Resubmissions
29/07/2026, 09:27
260729-le461adl4y1025/07/2026, 16:39
260725-t563aaag871008/11/2025, 17:35
251108-v5363acv5d1002/11/2025, 23:51
251102-3wgwgadl7x1001/11/2025, 12:53
251101-p4t9wasnhm1001/11/2025, 12:49
251101-p2d5wasnhj1001/11/2025, 04:57
251101-fk849a1ncn1031/10/2025, 18:11
251031-wspnksak2v10Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
31/10/2025, 18:11
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample251031-wspnksak2v
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Malware Config
Extracted
-
metasploit
-
metasploit_stager
-
192.168.1.65:4444
Extracted
-
svcstealer
-
http://176.46.152.46/diamo/data.php
-
http://158.94.208.102/diamo/data.php
-
http://178.16.53.7/diamo/data.php
-
http://nikmok.dz/diamo/data.php
-
http://176.46.152.47/diamo/data.php
-
bot_urls
http://213.226.113.54/bin/bot.dll
-
build_id
20/10/2025
-
srv_delay
1
-
srv_retry
1
Signatures
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 37 IoCs
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 44 IoCs
- Loads dropped DLL 24 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 9 IoCs
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 22 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Modifies system certificate store 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe cl.vbs4⤵
- Badlisted process makes network request
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c gold.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.studiofurlotti.it/pdf/corsoIVA.pdf5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\a\gold.bat' -ArgumentList 'h' -WindowStyle Hidden"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c start.bat4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\Clipper.exeClipper.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Updater Task" /tr "C:\Users\Admin\AppData\Roaming\uousrh.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exe2O7gWSz.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Stealc.exeStealc.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\T3kEAsarDOmv.exe"C:\Users\Admin\AppData\Local\T3kEAsarDOmv.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pitchometer.exepitchometer.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\nGFFa2Q.exenGFFa2Q.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib.exe5⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Never.aspx Never.aspx.bat && Never.aspx.bat5⤵
-
C:\Windows\system32\tasklist.exetasklist6⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\findstr.exefindstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"6⤵
-
-
C:\Windows\system32\extrac32.exeextrac32 /Y Dying.aspx *.*6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\rh_0.9.3.exerh_0.9.3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\10.exe10.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\a\payload_staged.exepayload_staged.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe sd99w090xcvjijsei000sdf09w0ef0cdf3iiuif920fs0f0sdf032fisidufiu0v0x9v090diudfg00909dfg00df.hta4⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe kkdi99ew0cv03jdjfsdhj400df04sdxcv0we03220dcxvjs9f930sxcvj322jjsdf0sdf0sfxc0f032jdkfs.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\QGviLQQ.exeQGviLQQ.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File vv.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File air.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener2.vbs4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File sird.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File tt.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_inject.exechrome_inject.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\crypted.execrypted.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "885efaee-7eac-4990-8b0d-ec19419f8a43c"6⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "885efaee-7eac-4990-8b0d-ec19419f8a43c" /tr "C:\ProgramData\efaeeeacbdecfac.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stein.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ttesstttttt.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File cash.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\POO.exePOO.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\xiobv.exexiobv.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\zocp.exezocp.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\dfdsvc.exedfdsvc.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\xiobv.exexiobv.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Kontraernes.msi4⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\stageless.exestageless.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WOO.exeWOO.exe4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp.exe"C:\Users\Admin\AppData\Local\Temp\DC56.tmp.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe"C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 79ff0f9208562d64861f40e64dfc80e7 OLBuPPg9J02KFaMTCk34Aw.0.1.0.0.01⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\efaeeeacbdecfac.exe"C:\ProgramData\efaeeeacbdecfac.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\efaeeeacbdecfac.exe"C:\ProgramData\efaeeeacbdecfac.exe"2⤵
- Executes dropped EXE
-
-
C:\ProgramData\efaeeeacbdecfac.exeC:\ProgramData\efaeeeacbdecfac.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\efaeeeacbdecfac.exe"C:\ProgramData\efaeeeacbdecfac.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\ProgramData\efaeeeacbdecfac.exeC:\ProgramData\efaeeeacbdecfac.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\efaeeeacbdecfac.exe"C:\ProgramData\efaeeeacbdecfac.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Users\Admin\AppData\Roaming\uousrh.exeC:\Users\Admin\AppData\Roaming\uousrh.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp.exeC:\Users\Admin\AppData\Local\Temp\DC56.tmp.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\DC56.tmp.exe"C:\Users\Admin\AppData\Local\Temp\DC56.tmp.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\efaeeeacbdecfac.exeC:\ProgramData\efaeeeacbdecfac.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\efaeeeacbdecfac.exe"C:\ProgramData\efaeeeacbdecfac.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\uousrh.exeC:\Users\Admin\AppData\Roaming\uousrh.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\efaeeeacbdecfac.exeC:\ProgramData\efaeeeacbdecfac.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\efaeeeacbdecfac.exe"C:\ProgramData\efaeeeacbdecfac.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\uousrh.exeC:\Users\Admin\AppData\Roaming\uousrh.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
T3kEAsarDOmv.exe
DC56.tmp.exe
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_xajjkznx.kfs.ps1
xiobv.exe
cache.txt
~temp.tmp
memory/396-379-0x0000000070180000-0x000000007022A000-memory.dmp
memory/400-318-0x0000015AFD8A0000-0x0000015AFD8C2000-memory.dmp
memory/1672-295-0x0000000140000000-0x0000000140004278-memory.dmp
memory/1688-539-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-508-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-541-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-549-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-534-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-536-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-522-0x0000000000400000-0x0000000000B99000-memory.dmp
memory/1688-525-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/1688-524-0x00000000032E0000-0x0000000003B61000-memory.dmp
memory/2620-144-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-139-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-140-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-138-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-146-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-150-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-149-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-148-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-147-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/2620-145-0x00000273607D0000-0x00000273607D1000-memory.dmp
memory/3216-514-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/3216-410-0x0000000007610000-0x0000000007611000-memory.dmp
memory/3216-414-0x0000000008630000-0x00000000086B3000-memory.dmp
memory/3216-417-0x0000000003240000-0x0000000003273000-memory.dmp
memory/3216-419-0x0000000008630000-0x00000000086B3000-memory.dmp
memory/3216-415-0x0000000008630000-0x00000000086B3000-memory.dmp
memory/3216-585-0x0000000008560000-0x0000000008561000-memory.dmp
memory/3216-431-0x00000000079D0000-0x00000000079D1000-memory.dmp
memory/3216-579-0x0000000008540000-0x0000000008541000-memory.dmp
memory/3216-571-0x0000000008920000-0x0000000008921000-memory.dmp
memory/3216-444-0x00000000079F0000-0x00000000079F1000-memory.dmp
memory/3216-564-0x00000000087E0000-0x00000000087E1000-memory.dmp
memory/3216-459-0x0000000007B10000-0x0000000007B11000-memory.dmp
memory/3216-556-0x00000000087C0000-0x00000000087C1000-memory.dmp
memory/3216-497-0x00000000083B0000-0x00000000083B1000-memory.dmp
memory/3216-501-0x00000000083D0000-0x00000000083D1000-memory.dmp
memory/3216-504-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/3216-505-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/3216-413-0x0000000003230000-0x0000000003231000-memory.dmp
memory/3216-404-0x0000000008630000-0x00000000086B3000-memory.dmp
memory/3216-515-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/3216-518-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/3216-411-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/3216-412-0x0000000003220000-0x0000000003221000-memory.dmp
memory/3216-409-0x0000000003210000-0x0000000003211000-memory.dmp
memory/3216-531-0x0000000008400000-0x0000000008401000-memory.dmp
memory/3216-407-0x0000000008630000-0x00000000086B3000-memory.dmp
memory/3216-408-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3672-582-0x00007FF778780000-0x00007FF77882D000-memory.dmp
memory/3672-578-0x000001F6370B0000-0x000001F6371FA000-memory.dmp
memory/3672-577-0x000001F636390000-0x000001F636426000-memory.dmp
memory/3672-576-0x000001F61D800000-0x000001F61D899000-memory.dmp
memory/3672-442-0x00007FF778780000-0x00007FF77882D000-memory.dmp
memory/3672-553-0x00007FF778780000-0x00007FF77882D000-memory.dmp
memory/3780-311-0x00007FFBC8AF0000-0x00007FFBC8CE5000-memory.dmp
memory/3780-306-0x0000000002F40000-0x0000000003340000-memory.dmp
memory/3780-305-0x0000000002F40000-0x0000000003340000-memory.dmp
memory/3780-314-0x0000000075B40000-0x0000000075D55000-memory.dmp
memory/5544-540-0x00000000032B0000-0x0000000003B31000-memory.dmp
memory/5544-542-0x0000000000400000-0x0000000000B99000-memory.dmp
memory/5544-538-0x00000000032B0000-0x0000000003B31000-memory.dmp
memory/5644-432-0x00007FF6B7780000-0x00007FF6B77FE000-memory.dmp
memory/5872-535-0x0000000003230000-0x0000000003AB1000-memory.dmp
memory/5872-537-0x0000000000400000-0x0000000000B99000-memory.dmp
memory/5872-533-0x0000000003230000-0x0000000003AB1000-memory.dmp
memory/5884-402-0x0000000140000000-0x000000014007E000-memory.dmp
memory/5884-403-0x0000000140000000-0x000000014007E000-memory.dmp