Trojan.Siggen34.18088

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\'"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"

Executes the following

'<SYSTEM32>\net.exe' stop WinDefend /y

Injects code into

the following user processes:

xxxxx.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\cmd.exe

Modifies file system

Creates the following files

%TEMP%\nsj6236.tmp\system.dll
%TEMP%\nsj6236.tmp\stdutils.dll
%TEMP%\nsj6236.tmp\spiderbanner.dll
%TEMP%\nsj6236.tmp\nsexec.dll
%LOCALAPPDATA%\programs\xxxxx\uninstallericon.ico
%TEMP%\nsj6236.tmp\app-64.7z
%TEMP%\nsj6236.tmp\nsis7z.dll
%TEMP%\nsj6236.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsj6236.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsj6236.tmp\7z-out\icudtl.dat
%TEMP%\nsj6236.tmp\7z-out\license.electron.txt
%TEMP%\nsj6236.tmp\7z-out\licenses.chromium.html
%TEMP%\nsj6236.tmp\7z-out\locales\af.pak
%TEMP%\nsj6236.tmp\7z-out\locales\am.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ar.pak
%TEMP%\nsj6236.tmp\7z-out\locales\bg.pak
%TEMP%\nsj6236.tmp\7z-out\locales\bn.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ca.pak
%TEMP%\nsj6236.tmp\7z-out\locales\cs.pak
%TEMP%\nsj6236.tmp\7z-out\locales\da.pak
%TEMP%\nsj6236.tmp\7z-out\locales\de.pak
%TEMP%\nsj6236.tmp\7z-out\locales\el.pak
%TEMP%\nsj6236.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsj6236.tmp\7z-out\locales\en-us.pak
%TEMP%\nsj6236.tmp\7z-out\locales\es-419.pak
%TEMP%\nsj6236.tmp\7z-out\locales\es.pak
%TEMP%\nsj6236.tmp\7z-out\locales\et.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fa.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fi.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fil.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\gu.pak
%TEMP%\nsj6236.tmp\7z-out\locales\he.pak
%TEMP%\nsj6236.tmp\7z-out\locales\hi.pak
%TEMP%\nsj6236.tmp\7z-out\locales\hr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\hu.pak
%TEMP%\nsj6236.tmp\7z-out\locales\id.pak
%TEMP%\nsj6236.tmp\7z-out\locales\it.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ja.pak
%TEMP%\nsj6236.tmp\7z-out\locales\kn.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ko.pak
%TEMP%\nsj6236.tmp\7z-out\locales\lt.pak
%TEMP%\nsj6236.tmp\7z-out\locales\lv.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ml.pak
%TEMP%\nsj6236.tmp\7z-out\locales\mr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ms.pak
%TEMP%\nsj6236.tmp\7z-out\locales\nb.pak
%TEMP%\nsj6236.tmp\7z-out\locales\nl.pak
%TEMP%\nsj6236.tmp\7z-out\locales\pl.pak
%TEMP%\nsj6236.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsj6236.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ro.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ru.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sk.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sl.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sv.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sw.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ta.pak
%TEMP%\nsj6236.tmp\7z-out\locales\te.pak
%TEMP%\nsj6236.tmp\7z-out\locales\th.pak
%TEMP%\nsj6236.tmp\7z-out\locales\tr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\uk.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ur.pak
%TEMP%\nsj6236.tmp\7z-out\locales\vi.pak
%TEMP%\nsj6236.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsj6236.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsj6236.tmp\7z-out\node_modules\@primno\dpapi\dist\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\@primno\dpapi\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\adm-zip.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\headers\entryheader.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\headers\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\headers\mainheader.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\deflater.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\inflater.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\zipcrypto.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\constants.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\decoder.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\errors.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\fattr.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\utils.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\zipentry.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\zipfile.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\core.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\error.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\plugins\json.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\plugins\tar.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\plugins\zip.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\dist\axios.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\dist\axios.min.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\adapters.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\fetch.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\http.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\xhr.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\axios.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\cancel\cancelederror.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\cancel\canceltoken.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\cancel\iscancel.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\axios.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\axioserror.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\axiosheaders.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\buildfullpath.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\dispatchrequest.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\interceptormanager.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\mergeconfig.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\settle.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\transformdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\defaults\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\defaults\transitional.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\env\classes\formdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\env\data.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\axiostransformstream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\axiosurlsearchparams.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\bind.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\buildurl.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\callbackify.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\combineurls.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\composesignals.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\cookies.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\deprecatedmethod.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\estimatedataurldecodedbytes.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\formdatatojson.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\formdatatostream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\fromdatauri.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\httpstatuscode.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\isabsoluteurl.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\isaxioserror.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\isurlsameorigin.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\null.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\parseheaders.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\parseprotocol.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\progresseventreducer.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\readblob.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\resolveconfig.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\speedometer.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\spread.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\throttle.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\toformdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\tourlencodedform.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\trackstream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\validator.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\zlibheadertransformstream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\classes\blob.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\classes\formdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\classes\urlsearchparams.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\common\utils.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\node\classes\formdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\node\classes\urlsearchparams.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\node\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\utils.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\lib\browser.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\lib\form_data.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\lib\populate.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-db\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-db\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-types\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-types\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\node-stream-zip\node_stream_zip.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\node-stream-zip\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\build\release\node_sqlite3.node
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\lib\sqlite3-binding.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\lib\sqlite3.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\lib\trace.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\node_modules\node-addon-api\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\buffer-util.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\constants.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\event-target.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\extension.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\limiter.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\permessage-deflate.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\receiver.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\sender.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\stream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\subprotocol.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\validation.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\websocket-server.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\websocket.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\package.json
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\index.js
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-build.sh
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-config.sh
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\package.json
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-x64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\release\node_sqlite3.node
%TEMP%\nsj6236.tmp\7z-out\resources.pak
%TEMP%\nsj6236.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsj6236.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsj6236.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsj6236.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsj6236.tmp\7z-out\dxcompiler.dll
%TEMP%\nsj6236.tmp\7z-out\dxil.dll
%TEMP%\nsj6236.tmp\7z-out\ffmpeg.dll
%TEMP%\nsj6236.tmp\7z-out\libegl.dll
%TEMP%\nsj6236.tmp\7z-out\libglesv2.dll
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\liblzma.dll
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\liblzma.dll
%TEMP%\nsj6236.tmp\7z-out\resources\elevate.exe
%TEMP%\nsj6236.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsj6236.tmp\7z-out\vulkan-1.dll
%TEMP%\nsj6236.tmp\7z-out\xxxxx.exe
%LOCALAPPDATA%\programs\xxxxx\chrome_100_percent.pak
%LOCALAPPDATA%\programs\xxxxx\chrome_200_percent.pak
%LOCALAPPDATA%\programs\xxxxx\d3dcompiler_47.dll
%LOCALAPPDATA%\programs\xxxxx\dxcompiler.dll
%LOCALAPPDATA%\programs\xxxxx\dxil.dll
%LOCALAPPDATA%\programs\xxxxx\ffmpeg.dll
%LOCALAPPDATA%\programs\xxxxx\icudtl.dat
%LOCALAPPDATA%\programs\xxxxx\libegl.dll
%LOCALAPPDATA%\programs\xxxxx\libglesv2.dll
%LOCALAPPDATA%\programs\xxxxx\license.electron.txt
%LOCALAPPDATA%\programs\xxxxx\licenses.chromium.html
%LOCALAPPDATA%\programs\xxxxx\resources.pak
%LOCALAPPDATA%\programs\xxxxx\snapshot_blob.bin
%LOCALAPPDATA%\programs\xxxxx\v8_context_snapshot.bin
%LOCALAPPDATA%\programs\xxxxx\vk_swiftshader.dll
%LOCALAPPDATA%\programs\xxxxx\vk_swiftshader_icd.json
%LOCALAPPDATA%\programs\xxxxx\vulkan-1.dll
%LOCALAPPDATA%\programs\xxxxx\xxxxx.exe
%LOCALAPPDATA%\programs\xxxxx\locales\af.pak
%LOCALAPPDATA%\programs\xxxxx\locales\am.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ar.pak
%LOCALAPPDATA%\programs\xxxxx\locales\bg.pak
%LOCALAPPDATA%\programs\xxxxx\locales\bn.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ca.pak
%LOCALAPPDATA%\programs\xxxxx\locales\cs.pak
%LOCALAPPDATA%\programs\xxxxx\locales\da.pak
%LOCALAPPDATA%\programs\xxxxx\locales\de.pak
%LOCALAPPDATA%\programs\xxxxx\locales\el.pak
%LOCALAPPDATA%\programs\xxxxx\locales\en-gb.pak
%LOCALAPPDATA%\programs\xxxxx\locales\en-us.pak
%LOCALAPPDATA%\programs\xxxxx\locales\es-419.pak
%LOCALAPPDATA%\programs\xxxxx\locales\es.pak
%LOCALAPPDATA%\programs\xxxxx\locales\et.pak
%LOCALAPPDATA%\programs\xxxxx\locales\fa.pak
%LOCALAPPDATA%\programs\xxxxx\locales\fi.pak
%LOCALAPPDATA%\programs\xxxxx\locales\fil.pak
%LOCALAPPDATA%\programs\xxxxx\locales\fr.pak
%LOCALAPPDATA%\programs\xxxxx\locales\gu.pak
%LOCALAPPDATA%\programs\xxxxx\locales\he.pak
%LOCALAPPDATA%\programs\xxxxx\locales\hi.pak
%LOCALAPPDATA%\programs\xxxxx\locales\hr.pak
%LOCALAPPDATA%\programs\xxxxx\locales\hu.pak
%LOCALAPPDATA%\programs\xxxxx\locales\id.pak
%LOCALAPPDATA%\programs\xxxxx\locales\it.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ja.pak
%LOCALAPPDATA%\programs\xxxxx\locales\kn.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ko.pak
%LOCALAPPDATA%\programs\xxxxx\locales\lt.pak
%LOCALAPPDATA%\programs\xxxxx\locales\lv.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ml.pak
%LOCALAPPDATA%\programs\xxxxx\locales\mr.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ms.pak
%LOCALAPPDATA%\programs\xxxxx\locales\nb.pak
%LOCALAPPDATA%\programs\xxxxx\locales\nl.pak
%LOCALAPPDATA%\programs\xxxxx\locales\pl.pak
%LOCALAPPDATA%\programs\xxxxx\locales\pt-br.pak
%LOCALAPPDATA%\programs\xxxxx\locales\pt-pt.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ro.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ru.pak
%LOCALAPPDATA%\programs\xxxxx\locales\sk.pak
%LOCALAPPDATA%\programs\xxxxx\locales\sl.pak
%LOCALAPPDATA%\programs\xxxxx\locales\sr.pak
%LOCALAPPDATA%\programs\xxxxx\locales\sv.pak
%LOCALAPPDATA%\programs\xxxxx\locales\sw.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ta.pak
%LOCALAPPDATA%\programs\xxxxx\locales\te.pak
%LOCALAPPDATA%\programs\xxxxx\locales\th.pak
%LOCALAPPDATA%\programs\xxxxx\locales\tr.pak
%LOCALAPPDATA%\programs\xxxxx\locales\uk.pak
%LOCALAPPDATA%\programs\xxxxx\locales\ur.pak
%LOCALAPPDATA%\programs\xxxxx\locales\vi.pak
%LOCALAPPDATA%\programs\xxxxx\locales\zh-cn.pak
%LOCALAPPDATA%\programs\xxxxx\locales\zh-tw.pak
%LOCALAPPDATA%\programs\xxxxx\node_modules\@primno\dpapi\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\@primno\dpapi\dist\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\adm-zip.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\zipentry.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\zipfile.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\headers\entryheader.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\headers\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\headers\mainheader.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\methods\deflater.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\methods\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\methods\inflater.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\methods\zipcrypto.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\util\constants.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\util\decoder.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\util\errors.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\util\fattr.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\util\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\adm-zip\util\utils.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\lib\core.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\lib\error.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\lib\plugins\json.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\lib\plugins\tar.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\archiver\lib\plugins\zip.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\dist\axios.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\dist\axios.min.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\axios.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\utils.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\adapters\adapters.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\adapters\fetch.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\adapters\http.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\adapters\xhr.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\cancel\cancelederror.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\cancel\canceltoken.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\cancel\iscancel.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\axios.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\axioserror.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\axiosheaders.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\buildfullpath.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\dispatchrequest.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\interceptormanager.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\mergeconfig.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\settle.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\core\transformdata.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\defaults\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\defaults\transitional.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\env\data.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\env\classes\formdata.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\axiostransformstream.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\axiosurlsearchparams.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\bind.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\buildurl.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\callbackify.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\combineurls.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\composesignals.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\cookies.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\deprecatedmethod.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\estimatedataurldecodedbytes.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\formdatatojson.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\formdatatostream.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\fromdatauri.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\httpstatuscode.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\isabsoluteurl.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\isaxioserror.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\isurlsameorigin.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\null.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\parseheaders.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\parseprotocol.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\progresseventreducer.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\readblob.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\resolveconfig.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\speedometer.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\spread.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\throttle.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\toformdata.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\tourlencodedform.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\trackstream.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\validator.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\helpers\zlibheadertransformstream.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\browser\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\browser\classes\blob.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\browser\classes\formdata.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\browser\classes\urlsearchparams.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\common\utils.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\node\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\node\classes\formdata.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\axios\lib\platform\node\classes\urlsearchparams.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\lib\browser.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\lib\form_data.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\lib\populate.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\node_modules\mime-db\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\node_modules\mime-db\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\node_modules\mime-types\index.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\form-data\node_modules\mime-types\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\node-stream-zip\node_stream_zip.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\node-stream-zip\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\sqlite3\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\sqlite3\build\release\node_sqlite3.node
%LOCALAPPDATA%\programs\xxxxx\node_modules\sqlite3\lib\sqlite3-binding.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\sqlite3\lib\sqlite3.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\sqlite3\lib\trace.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\sqlite3\node_modules\node-addon-api\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\package.json
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\buffer-util.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\constants.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\event-target.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\extension.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\limiter.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\permessage-deflate.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\receiver.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\sender.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\stream.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\subprotocol.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\validation.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\websocket-server.js
%LOCALAPPDATA%\programs\xxxxx\node_modules\ws\lib\websocket.js
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar
%LOCALAPPDATA%\programs\xxxxx\resources\elevate.exe
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\index.js
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-build.sh
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-config.sh
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\package.json
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\electron.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\electron.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\electron.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-x64\electron.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-x64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\electron.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\liblzma.dll
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\electron.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\liblzma.dll
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\node.napi.node
%LOCALAPPDATA%\programs\xxxxx\resources\app.asar.unpacked\node_modules\sqlite3\build\release\node_sqlite3.node
%LOCALAPPDATA%\xxxxx-updater\installer.exe
%LOCALAPPDATA%\programs\xxxxx\uninstall xxxxx.exe
%APPDATA%\microsoft\windows\start menu\programs\xxxxx.lnk
%TEMP%\nsj6236.tmp\winshell.dll
%HOMEPATH%\desktop\xxxxx.lnk
%HOMEPATH%\electron-debug.log
nul
%APPDATA%\xxxxx\local storage\leveldb\log
%APPDATA%\xxxxx\local storage\leveldb\manifest-000001
%APPDATA%\xxxxx\code cache\wasm\index
%APPDATA%\xxxxx\code cache\js\index
%APPDATA%\xxxxx\local storage\leveldb\000001.dbtmp
%APPDATA%\xxxxx\code cache\wasm\index-dir\temp-index
%APPDATA%\xxxxx\code cache\js\index-dir\temp-index
%APPDATA%\microsoft\spelling\en-us\default.dic
%APPDATA%\microsoft\spelling\en-us\default.exc
%APPDATA%\microsoft\spelling\en-us\default.acl
%APPDATA%\xxxxx\dips-journal
%APPDATA%\xxxxx\dips
%APPDATA%\xxxxx\dips-wal
%APPDATA%\xxxxx\shared dictionary\cache\index
%APPDATA%\xxxxx\shared dictionary\db-journal
%APPDATA%\xxxxx\network\trust tokens-journal
%APPDATA%\xxxxx\shared dictionary\cache\index-dir\temp-index
%APPDATA%\xxxxx\shared dictionary\db
%APPDATA%\xxxxx\network\trust tokens
%APPDATA%\xxxxx\network\54afb8ba-57a8-46ce-a53e-ab9df6af6687.tmp
%TEMP%\temp_1790019642982.vbs
%APPDATA%\xxxxx\226f9d92-9422-4f16-aedd-3de3ececfe7e.tmp
%APPDATA%\xxxxx\05e81037-ccd0-4623-917c-dc0d46561223.tmp
%TEMP%\sex.vbs

Deletes following files that it created itself

%TEMP%\nsj6236.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsj6236.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsj6236.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsj6236.tmp\7z-out\dxcompiler.dll
%TEMP%\nsj6236.tmp\7z-out\dxil.dll
%TEMP%\nsj6236.tmp\7z-out\ffmpeg.dll
%TEMP%\nsj6236.tmp\7z-out\icudtl.dat
%TEMP%\nsj6236.tmp\7z-out\libegl.dll
%TEMP%\nsj6236.tmp\7z-out\libglesv2.dll
%TEMP%\nsj6236.tmp\7z-out\license.electron.txt
%TEMP%\nsj6236.tmp\7z-out\licenses.chromium.html
%TEMP%\nsj6236.tmp\7z-out\locales\af.pak
%TEMP%\nsj6236.tmp\7z-out\locales\am.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ar.pak
%TEMP%\nsj6236.tmp\7z-out\locales\bg.pak
%TEMP%\nsj6236.tmp\7z-out\locales\bn.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ca.pak
%TEMP%\nsj6236.tmp\7z-out\locales\cs.pak
%TEMP%\nsj6236.tmp\7z-out\locales\da.pak
%TEMP%\nsj6236.tmp\7z-out\locales\de.pak
%TEMP%\nsj6236.tmp\7z-out\locales\el.pak
%TEMP%\nsj6236.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsj6236.tmp\7z-out\locales\en-us.pak
%TEMP%\nsj6236.tmp\7z-out\locales\es-419.pak
%TEMP%\nsj6236.tmp\7z-out\locales\es.pak
%TEMP%\nsj6236.tmp\7z-out\locales\et.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fa.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fi.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fil.pak
%TEMP%\nsj6236.tmp\7z-out\locales\fr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\gu.pak
%TEMP%\nsj6236.tmp\7z-out\locales\he.pak
%TEMP%\nsj6236.tmp\7z-out\locales\hi.pak
%TEMP%\nsj6236.tmp\7z-out\locales\hr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\hu.pak
%TEMP%\nsj6236.tmp\7z-out\locales\id.pak
%TEMP%\nsj6236.tmp\7z-out\locales\it.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ja.pak
%TEMP%\nsj6236.tmp\7z-out\locales\kn.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ko.pak
%TEMP%\nsj6236.tmp\7z-out\locales\lt.pak
%TEMP%\nsj6236.tmp\7z-out\locales\lv.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ml.pak
%TEMP%\nsj6236.tmp\7z-out\locales\mr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ms.pak
%TEMP%\nsj6236.tmp\7z-out\locales\nb.pak
%TEMP%\nsj6236.tmp\7z-out\locales\nl.pak
%TEMP%\nsj6236.tmp\7z-out\locales\pl.pak
%TEMP%\nsj6236.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsj6236.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ro.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ru.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sk.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sl.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sv.pak
%TEMP%\nsj6236.tmp\7z-out\locales\sw.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ta.pak
%TEMP%\nsj6236.tmp\7z-out\locales\te.pak
%TEMP%\nsj6236.tmp\7z-out\locales\th.pak
%TEMP%\nsj6236.tmp\7z-out\locales\tr.pak
%TEMP%\nsj6236.tmp\7z-out\locales\uk.pak
%TEMP%\nsj6236.tmp\7z-out\locales\ur.pak
%TEMP%\nsj6236.tmp\7z-out\locales\vi.pak
%TEMP%\nsj6236.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsj6236.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsj6236.tmp\7z-out\node_modules\@primno\dpapi\dist\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\@primno\dpapi\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\adm-zip.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\headers\entryheader.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\headers\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\headers\mainheader.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\deflater.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\inflater.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\methods\zipcrypto.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\constants.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\decoder.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\errors.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\fattr.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\util\utils.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\zipentry.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\adm-zip\zipfile.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\core.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\error.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\plugins\json.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\plugins\tar.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\lib\plugins\zip.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\archiver\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\dist\axios.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\dist\axios.min.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\adapters.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\fetch.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\http.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\adapters\xhr.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\axios.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\cancel\cancelederror.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\cancel\canceltoken.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\cancel\iscancel.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\axios.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\axioserror.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\axiosheaders.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\buildfullpath.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\dispatchrequest.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\interceptormanager.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\mergeconfig.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\settle.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\core\transformdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\defaults\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\defaults\transitional.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\env\classes\formdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\env\data.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\axiostransformstream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\axiosurlsearchparams.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\bind.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\buildurl.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\callbackify.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\combineurls.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\composesignals.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\cookies.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\deprecatedmethod.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\estimatedataurldecodedbytes.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\formdatatojson.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\formdatatostream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\fromdatauri.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\httpstatuscode.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\isabsoluteurl.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\isaxioserror.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\isurlsameorigin.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\null.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\parseheaders.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\parseprotocol.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\progresseventreducer.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\readblob.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\resolveconfig.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\speedometer.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\spread.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\throttle.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\toformdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\tourlencodedform.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\trackstream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\validator.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\helpers\zlibheadertransformstream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\classes\blob.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\classes\formdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\classes\urlsearchparams.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\browser\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\common\utils.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\node\classes\formdata.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\node\classes\urlsearchparams.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\platform\node\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\lib\utils.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\axios\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\lib\browser.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\lib\form_data.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\lib\populate.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-db\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-db\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-types\index.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\node_modules\mime-types\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\form-data\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\node-stream-zip\node_stream_zip.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\node-stream-zip\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\build\release\node_sqlite3.node
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\lib\sqlite3-binding.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\lib\sqlite3.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\lib\trace.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\node_modules\node-addon-api\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\sqlite3\package.json
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\buffer-util.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\constants.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\event-target.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\extension.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\limiter.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\permessage-deflate.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\receiver.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\sender.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\stream.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\subprotocol.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\validation.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\websocket-server.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\lib\websocket.js
%TEMP%\nsj6236.tmp\7z-out\node_modules\ws\package.json
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\@primno\dpapi\prebuilds\win32-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\index.js
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-build.sh
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\liblzma-config.sh
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\package.json
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-arm64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\darwin-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-arm64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-x64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\linux-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\liblzma.dll
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-ia32\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\electron.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\liblzma.dll
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\lzma-native\prebuilds\win32-x64\node.napi.node
%TEMP%\nsj6236.tmp\7z-out\resources\app.asar.unpacked\node_modules\sqlite3\build\release\node_sqlite3.node
%TEMP%\nsj6236.tmp\7z-out\resources\elevate.exe
%TEMP%\nsj6236.tmp\7z-out\resources.pak
%TEMP%\nsj6236.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsj6236.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsj6236.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsj6236.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsj6236.tmp\7z-out\vulkan-1.dll
%TEMP%\nsj6236.tmp\7z-out\xxxxx.exe
%TEMP%\nsj6236.tmp\app-64.7z
%TEMP%\nsj6236.tmp\nsexec.dll
%TEMP%\nsj6236.tmp\nsis7z.dll
%TEMP%\nsj6236.tmp\spiderbanner.dll
%TEMP%\nsj6236.tmp\stdutils.dll
%TEMP%\nsj6236.tmp\system.dll
%TEMP%\nsj6236.tmp\winshell.dll
%APPDATA%\xxxxx\dips-journal
%TEMP%\temp_1790019642982.vbs
%TEMP%\sex.vbs

Moves the following files

from %APPDATA%\xxxxx\local storage\leveldb\000001.dbtmp to %APPDATA%\xxxxx\local storage\leveldb\current
from %APPDATA%\xxxxx\code cache\wasm\index-dir\temp-index to %APPDATA%\xxxxx\code cache\wasm\index-dir\the-real-index
from %APPDATA%\xxxxx\code cache\js\index-dir\temp-index to %APPDATA%\xxxxx\code cache\js\index-dir\the-real-index
from %APPDATA%\xxxxx\shared dictionary\cache\index-dir\temp-index to %APPDATA%\xxxxx\shared dictionary\cache\index-dir\the-real-index
from %APPDATA%\xxxxx\network\54afb8ba-57a8-46ce-a53e-ab9df6af6687.tmp to %APPDATA%\xxxxx\network\network persistent state
from %APPDATA%\xxxxx\226f9d92-9422-4f16-aedd-3de3ececfe7e.tmp to %APPDATA%\xxxxx\local state
from %APPDATA%\xxxxx\05e81037-ccd0-4623-917c-dc0d46561223.tmp to %APPDATA%\xxxxx\preferences

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'SysListView32' WindowName: ''

Creates and executes the following

'%LOCALAPPDATA%\programs\xxxxx\xxxxx.exe'
'%LOCALAPPDATA%\programs\xxxxx\xxxxx.exe' --type=gpu-process --user-data-dir="%APPDATA%\xxxxx" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== -...
'%LOCALAPPDATA%\programs\xxxxx\xxxxx.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\xxxxx" --field-trial-handle=1772,i,4391073297965511914,1104543...
'<SYSTEM32>\cscript.exe' //nologo "%TEMP%\temp_1790019642982.vbs" /elevate:true
'<SYSTEM32>\cscript.exe' //nologo "%TEMP%\sex.vbs" /elevate:true
'%LOCALAPPDATA%\programs\xxxxx\xxxxx.exe' --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="%...

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c "net session"
'<SYSTEM32>\net.exe' session
'<SYSTEM32>\net1.exe' session
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
'<SYSTEM32>\cmd.exe' /d /s /c "net stop WinDefend /y"
'<SYSTEM32>\net1.exe' stop WinDefend /y
'<SYSTEM32>\cmd.exe' /d /s /c "WMIC csproduct get UUID"
'<SYSTEM32>\wbem\wmic.exe' csproduct get UUID
'<SYSTEM32>\cmd.exe' /d /s /c "cscript //nologo "%TEMP%\temp_1790019642982.vbs" /elevate:true"
'<SYSTEM32>\cmd.exe' /d /s /c "cscript //nologo "%TEMP%\sex.vbs" /elevate:true"
'<SYSTEM32>\cmd.exe' /d /s /c "sc config node DisplayName= "Background Tasks Host""
'<SYSTEM32>\sc.exe' config node DisplayName= "Background Tasks Host"
'<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f"
'<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i svchost.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i winlogon.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i services.exe"
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\findstr.exe' /i svchost.exe
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i explorer.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i dllhost.exe"
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i taskhostw.exe"
'<SYSTEM32>\findstr.exe' /i services.exe
'<SYSTEM32>\findstr.exe' /i explorer.exe
'<SYSTEM32>\findstr.exe' /i taskhostw.exe
'<SYSTEM32>\findstr.exe' /i dllhost.exe
'<SYSTEM32>\findstr.exe' /i winlogon.exe
'<SYSTEM32>\cmd.exe' /d /s /c "cscript //Nologo "%TEMP%\4351583097.vbs""
'<SYSTEM32>\cscript.exe' //Nologo "%TEMP%\4351583097.vbs"
'<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,2...
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,235,1,0,0,0,69,247,204,56,...
'<SYSTEM32>\cmd.exe' /c "ver"
'<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\'""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net stop WinDefend /y"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "WMIC csproduct get UUID"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "cscript //nologo "%TEMP%\temp_1790019642982.vbs" /elevate:true"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath $env:APPDATA; Add-MpPreference -ExclusionPath 'C:\'"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "cscript //nologo "%TEMP%\sex.vbs" /elevate:true"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "sc config node DisplayName= "Background Tasks Host""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\" /t REG_DWORD /d 0 /f"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i svchost.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i winlogon.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i services.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i explorer.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i dllhost.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "tasklist | findstr /i taskhostw.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "cscript //Nologo "%TEMP%\4351583097.vbs""' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "powershell.exe Add-Type -AssemblyName System.Security; [System.Security.Cryptography.ProtectedData]::Unprotect([byte[]]@(1,0,0,0,208,140,157,223,1,21,209,17,140,122,0,192,79,194,151,2...' (with hidden window)
'%TEMP%\winget\tools\python.exe' -m pip install --upgrade pycryptodome' (with hidden window)
'%TEMP%\winget\tools\python.exe' -m pip install --upgrade pywin32' (with hidden window)
'%TEMP%\winget\tools\python.exe' -m pip install --upgrade PythonForWindows' (with hidden window)
'<SYSTEM32>\cmd.exe' /c "ver"' (with hidden window)

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial