Trojan.Siggen32.61062

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

adds antivirus exclusion:

'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;Add-MpPreference -ExclusionPath '%HO...

Injects code into

the following user processes:

bizayasystem.exe

Modifies file system

Creates the following files

%TEMP%\nsb65fa.tmp\system.dll
%TEMP%\nsb65fa.tmp\app-64.7z
%TEMP%\nsb65fa.tmp\nsis7z.dll
%TEMP%\nsb65fa.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsb65fa.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsb65fa.tmp\7z-out\icudtl.dat
%TEMP%\nsb65fa.tmp\7z-out\license.electron.txt
%TEMP%\nsb65fa.tmp\7z-out\licenses.chromium.html
%TEMP%\nsb65fa.tmp\7z-out\locales\af.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\am.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ar.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\bg.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\bn.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ca.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\cs.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\da.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\de.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\el.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\en-us.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\es-419.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\es.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\et.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fa.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fi.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fil.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\gu.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\he.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\hi.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\hr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\hu.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\id.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\it.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ja.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\kn.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ko.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\lt.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\lv.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ml.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\mr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ms.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\nb.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\nl.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\pl.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ro.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ru.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sk.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sl.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sv.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sw.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ta.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\te.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\th.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\tr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\uk.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ur.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\vi.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsb65fa.tmp\7z-out\resources\app.asar
%TEMP%\nsb65fa.tmp\7z-out\resources\es.pak
%TEMP%\nsb65fa.tmp\7z-out\resources.pak
%TEMP%\nsb65fa.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsb65fa.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsb65fa.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsb65fa.tmp\7z-out\bizayasystem.exe
%TEMP%\nsb65fa.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsb65fa.tmp\7z-out\ffmpeg.dll
%TEMP%\nsb65fa.tmp\7z-out\libegl.dll
%TEMP%\nsb65fa.tmp\7z-out\libglesv2.dll
%TEMP%\nsb65fa.tmp\7z-out\resources\elevate.exe
%TEMP%\nsb65fa.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsb65fa.tmp\7z-out\vulkan-1.dll
%TEMP%\ucd93q3raxbelses\bizayasystem.exe
%TEMP%\ucd93q3raxbelses\chrome_100_percent.pak
%TEMP%\ucd93q3raxbelses\chrome_200_percent.pak
%TEMP%\ucd93q3raxbelses\d3dcompiler_47.dll
%TEMP%\ucd93q3raxbelses\ffmpeg.dll
%TEMP%\ucd93q3raxbelses\icudtl.dat
%TEMP%\ucd93q3raxbelses\libegl.dll
%TEMP%\ucd93q3raxbelses\libglesv2.dll
%TEMP%\ucd93q3raxbelses\license.electron.txt
%TEMP%\ucd93q3raxbelses\licenses.chromium.html
%TEMP%\ucd93q3raxbelses\resources.pak
%TEMP%\ucd93q3raxbelses\snapshot_blob.bin
%TEMP%\ucd93q3raxbelses\v8_context_snapshot.bin
%TEMP%\ucd93q3raxbelses\vk_swiftshader.dll
%TEMP%\ucd93q3raxbelses\vk_swiftshader_icd.json
%TEMP%\ucd93q3raxbelses\vulkan-1.dll
%TEMP%\ucd93q3raxbelses\locales\af.pak
%TEMP%\ucd93q3raxbelses\locales\am.pak
%TEMP%\ucd93q3raxbelses\locales\ar.pak
%TEMP%\ucd93q3raxbelses\locales\bg.pak
%TEMP%\ucd93q3raxbelses\locales\bn.pak
%TEMP%\ucd93q3raxbelses\locales\ca.pak
%TEMP%\ucd93q3raxbelses\locales\cs.pak
%TEMP%\ucd93q3raxbelses\locales\da.pak
%TEMP%\ucd93q3raxbelses\locales\de.pak
%TEMP%\ucd93q3raxbelses\locales\el.pak
%TEMP%\ucd93q3raxbelses\locales\en-gb.pak
%TEMP%\ucd93q3raxbelses\locales\en-us.pak
%TEMP%\ucd93q3raxbelses\locales\es-419.pak
%TEMP%\ucd93q3raxbelses\locales\es.pak
%TEMP%\ucd93q3raxbelses\locales\et.pak
%TEMP%\ucd93q3raxbelses\locales\fa.pak
%TEMP%\ucd93q3raxbelses\locales\fi.pak
%TEMP%\ucd93q3raxbelses\locales\fil.pak
%TEMP%\ucd93q3raxbelses\locales\fr.pak
%TEMP%\ucd93q3raxbelses\locales\gu.pak
%TEMP%\ucd93q3raxbelses\locales\he.pak
%TEMP%\ucd93q3raxbelses\locales\hi.pak
%TEMP%\ucd93q3raxbelses\locales\hr.pak
%TEMP%\ucd93q3raxbelses\locales\hu.pak
%TEMP%\ucd93q3raxbelses\locales\id.pak
%TEMP%\ucd93q3raxbelses\locales\it.pak
%TEMP%\ucd93q3raxbelses\locales\ja.pak
%TEMP%\ucd93q3raxbelses\locales\kn.pak
%TEMP%\ucd93q3raxbelses\locales\ko.pak
%TEMP%\ucd93q3raxbelses\locales\lt.pak
%TEMP%\ucd93q3raxbelses\locales\lv.pak
%TEMP%\ucd93q3raxbelses\locales\ml.pak
%TEMP%\ucd93q3raxbelses\locales\mr.pak
%TEMP%\ucd93q3raxbelses\locales\ms.pak
%TEMP%\ucd93q3raxbelses\locales\nb.pak
%TEMP%\ucd93q3raxbelses\locales\nl.pak
%TEMP%\ucd93q3raxbelses\locales\pl.pak
%TEMP%\ucd93q3raxbelses\locales\pt-br.pak
%TEMP%\ucd93q3raxbelses\locales\pt-pt.pak
%TEMP%\ucd93q3raxbelses\locales\ro.pak
%TEMP%\ucd93q3raxbelses\locales\ru.pak
%TEMP%\ucd93q3raxbelses\locales\sk.pak
%TEMP%\ucd93q3raxbelses\locales\sl.pak
%TEMP%\ucd93q3raxbelses\locales\sr.pak
%TEMP%\ucd93q3raxbelses\locales\sv.pak
%TEMP%\ucd93q3raxbelses\locales\sw.pak
%TEMP%\ucd93q3raxbelses\locales\ta.pak
%TEMP%\ucd93q3raxbelses\locales\te.pak
%TEMP%\ucd93q3raxbelses\locales\th.pak
%TEMP%\ucd93q3raxbelses\locales\tr.pak
%TEMP%\ucd93q3raxbelses\locales\uk.pak
%TEMP%\ucd93q3raxbelses\locales\ur.pak
%TEMP%\ucd93q3raxbelses\locales\vi.pak
%TEMP%\ucd93q3raxbelses\locales\zh-cn.pak
%TEMP%\ucd93q3raxbelses\locales\zh-tw.pak
%TEMP%\ucd93q3raxbelses\resources\app.asar
%TEMP%\ucd93q3raxbelses\resources\elevate.exe
%TEMP%\ucd93q3raxbelses\resources\es.pak
%TEMP%\nsb65fa.tmp\stdutils.dll
%HOMEPATH%\appdata\.4zo8d44s\yxzxzz9zu5.exe
%APPDATA%\bizayasystem-9gi75u\b4bc7100-5936-4f34-b2a1-37cb01ad29da.tmp

Deletes following files that it created itself

%TEMP%\ucd93q3raxbelses\bizayasystem.exe
%TEMP%\ucd93q3raxbelses\chrome_100_percent.pak
%TEMP%\ucd93q3raxbelses\chrome_200_percent.pak
%TEMP%\ucd93q3raxbelses\d3dcompiler_47.dll
%TEMP%\ucd93q3raxbelses\ffmpeg.dll
%TEMP%\ucd93q3raxbelses\icudtl.dat
%TEMP%\ucd93q3raxbelses\libegl.dll
%TEMP%\ucd93q3raxbelses\libglesv2.dll
%TEMP%\ucd93q3raxbelses\license.electron.txt
%TEMP%\ucd93q3raxbelses\licenses.chromium.html
%TEMP%\ucd93q3raxbelses\locales\af.pak
%TEMP%\ucd93q3raxbelses\locales\am.pak
%TEMP%\ucd93q3raxbelses\locales\ar.pak
%TEMP%\ucd93q3raxbelses\locales\bg.pak
%TEMP%\ucd93q3raxbelses\locales\bn.pak
%TEMP%\ucd93q3raxbelses\locales\ca.pak
%TEMP%\ucd93q3raxbelses\locales\cs.pak
%TEMP%\ucd93q3raxbelses\locales\da.pak
%TEMP%\ucd93q3raxbelses\locales\de.pak
%TEMP%\ucd93q3raxbelses\locales\el.pak
%TEMP%\ucd93q3raxbelses\locales\en-gb.pak
%TEMP%\ucd93q3raxbelses\locales\en-us.pak
%TEMP%\ucd93q3raxbelses\locales\es-419.pak
%TEMP%\ucd93q3raxbelses\locales\es.pak
%TEMP%\ucd93q3raxbelses\locales\et.pak
%TEMP%\ucd93q3raxbelses\locales\fa.pak
%TEMP%\ucd93q3raxbelses\locales\fi.pak
%TEMP%\ucd93q3raxbelses\locales\fil.pak
%TEMP%\ucd93q3raxbelses\locales\fr.pak
%TEMP%\ucd93q3raxbelses\locales\gu.pak
%TEMP%\ucd93q3raxbelses\locales\he.pak
%TEMP%\ucd93q3raxbelses\locales\hi.pak
%TEMP%\ucd93q3raxbelses\locales\hr.pak
%TEMP%\ucd93q3raxbelses\locales\hu.pak
%TEMP%\ucd93q3raxbelses\locales\id.pak
%TEMP%\ucd93q3raxbelses\locales\it.pak
%TEMP%\ucd93q3raxbelses\locales\ja.pak
%TEMP%\ucd93q3raxbelses\locales\kn.pak
%TEMP%\ucd93q3raxbelses\locales\ko.pak
%TEMP%\ucd93q3raxbelses\locales\lt.pak
%TEMP%\ucd93q3raxbelses\locales\lv.pak
%TEMP%\ucd93q3raxbelses\locales\ml.pak
%TEMP%\ucd93q3raxbelses\locales\mr.pak
%TEMP%\ucd93q3raxbelses\locales\ms.pak
%TEMP%\ucd93q3raxbelses\locales\nb.pak
%TEMP%\ucd93q3raxbelses\locales\nl.pak
%TEMP%\ucd93q3raxbelses\locales\pl.pak
%TEMP%\ucd93q3raxbelses\locales\pt-br.pak
%TEMP%\ucd93q3raxbelses\locales\pt-pt.pak
%TEMP%\ucd93q3raxbelses\locales\ro.pak
%TEMP%\ucd93q3raxbelses\locales\ru.pak
%TEMP%\ucd93q3raxbelses\locales\sk.pak
%TEMP%\ucd93q3raxbelses\locales\sl.pak
%TEMP%\ucd93q3raxbelses\locales\sr.pak
%TEMP%\ucd93q3raxbelses\locales\sv.pak
%TEMP%\ucd93q3raxbelses\locales\sw.pak
%TEMP%\ucd93q3raxbelses\locales\ta.pak
%TEMP%\ucd93q3raxbelses\locales\te.pak
%TEMP%\ucd93q3raxbelses\locales\th.pak
%TEMP%\ucd93q3raxbelses\locales\tr.pak
%TEMP%\ucd93q3raxbelses\locales\uk.pak
%TEMP%\ucd93q3raxbelses\locales\ur.pak
%TEMP%\ucd93q3raxbelses\locales\vi.pak
%TEMP%\ucd93q3raxbelses\locales\zh-cn.pak
%TEMP%\ucd93q3raxbelses\locales\zh-tw.pak
%TEMP%\ucd93q3raxbelses\resources\app.asar
%TEMP%\ucd93q3raxbelses\resources\elevate.exe
%TEMP%\ucd93q3raxbelses\resources\es.pak
%TEMP%\ucd93q3raxbelses\resources.pak
%TEMP%\ucd93q3raxbelses\snapshot_blob.bin
%TEMP%\ucd93q3raxbelses\v8_context_snapshot.bin
%TEMP%\ucd93q3raxbelses\vk_swiftshader.dll
%TEMP%\ucd93q3raxbelses\vk_swiftshader_icd.json
%TEMP%\ucd93q3raxbelses\vulkan-1.dll
%TEMP%\nsb65fa.tmp\7z-out\bizayasystem.exe
%TEMP%\nsb65fa.tmp\7z-out\chrome_100_percent.pak
%TEMP%\nsb65fa.tmp\7z-out\chrome_200_percent.pak
%TEMP%\nsb65fa.tmp\7z-out\d3dcompiler_47.dll
%TEMP%\nsb65fa.tmp\7z-out\ffmpeg.dll
%TEMP%\nsb65fa.tmp\7z-out\icudtl.dat
%TEMP%\nsb65fa.tmp\7z-out\libegl.dll
%TEMP%\nsb65fa.tmp\7z-out\libglesv2.dll
%TEMP%\nsb65fa.tmp\7z-out\license.electron.txt
%TEMP%\nsb65fa.tmp\7z-out\licenses.chromium.html
