Trojan.Siggen21.9196

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'OneDriveHost' = '%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveHost.exe'

Creates or modifies the following files

<SYSTEM32>\tasks\onedrivehost

Modifies file system

Creates the following files

%TEMP%\ms.exe
%TEMP%\rarsfx0\data\flutter_assets\resources\images\reloading.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\rules.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\scoped.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\snow.webp
%TEMP%\rarsfx0\data\flutter_assets\resources\images\snow_alternative.webp
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\bomb.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\decoy.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\flash.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\grenade.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\molotov_ct.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\forge_second.png
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\molotov_t.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\rain.webp
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\distinguished%20master%20guardian.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20ii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20iii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20master.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\legendary%20eagle%20master.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\legendary%20eagle.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\master%20guardian%20elite.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\master%20guardian%20i.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\master%20guardian%20ii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20elite%20master.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20elite.png
%TEMP%\rarsfx0\data\flutter_assets\resources\other_items\smoke.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20i.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\gold%20nova%20i.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\grain.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\forge_first.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\flashed.png
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sort.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\space.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\star.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\stars.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\steam.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sun.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\swords.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\tank.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\telegram.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\tick.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\translate.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sort-ascending-reflected.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\trash-bin.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\trust-properties.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\unavailable.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\unsafe-shield.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\unverified.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\user.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\users.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\vac.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\verified.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\agent_model.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\bomb.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\fabric_first.png
%TEMP%\rarsfx0\data\flutter_assets\resources\images\fabric_second.png
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\trash.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\images\fabric_third.png
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\shrimp.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\sort-ascending.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20ii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\the%20global%20elite.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_widowmaker.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_m249.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_m4a1.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_m4a1_silencer.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mac10.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mag7.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mp5sd.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mp7.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_mp9.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_negev.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_nova.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_tactical.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_ursus.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_p250.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_sawedoff.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_scar20.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_sg556.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_ssg08.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_tec9.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_ump45.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_usp_silencer.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_xm1014.svg
%TEMP%\rarsfx0\data\flutter_assets\shaders\ink_sparkle.frag
%TEMP%\rarsfx0\data\icudtl.dat
%TEMP%\rarsfx0\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_p90.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_revolver.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_survival_bowie.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_push.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\flower.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\unranked.png
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_ak47.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_aug.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_awp.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_bayonet.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_bizon.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_cz75a.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_deagle.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_elite.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_famas.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_fiveseven.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_g3sg1.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_galilar.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_glock.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_hkp2000.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_butterfly.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_canis.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_cord.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_css.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_falchion.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_flip.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_gut.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_gypsy_jackknife.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_karambit.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_m9_bayonet.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20iii.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\supreme%20master%20first%20class.png
%TEMP%\rarsfx0\data\flutter_assets\resources\ranks_competitive\silver%20iv.png
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\shield-exclamation.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\settings.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\selected.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\victoryday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\warcraft.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\warhammer.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\cats.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\clown.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\easygames_logo.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\food.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\halloween.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\installer_logo.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\logo.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\spaceday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\newyear.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\tastyfoodday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\space.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\war.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-bold.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-medium.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-regular.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\noirpro-semibold.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-black.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-bold.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-extrabold.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-medium.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\fonts\raleway-semibold.ttf
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\romantic.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\schoolday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\compressed_logos\summer.ico
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\newyear.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\loveday.jpg
%TEMP%\securityhealthsystem.exe
%APPDATA%\mydata\datalogs.conf
%TEMP%\exloader_installer.exe
%TEMP%\tmpcc53.tmp.bat
%TEMP%\rarsfx0\exloader_installer.exe
nul
%TEMP%\rarsfx0\flutter_windows.dll
%TEMP%\rarsfx0\msvcp140.dll
%TEMP%\rarsfx0\vcruntime140.dll
%TEMP%\rarsfx0\vcruntime140_1.dll
%TEMP%\rarsfx0\data\app.so
%TEMP%\rarsfx0\data\flutter_assets\assetmanifest.json
%TEMP%\rarsfx0\data\flutter_assets\fontmanifest.json
%LOCALAPPDATA%\microsoft\onedrive\onedrivehost.exe
%TEMP%\rarsfx0\data\flutter_assets\fonts\materialicons-regular.otf
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\agents%20of%20mayhem.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\anime.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\catsday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\cyberpank.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\fallguys.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\fishingday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\god%20of%20war.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\halloween.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\halo.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\icecreamday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\jokeday.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\0.svg
%TEMP%\rarsfx0\data\flutter_assets\notices.z
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\add.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\backgrounds\summerstart.jpg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\admin-panel.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\gamepad.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\geo.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\ghost.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\google.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\heart.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\hot.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\icecream.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\key.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\keyboard-properties.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\library.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\mail.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\mask.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\moon.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\new-year-star.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\notification.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\pencil.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\plug.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\plus.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\preview.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\puffer-fish.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\pumpkin.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\refresh.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\safe-shield.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\search.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\selected-anixart.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\selected-viewbox.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\fun.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\alien.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\gear.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\skin_items\weapon_knife_stiletto.svg
%APPDATA%\com.swiftsoft\exloader_installer\shared_preferences.json
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\filter.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\auto-delete.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\back-arrow.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\bank.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\bell.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\bug.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\calendar-alternative.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\calendar.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\cat-1.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\cat.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\chart-bar-alt.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\checked.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\christmas-tree.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\arrow-down.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\circular-divider.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\collapse.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\complain.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\cookie.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\crab.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\day.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\discord.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\download.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\edit.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\exloader.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\favourite-add.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\favourite-added.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\file-text.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\close.svg
%TEMP%\rarsfx0\data\flutter_assets\resources\icons\folder.svg
%APPDATA%\com.swiftsoft\exloader_installer\latest_application_log_file.txt

Deletes the following files

%TEMP%\ms.exe

Network activity

Connects to

'se####.yahoo.com':443
'google.com':443
'bing.com':443
'me##um.ai':443

TCP

Other

'google.com':443
'bing.com':443
'se####.yahoo.com':443
'me##um.ai':443

UDP

DNS ASK google.com
DNS ASK se####.yahoo.com
DNS ASK bing.com
DNS ASK me##um.ai

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'FLUTTER_RUNNER_WIN32_WINDOW_SWIFTSOFT_INSTALLER' WindowName: ''

Creates and executes the following

'%TEMP%\ms.exe'
'%TEMP%\securityhealthsystem.exe'
'%LOCALAPPDATA%\microsoft\onedrive\onedrivehost.exe'
'%TEMP%\exloader_installer.exe'
'%TEMP%\rarsfx0\exloader_installer.exe'
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHgAbAB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAaABlACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBTAHkA...' (with hidden window)
'%TEMP%\ms.exe' ' (with hidden window)
'<SYSTEM32>\schtasks.exe' /Create /F /TN "OneDriveHost" /SC ONLOGON /TR "%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveHost.exe" /RL HIGHEST' (with hidden window)

Executes the following

'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -EncodedCommand "PAAjAHgAbAB6ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHAAaABlACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKABbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBTAHkA...
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v3.0\Setup" /v InstallSuccess
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v2.0.50727" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v1.1.4322" /v Install
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\v1.0\3705 /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid
'<SYSTEM32>\timeout.exe' 3
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmpCC53.tmp.bat""
'<SYSTEM32>\schtasks.exe' /Create /F /TN "OneDriveHost" /SC ONLOGON /TR "%LOCALAPPDATA%\Microsoft\OneDrive\OneDriveHost.exe" /RL HIGHEST
'<SYSTEM32>\cmd.exe' /C <SYSTEM32>\reg.exe query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install
'<SYSTEM32>\reg.exe' query "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\NET Framework Setup\NDP\v4\Full" /v Install

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial