b5920f8dff4084425d7a76041f4a77f477741c6e25f7fa
SSDEEP 384:lgHQBVdBJi4eN5ExvRz2YYZG9YNfv2Few9bzfsEQ:lgie5pf2Few9boEQ
TLSH
T172C2F46E56FE054F2EAC35ECB5F506C4A94D2B9AA000EEDE1374E80934C1C6525EFD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\FontManifest.json
Size 724B
SHA256 10f4c023c6fd7569af85d697981b7e7bc64ea03566a9a332b24c872430688e51
MD5 c75f7af11fb9919e042ad2ee704db319
SHA1 63e94befced83eda49ab19bda523176a0c0dc5c1
SHA512 3ae4fbcf97b3097c4f051733af1a4379c21a8e19c1a32077477d5931f63449b94017b3e7a594c2b4f2dd0f655c7b84073a3e3f24194b771a550f4e11ac496ad7
TLSH
T10001B90F8B1A16F5248DAD0BB47612716C482A957DD6F9DAF3784BD8C1E1A363236243
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

Console.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Console.dll
Size 1.2MB
SHA256 10178ede2b5c4d9c99572e4c6ded8482357b0452fceaa48a89f05cb8368749e8
MD5 0386e4781e5cfa5c08112090b0b6ef43
SHA1 2e3daabe043dc2ede87d94626c7bea67ef7f5ef6
SHA512 4e45c717ae7d039fbeaffa19f2755989f548c782366ff6e2a6cc5ecc605d27f71f8a3e46f258ce25eb2455a1b9f63dab8c97829ba7501da2db14f793d4227f5f
SSDEEP 24576:jhqAhuPyxkDKAADJsLoiRru28s4VgFkKgYXxVcsnjT1D:jhoyxeKry1Rj8s4VckfYisnh
TLSH
T1E645E145F1A941BCC06BA138D787A60BEF7138550B308ADB33D859A86FAB7F0567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Magnesium.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Magnesium.dll
Size 4.0MB
SHA256 eb1bcd2278ed8c4f22adf8bcb3bcdf5492d93f5b3c09859b540be5aa7baa35f9
MD5 2b1313c60887f326d163212a862bd805
SHA1 ec796443312069eba865439c7c983075254133a2
SHA512 d2903ed683a92d61b115d50b5e3760d113ec004dbc1a221ba029672442093244c460939dc6147a3f4725fe4a2beddb93b724841e48629bc56e49836c5c2dd7f3
SSDEEP 49152:mzkwhiMNBrKyAC9y/u1EaUkvsDb7YyHFRE9zh3UivgCaXdjrkF9u03I6WEGhdAOO:VanRtP1iq8Xd8ju03cPbAOCFao0
TLSH
T16016BE5572E911ADE07BE538DBAB1123C27238951730C6EF12A4155C2F7BAE0663BF23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Memory.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Memory.dll
Size 13KB
SHA256 09678b68e73eeb4463e3b442e0982eba7ff08b07df0614b12a02ed4c9f17fb7a
MD5 f41a402cb4bfa9db9c23758314d782b1
SHA1 3dd78fe11b2928fa692e14268467fd951a440632
SHA512 57464ea0d3a04e013518354bf83509e30ad31ef6988dc73ba1977caf893a98149ed497fc481b5efabf295e8632b9b588edcba0004205d01ee5670db8f8fc188a
SSDEEP 192:e7EY6GsP9AQz/y9cH4IdEByc76AnPAsAV2xDKJ8P:e4Y6GXQz/y9e2ocXHcc
TLSH
T10D524A46F79A04F9DA6582F4C8A74A18E379F920476097EF03F0552D1DA33C6323EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remix%20Console.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Remix%20Console.dll
Size 252KB
SHA256 fe56c7117bb0ecff29194bd6b7f08dd0615282b5a9db4e8ca316e7263b957f98
MD5 79ec854abee3f7a913134f5ec59e7971
SHA1 12e2341eddc6f8a014a4954b4f7ad340374963b0
SHA512 cff47e2122d0a3f3d0854300e1cbb99a82d86c5bb0cfce4f91affd1c382474861cd1ede2aeddbe86e4edacee312e21a27f16cf40a99960887fa9bd155288a68c
SSDEEP 3072:dwoI7c3k0D9zSo8aS4OLzvJ7Vd39HMo4PvCLjAwECa7xVT9z3hszWTxMKno7:dwoD3T8a2Pngr9z3GzWdMso
TLSH
T184447C25A7941DBCF573A57CCE538402D9B278688360EEDF17A048660FB7AE0B739325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Remix.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Remix.dll
Size 1.0MB
SHA256 75b2886a9836e07699f58482e85165aae7136b9bdaae5c14e9d4c99c7e9568c1
MD5 34d7e43db9d86d525ddab009f0c89e94
SHA1 9eb17ddcb418ba9d86e6ae039918e90ca26e05b6
SHA512 f4dfa5bf852071f63bc1372a8a220f4f8b2dbf41b380a5c4a02051cb6fa95386bc47b04563a9a77d72b94998a56ee977dfdbca394c7dfb787bb86841bf731458
SSDEEP 24576:Lqi3BrT+ECvFGImkihpZBKJvNGTJ5DMfwpakN3YiRnpW4Dk:PrTtCvARfeNGTokFFRnpFk
TLSH
T13D359E45B7AC11A8E0F7A178DA529227EA72384507308FEF13D456681FB76E0773EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Starfall.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Starfall.dll
Size 24KB
SHA256 322c1f6b0bfdd4b78da8ef38d980a4edf28130fcfb1e385257e1b7eff248dd64
MD5 dfd3b86c50961521ce5d99573a0db591
SHA1 97c6a15f5c42f9945e956600c007cd2e252ca1a8
SHA512 7aefdce36777a00fd715547869d24cbe233e4eca056865c310c12ccbb67aa4488fd3be3e626f49e99161a735dd7b0dd58ad72986e46ddaa14814fb670ebd3b3e
SSDEEP 384:zShxRvNP5nZx6yqYshF5BIas05HSsY79NQuhPCsrek:GhTFN6JbzIaVHSD9Sie
TLSH
T167B26B59A79405EED53B8178C5A30829DBB278313720D3DF73A2853D0EA37D2953CB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tellurium.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\Tellurium.dll
Size 17KB
SHA256 e3139acf7d542c895a88267014aefab9ccfba3bcc8ecfdb9765a3aaa1baaa55c
MD5 49f556f729f6e087310faf08ef903d65
SHA1 7d4387811830f302a45003386deb47692e846e59
SHA512 2b6c9718fc9ca0a6d25e0f7504be8918cf832fc07f32f3e4ca642140d68b936facd44841112d6bb74c4a290c803b3bd5fed6c40c84cb21a0b9ca246dcab9f4a2
SSDEEP 384:cuIrWkaQ7T8f91sdeg1C5hnc0OV+mctlwO:cOkaQ7of9jHcxVot+
TLSH
T1C7822969FBA401FDD63AD578C4B21A3BD176B1212B6153EF0355847A0F73A41793CB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-rpc.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\dlls\discord-rpc.dll
Size 291KB
SHA256 49f0e72e6b790be8386e06cdb570b67f8f3fd58c4652222cf55c71d1057d5db8
MD5 e29a873d643845fcfab2908cb0e2e6c9
SHA1 4cd2919579f3e6e1a9bc7957acb0af10007089a6
SHA512 99423c002c4a564b27fb7704cf3010c36c3986cbe99d089c2c847ba80a2d0504c1e0b5c2e0c7e306a2b696032638693a1be18a004a8534a86e34a7a9eea26bc5
SSDEEP 3072:sNz/oDsxllTAaCnZzMASRknmddwX+0JVRtC5Atws8gwjPmeOYpz8+17+Av222LO0:sloDsx/oMASRz09tCWt7yyE8POHfc
TLSH
T16E546C15F7A410BDE167C27CCA534901EBF2BC564B60EACF13904A9A2F27BE4563EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atlas_apps.png

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\atlas_apps.png
Size 2.6MB
SHA256 2acfb31372c2424379e6e0585113fb093a2abffadfd4214c2f78c7ffe2c5b3b7
MD5 5ef3fbbac03283061f7290aa59f2f458
SHA1 e60f0ede2168db7057c3faf84ed2049cc2b4ef9c
SHA512 eab7f18e6e09190aec6c6f30bd4b1b1816dae0d3a370535dfed77200a4ec5ec429d92fffb6e761a9ce7dd00c7bc21936c0f421fdaa135f76672e6a34b45fa3fb
SSDEEP 49152:Pi09DXyvm5oaFMOtzUmE/SB2ChVb9YevlSGf2nboud0FU25PsIpKXGd8lJUGh40Z:PpDCgoaF5KKcgbaMSdbjqU2bDC40V3CW
TLSH
T1FCC53341D55C31B3E54CFA67B9588BAE28EB81C367735C54B47FD8282F214940B8A3BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atlas_banner_v2.png

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\atlas_banner_v2.png
Size 2.1MB
SHA256 08e3423a8c4b9c3a27ffb25570afcdbd44f36b304bd773d2af6100572f245689
MD5 11c6524f75090a02dabfdc9a396fea9b
SHA1 687dab6c2c0a640decd14c910b6d6e6e5030daed
SHA512 0d77919a3fa6526bb5b2c6ccffd3a4dd7a57ac44f22151206f9888aaa173808317951e512df416abc7feeefda729299854ae31f923f7b64b08645492fb9a8dc6
SSDEEP 49152:Nqt1VN1vmuUubwjD32PJ/ZtPvXC396+lWkK+xD1S1Cv:OvmNubwj6PJr3XEBAkFV8I
TLSH
T197A533C2C8CDCB73F96F2A5124D3ECA247A57E5268D5D4513A4FCAED0F4686A130236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atlas_default_background.webp

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\atlas_default_background.webp
Size 2.6MB
SHA256 42073ff4e81e76379b9d77dd4f6e2e82e94ed39d73e16297a7f77b743165ac77
MD5 9b21bb6c6f8fe39e302de33d4bcd3d66
SHA1 c2e70edba257b4c614bed4ecb867a9717a78c095
SHA512 52fc96377b8d6b3474471b8fac30d9fb2c50c7e8e3809cba7afe99ef3fdfe0f0bb8b8dd7602dbe2dcc6dd4b906b24f52aa9e985b3a6532b52b6f83f9409a8844
SSDEEP 49152:JheBusyfr4SDM+z8y3+u2nlfPojn1DKu508/+gv7v/MORKpawuaXSh7LPjz76Gsu:JheBusyr58y2Bob1DP0e1nMOKhuxhn7V
TLSH
T13CC5331CE932F33A07854ACA76DB9D2432252D63E8C67750435F1B2BFEEB114F42A169
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atlas_default_video_background.mp4

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\atlas_default_video_background.mp4
Size 47.9MB
SHA256 4e55eb3c94c5aca1173ebfa5d2a174749b5557c47137a2f0ed4d66e811048694
MD5 0b2a8cd72bc91c12897c00ab87c994ac
SHA1 17f6135dcfef990a8025b3a53af30197c4f4fd97
SHA512 a5d76211ac84dfce3ff41dee0ee9287600176328a9227e5e7748256442a8e5d1400065fe630753167b73affe408e2e6df4651c40f7f7069e06034afc31b4f8cf
SSDEEP 786432:wiEq6oLmVbA5AXhHFtVCF2AB/voI4sgUPensAlyGSlrCEY/APGz+gTuWd:poVk5+jXCHvus+nTAG2NYYPGz+gTvd
TLSH
T167B7336317DBA9CCE137C47D8724C43AA95BF4B7A8675007CE88C860BF2657E6F82911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

atlas_logo.png

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\atlas_logo.png
Size 451KB
SHA256 a2909c517c1321a7d0b37ab7822c1157d9cb0c145e14efef6f6e54abd7f5b2e4
MD5 b7baf5087a26ddde0a1b4d6286772965
SHA1 0788f7d8c9523cf72438ffe11ce103887a3485f2
SHA512 218b2c63119daba05823287fb9dc8b76c480d2fa1b026026469d02d69d5f00bd7aa886e2ad2824703a53f6410f04c00e5f0de626dd04eb9cf944e72ff2d56fba
SSDEEP 12288:0eET3iRTR4ypF5yN2/sXsqT08tn1O55Rcob8UXVQ:XET3iRQMsR7tns5/7b8UFQ
TLSH
T15CA423BCBF13843CFA7D267202BA962681407F50E7311AF293796896ED464F757A203D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_pfp.png

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\default_pfp.png
Size 298KB
SHA256 dd87d341a70bae8e26347ad1dc6fd89e83cab44e4c9696cd77bb6b6b8acf0386
MD5 89b8f18a158f656173b324a989505cf9
SHA1 343d8516c2adff4e87ade5bd296b1ccd73817acc
SHA512 c44a173e143c09cfcdf0935c18e0af20a91a0e6c08eea0452f4aa7cd0bf9310947bfb012e0601d298791f0c6d1de477292c2f57176ccb73d67d6eb15fea795f0
SSDEEP 6144:E9NPE14v+si9Jepv3Tg7PdPjs5oudJl10/DjA+Vrlcxfm16X:ELs1XVPwvELRIoQ0/Q+Ff0X
TLSH
T1F9541207C227DAB24C2F106FA6FAD88E785653F485A24EF165BF409DCBDA02423576CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord.webp

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\discord.webp
Size 117KB
SHA256 11bd2afa41b5794311fc2d7ca6b86c0f361b9ce295797ef7052ca7cab04cf205
MD5 540a6cc0de4f9295ae192c90ba177410
SHA1 122fa75cc035a55aafa4e48af9b6f63aed92dd51
SHA512 9d58ca5812ecc49e1e2eb0206a876ec41c9f22b8068d4af9e687fa74caf6917845bdad39a92db8eb813060f9494e5945df0528ec83c53783d6eb205a82b9fa29
SSDEEP 1536:o1Lssbb0Ig6tny34goohdM6qN6pfHHg+qdYDkN8nw1VOkOlDQ4mJc:o1LssP0d4g3LM69RyQk8wekWaJc
TLSH
T1D8C3F123A3015227CDC62335C8F31B34BFB35479D6AA1A07BF755878687A7183E1EA85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

missingasset.webp

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\assets\images\missingasset.webp
Size 2.1MB
SHA256 9e2552d67d1a1ae49678bdf31faf88ca1e7e886a1ff7e98b786a1bf6269c4010
MD5 53c471d89f5d0a77ea1091f0092724e1
SHA1 57aaf07ec5dadc1de2758d6235c13c07868e607e
SHA512 0c8e7da09158b9a264433579338fefa1c0319f8abad269a5720f09eb0c898fde39265a2f74772fa4e356afea4e6215b91b799ed1958feb7e326112872b1689f2
SSDEEP 49152:VDBziqyzv/Gg9X9Bngv9VeRUBX4IS1ceEJZDfuTR7+798:vObj/d9NBgvToUBoIbeYCkZ8
TLSH
T167A5337888DA1E25E2DD460592DE7C07219F5082CB32507B7ACED0EAFF5C5F86A07B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ATLAS Link\data\icudtl.dat
Size 760KB
SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
MD5 692337664e861ad322138061132dddc6
SHA1 8a99bc860eda0772f3b1f4a125fa4d474410e21c
SHA512 3e2e6adb651e37e530734f999634d7c101fa1c45ae380be8ad169bbfb0a047f2878ff6c8d1428d6b9e7301b447ab2f8839484322ddb3831984be71d442829a55
SSDEEP 12288:HMlhw771h0jM7ykPG07+r4c8w0P4N48RkjtYdPHz982VT50q:ahw3zVtjsbGu4RjgPHzfCq
TLSH
T18CF47C03B1D79C9FE0D48636C9A1E37A9A33978C5B7311D67E6D45887F4A0D70282BCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_acrylic_plugin.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\flutter_acrylic_plugin.dll
Size 82KB
SHA256 f15164032e182e8291787240f1f91bfe1b47e78ade9c22193e7402d1fdd3b436
MD5 a0e23ce073a8ed5d955cafe5b5b15e05
SHA1 9debd57eb9516e53dea362f21d791bec0c0d2a7a
SHA512 2452b9833bb3c1165278ade0feac8a2cc4631d879f6c893878a4f75717d468d0015ef996643c6da1dd55e2fd921902dd2d4712f64137dab49649504c2904e179
SSDEEP 1536:whyJpj9qif1F1SIMZXpwON0gaT6igHD4vAo108nYCz8tll:whMjqif1vs10gaT6igj4vAo108nzz8tl
TLSH
T177831A2AEA59906BE21AD4F8CA474D05CB72F88657D16BCF53800EDF0F57AE81E3E101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\flutter_windows.dll
Size 17.7MB
SHA256 9096bfdcab5d1241f6ff1b0d6d5144ae996ba4cfb918acfc84962e5d462a3d08
MD5 5a871495d9f547db535366ae14f555d0
SHA1 8c8de5e7570dcb6fcc6f3bcf491c5069b96e3109
SHA512 1fb740a86a33d6a9a1a1e7fda7699b94704c7a51fcf6743252cbd524d4277abd10b1cfd687258cd252f7e293dc23af027019f8cdd9fcc1d478c94c4fc609139f
SSDEEP 98304:URjeVt2SfFEq7xE05UDoP5gEY0MlJiA2nJhzJdD99cnZiews6GIhZ35N:U8VtwV0Vz8Tws4v5N
TLSH
T1E6177C07F29680A9C44DD2B88B1B8A27F7B0B4890625B2DF375817112F67FB46B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\libEGL.dll
Size 461KB
SHA256 b2590bd0692f0381fc45c20bf1c7f7f713c9ea19c7ea6bab62efdd1fadc4eaac
MD5 0f61da7cea39e89861117f3cb4620dae
SHA1 9ca286bf6d5617eb38101d5e166edac29497c9c5
SHA512 7dc2bbce9808e00122ae0d960ad6b0156d201494aedf4c4c9e261f50986b72dd19b41d443138ffdf1b2e5b8e29614f0a1e909e4c867262eab311f6675618369d
SSDEEP 6144:bAJGuTlLMP/jvtG0uMgvgZS+U85p+2uEA3sB9KeZTyT/tSOaj0yPepA9YK9f:oTaP/jvtG0urvgZS724sBbj0ZS7
TLSH
T156A48D15B79448A9D02AC074CA538643EA72B8960F64FADF13A0D37D1F777E85B3A324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\libGLESv2.dll
Size 7.1MB
SHA256 620bb6e38d7ed6c760a0cf4a8eb6a8f64b259b96ff286551cd32cefc6c35ca39
MD5 d22c92bee4e7a14d6c74e7376eca7605
SHA1 0592d72d5e0e38e5cfd9a090309260962bf8c4d9
SHA512 2aeec8ccf9db442a2b1e3b391e6c3e899de1266199e6ee6040aceeaf8931e1d10c55ea1ab9ebbd3cc662bf56aea698c09e38f75c7b3e8b0b27c02af63d36993f
SSDEEP 49152:fR1vq8X1ZxC721Mr+IqizQ0LQj7KxKT1wvIOCaDCmvWI2YQkGk6jouaLlbpx/fur:b/xO21eqnoIw+vknAYYszpuSxxZi8Y1
TLSH
T142765A03F69141EAD05DD2B98B5B9622F231BC861371B6DF229473153F76BE0AB3A314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libmpv-2.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\libmpv-2.dll
Size 28.4MB
SHA256 d5f0694b08c124e785d858d00082f3e3b158dd9138bfc48c0382bf1eb443a5fc
MD5 3a6bd0dc9ab32d7b450f06bca2359274
SHA1 b2be6a73be23b60f1d23543363ea559438218c72
SHA512 4c8133321833bc94c8a2f1ddc83523fd554d9699efa09d8dea6ef4aa9bbca0a4f041a10e4793b6424c8cffc4583e36c2a96039017f29465458a9a2e5510631ef
SSDEEP 196608:2E4MJL6OGzrpR79PnKPBv00IbW8p6NMA+31bGb34+1VVMjbCtuQ/OHAs4:CMMOap19/KPR0Zz50I+5Mjbou4Eb4
TLSH
T116676D07E29350ACC56BC170876AE733A631785D02B47A7F2695E7B02F22F90775EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_kit_libs_windows_video_plugin.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\media_kit_libs_windows_video_plugin.dll
Size 12KB
SHA256 be4149c6624302b8525e6a2b0bae4a40ca288d10afcec5a1b5f729739d85b6c4
MD5 0bc18938c39533ce01ee39d049535cf6
SHA1 1685c732933d09c8f04e2c674eb08c0ee9f29d8e
SHA512 9d1420b32b3e4dfcb9240274e5484ea2d56ecd4ba79c0cabbc4cbf8add6722611de53ea161cbe5e59f7665aec6bffbd89d3d8c4e80abd75036edd7e1185e7391
SSDEEP 192:FjD69xiHLVKwgXrMvDKLzwlNrsIHqU0KfWSAvX2TrWDty6yfF9ZeP:pD69QKwQMvDKLslGs1FSP
TLSH
T10542C7477B590A95E23543B8A0930F00A6B5BC316BA267CB23E1915A0F577C5B0BEA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

media_kit_video_plugin.dll

Path C:\Users\Admin\AppData\Local\ATLAS Link\media_kit_video_plugin.dll
Size 147KB
SHA256 3d8f6e6aa4d7897ae1ef199933003d48849023c98b78cf655e4c9e43047789dd
MD5 c1b866fd8e36284aef95b1761b14077f
SHA1 808b8e8a17b5dd208ff92b7ba14505104b3c40a3
SHA512 128971bf7842de06ff713d17ee77a500fa65828ef3a4d602acb4b3f1491733458ed6e12310fbeee9bbc86ad64bf5b4efca26db940f71777a252a46a624cc9cca
SSDEEP 3072:KwF/k8+AMznSGJtjfti+r1zE0iTMfe2nSoPH:Ke+AKJ9li+5w0iTMfe2nSoPH
TLSH
T133E34C2BB65940ABE22AD0BC89474D06EB72F885476197CB17904BEF0F17FE46E3E510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 bf1aa6ac9ad2aba7c10a908fe04522937f89215eed432273fe494d0b6a827426
MD5 367cd011c44fd63e1fa95cab22ac2c26
SHA1 59a7c8c8f0ac1bb652ca5e01e984da95b18b5ccd
SHA512 de6a8bd27da753255d813fdeca4dff39da83e3c7818987928aa2797ea2ee27db127a417347d6005e5fb7f737cf2ef897c49d50d196ede66a0e35592a1e44afa7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_unylh3p0.5cl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_unylh3p0.5cl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ATLAS.Link.Setup-2.0.4.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-71850112MH.tmp\ATLAS.Link.Setup-2.0.4.tmp
Size 4.2MB
SHA256 b14b3b361c6ed3146292b46d19b854063120db1f62ba1557f72196f0a2ffefef
MD5 f320404f86586f3f935ec9cef2e701df
SHA1 19a246344115d348f167728ffa71099184038391
SHA512 df63a0cc71cf3d6a035625695a7415473ca35bc4ecb8d4509724e07e95ebc062593d37adf5d16fcd917be367a54ed063fe7b8c89c876ddf85c3af408984cfddd
SSDEEP 98304:+3U5HY/KwjoYY1j48UWm2eTMFdC+Jf333F1:X4/1jorPmEP1
TLSH
T180168F03B348753EE4671A3A583FA680983F7A213A26CD4B6BF40D5C8F396416D3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_is7z.dll

Path C:\Users\Admin\AppData\Local\Temp\is-Z7DWH5E697.tmp\_isetup\_is7z.dll
Size 971KB
SHA256 f97cda058bfe97a7e9ced5cde7018bbc26e35155c3c7405c6146808f8d06806d
MD5 e61d992e2fdcce91e7cefc7f2b4e25ba
SHA1 d3331673e9f0e8bdd6f44774c46f2ba69b94aee6
SHA512 b2213c1b15000fdbb6e5b4e00c916633237397de34799651193c046937b0e01ceb31d8c42c4ce6d63aabd34ce54574f250837e9aecc58d1505943543292e7655
SSDEEP 24576:Vu7+5bgfJ9DpAuwNrpH3XysiHAwor7XVq:wAI3wNKHAzrE
TLSH
T10F25AE12B7EEC1F8CA4E15305A3DAB59167DA39807108ADBA3D02E9E7F309D2D735E05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-273-0x00007FFB16760000-0x00007FFB18868000-memory.dmp

Download

memory/692-233-0x000001D85A830000-0x000001D85A831000-memory.dmp

Download

memory/692-236-0x000001D85B030000-0x000001D85B91D000-memory.dmp

Download

memory/692-237-0x000001D85B030000-0x000001D85B91D000-memory.dmp

Download

memory/692-289-0x00007FFB16760000-0x00007FFB18868000-memory.dmp

Download

memory/692-234-0x000001D85B030000-0x000001D85B91D000-memory.dmp

Download

memory/692-238-0x000001D85A840000-0x000001D85A841000-memory.dmp

Download

memory/2596-248-0x000001D75CEE0000-0x000001D75CF02000-memory.dmp

Download

memory/3712-13-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/3712-12-0x0000000000130000-0x0000000000572000-memory.dmp

Download

memory/3712-15-0x0000000000130000-0x0000000000572000-memory.dmp

Download

memory/3712-17-0x0000000000130000-0x0000000000572000-memory.dmp

Download

memory/3712-6-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/3712-30-0x0000000000130000-0x0000000000572000-memory.dmp

Download

memory/3712-212-0x0000000000130000-0x0000000000572000-memory.dmp

Download

memory/3712-235-0x0000000000130000-0x0000000000572000-memory.dmp

Download

memory/3716-11-0x00000000009E0000-0x0000000000AC8000-memory.dmp

Download

memory/3716-1-0x00000000009E0000-0x0000000000AC8000-memory.dmp

Download

memory/3716-240-0x00000000009E0000-0x0000000000AC8000-memory.dmp

Download