%TEMP%\nsb65fa.tmp\7z-out\locales\af.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\am.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ar.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\bg.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\bn.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ca.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\cs.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\da.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\de.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\el.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\en-gb.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\en-us.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\es-419.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\es.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\et.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fa.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fi.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fil.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\fr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\gu.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\he.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\hi.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\hr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\hu.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\id.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\it.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ja.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\kn.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ko.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\lt.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\lv.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ml.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\mr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ms.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\nb.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\nl.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\pl.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\pt-br.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\pt-pt.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ro.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ru.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sk.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sl.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sv.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\sw.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ta.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\te.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\th.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\tr.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\uk.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\ur.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\vi.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\zh-cn.pak
%TEMP%\nsb65fa.tmp\7z-out\locales\zh-tw.pak
%TEMP%\nsb65fa.tmp\7z-out\resources\app.asar
%TEMP%\nsb65fa.tmp\7z-out\resources\elevate.exe
%TEMP%\nsb65fa.tmp\7z-out\resources\es.pak
%TEMP%\nsb65fa.tmp\7z-out\resources.pak
%TEMP%\nsb65fa.tmp\7z-out\snapshot_blob.bin
%TEMP%\nsb65fa.tmp\7z-out\v8_context_snapshot.bin
%TEMP%\nsb65fa.tmp\7z-out\vk_swiftshader.dll
%TEMP%\nsb65fa.tmp\7z-out\vk_swiftshader_icd.json
%TEMP%\nsb65fa.tmp\7z-out\vulkan-1.dll
%TEMP%\nsb65fa.tmp\app-64.7z
%TEMP%\nsb65fa.tmp\nsis7z.dll
%TEMP%\nsb65fa.tmp\stdutils.dll
%TEMP%\nsb65fa.tmp\system.dll

Moves the following files

from %APPDATA%\bizayasystem-9gi75u\b4bc7100-5936-4f34-b2a1-37cb01ad29da.tmp to %APPDATA%\bizayasystem-9gi75u\local state

Network activity

Connects to

'sy##.#spenframe.lol':443
'po######public.nodies.app':443

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?98##############

Other

'sy##.#spenframe.lol':443
'po######public.nodies.app':443

UDP

DNS ASK sy##.#spenframe.lol
DNS ASK po######public.nodies.app

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\bizayasystem-9gi75u'

Creates and executes the following

'%TEMP%\ucd93q3raxbelses\bizayasystem.exe'
'%TEMP%\ucd93q3raxbelses\bizayasystem.exe' --type=gpu-process --user-data-dir="%APPDATA%\bizayasystem-9gi75u" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAI...
'%HOMEPATH%\appdata\.4zo8d44s\yxzxzz9zu5.exe'
'%TEMP%\ucd93q3raxbelses\bizayasystem.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="%APPDATA%\bizayasystem-9gi75u" --field-trial-handle=2104,i,2513234369857...

Executes the following

'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name /format:list"
'<SYSTEM32>\wbem\wmic.exe' path win32_VideoController get name /format:list
'<SYSTEM32>\cmd.exe' /d /s /c "net session"
'<SYSTEM32>\net.exe' session
'<SYSTEM32>\net1.exe' session
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;$target = '%HOMEPATH%\AppData'; try ...
'<SYSTEM32>\cmd.exe' /d /s /c "wmic path win32_VideoController get name /format:list"' (with hidden window)
'<SYSTEM32>\cmd.exe' /d /s /c "net session"' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;$target = '%HOMEPATH%\AppData'; try ...' (with hidden window)
'<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoProfile -NonInteractive -WindowStyle Hidden -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;Add-MpPreference -ExclusionPath '%HO...' (with hidden window)
'%HOMEPATH%\appdata\.4zo8d44s\yxzxzz9zu5.exe' ' (with hidden window)

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial