| File name: | 65ef2eef1ccf3146b44010406a235cb7.exe.vir |
| Full analysis: | https://app.any.run/tasks/eda8baa7-d95e-4e6c-bb56-8e292ab3064b |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | October 06, 2023, 02:00:59 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 65EF2EEF1CCF3146B44010406A235CB7 |
| SHA1: | 6BFB70D4265675A09EB2D980B4A10C3BBC077004 |
| SHA256: | 169B23F45787A0213143BDBB4125658B4BEE18E74CB9899C09C29233807BCD21 |
| SSDEEP: | 98304:qn2tKPFGdfb8KT6Lmtjg2TDOoltBSJcUN2dp6Xg9h/7INuJfVteSJ4wOCfSJVOEt:LdwLugHe53G |
MALICIOUS
Application was dropped or rewritten from another process
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
Drops the executable file immediately after the start
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
- cmd.exe (PID: 856)
- faehelyy.exe (PID: 1988)
Lu0bot is detected
- faehelyy.exe (PID: 1988)
Create files in the Startup directory
- faehelyy.exe (PID: 1988)
LU0BOT has been detected (YARA)
- faehelyy.exe (PID: 1988)
SUSPICIOUS
Process drops legitimate windows executable
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
Starts CMD.EXE for commands execution
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
Executing commands from a ".bat" file
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
Uses WMIC.EXE to obtain data on processes
- faehelyy.exe (PID: 1988)
Reads the Internet Settings
- WMIC.exe (PID: 2616)
INFO
Manual execution by a user
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
Checks supported languages
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
- faehelyy.exe (PID: 1988)
Create files in a temporary directory
- 65ef2eef1ccf3146b44010406a235cb7.exe (PID: 1368)
Reads the computer name
- faehelyy.exe (PID: 1988)
The executable file from the user directory is run by the CMD process
- faehelyy.exe (PID: 1988)
Reads the machine GUID from the registry
- faehelyy.exe (PID: 1988)
Reads CPU info
- faehelyy.exe (PID: 1988)
Creates files in the program directory
- faehelyy.exe (PID: 1988)
Creates files or folders in the user directory
- faehelyy.exe (PID: 1988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Lu0Bot
(PID) Process(1988) faehelyy.exe
С2 (2)aoa.aent78.sbs
otl.dwt51.shop
Strings (7525)61c73c03
*.aoa.aent78.sbs
ba8e3e
*.otl.dwt51.shop
5P6XoAdjG/sn1MY8e7DlNls1hOD/o6rsNERYOyMF2n7pvmx0DLp6rfYBxp2z8+ToxXGMxMZ/roC8EjP+gTP/ExXWZhuQaf/766TLUq/L0ZnqhUjUjb7v3oPli3K4mjv2URjiUV4oQNZiRKIDaChOzEinPm4FasyuRFQtPg2ISQFap01lV69lfO0NDgG61ZmNcol3DqcbkdwqiCzI09W7fmon5mG+SCJ5FV6ciMIk9Y8b4/70Dy8iqiAYPr2EpHVmTZbr+ijKlIjwIu5Ue2yA0VJA0a96ZwAU5xPxewa/N74p...
require
mainModule
require
crypto
path
sep
dgram
child_process
env
kpCxE
toLowerCase
toLowerCase
env
ignore
cmd.exe
object
stdio
xLeci
detached
windowsHide
env
env
env
env
slice
wusYU
wusYU
unshift
unshift
unshift
unshift
LqIwj
shift
spawn
unref
string
false
fIRKG
zQAwV
JaNhD
UDVor
undefined
JGZBH
pkTEU
QCuiw
mOUKe
ilGyf
SgbYU
pipe
close
data
VtsTc
function
LFClx
TQEjW
TQEjW
att
niDCN
object
stdio
YSoDR
detached
windowsHide
env
env
env
env
slice
shift
spawn
timeout
ktmr
YTQcw
QIKCI
IpMdy
HTChD
DHUkW
VtsTc
AYkdv
LFClx
casCI
iqWRH
kill
isArray
IIwpj
length
mVmWl
iTWVp
length
split
kZJqx
length
RFodP
sOKTQ
IOPoU
timeout
once
error
pyjtA
hzIIS
error
once
exit
xjvMF
oCGQO
JGZBH
jhpEB
jAnMJ
MjdLg
code
EQgpl
undefined
signal
oCGQO
code
PwPce
oCGQO
signal
once
NWCxL
ZvkpF
pkTEU
ktmr
LFClx
cwYlq
QCuiw
ySaaP
ktmr
ktmr
error
AUDvD
HTBLV
readFileSync
NpPJj
error
error
oCGQO
code
undefined
signal
outbuf
concat
outbuf
errbuf
concat
errbuf
returnbuffer
AZMlD
AZMlD
out
outbuf
toString
outbuf
err
errbuf
toString
errbuf
YTQcw
nostr
out
Quad
stdout
ogbKB
UIGAl
ymwrb
gzrcM
outbuf
outbuf
push
stderr
ogbKB
UIGAl
xUDpi
aNaAY
statSync
pf2
outerr
outerr
push
3|0|4|6|5|2|1
LnFRI
split
ppid
push
drFEE
biwiw
lgHxw
pid
name
length
ppid
UI16LE
UI8
2|3|5|0|4|6|1
.exe
\Microsoft\Windows\Start Menu\Programs\Startup\
hex
uncaughtException
Gdfpl
Node,
oJJGJ
lrvEE
oVYyx
LoBPp
GWBgI
executablepath
path
parentprocessid
ppid
name
amozN
Console
Services
lTsiN
zUqMO
gqbRl
DArOu
process
get
processid,parentprocessid,name,executablepath,commandline
/format:csv
release
FkFIM
indexOf
kijCn
indexOf
6.0
PxrBd
wmic
waNEW
MBsZn
hmVrU
HPgaY
5|2|8|1|3|0|4|7|6
OXvak
kenLe
kenLe
kenLe
ajCJT
AHZnz
Nidit
HglLa
AHZnz
AHZnz
OHOBN
DvKMD
nUOSl
qlbTU
NqKan
vasUe
vasUe
gGHhs
izHlO
NHwce
ZxKEV
log
stack
log
stack
vftZW
length
split
join
split
length
length
shift
bwUaF
indexOf
CfMKo
ZHRfj
WRnei
EsbwZ
split
evZff
EwShE
evZff
OlwDt
XtPyf
DpQMz
aup
OlwDt
TXNEO
LyNPD
Nmmun
RjSNB
LyNPD
BJYIc
LyNPD
kNXdn
wWSmZ
nigFj
nigFj
apd
OdGiW
oNIkq
nigFj
oNIkq
.lnk
oNIkq
iZMeC
oNIkq
mkdirSync
iZMeC
AvKLk
tmp
split
shift
FCuxy
length
ynrJL
MavHt
MavHt
uPRIM
kBjaD
UI8
push
from
kBjaD
wEkFW
push
alloc
split
OHOBN
length
length
izHlO
LboLY
Xtlvy
dathq
split
push
pid
iAcrl
nUOSl
ppid
ppid
push
path
path
length
path
name
session
push
args
args
FCuxy
length
TEsbr
PALTm
GWBgI
toLowerCase
commandline
args
length
ogeSx
nhOlM
length
AGVGg
aZuwp
processid
pid
UfTYm
name
NKLEk
length
from
eCrHh
createDecipheriv
concat
update
final
toString
pid
Node
pid
TEsbr
SwSDG
SwSDG
pid
session
path
JAEUB
lvpnY
randomBytes
RLsJW
pJgue
NEPju
NEPju
OXfMr
ryzLK
rQbox
TEsbr
mbWdd
pGxDC
uerepl
HIuXo
removeAllListeners
log
stack
log
stack
pid
ynrJL
Icxpq
BVTOB
EmFqG
ppid
length
tree
statSync
pf1
PxrBd
systemroot
allusersprofile
appdata
username
\networkservice\
LXlyd
network service
system
dwm-
umfd-
qbRBD
isc
FYKIN
windir
FYKIN
JJAXX
tmp
temp
aup
lRiJm
pSszI
apd
NiKwk
usr
wkwEA
tmp
isc
isc
ZhFfI
tmp
toLowerCase
indexOf
toLowerCase
isc
isc
tmp
toLowerCase
indexOf
tdFBq
isc
isc
aup
apd
isc
isc
usr
isc
isc
gvJZo
gvJZo
writeFileSync
usr
toLowerCase
sycOh
JMELV
zqiFX
somLB
local service
ZuoMm
substr
length
kjCji
indexOf
IumJe
kjCji
indexOf
kiqeF
qNzjq
qbRBD
slAvI
isc
createHash
sha256
update
digest
7|2|0|8|5|3|9|6|1|4
computername
oAKWd
split
prototype
slice
call
pIqbU
userdomain
concat
pIqbU
CLdVe
JaGtH
username
sWCZx
push
JaGtH
uUuSk
vBiKT
ILZKB
IbIFN
JOATT
u
floor
SVAea
pop
kqEYE
fromCharCode
WSvkS
YrigE
LEBOV
3|0|2|4|1
Undefined
base64
2|5|0|4|1|3
aes-128-cbc
nVMOz
SiHop
VvXJF
gpiCF
VlmRH
PSBVY
CZzhZ
xgYTS
uDKQz
win32
linux
darwin
unknown
openbsd
freebsd
intel
celeron
pentium
core(tm)2
amd
atom
i3
i7
i9
epyc
ryzen
threadrip
kvm
qemu
md5
hex
DESKTOP
AcNyG
LntCH
art-pc
work
amazing-av
shadow-
cape-pc
janusz-
compalexey
dillon
host1
user
frank
lisa
shadow
straznj
joe smith
john doe
cape
goatuser
janusz
stark
a.monaldo
alexeyzolotov
peter wilson
Unknown
Intel Undefined
Intel Celeron
Intel i3
Intel Pentium
Intel i5
Intel Core(TM)2
Intel i7
Intel Atom
Intel i9
Intel Xeon
AMD Ryzen
AMD Threadripper
AMD Undefined
CPU KVM/QEMU
syijL
Duo
qIKQf
Quad
avSmJ
biPfQ
NOHID
my_pc_
AMAZING-AVOCADO
DESKTOP-JTAPJCC
azure-
CompAlexey
anna-
gary-pc
mars-pc
UNKNOWNHID
NOUID
administrator
admin
john
george
STRAZNJICA.GRUBUTT
azure
UNKNOWNUID
acHcK
alloc
floor
RWAsE
VBMgL
writeUInt8
PbLsV
KsxWg
round
ajVjg
RWAsE
sqkFF
ukwjv
ukwjv
Wnmss
PbeEZ
uixTm
LzoGr
OysHM
split
file
indexOf
file
xtVbS
file
sqkFF
file
uYchf
file
Wnmss
MLUSE
TuxpM
gpiCF
statSync
Wnmss
GGXVe
ntmty
eCtkf
ppid
length
tree
ijcIK
ijcIK
tEfNw
oOIWw
ppid
ppid
HCmyN
ppid
gIJBH
BKDMg
tllWY
EqzQd
VaaId
writeUInt8
PbLsV
length
split
min
HCmyN
min
min
writeUInt8
UBsbg
gvyun
eMyTa
writeUInt16BE
join
doklM
round
ajVjg
writeUInt8
ceil
kuZDd
Fjtpx
SNBdn
bJIzJ
SNBdn
MExLK
YTqhK
Ehoza
YTqhK
openbsd
mOHdJ
freebsd
PHaEI
bJIzJ
MExLK
darwin
wKNvl
vSHIp
doklM
doklM
Wqeet
eMyTa
QNeHx
eMyTa
mOHdJ
writeUInt8
length
toLowerCase
PIngo
indexOf
QeOJc
PIngo
indexOf
iIUZx
PIngo
indexOf
ZIony
JyhUb
indexOf
YnAkD
FEANN
indexOf
aaHWk
BKDMg
indexOf
amd
fqDeB
indexOf
OsJJJ
fqDeB
indexOf
fTymw
lwJfI
indexOf
i5
indexOf
gRWyd
SmjoE
indexOf
HCGYP
indexOf
xeon
zdMOh
indexOf
jWwLI
lDjaZ
indexOf
ddIfY
lDjaZ
indexOf
VwWeB
uVWyH
indexOf
xFpOE
indexOf
LKsBI
ceil
AxJmP
YiXYT
writeUInt8
urhlX
eMyTa
createHash
Xgcck
update
digest
slice
toString
IOhHC
copy
length
split
toLowerCase
IUNVS
length
ClEIY
vDpNk
AwCnU
ePZMi
MBmuL
parse
muKUx
from
env
LU0
HHBXT
toString
BKDMg
indexOf
my_pc_
ClEIY
SusND
ugzMA
indexOf
FFWTe
indexOf
bea-chi
indexOf
xwPvl
ClEIY
ZxlZK
ClEIY
JTAPJCC
FDepy
indexOf
azure-
XpMwT
indexOf
UAuMX
ClEIY
OCAfK
JzvJC
Jkznn
AQHHW
indexOf
anna-
gary-pc
LiDkI
mars-pc
aTehi
ifNRV
writeUInt8
Fjtpx
createHash
Xgcck
update
digest
slice
toString
IOhHC
copy
length
split
toLowerCase
administrator
admin
phLCJ
aTehi
john
aTehi
jWkjh
THoso
george
KpMTF
YKasO
aMUtu
indexOf
ZhPhk
harry johnson
yJpLV
BVXIQ
eRhSF
JZOVe
Udxwn
UGYWB
sYqSD
UGYWB
azure
TteLn
cavnK
TteLn
ARQcu
butCg
CQzik
Waxuu
fFSDY
zdoqX
writeUInt8
Fjtpx
createHash
Xgcck
update
digest
slice
toString
IOhHC
copy
qdLWi
XKzJj
WcbWV
QxinQ
anZTi
sfqmm
dHsVY
XLoDD
bCcxY
UVSZT
frpwz
AMD EPYC
gUdyE
IeVvL
NSdvC
jYLLb
Waxuu
Waxuu
aMUtu
MKnch
MKnch
BsBbs
AlYbB
split
createCipheriv
OxpEd
slice
slice
writeFileSync
prs
from
stringify
concat
update
final
randomBytes
Waxuu
Unhjt
Unhjt
from
stringify
randomBytes
createCipheriv
OxpEd
slice
slice
concat
update
final
writeFileSync
prs
cEBoJ
aMUtu
TWDMJ
jamIa
length
model
model
trim
speed
speed
VaaId
xtVbS
qlTXd
IRtaF
vDpNk
HhthQ
SusND
ugzMA
NBhzF
bea-chi
xwPvl
ZxlZK
cGtrI
JvuNp
UAuMX
jvDiV
Jkznn
vonAR
QBcqD
hwycA
Host1
iTXMT
qlTXd
ispwB
XCKER
wHHPh
UUEEr
phLCJ
QlfwJ
frank
THoso
Fkmfy
YKasO
NrKSs
harry johnson
yJpLV
eRhSF
Udxwn
goatuser
pGwVO
cavnK
stark
a.monaldo
fFSDY
zdoqX
Owifh
MPhnM
kwbDT
BfIpN
uYchf
uYchf
toString
IOhHC
7|0|1|10|12|9|4|14|2|11|15|3|8|5|6|13
string
false
jfMGf
split
jyccV
owiRY
length
split
skJMq
isArray
sqnLl
length
SHPgQ
length
win32
9a50
351468
275dec
e1e853
6.1.7601
570a90
a.monaldo
azure-
Xeon
NOHID
user
10.0.18362
10.0.10586
3151
NOUID
10.0.19041
00181a
a8776a
e94c92
9ab4de
f7e0fe
55d8
CompAlexey
alexeyzolotov
bf7e
35ae2e
d8716f
anna-
97a9d3
Host1
2be941
10.0.19045
10.0
10.0.10240
10.0.19044
a888
7e73
70b4
d580
DESKTOP
admin
b71c
cd4ee8
bac5dd
56aee3
4b418f
74529b
a65640
5bc06f
AMAZING-AVOCADO
harry johnson
10.0.19043
administrator
art-pc
john
KVM/QEMU
46502a
6.1
10.0.15063
50ab44
9639a3
10.0.22621
0fdc
cc1a
88dba0
18275d
1285
abcf10
b3c775
e379b3
72c1f0
6f2958
10.0.18363
dillon
peter wilson
9ec750
badfad
77bd
bea-chi
2a4494
10.0.22000
f1dd
EPYC
shadow-
shadow
my_pc_
6.1.
STRAZNJICA.GRUBUTT
joe smith
george
goatuser
10.0.17134
DESKTOP-JTAPJCC
janusz-
janusz
gary-pc
stark
5a1d
bc54f4
611a3e
11d4d6
86438b
10.0.14393
7aed
lisa
25cd40
2088
3635
1cce9e
835669
10.0.17763
1e75
c589
cb0013
dd15
6e6551
2253
e8c630
3f9b99
c8b63d
7b7bc2
582a34
851c
061613
7bf5
f3f0c6
167bfe
4085c6
a739
d60869
75c891
86131a
e06b
6a29b3
52acd9
3a83fe
d38e35
7f8794
aff8
72f6c0
f4cb33
e32aca
092f16
48fdf5
cc9adb
5803c5
9db1e4
93a77b
033bd9
c350
32b1d5
5fd4c0
9a8599
10.0.19042
fb6ab4
379a7d
9d5196
10.0.
b624
03fea1
4b33b6
24889e
bot 115 W7 Xeon H 24889e U 18126e
6.1.7600
a592e8
0b6631
d76211
4ed984
2652ee
a98d
efba14
930d8a
7c1a
cd4ec1
b4a2c8
436f
e717
646a8b
41c07c
4f5cec
3322
bca236
723943
471915
9f72
bd9ff1
c39efd
d04f74
2bf408
f6b8ae
a6f2
5b2e9c
9ca5a0
32b5
9f9d51
6bd1
d864df
bb2e4c
b1a8
7db39b
62efb9
6d05
6cfdbc
b38e56
04159b
299243
d1457b
a30c
4b9de2
591acb
e8b9
fca565
f2886f
13b4
6e64
747890
73a080
0bd650
709b
f5faf7
f94649
bf0760
9114
db9a51
64ca98
b7e24d
b6f4a2
62327b
d61484
d0062c
26112
2988b8
2970
8e776c
6.3.9600
72e748
2048
16a7c1
isArray
QuaMP
length
Mogaw
wOKnQ
MIDnx
RYhWS
275dec
RYhWS
351468
waZdp
wOKnQ
mOLrJ
AThhc
MIDnx
ZMhoB
KqeBx
wOKnQ
HGdkf
hHPVp
KqeBx
MIDnx
KqeBx
TbuyJ
wOKnQ
josng
Zvkie
275dec
Zvkie
ZMhoB
pXAJB
wOKnQ
hHPVp
vggcx
NOLdb
txqbi
pXAJB
wOKnQ
10.0.16299
soEPH
ClMtr
soEPH
wOKnQ
YxNnx
hHPVp
abBgd
indexOf
KhwuB
txqbi
TMIaP
huoCu
indexOf
Xeon
Iyuoz
wOKnQ
sjxOT
ctJAc
indexOf
tGBhc
NQFkt
indexOf
azure
eJTxT
txqbi
eJTxT
huoCu
indexOf
bmnjo
sqUjT
wOKnQ
huoCu
sjxOT
QEtro
indexOf
ierUt
RtVNZ
indexOf
jDgoJ
EebRk
EebRk
jDuYY
txqbi
BudYT
win32
BudYT
BudYT
BudYT
zbGVn
NWJoR
txqbi
Zjuve
Zjuve
JigFS
RtVNZ
indexOf
ierUt
iagCi
indexOf
NOUID
Zjuve
wOKnQ
Zjuve
SfrnF
iagCi
indexOf
ierUt
indexOf
PfBxU
YQAbA
SfrnF
zbGVn
SfrnF
JigFS
XjTAM
SfrnF
MaZfV
SfrnF
yWmAy
SfrnF
spTNH
SfrnF
129654
uaHxZ
aOBHQ
wOKnQ
FWGUt
CDJYu
CDJYu
6.1.7601
CDJYu
10.0.10240
tfxmJ
ttzff
indexOf
ierUt
indexOf
PfBxU
CDJYu
wOKnQ
Sikod
QxvwV
aGSOh
indexOf
xDFIX
aGSOh
indexOf
nZbpl
CDJYu
wOKnQ
indexOf
xDFIX
aGSOh
indexOf
nZbpl
allna
win32
Sikod
aGIIl
10.0.19044
allna
MQDbS
uhNVF
MQDbS
SrNZu
cXdfQ
ZQqoH
cXdfQ
wOKnQ
cXdfQ
aGSOh
indexOf
CjATT
cXdfQ
wPBCQ
wOKnQ
aGIIl
aGSOh
indexOf
anna-
cXdfQ
cXdfQ
wPBCQ
cXdfQ
wOKnQ
aGIIl
Sikod
indexOf
bmnjo
aGSOh
indexOf
ycYNK
aGSOh
indexOf
jDgoJ
wOKnQ
Sikod
oMwtx
Gumww
indexOf
Xeon
LWCcS
indexOf
Host1
indexOf
jDgoJ
dIWpg
wOKnQ
iPwBc
JxtmM
64ccb5
AqsmO
zGMKL
Ylipn
iPwBc
indexOf
Xeon
wOKnQ
iPwBc
YjlVr
xrpqq
indexOf
qVeKo
ifins
ZfSQr
ZfSQr
iPwBc
indexOf
Xeon
indexOf
AMD EPYC
ZfSQr
XEnne
gSXoA
zTWLI
wDyTW
indexOf
ierUt
gSXoA
bHvER
buGMP
NnYfO
iBrSK
uJHTX
indexOf
administrator
wOKnQ
iPwBc
dXxvx
indexOf
esdRV
uJHTX
indexOf
lScgJ
MZTuo
jDuYY
vRlJm
indexOf
bmnjo
MZTuo
win32
txqbi
MZTuo
MZTuo
MZTuo
hOxlQ
PqxDK
IynLr
PqxDK
OaZHU
PqxDK
7fa24d
PqxDK
kutlr
GUEJb
2b22
SYSNZ
Elder
ohffm
RQVuz
ohffm
wOKnQ
dXxvx
ohffm
txqbi
cmYZk
cmYZk
cmYZk
indexOf
Xeon
VEtuB
vQOCS
VEtuB
RLWZm
win32
uJHTX
indexOf
mFvma
uJHTX
indexOf
odEqX
lFEmr
wOKnQ
OJgfj
TgEOT
lFEmr
oMqvv
hkXLP
indexOf
odEqX
lFEmr
wOKnQ
TgEOT
lFEmr
6.1.7601
nDFfD
indexOf
mars-pc
nDFfD
indexOf
KcYPl
DwhkT
win32
TgEOT
DwhkT
txqbi
indexOf
MlHqp
nDFfD
indexOf
KcYPl
wOKnQ
OJgfj
txqbi
lDYgK
indexOf
ierUt
dlDql
indexOf
NOUID
52c9
lDYgK
wOKnQ
OJgfj
lDYgK
txqbi
953225
UbKmV
indexOf
gqYyv
vKEtT
wOKnQ
sTyFF
indexOf
SXRqR
vKEtT
vKEtT
WhFBG
wOKnQ
sTyFF
TgEOT
indexOf
SXRqR
mLayk
mLayk
wOKnQ
sTyFF
TgEOT
sTyFF
indexOf
SXRqR
IxYCu
IxYCu
win32
sTyFF
VSguD
HlGSw
txqbi
HlGSw
kBNWn
UbKmV
indexOf
KcYPl
nEsrh
wOKnQ
sTyFF
LfGsX
gWNiP
indexOf
ycHOs
XcGWo
sHUvT
SUwUt
sTyFF
indexOf
Xeon
NexVx
4f81e3
NrJLC
b75705
qsdRB
wOKnQ
izyeE
LfGsX
gWNiP
indexOf
10.0
qsdRB
EPZFi
indexOf
Xeon
xFQlt
LnXwb
hgyPU
amuCn
win32
EPZFi
gWNiP
indexOf
10.0
rVelq
indexOf
DESKTOP
amuCn
amuCn
GxoOM
gGzUe
8920
BNcya
0cbc66
BNcya
win32
OGaBa
OplyY
bsXXF
bsXXF
MpasZ
twhrA
PrZEi
DMHFm
FWCgY
indexOf
KcYPl
vqsTK
wOKnQ
CGKrF
indexOf
qVeKo
GZKFe
IfKeA
IfKeA
yqeHm
IamCt
wwYdb
IamCt
FHZLU
wOKnQ
LfGsX
NuLEx
txqbi
AcUpv
TmEse
WWqqV
idFOW
indexOf
bmnjo
tVxep
IQSRE
tVxep
YLVAc
XzLXZ
wOKnQ
mLHnv
LfGsX
wqYWU
indexOf
qVeKo
gqLFD
wqYWU
indexOf
gqYyv
wOKnQ
LfGsX
wqYWU
indexOf
10.0
PWqPD
reDDx
804a
tfAiZ
tfAiZ
wqYWU
indexOf
esdRV
DLxEu
indexOf
frank
tfAiZ
wOKnQ
dxeHF
ZzHqA
indexOf
YhCCm
ytlPV
indexOf
lYWqy
wOKnQ
vZrLN
yorTa
indexOf
qVeKo
tfAiZ
yorTa
indexOf
esdRV
hOxlQ
tfAiZ
OaZHU
BTDnG
wOKnQ
BNHhk
dxeHF
BTDnG
txqbi
BTDnG
56d4
BTDnG
d33e1f
FduQa
WjlTo
FduQa
win32
TmBUn
fSLNY
TQcJD
indexOf
10.0
FduQa
fOcYj
fOcYj
badfad
TQcJD
indexOf
admin
wOKnQ
fYVdW
indexOf
10.0
fOcYj
fOcYj
fOcYj
MyUwo
MLkXx
indexOf
lScgJ
fOcYj
win32
OhpGX
indexOf
qVeKo
vOodx
OhpGX
indexOf
esdRV
vOodx
evdUC
vOodx
736b19
gvolL
wOKnQ
IJyIi
UDZeI
indexOf
FljAk
indexOf
john doe
jPIGo
wOKnQ
iPTYr
YQAbA
iPTYr
AOfWw
MYFbd
MYFbd
wOKnQ
MYFbd
MYFbd
10.0.19041
AOfWw
cCJuT
win32
mgBti
oaTyP
oaTyP
ZkaLT
GxoOM
ZkaLT
AOfWw
ZkaLT
wOKnQ
SLMxE
SQoOt
indexOf
esdRV
SLMxE
OETqg
pKYtq
OETqg
wOKnQ
indexOf
qVeKo
XbNCr
indexOf
TCjjX
zTJdu
indexOf
bmnjo
SPLlq
indexOf
RbIhh
SPLlq
indexOf
yovNJ
iQzdY
win32
zTJdu
igIzv
SPLlq
indexOf
6.1.
SPLlq
indexOf
JFfTd
SPLlq
indexOf
KcYPl
iQzdY
wOKnQ
igIzv
SPLlq
indexOf
dPBhX
wxfZr
indexOf
esdRV
ZXSIm
indexOf
lScgJ
wOKnQ
PzaDO
QzCCC
indexOf
dPBhX
GENLL
indexOf
VqmBh
nATuz
wOKnQ
cuEDQ
PHkyX
GENLL
indexOf
DESKTOP
GENLL
indexOf
QuKlu
nATuz
wOKnQ
nATuz
GENLL
indexOf
6.1.
GENLL
indexOf
work
indexOf
lScgJ
zLVcT
wOKnQ
RTxcv
indexOf
qVeKo
zLVcT
Pnqtz
indexOf
hUDSQ
tNFlg
wOKnQ
cuEDQ
vpiXx
MwGci
indexOf
dPBhX
sNzfP
indexOf
ejaWn
GvSrM
wOKnQ
wjhnX
indexOf
DESKTOP-JTAPJCC
GvSrM
wOKnQ
sNzfP
indexOf
wOPpP
wOKnQ
PnIcj
JcRqg
indexOf
yUcVP
JcRqg
indexOf
LhpmB
SoLTy
win32
JcRqg
indexOf
dPBhX
twVBR
indexOf
idYyV
indexOf
EHOHc
wOKnQ
PnIcj
6.1.7601
SoLTy
twVBR
indexOf
administrator
enNIK
rlklG
pOMRM
eobOM
6adf97
eobOM
wOKnQ
6.1.7601
eobOM
eobOM
twVBR
indexOf
ierUt
JDEWF
indexOf
john
SJjYK
wOKnQ
kFkYS
indexOf
qVeKo
cuEDQ
indexOf
KVM/QEMU
SJjYK
5d0c
hyVCM
rHLex
zTWLI
indexOf
DESKTOP
bemIU
xSWIb
wOKnQ
cuEDQ
PzZxF
uIUrm
AisJX
FwnUm
6.1.7601
indexOf
Xeon
kFkYS
indexOf
NOHID
indexOf
administrator
FwnUm
wOKnQ
cuEDQ
QkGDF
txqbi
FwnUm
FwnUm
kdMjc
rVsYs
OSOTJ
MAtVB
indexOf
KcYPl
rVsYs
wOKnQ
tUBwb
rVsYs
txqbi
VxASH
OSOTJ
jMwqE
indexOf
KcYPl
VxASH
win32
uOSNG
VxASH
txqbi
HCpQJ
MfCgH
eJiKw
indexOf
lScgJ
wOKnQ
lqANN
oIwve
MfCgH
txqbi
eJiKw
mrhHg
indexOf
admin
MfCgH
wOKnQ
lqANN
oIwve
jeSqX
hlAHR
iBcng
mrhHg
indexOf
esdRV
mrhHg
indexOf
lScgJ
OPZwG
win32
oIwve
OPZwG
txqbi
OPZwG
caESR
nQZDH
caESR
b445bf
mrhHg
indexOf
PtUKi
lXNOE
wOKnQ
ilPEe
qiuQa
txqbi
zCpTU
b445bf
cvcbR
indexOf
lisa
wOKnQ
zCpTU
txqbi
UuzYs
UuzYs
KUqWm
UuzYs
59a422
UuzYs
wOKnQ
ilPEe
UuzYs
UuzYs
PGLwR
wjhnX
PGLwR
10.0.18362
ihTDq
indexOf
esdRV
pFAWW
indexOf
PfBxU
gwDFl
wOKnQ
iJPfn
tKNdS
gwDFl
BGnnH
wjhnX
10.0.18362
BGnnH
ihTDq
pFAWW
indexOf
esdRV
pFAWW
indexOf
NOUID
khrzn
wOKnQ
iJPfn
tKNdS
khrzn
RknOE
txqbi
RknOE
jDuYY
JemeN
ihTDq
JemeN
wOKnQ
HQKdf
tKNdS
JemeN
txqbi
JemeN
RyfVN
xOeeU
zexrv
rXAwr
indexOf
lScgJ
zexrv
wOKnQ
dAneF
tKNdS
zexrv
zexrv
waCPL
1cce9e
pFAWW
indexOf
admin
waCPL
wOKnQ
dAneF
uNGnm
10.0.19044
ewPcI
RyfVN
ewPcI
dMGnb
dMGnb
lmBTL
pFAWW
indexOf
lScgJ
peNVo
wOKnQ
dAneF
tKNdS
peNVo
txqbi
UHMKj
xFQlt
UHMKj
UHMKj
indexOf
ierUt
indexOf
admin
EIosP
709b
pWjzB
win32
dAneF
pWjzB
txqbi
SixJj
SixJj
pFAWW
indexOf
esdRV
pFAWW
indexOf
admin
sFwFh
wOKnQ
dAneF
pFAWW
indexOf
esdRV
lAGQN
10.0.10240
lAGQN
XGHnq
win32
XGHnq
QGHFO
zTWLI
EiXba
EiXba
EiXba
indexOf
esdRV
mEfkA
IAnzl
mEfkA
win32
AOwyf
QGHFO
zTWLI
AOwyf
pFAWW
indexOf
esdRV
AOwyf
wOKnQ
dAneF
dAneF
indexOf
bmnjo
AOwyf
6.1.7601
HjWJp
HjWJp
HjWJp
CfIMu
HjWJp
AisJX
indexOf
KcYPl
nJMjV
win32
nJMjV
10.0.22621
indexOf
esdRV
nJMjV
95deb5
QmHJg
wOKnQ
mCdyE
indexOf
Xeon
QmHJg
10.0.19044
QmHJg
QmHJg
QmHJg
indexOf
NOHID
aTzpo
indexOf
lScgJ
QmHJg
wOKnQ
c23200
769fc7
QmHJg
wOKnQ
QmHJg
txqbi
QmHJg
xzazH
xzazH
uTZci
indexOf
Xeon
wOKnQ
MjCcR
VEuGm
RLWZm
MjCcR
wOKnQ
jBggA
VusIu
MjCcR
txqbi
wQfQm
hcZkE
zSbEj
zSbEj
bHvER
zSbEj
2001f7
aTzpo
indexOf
administrator
zSbEj
wOKnQ
VusIu
eOAxl
6.1.7601
BifLz
mkXXB
HahpQ
IXppR
indexOf
bmnjo
aTzpo
indexOf
ierUt
TUJOs
indexOf
PfBxU
wlzLA
wOKnQ
CLtwI
wlzLA
txqbi
wlzLA
RzWAc
CEMbW
RzWAc
WNSog
TUJOs
indexOf
KcYPl
Txmnz
win32
CLtwI
VusIu
Txmnz
GxoOM
CEIek
aVrIw
DPKls
DPKls
2293
VWzdE
tAPlV
HehuH
SdaFn
TUJOs
indexOf
ierUt
indexOf
PfBxU
DqcXZ
wOKnQ
DqcXZ
reDDx
DqcXZ
3e45fc
46e6f8
wOKnQ
aWxAi
6.3.9600
hlQtp
yKTDB
sqJUH
HSBxH
JnoEN
wOKnQ
Ylipn
FEczF
FEczF
AsLyc
990d1b
nOLAm
tknXj
copKe
win32
copKe
copKe
Gcaig
Kzaml
b0f8e1
Kzaml
061613
Kzaml
win32
VusIu
Kzaml
FgyMp
Gcaig
CkrEL
FrKMN
dvTNH
PStAY
VjhOw
win32
KWhCU
6.1.7601
jdxSJ
jdxSJ
jdxSJ
win32
CLtwI
KWhCU
txqbi
jdxSJ
jdxSJ
tsLlx
tsLlx
mguvo
tsLlx
2cb5a5
tsLlx
nCKNH
XkNhN
wOKnQ
lAlOf
lAlOf
GxoOM
MCsAE
MCsAE
MCsAE
lsXOS
lsXOS
lsXOS
RkmLH
qDPxC
d6a5b0
RkmLH
wOKnQ
oMqvv
nUGwN
10.0.19045
zCdVO
zCdVO
zCdVO
zCdVO
zCdVO
PqpgM
PqpgM
win32
PqpgM
Ylipn
PqpgM
PqpgM
HYivK
qspNU
win32
LMbUR
jeSqX
qspNU
qspNU
Epcwk
Epcwk
yVKGQ
Epcwk
Epcwk
wOKnQ
AYTAV
6.1.7601
AYTAV
AYTAV
hqAFz
RoxZF
RoxZF
yVKGQ
wFkxv
mZALZ
RoxZF
win32
LMbUR
KWhCU
6.1.7601
HJyTD
HJyTD
Qpadm
zZICf
YShsQ
sLMsc
sLMsc
gJVHt
sLMsc
win32
LMbUR
10.0.19044
KMoJp
pFuOR
bpZhy
WGfHa
jyCWZ
WGfHa
RcciA
Yzsnk
wOKnQ
tqYCt
Ylipn
tqYCt
tqYCt
tqYCt
oiXPc
win32
GxoOM
tqYCt
SLxGD
SFtHT
wOKnQ
tqYCt
reDDx
eqPSi
KfNWh
eqPSi
eqPSi
MeZiM
win32
eqPSi
reDDx
Gbmst
Gbmst
KfNWh
Gbmst
YRpdJ
win32
Ylipn
YRpdJ
WyPdx
WyPdx
YcWlG
WyPdx
win32
WyPdx
Ylipn
yJCTB
yJCTB
gljKu
YcWlG
UvxZM
wOKnQ
PpjoD
zTWLI
afTxu
afTxu
QfKqI
ed6464
QfKqI
wOKnQ
LMbUR
KWhCU
zTWLI
BgPQK
qANtJ
qANtJ
hLsLp
qANtJ
wOKnQ
LMbUR
KWhCU
qANtJ
Ylipn
qANtJ
qANtJ
ccdjE
win32
qANtJ
6.1.7601
qANtJ
WyGYv
zoAmB
WyGYv
sXjhj
WyGYv
wOKnQ
wjhnX
YxMrB
YxMrB
HMiHJ
wOKnQ
HMiHJ
reDDx
VNyQm
qbOoM
qbOoM
igIjd
wOKnQ
LMbUR
KWhCU
qbOoM
GxoOM
LiZLy
lFtXC
2cd67e
wOKnQ
UCwoG
KWhCU
lFtXC
txqbi
UkXkh
cCsnc
YjNRL
YjNRL
YjNRL
wOKnQ
krMAl
KWhCU
GnbVY
xFQlt
GnbVY
rxTdm
rxTdm
vOSpX
Atbyd
wOKnQ
krMAl
Atbyd
txqbi
VrSyH
3219
VrSyH
Uhvot
TMgET
gHlLs
TMgET
win32
krMAl
10.0.19044
motbl
KKqlz
KKqlz
KKqlz
CRFUR
KKqlz
wOKnQ
uKjAp
GxoOM
uKjAp
32b1d5
xLWTh
Spamo
jsncE
wOKnQ
uZyWb
GxoOM
PqZnP
PqZnP
vJLcK
PqZnP
lbUyM
wOKnQ
lbUyM
GxoOM
fZPkZ
fZPkZ
hjTWC
7e0c8b
YowEu
7b7cd2
YowEu
win32
YowEu
10.0.22621
qxFkv
qxFkv
qxFkv
qxFkv
oEvTt
qxFkv
wOKnQ
mmvbu
EjOeK
10.0.19044
yBhwg
yBhwg
yBhwg
yBhwg
sbJVy
wOKnQ
YGunJ
tDags
YGunJ
YGunJ
aqyRX
aqyRX
aqyRX
qwUdt
aqyRX
wOKnQ
bdEpY
TYVYV
txqbi
aqyRX
VxqBM
VxqBM
bHvER
HaRRt
indexOf
KcYPl
qagCE
wOKnQ
CbUqY
10.0.22000
CbUqY
Uqxlo
fnMEo
CBzzl
tjNuv
epdyi
vRsVX
win32
xVSSc
vKKnW
aqspj
indexOf
brCLp
gCKCe
bhPMn
bhPMn
sZOkj
SnJyu
sZOkj
oMtXB
UgsNT
wRjHC
wOKnQ
zggFl
fyLsj
MiufK
6.1.7601
MiufK
MiufK
MiufK
CgRub
pIrdn
blyUe
bdDoQ
18126e
LdfwW
win32
WMQSr
fyLsj
bdDoQ
6.1.7601
Aftgk
sgKfH
dJsJa
WcnTu
WcnTu
win32
xmrrl
fyLsj
WcnTu
CvUGy
XuGVw
XuGVw
XuGVw
lfNeg
lfNeg
bXjqw
vdmOE
iMEjv
wOKnQ
iMEjv
YQAbA
iMEjv
jSvgh
IjzEr
HmraW
HmraW
HmraW
loFzr
yvqXs
wOKnQ
GxpwP
yxdDY
OWWfU
Ylipn
liNQb
fBxWc
fBxWc
win32
ghmTb
TQNmz
fBxWc
Ylipn
fBxWc
mGpuh
ZeRjl
yvxUY
yvxUY
wOKnQ
sMqBS
txqbi
pmMbl
pmMbl
pmMbl
YzwFD
YzwFD
KcfiC
zFbdy
qMncG
wOKnQ
zFbdy
10.0.22000
kEkhI
JSQRc
iKMKU
iKMKU
CqWjy
NfVjJ
iKMKU
wOKnQ
VshfD
GxoOM
GZOpC
cJYUY
YvCMk
cJYUY
8726e3
YlZYa
riWYq
YlZYa
wOKnQ
OiDFD
GxoOM
vSSjG
vSSjG
vSSjG
c037
vSSjG
fjDRH
vSSjG
wOKnQ
mbNcI
oMqvv
mbNcI
mbNcI
mbNcI
zshdx
mbNcI
wOKnQ
10.0.22621
vNTCE
GjeDH
mrJUr
iwadr
DHMzD
vduzl
wOKnQ
sMqBS
IiDih
IMTaL
txqbi
mdnfP
mdnfP
hgzrQ
hgzrQ
QmDdO
kSUIG
QmDdO
Qxonm
wOKnQ
sMqBS
kMuIm
Qxonm
zTWLI
Qxonm
SeYdN
TEPOT
TEPOT
XIKtc
wOKnQ
dVExP
GxoOM
dVExP
dVExP
NLkTQ
dVExP
EOsEJ
dVExP
VuJWp
qkOfr
wOKnQ
eFeRu
qkOfr
Ylipn
ROjuM
pTEED
pTEED
pTEED
JdFCA
sdiAI
win32
sdiAI
QGHFO
ooGCo
ooGCo
qyMWr
qyMWr
SqONG
HquHy
SqONG
etfRc
vGitB
wOKnQ
Ylipn
vGitB
HOhAo
ogVbg
Fjlhj
rDAWL
wOKnQ
rDAWL
txqbi
rDAWL
ZgSAd
jwlzB
b71c
NnPzd
FWWTZ
HzhTH
cEMEI
FBbDW
wOKnQ
ONnKw
txqbi
ONnKw
ONnKw
ONnKw
uccwt
ONnKw
wOKnQ
txqbi
ONnKw
ONnKw
rNXLv
OVQGA
hOzWd
YAQYg
fauaw
YAQYg
BFGUZ
YAQYg
faaZg
wOKnQ
OVQGA
hOzWd
NgZej
6.1.7601
NgZej
NgZej
NgZej
iIOCx
VOGyw
iIOCx
iIOCx
win32
iIOCx
Ylipn
iIOCx
iIOCx
PlxFg
PlxFg
PlxFg
iLjCA
YBKZM
oHeij
KNlSM
oHeij
wOKnQ
ntezn
hOzWd
bcmDH
txqbi
bcmDH
OsWDB
OsWDB
CSJBZ
cGouA
TUpkn
kDgGj
VpkJl
nGjTa
wOKnQ
Ylipn
jCTpZ
jCTpZ
lJaTJ
lJaTJ
5a1d
lJaTJ
lJaTJ
lJaTJ
win32
jNTvB
hOzWd
lJaTJ
jDuYY
RSsda
hOxlQ
RSsda
hrdvH
hrdvH
wOKnQ
Ylipn
hrdvH
JKxhS
hrdvH
HjQeg
EmVBb
win32
jNTvB
ZzMvo
txqbi
eCDvi
eCDvi
mgEPK
pKLwt
#56d4#
ufkpW
pKLwt
win32
SLLtg
QpjTd
Ylipn
QpjTd
hEtQx
kOKhh
hEtQx
CGGgh
iVLGr
YstWF
Gzatl
wOKnQ
jNTvB
gNsIX
6.3.9600
RJfIe
dRVKa
oThSy
dRVKa
wOKnQ
VeJAu
10.0.17763
VeJAu
Cdpvc
gaDrZ
rcHxI
rcHxI
afRTo
uuCtj
rcHxI
wOKnQ
USMMJ
GxoOM
USMMJ
USMMJ
OxOCp
jUmDO
AOoRO
mkWZM
6eb45e
mkWZM
wOKnQ
zTWLI
oqxmY
EhcHD
jruAk
YvCMk
jruAk
QAXUc
mUvOb
wOKnQ
hIVVp
6.1.7601
AJDWJ
gvFCN
CSFGt
pagbf
jgMsQ
Qulil
GNyXU
Qulil
wOKnQ
XNVBw
10.0.16299
XNVBw
vVGZc
DLghd
yuUVM
ekwvO
ab86a1
dgIoj
dc599a
dgIoj
wOKnQ
Ylipn
dgIoj
fTjxS
WPSom
giQXt
WPSom
WPSom
MQTZB
mthYf
wOKnQ
hIVVp
TZikQ
YPlhm
txqbi
YPlhm
YPlhm
YPlhm
b5a0
YPlhm
BhUer
jZFLv
ovBQG
wOKnQ
ovBQG
10.0.18363
ovBQG
RGqkv
WWEBs
WWEBs
WWEBs
RegIx
WWEBs
8215e4
win32
OXSRo
TZikQ
WWEBs
txqbi
VQOPp
VQOPp
YmXTT
kzEzS
YmXTT
8fdf0b
Mejsm
Mejsm
wOKnQ
Mejsm
Ylipn
dCdCo
dCdCo
e2c5
veMHT
12a5b6
OXSRo
veMHT
veMHT
wOKnQ
iqiDQ
txqbi
xoTLC
xoTLC
VumwR
VumwR
XhxIo
SnlyQ
chyXo
SnlyQ
wOKnQ
OXSRo
MucFN
10.0.19045
MucFN
MucFN
dUvSP
dUvSP
Vvoau
TOYmH
SUrBC
TOYmH
OYYqJ
wOKnQ
kmZDH
GxoOM
kmZDH
JiZzk
GTZmc
LaYno
tniZQ
LaYno
VNREQ
LaYno
wOKnQ
10.0.19045
LaYno
tzQFC
fblzz
XOyEg
wOKnQ
oxitq
10.0.17763
BTEHL
GthtC
tKUjH
tKUjH
gWNBR
tKUjH
a4757d
wOKnQ
TZikQ
tKUjH
RwsYn
pKSDc
tKUjH
win32
OXSRo
bjiGs
reDDx
UMBTw
VKsfA
rsxCS
UMBTw
RaEmi
wOKnQ
SrLta
bjiGs
EWeFS
xFQlt
EWeFS
WmaXj
IMqdQ
IMqdQ
VbBhV
jBFwS
wOKnQ
YvJyz
jBFwS
ZgAvf
daGmV
ZgAvf
xhiBQ
win32
SrLta
bjiGs
xhiBQ
txqbi
KiOfb
Twowq
KiOfb
LXKIp
jgmCv
UrPlO
39549c
UI32LE
UI16BE
hex
GUID
UI16LE
FTIME
DTSTP
STR16
undefined
ysGls
wtMvn
oCrHv
alloc
writeUInt32LE
UI32BE
alloc
writeUInt32BE
UI16LE
alloc
writeUInt16LE
axlKs
alloc
writeUInt16BE
UI8
alloc
writeUInt8
HEX
from
XCLpJ
HEhqW
split
xVWjt
oCrHv
AILVX
wPprS
LpfBu
FsrOy
rKIIX
LpfBu
rKIIX
HEX
EUlVx
HEX
concat
qhmKE
VydvP
szBvI
YjhnQ
xyWnd
floor
szBvI
floor
EUlVx
oCrHv
EUlVx
oCrHv
concat
HpOAG
cpsXo
YjhnQ
getFullYear
cpsXo
PPBNi
getMonth
cpsXo
getDate
EUlVx
UI16LE
ioVUo
getHours
ioVUo
getMinutes
floor
getSeconds
uvxWv
UI16LE
concat
oyGPL
alloc
kvIzz
length
PdPXW
length
writeUInt16LE
charCodeAt
NDIjW
bfKqW
EkKJK
jNIxk
ONzTT
ONzTT
push
jNIxk
wtMvn
EaIOJ
statSync
pf2
4|5|3|1|2|0
\.\
qkisN
split
substr
substr
FbEHm
length
XGEoj
substr
SHOxx
substr
length
substr
length
Xlujb
indexOf
split
join
Xlujb
indexOf
\.\
split
HFINk
join
STR16
6|4|5|1|11|12|2|0|3|8|10|7|9
aes-128-cbc
C:\
reg.exe
add
HKCU\Software\SPoloCleaner
Installed
REG_DWORD
object
YCuOk
SgUIV
xsYSl
nIJqC
WRYbs
tgWOX
IKwVZ
NDyra
kguLW
bTWDX
max
GUID
00021401-0000-0000-c000-000000000046
UI32LE
FTIME
UI16LE
xwCeu
UI8
20d04fe0-3aea-1069-a2d8-08002b30309d
pNXPN
DTSTP
VPjRA
mmdkI
XzDJY
vLyIO
iUKcm
VQbIo
EhhBp
EObrc
length
rCquB
epJPo
name
name
length
name
file
file
length
file
workdir
workdir
length
workdir
args
args
length
args
icon
icon
length
icon
now
workdir
NTooR
pFBve
workdir
workdir
workdir
indexOf
XLKmP
workdir
iHkLf
icon
WBvkA
UI16LE
length
OZkKF
hngwf
file
ItxlP
ORXxL
ORXxL
file
RFFcr
file
file
indexOf
tNtLV
LziAx
SjyYn
ItxlP
ZxIsW
Nrytp
MTHfr
gQzry
gQzry
pLysj
pslo
aCPOK
file
Bssjy
goFAZ
goFAZ
ktmr
ktmr
vIsHe
file
env
ItxlP
toLowerCase
toLowerCase
env
RFFcr
split
flg
flg
flg
flg
SjUmT
flg
SjUmT
name
flg
file
flg
SjUmT
workdir
flg
SjUmT
args
flg
SjUmT
icon
flg
SjUmT
att
att
file
ItxlP
gEctd
agIGV
pojfA
OmwOn
length
6|2|3|1|5|0|4
split
push
args
args
push
pid
session
zgWjj
ppid
ppid
push
path
path
length
path
name
att
agful
PmyqJ
WFIzt
writeFileSync
readFileSync
att
shcm
show
ExiuK
shcm
show
min
agful
show
shcm
UI32LE
OZkKF
LIzni
kdtSE
OZkKF
GrKbF
flg
GrKbF
att
OZkKF
FeKRy
ftc
ftc
FeKRy
fta
fta
FeKRy
ftw
ftw
GrKbF
fsz
fsz
TXSMJ
GrKbF
icidx
icidx
GrKbF
shcm
ksSdU
UzOhb
hky
hky
ksSdU
UzOhb
pHhwE
GrKbF
pHhwE
UI32LE
concat
jXfjO
cSewS
flg
JrUbH
QesNU
xwCeu
log
pHhwE
UzOhb
qywDh
UI16LE
qywDh
vfvvV
qywDh
vfvvV
LIzni
xUATp
length
substr
hUDlk
YiBVH
YiBVH
UdCBr
split
TeIMz
length
writeUInt16BE
concat
update
final
FtQLR
HfTHl
randomBytes
alloc
zsiTz
WwwYb
taOax
concat
alloc
concat
from
createCipheriv
hIktG
slice
jlJrO
UzOhb
jlJrO
vfvvV
push
from
jlJrO
UI8
push
alloc
LDIgS
length
mGnNr
pNXPN
aSzhS
length
from
file
veIPK
TeIMz
length
jWXHK
UzOhb
vIsHe
length
NAxzb
vfvvV
Gzvav
UI8
GrKbF
Gzvav
XNGPR
ftw
ftw
UzOhb
push
vfvvV
vfvvV
Gzvav
UzOhb
Gzvav
UzOhb
Gzvav
GrKbF
XNGPR
ftc
ftc
Gzvav
DTSTP
fta
fta
length
UzOhb
vIsHe
vIsHe
length
vKjTG
UzOhb
vKjTG
hngwf
UzOhb
UzOhb
concat
writeUInt16LE
length
push
concat
writeUInt16LE
length
push
readdirSync
VaNDj
Isieg
UI16LE
concat
length
writeUInt16LE
length
jXfjO
flg
tawXX
IEURW
IEURW
fromCharCode
JjYKk
RFFcr
VPXhD
name
Isieg
UzOhb
length
AiLoD
hngwf
WoUQa
flg
qeCwt
EAVwe
hiYun
vIsHe
tRGRc
file
JMOFI
UI16LE
length
WNvWq
STR16
XIEsM
dVZct
naxdZ
SSyNn
svduU
tRsEX
CmSNx
flg
KkTiY
IYHoZ
ydsii
RGCpY
MTHfr
HfTHl
tvhmF
SapDz
workdir
FNhPl
length
UzOhb
length
hngwf
FNhPl
CmSNx
flg
qeCwt
EDIms
boKer
args
trim
BbBuL
UzOhb
length
hngwf
log
rYvcl
jeJdF
flg
GNWWq
HbgtV
iaoeT
icon
BbBuL
UzOhb
length
asxEv
hngwf
GxUnz
ASRXd
taOax
tvhmF
YMbGA
rSHVZ
HfTHl
YMbGA
length
LvJyn
GrKbF
concat
concat
tpkCa
jtkhM
KUjPL
writeFileSync
pid
SODzW
MLanV
MLanV
outbuf
outbuf
push
.exe
\Microsoft\Windows\Start Menu\Programs\Startup\
.lnk
vMTuL
PBYDt
xcXIv
PBYDt
xcXIv
xcXIv
aup
MsDOb
xcXIv
MsDOb
WcsWv
tmp
CVkUM
CVkUM
CVkUM
jEgiU
vApeZ
vApeZ
MsDOb
VwzGn
BZGWN
BZGWN
apd
UGYXi
kAHEz
BZGWN
HApKP
dJrns
NDvlt
JBUqe
fill
mkdirSync
gttk
UI16LE
STR16
appdata
network service
local service
umfd-
\networkservice\
windir
systemroot
allusersprofile
temp
aes-128-cbc
Duo
prsv
carAS
DILVK
OtcVD
wTaqv
Urexc
QFHyi
nNTok
log
vsVmu
pf1
pf2
RgVXJ
vUVDr
mkdirSync
file
existsSync
resolve
argv
resolve
argv
bXvlD
rsyNq
log
RlWVo
AKWXz
JNgoG
statSync
pf1
LQlQI
xwfjI
wTaqv
args
trim
Whkii
length
mBFAc
piMVq
statSync
CbAzL
size
size
LQlQI
wJYBb
mlLWI
writeFileSync
pf1
readFileSync
AVJnx
AVJnx
statSync
pf1
8|5|6|9|7|0|3|10|11|4|12|1|2
split
apd
IAyJZ
SuCRa
isc
usr
isc
isc
usr
toLowerCase
eHCbF
muexM
zuxoL
system
zuxoL
ldHxt
NLlns
substr
BFiCB
length
prtfj
indexOf
dwm-
LbClv
indexOf
XxDjl
isc
usr
username
isc
tmp
toLowerCase
indexOf
zwnse
isc
IAyJZ
DvWqo
pwONH
MbCwj
aup
pWPBp
roVvO
isc
tmp
kLsej
tmp
isc
isc
tmp
toLowerCase
indexOf
toLowerCase
isc
isc
aup
apd
isc
CbAzL
size
size
HBRvq
qveSB
WLudC
statSync
pf2
s1e
s1e
LbClv
dKBkJ
HjjJj
pf1
pf2
resolve
pf1
resolve
pf2
resolve
argv
resolve
argv
HgWgJ
statSync
CbAzL
size
size
HBRvq
lbpmW
lbpmW
readFileSync
prs
createDecipheriv
ZYGIk
slice
slice
concat
update
slice
final
parse
toString
writeFileSync
pf2
readFileSync
mmTZh
ruoyk
argxI
statSync
pf2
dZnsd
size
size
basename
pf1
basename
pf2
argv
join
2|3|6|7|0|5|4|1
split
resolve
argv
pf1
pf2
resolve
pf1
FCjDi
FCjDi
resolve
pf2
resolve
argv
\Fonts\micross.ttf
HDCrI
hex
Microsoft Root
jjFxl
uMarA
mBJez
ctPKT
ctPKT
gybja
readFileSync
length
hXxbN
length
toString
YaOLo
from
Washington1
toString
YaOLo
indexOf
from
NLZHt
toString
YaOLo
SdGWp
indexOf
network service
system
umfd-
2|6|1|5|0|3|4
dINbJ
length
ISbZp
weOJo
vfayu
usr
toLowerCase
izOTa
knVWk
sMdtd
VMcfP
lmLdz
local service
substr
QgDuZ
length
indexOf
dwm-
ISbZp
indexOf
mWNSB
isc
CoTmw
split
push
path
path
length
path
name
session
push
args
args
wOIPN
ppid
ppid
push
pid
test
sha256
x64
20|9|10|0|21|30|18|1|14|23|19|7|25|2|8|3|12|5|11|17|29|22|26|16|27|15|31|6|24|28|4|13
USER
PROCESSOR_ARCHITECTURE
PROCESSOR_ARCHITEW6432
Unknown
xnVgx
rbiTg
aWmzT
ZMSEO
msiexec.exe
wlvxc
ktcWV
psls
FBhGv
cFONR
FCbIE
ercDx
HJgCs
HnksX
Ghigw
HJgCs
xDqZu
yIJro
JFVnJ
USERNAME
vsKOW
string
vnJBS
XmUhe
NdMwr
log
cmuPs
writeFileSync
trim
exit
pid
hdsfD
ercDx
YQZqj
ppid
ppid
ercDx
KbhGf
ppid
ppid
radiU
ppid
ppid
zbKon
length
length
hdsfD
hdsfD
vnJBS
UhMBJ
UhMBJ
hdsfD
TaOuQ
RAHFa
fByuA
ALKov
jCfEd
length
WAhAp
toLowerCase
indexOf
createHash
vsimW
update
digest
vnJBS
mDLzW
wlvxc
env
sfxname
length
basename
toLowerCase
mkdirSync
vnJBS
HfpLt
HfpLt
path
path
toLowerCase
name
name
toLowerCase
pid
SSfvF
indexOf
WAhAp
indexOf
push
KPHlf
length
VUXav
aYbnE
aYbnE
WXwjc
ThkgP
wOGch
ppid
ppid
wOGch
ppid
fGssx
vsKOW
ZazBX
split
freemem
cusOv
tmpdir
UyURd
length
substr
length
substr
hostname
cwd
platform
arch
rsCog
GExuM
versions
node
BdKzQ
length
cpus
qtoPC
kQQfs
totalmem
release
xmUop
string
indexOf
exJec
length
substr
YymWK
EcPpy
length
length
model
model
trim
speed
speed
lrVcT
length
substr
QUeKr
indexOf
uptime
lrVcT
length
substr
XDPFz
length
log
qvKfY
FBhGv
KBzEn
5|3|0|1|2|4
aes-128-cbc
OannJ
EeAcf
EeAcf
PeEQQ
split
createCipheriv
PByjY
slice
slice
concat
update
final
writeFileSync
prs
randomBytes
from
stringify
error
MAAfC
SfuFG
4|2|0|3|1
aes-128-cbc
TmhYR
oCqrL
kWjcN
out
outbuf
toString
outbuf
err
errbuf
toString
errbuf
dxVVm
split
concat
update
slice
final
createDecipheriv
QYkVT
slice
slice
parse
toString
readFileSync
prs
randomBytes
pWdtj
pWdtj
pWdtj
Xoyxe
bYvkv
UuDYB
yTXHo
UuDYB
BWgSp
Console
Services
mqzMz
GrJTG
JNuxJ
lcjQl
OKRvX
jbKno
pid
session
path
BMOBG
BOTIU
JbNne
TkBgx
egWyc
cmd.exe
computername
username
u
.exe
liUhO
OZjiZ
DzLgG
hMHWy
C:\
rpcsrv
LU0TO
_i_
.txt
tqyJm
oRaqb
hwv
wfr
atct
argv
indexOf
GhmxR
argv
GhmxR
AhsUX
dWSuC
argv
piLfz
ixvfR
argv
kTNDT
LU0TO
lzmGf
BJGqB
EVLvB
unshift
unshift
unshift
unshift
oZRZb
lzmGf
rTelY
rTelY
readdirSync
C:\
writeFileSync
trim
xBKmr
indexOf
rpcsrv
bqAvm
gWSaO
ATJDN
kTNDT
userdomain
kTNDT
IJaFU
xijmC
push
kTNDT
eIeMZ
eIeMZ
eIeMZ
iQlTi
concat
prototype
slice
call
nUwpu
OSJJn
HMNrl
xiaOs
xiaOs
xiaOs
CIUjR
apUOR
tmpbuild
ImDlx
wDDLR
OLXvl
nZXgp
CZKiM
NmrkS
readFileSync
toString
trim
createDecipheriv
concat
update
final
toString
nMcZU
TgPJw
log
dhbah
log
jyJSS
isc
log
sfre
log
VkpIB
kTNDT
prsf
tpyWk
undefined
0|4|1|3|2
aes-128-cbc
UI16LE
STR16
sbchn
oUfLR
TmdtE
bfrin
zdWKl
TjGqe
Rnjhk
RjWbg
eGTnN
usdFQ
KwuWn
ixmNk
LsCvg
QhpWu
fqBtY
prsi
331db0
vTnTS
GmiPU
reg.exe
add
Installed
REG_DWORD
s1b
nawPc
base64
zEKzK
log
TyzUN
gNbui
now
prs
pslo
jBVdr
QeZdX
HOyUo
push
now
ata
cta
prs
HIInR
fjtaX
HIInR
iHCZf
fjtaX
GJGiy
bfrin
etGYj
jBVdr
HSwUi
HSwUi
wPDfR
pslo
rzgOn
HfXqa
prsi
log
NXPun
rzgOn
outerr
outerr
push
jBeGB
iNEHC
iNEHC
workdir
sfiUv
workdir
workdir
indexOf
jBeGB
workdir
fjtaX
log
log
Unpacking installer archive ...
oKzuv
oKzuv
oKzuv
jFUBw
fjtaX
jFUBw
fnYAJ
LgjdA
ZAcsh
ktmr
fjtaX
ktmr
ktmr
error
fjtaX
error
error
cEtNW
code
UVMOd
cEtNW
signal
outbuf
concat
outbuf
errbuf
concat
errbuf
returnbuffer
out
outbuf
toString
outbuf
err
errbuf
toString
errbuf
nostr
out
prs
fjtaX
prs
exit
argv
fjtaX
argv
slice
oKzuv
jvjLc
cGFnN
zwXug
resolve
resolve
dirname
resolve
jgCBP
sep
basename
KbgmR
fkfBc
sep
basename
jvjLc
jdmFa
xzlym
mkdirSync
ITAnx
split
readFileSync
prs
concat
update
slice
final
parse
toString
createDecipheriv
JVFzq
slice
slice
wmRuD
JZRnX
workdir
length
oXkdH
UI16LE
length
oXkdH
STR16
writeFileSync
readFileSync
vTgMf
uvPiK
LwNzp
name
rmMda
hcXwQ
length
LzBmv
YcPqp
writeFileSync
readFileSync
qwfYS
qwfYS
chdir
msiexec.exe
KnUDD
length
WJXxe
toLowerCase
indexOf
LzBmv
rUwou
XwOxR
fqBtY
HZzuG
file
prsi
log
prsf
tHyhr
fkfBc
prs
prs
log
tbJjc
prsi
pIfkR
FvITq
Wgrwc
HaQYs
YXWZl
lXacM
mmXFi
rDGSa
HKCU\Software\SPoloCleaner
Woljp
sOwLA
gNbui
log
nQnLB
Wgrwc
bShYH
bShYH
parse
mlkaK
from
env
LU0
CSAip
toString
fjtaX
env
LU0
LU0
s1e
hMSkD
zEKzK
SwdCr
att
s1e
s1e
vrsav
jMPLj
2|4|3|0|5|1
\.\
0|182|114|90|64|119|20|178|146|188|130|88|65|128|8|80|141|113|39|75|69|150|139|135|30|4|2|52|161|166|171|163|42|26|13|98|133|58|140|70|63|148|66|7|167|162|56|180|117|155|17|29|25|181|27|118|108|132|41|46|74|35|156|21|174|18|96|170|71|168|158|123|53|6|38|31|112|32|106|77|19|165|116|16|1|138|48|33|10|...
win32
3635
835669
AMAZING-AVOCADO
harry johnson
10.0.19045
32b5
9f9d51
6.1.7601
Xeon
a65640
5bc06f
10.0.22621
d38e35
86438b
10.0
10.0.18363
DESKTOP
frank
alexeyzolotov
2253
2293
e8c630
3f9b99
NOHID
NOUID
10.0.17763
10.0.19044
1e75
b71c
d04f74
2bf408
ed6464
KVM/QEMU
10.0.15063
2970
8e776c
e32aca
admin
john doe
10.0.17134
10.0.18362
2088
e1e853
52acd9
a739
d60869
b6f4a2
10.0.19041
2a4494
f1dd
3219
9db1e4
93a77b
cd4ee8
bac5dd
7fa24d
4b418f
10.0.14393
10.0.10240
4ed984
2652ee
george
a888
2001f7
administrator
anna-
97a9d3
7c1a
8726e3
6.1.
STRAZNJICA.GRUBUTT
c8b63d
7b7bc2
990d1b
582a34
747890
joe smith
a6f2
5b2e9c
cc9adb
10.0.16299
13b4
ab86a1
dc599a
10.0.19043
11d4d6
2048
7bf5
2cb5a5
f3f0c6
56d4
10.0.
b624
4b33b6
50ab44
9639a3
48fdf5
851c
061613
1285
abcf10
b3c775
9a50
275dec
10.0.10586
00181a
a8776a
e94c92
9ab4de
f7e0fe
6f2958
john
10.0.22000
9d5196
user
cc1a
88dba0
18275d
dd15
6e6551
work
Host1
41c07c
9ca5a0
#56d4#
62efb9
CompAlexey
95deb5
c23200
5a1d
6a29b3
10.0.19042
fb6ab4
3151
7f8794
351468
c589
611a3e
cb0013
a98d
efba14
930d8a
86131a
gary-pc
stark
e2c5
12a5b6
46502a
6.3.9600
100
6.1.7600
a592e8
0b6631
101
9a8599
103
04159b
104
105
46e6f8
106
25cd40
59a422
107
26112
2988b8
108
my_pc_
7e0c8b
7b7cd2
110
379a7d
111
f4cb33
112
7aed
b445bf
lisa
113
114
115
d61484
d0062c
116
1cce9e
badfad
118
EPYC
shadow-
shadow
119
120
b0f8e1
436f
122
709b
8fdf0b
123
124
125
db9a51
64ca98
126
127
646a8b
128
55d8
129
130
131
033bd9
132
133
4f81e3
134
135
136
b4a2c8
137
73a080
138
AMD EPYC
d580
140
8920
0cbc66
bf7e
35ae2e
142
143
62327b
144
299243
d1457b
145
f5faf7
146
a.monaldo
9f72
bd9ff1
148
e379b3
9114
150
64ccb5
151
6cfdbc
153
4b9de2
591acb
154
6bd1
bb2e4c
155
736b19
156
157
158
160
161
mars-pc
162
953225
164
c39efd
165
166
167
peter wilson
168
5d0c
bc54f4
169
170
6adf97
171
52c9
172
f6b8ae
3322
bca236
174
DESKTOP-JTAPJCC
175
0bd650
8215e4
24889e
bot 115 W7 Xeon H 24889e U 18126e
177
72f6c0
178
570a90
179
d6a5b0
180
181
182
183
f2886f
184
185
4085c6
187
188
azure-
7db39b
USERNAME
USER
PROCESSOR_ARCHITECTURE
PROCESSOR_ARCHITEW6432
string
tMmRw
dhGKD
x64
lKlTM
yQDdW
platform
arch
release
uptime
totalmem
freemem
Unknown
hostname
VZqYa
idSob
sHZmf
cwd
tmpdir
versions
node
nbHAL
AcCtl
VbDAa
azdBu
CpsNZ
JVceZ
indexOf
xqFrf
CpsNZ
indexOf
dsyBa
aNzbi
ocvFp
RlsXt
split
GapCT
substr
substr
BlpAi
indexOf
split
join
GapCT
substr
UUljf
length
substr
CMjzo
length
tLMfk
indexOf
\.\
split
FUbbJ
join
hXNeY
length
gWWFG
substr
sWeAk
cpus
length
DImtG
WGFzi
HeuOR
length
model
model
trim
speed
speed
Lzixn
split
isArray
AUbDo
length
odIMu
FSKfS
tLMfk
pSHKR
10.0.19044
IBAWU
vjOlO
IBAWU
IBAWU
gIRRP
KlWaI
Szogp
indexOf
admin
ZgCqf
FSKfS
indexOf
gqaAo
indexOf
oPiBj
ZgCqf
win32
ZgCqf
srfIE
DhyQU
DhyQU
wGjYi
rRBiX
Fsnqg
Fsnqg
vGVQY
Fsnqg
IHdus
FSKfS
tLMfk
pSHKR
FkxTb
tWLhi
FkxTb
WhGWJ
WhGWJ
indexOf
ehdwW
jrSMs
hlNce
jrSMs
GkjfI
eihce
FSKfS
hEUwT
viKhe
hEUwT
hEUwT
3a83fe
OssTp
hEUwT
FSKfS
tLMfk
hNudB
tWLhi
EbyJF
EbyJF
EbyJF
EbyJF
iCOZc
Szogp
indexOf
admin
FSKfS
Szogp
indexOf
CUuad
EbyJF
ZNXbv
804a
PUutZ
indexOf
GtQWV
Szogp
indexOf
DSQFA
PUutZ
FSKfS
VIbla
indexOf
CompAlexey
indexOf
TgRyA
PUutZ
win32
tLMfk
hNudB
viKhe
PUutZ
KnDui
sNiyA
hrKOS
dmmVc
sNiyA
DhnAZ
VIbla
indexOf
XPRMU
indexOf
aKUSD
mfwOh
FSKfS
XUNbj
dONxl
XUNbj
vEwcq
zpqwv
zpqwv
VIbla
indexOf
GtQWV
zpqwv
ODYWO
wjbHu
FSKfS
GZkDJ
cjnHS
tWLhi
cjnHS
XJXZA
MGEiF
MGEiF
bzjfd
rtqsH
MGgPi
YdQDO
dIpGe
FSKfS
dIpGe
vEwcq
WqQJv
lOmAf
FSKfS
tLMfk
GZkDJ
indexOf
hxpOt
fQkPm
fQkPm
FSKfS
tLMfk
hQkQb
hstMP
scqiz
TCjvb
PLiny
HKhnV
SquIZ
FSKfS
gSJzQ
HKhnV
10.0.19045
CYJJH
FjoDe
fzLoE
FSKfS
snhWX
FjoDe
dqiiZ
dqiiZ
1cce9e
VIbla
indexOf
bAljC
dqiiZ
FSKfS
gSJzQ
JyXNj
XaMEI
indexOf
bea-chi
lDxZf
indexOf
qVcGl
koPbi
FSKfS
gSJzQ
JyXNj
CsVCz
indexOf
janusz-
indexOf
janusz
FSKfS
JyXNj
koPbi
FoYMV
fvJPK
TEAcc
ASYFW
xQJZB
bBQyt
indexOf
GtQWV
bBQyt
indexOf
NOUID
ASYFW
win32
LcRBe
HHWAY
qPSPq
6.1.7601
eFeJI
FSKfS
FoYMV
bBQyt
indexOf
DESKTOP-JTAPJCC
IpHrO
FSKfS
IpHrO
10.0.19045
tHgMR
XERcQ
tOzDw
fwqIF
tOzDw
win32
LcRBe
JyXNj
tWLhi
tOzDw
tOzDw
tOzDw
tOzDw
tOzDw
tOzDw
bPxOi
tOzDw
wQkte
75c891
tOzDw
FSKfS
MqCLe
10.0.19045
JDXNL
JDXNL
JDXNL
ZYLmU
b7e24d
nCjsD
pmejy
FSKfS
LPCym
JjpOx
JjpOx
hbijd
jAOEZ
pQZzR
SQRgD
FSKfS
tPmCS
GMxJb
indexOf
hxpOt
pRlJf
pRlJf
FSKfS
10.0.22000
bBQyt
indexOf
GtQWV
mtZzm
mtZzm
mtZzm
puiIn
win32
mtZzm
tWLhi
mtZzm
hzoIp
hzoIp
pxWhH
KTvId
pFXpZ
KTvId
uvcgt
KTvId
win32
BtaJZ
BtaJZ
ptexN
ptexN
jAOEZ
SQRgD
ptexN
ptexN
FSKfS
ZkfOa
tWLhi
xgnhd
xgnhd
xgnhd
ztDad
XiPqu
bzjfd
adiZN
XiPqu
wEyku
rleJq
XiPqu
56aee3
2b22
WkTEe
GQAbY
GWBXy
74529b
GWBXy
win32
GMxJb
cXpgv
HKtlJ
kkIRy
HKtlJ
QWEmT
LClwc
indexOf
GtQWV
LClwc
indexOf
admin
FSKfS
QWEmT
6.1.7601
b445bf
indexOf
lisa
QWEmT
FSKfS
rRlrm
cXpgv
yScVN
indexOf
GtQWV
OmjsR
QWEmT
Wwfql
txlYw
oVfDz
win32
cXpgv
tWLhi
oVfDz
xzPgN
WRHCW
hPnoJ
uoYXt
ETvDo
FSKfS
UcMtt
indexOf
CUuad
ETvDo
UcMtt
indexOf
yLDpl
ETvDo
win32
6.1.7601
ETvDo
ETvDo
ETvDo
ETvDo
win32
YCPJz
aKKho
ETvDo
6.1.7601
ETvDo
ETvDo
ETvDo
xulTd
XUrhd
RHiYl
indexOf
PVirC
XUrhd
win32
nNygR
aKKho
XUrhd
tWLhi
XUrhd
iCOZc
UcMtt
indexOf
bAljC
WySRe
FSKfS
nNygR
indexOf
EYknu
LkFod
QbPtQ
BEbbs
FSKfS
qshQu
10.0.22621
qshQu
kxxdH
Ufiuf
kxxdH
PPnHe
kxxdH
cd4ec1
kxxdH
win32
UcMtt
indexOf
nVASz
UcMtt
indexOf
uMVPc
sxhOU
FSKfS
fPxsV
aKKho
indexOf
hxpOt
sxhOU
sxhOU
itahV
FSKfS
fDIyo
6.3.9600
fDIyo
bvcPR
gPGfP
FSKfS
SaSHA
srfIE
SaSHA
CbRge
htFQG
hvggJ
vcKdu
FSKfS
hvggJ
srfIE
yRpey
cIGLI
cIGLI
DcICd
uPiUv
6e64
RvkHG
eKhRJ
FSKfS
qadpw
aKKho
DcOoX
indexOf
GtQWV
DcOoX
indexOf
UAWCf
RvkHG
FSKfS
sOPYj
tWLhi
nmLlL
qadpw
aKKho
QIvNT
nmLlL
FAeuP
PgkDy
PgkDy
FSKfS
tWLhi
PCsOF
hbgiT
NXRoF
DcOoX
indexOf
GtQWV
indexOf
bAljC
NXRoF
FSKfS
rneSn
ZNXbv
azMOG
azMOG
gPwwW
azMOG
FSKfS
oiIBY
hzzKk
tWLhi
hzzKk
ULzdt
IAuXD
IAuXD
Aobyb
Aobyb
FSKfS
Aobyb
qiRBC
DtTeb
pqpTr
pqpTr
pqpTr
uxHGG
zbIEw
OvPoI
win32
qadpw
oiIBY
pqpTr
sKdkG
DcOoX
indexOf
harry johnson
pqpTr
win32
Yfszt
pqpTr
tWLhi
mhKYp
MtMmz
pcxpc
indexOf
PVirC
mhKYp
FSKfS
BPxQN
tWLhi
VofUt
Ouenw
wpvFK
ircQS
ircQS
16a7c1
ircQS
39549c
ircQS
FSKfS
wwBaU
tWLhi
fzKLG
djVaT
XXqzy
XXqzy
CMqRc
XXqzy
Xmava
kILnF
WwQtg
LhOcz
win32
BPxQN
uLTrO
tWLhi
KTKWu
ZduZp
ZduZp
xzKuB
ZduZp
d33e1f
9ec750
QkWoJ
FSKfS
uLTrO
SpmnU
indexOf
nXDHx
rrgPu
rrgPu
rrgPu
rrgPu
GMfwZ
ICzfl
03fea1
XZDYz
mKFch
XZDYz
FSKfS
BPxQN
uLTrO
indexOf
10.0
XZDYz
dAQyI
BPxQN
indexOf
ehdwW
scqiz
dAQyI
rCwHg
dAQyI
oIuUx
qQmWx
FSKfS
uLTrO
qQmWx
viKhe
qQmWx
2cd67e
CaEAQ
FSKfS
tWLhi
CaEAQ
nbEGm
092f16
bVGfm
TBfms
ANpYN
FSKfS
jeqXB
dONxl
jeqXB
vEwcq
jeqXB
jeqXB
indexOf
GtQWV
jeqXB
FSKfS
BPxQN
uLTrO
Yrpuz
Yrpuz
yZlTp
HPeVH
JAlVH
oTmJQ
JAlVH
FSKfS
bXBul
indexOf
10.0
MEsVN
MEsVN
MEsVN
MEsVN
woTjD
zRKiU
InVTy
xceZO
InVTy
win32
hUHjF
uLTrO
ePuIO
NVyKy
IxaSn
ftfjl
FSKfS
ftfjl
ftfjl
bXBul
indexOf
NOHID
NRCTX
indexOf
aKUSD
vyeDA
jAOEZ
Kslxh
dvHOs
NjAUu
3151
uxpVo
IJpLW
QYtMM
MbbVC
qFney
uxpVo
129654
DDVjM
MbJpi
FSKfS
hvXwA
erIrS
indexOf
CUuad
MbJpi
AQvcl
NRCTX
indexOf
izbdo
MbJpi
FSKfS
lplwk
viKhe
lplwk
NlzaL
sWSxL
WVqdE
a30c
6eb45e
FSKfS
WVqdE
XfEER
WVqdE
WVqdE
lyLvO
WVqdE
FSKfS
hvXwA
hvXwA
indexOf
Xeon
indexOf
Host1
NRCTX
indexOf
jXbcm
win32
WVqdE
fgWJN
pqvcf
0fdc
jqsNq
Sexjq
YbVEB
RgqXH
svAIT
yrdCE
indexOf
PVirC
win32
lcSnM
6.1.7601
tnRlu
soElN
indexOf
XPRMU
yrdCE
indexOf
izbdo
TwzfF
win32
ItmsL
erIrS
EgqjP
srfIE
EgqjP
yzEEy
yzEEy
bzmsJ
bzmsJ
ntbrC
ntbrC
win32
ntbrC
tWLhi
ntbrC
cGHIr
ynBtJ
VHBbL
XSJXx
icVYq
indexOf
administrator
XSJXx
FSKfS
XSJXx
indexOf
nVASz
indexOf
mHsQq
NuMbA
indexOf
bAljC
XSJXx
win32
ItmsL
erIrS
indexOf
Xeon
NuMbA
indexOf
LWtaX
gimIP
indexOf
jXbcm
win32
ItmsL
tWLhi
XSJXx
XSJXx
XSJXx
lLJhu
XSJXx
zOKOi
FSKfS
ItmsL
erIrS
qkLiM
fcdHf
XTUjJ
10.0.17134
bMSFC
10.0.18362
XErIb
xQJZB
puEZF
indexOf
GtQWV
HgrGR
indexOf
aKUSD
FSKfS
ItmsL
ykCPu
6.1.7601
COKUY
COKUY
jFHrz
cAGGa
VXKcj
VXKcj
win32
ykCPu
VXKcj
tWLhi
aXthL
aXthL
nAaYe
aXthL
OlmiC
kceOG
win32
indexOf
StAIO
HgrGR
indexOf
alexeyzolotov
dzXDJ
FSKfS
dzXDJ
10.0.22621
uMesz
indexOf
DESKTOP
IHLxG
Mbdtt
hkzOg
FSKfS
hkzOg
mUDSv
769fc7
zVhEj
FSKfS
srfIE
zVhEj
CvnJD
CvnJD
zORjW
ehkaA
ehkaA
FSKfS
uhbpG
ykCPu
10.0.19044
ehkaA
ehkaA
tgCmN
e06b
tgCmN
QvLuw
tgCmN
FSKfS
uhbpG
LEiEM
tgCmN
6.1.7601
LpJZS
IMtCt
viPSy
viPSy
FSKfS
viPSy
NKgqS
viPSy
viPSy
viPSy
mrLQo
LdiZI
gNsqx
BgQBW
win32
zRgPL
cIKUx
vEwcq
xvQnI
FhntQ
QQxhn
4f5cec
QQxhn
FSKfS
QQxhn
QQxhn
QQxhn
dvHOs
6.1.7601
DaUAD
KbAer
KbAer
Sjanm
uMesz
indexOf
NOHID
PJuww
indexOf
aKUSD
FSKfS
10.0.18363
grARF
XNDtK
tKZBT
FSKfS
VtFUM
NVyKy
COivL
pJtTP
COivL
FSKfS
VtFUM
uhbpG
indexOf
Xeon
tWLhi
COivL
COivL
COivL
CDSof
ufpFe
ESeYe
PJuww
indexOf
PVirC
ufpFe
win32
ufpFe
TgcZz
ufpFe
GkjfI
AWGuO
win32
XfEER
Dmpyj
pCjuM
Dmpyj
lYTNX
Dmpyj
QGqGm
Dmpyj
win32
rCCjw
6.1.7601
rCCjw
rCCjw
rxUtd
indexOf
ehdwW
pqrld
FSKfS
Bqaek
ZZvHV
tWLhi
DCIBl
DCIBl
DCIBl
DCIBl
XgiGl
rDJci
FSKfS
XgiGl
indexOf
6.1.
indexOf
gZWKl
PJuww
indexOf
ggWMN
XgiGl
FSKfS
XgiGl
srfIE
OXBnW
Xxoyr
Xxoyr
PzXjd
Xxoyr
fbANB
Xxoyr
gKTni
win32
rxUtd
Bqaek
gKTni
6.1.7601
gdHgh
PJuww
indexOf
administrator
FSKfS
yEgqm
wrOMG
yEgqm
yEgqm
BOCJW
72e748
BOCJW
ykMmN
BOCJW
FSKfS
AGJDl
KYZAU
UojgD
qsGlk
VvJrJ
xDQew
orLtz
xDQew
bbWEH
ALyXe
nIzTD
FSKfS
AGJDl
WoKDp
vEwcq
WoKDp
WoKDp
knmqG
Jmnnc
UgfhK
102
admuw
FSKfS
AGJDl
KYZAU
oJosd
srfIE
oJosd
cIqie
471915
SfPLC
acjLM
FSKfS
AGJDl
KYZAU
OaMyT
6.3.9600
LtKce
LtKce
gnvQF
YMlet
nBQhT
FSKfS
fqmLw
viKhe
fqmLw
JxtWI
JxtWI
JxtWI
JxtWI
5fd4c0
hGYbx
JxtWI
FSKfS
JxtWI
ZNXbv
JxtWI
3e45fc
wsuFD
vapSc
UiBgL
PXVTC
FSKfS
PXVTC
6.1.7601
PXVTC
PXVTC
udMtf
MwoNu
PUdaa
ETkeF
MwoNu
FSKfS
AGJDl
XTliu
MwoNu
ZNXbv
MwoNu
zhkEY
xiSWN
MwoNu
wENzy
MwoNu
FSKfS
PJuww
indexOf
nVASz
gpkzf
indexOf
fpsZk
NbZJa
indexOf
PVirC
109
FSKfS
iwjhz
viKhe
CIGfN
hAhCj
xSsfE
DvUsX
nYtks
oSPLx
FSKfS
puNKz
oSPLx
tWLhi
RHABd
RHABd
xulTd
qDyJT
BhalZ
sHgTo
indexOf
PVirC
eaylx
GeGGj
FSKfS
XTliu
vEwcq
GeGGj
fsZks
LgDqi
HAXrV
FSKfS
HqPas
tWLhi
HAXrV
GcYsO
GcYsO
hPPpm
MVigM
PryfN
kzrbV
indexOf
gzVpU
hyMut
MVigM
win32
MVigM
MVigM
FQvHv
indexOf
EYknu
Ndrny
97a9d3
vjEJa
ZBuQz
FSKfS
9a50
ZBuQz
IxaSn
OLYrg
pJtTP
zTTSR
OLYrg
FSKfS
AhtAg
ToYdt
bbJOw
JCguA
CQWHf
IJCWx
FSKfS
NwpOt
FFcub
ylKcQ
tWLhi
vjOlO
AvIsm
iOOzU
ZWToJ
indexOf
bAljC
117
dTWnk
FSKfS
ZoQbj
nAAQV
FQvHv
indexOf
10.0
IUwEY
FQvHv
indexOf
admin
EmSMF
dTWnk
FSKfS
bhGdY
indexOf
CUuad
indexOf
pZFwd
URBSP
indexOf
ehdwW
vVyjV
indexOf
LuZEb
CyDcr
indexOf
DXJez
xVYYd
dTWnk
FSKfS
HdGNu
dTWnk
IxaSn
351468
tSNmH
dTWnk
win32
bjEyM
tZzap
dTWnk
yqCKI
yqCKI
851c
UqBJN
dUZek
oTmJQ
121
UqBJN
FSKfS
iSpuk
10.0.19043
ADwtv
BFREI
OOWhj
vnrOv
nehXo
wpFpg
nsjgr
qClEH
FSKfS
tZzap
tWLhi
qClEH
qClEH
eBOwS
eBOwS
vLFWq
ZPqVO
qtsTK
ZPqVO
fuvFL
aetbW
FSKfS
bjEyM
tZzap
aetbW
tWLhi
aetbW
aetbW
aetbW
leSnm
11d4d6
indexOf
PVirC
nJYIY
PQrIW
FSKfS
bjEyM
TLaif
10.0.19045
FaamG
FaamG
FaamG
FaamG
VmLOG
SXyqu
FSKfS
10.0.22621
JPqCI
ujqRj
TQqZX
UjxLZ
LTLRj
TQqZX
win32
PTtTT
10.0.22621
PTtTT
32b1d5
c350
ihuUi
PTtTT
FSKfS
viKhe
PrIZr
PrIZr
e717
PrIZr
CVDEm
STMaJ
ZRuhd
win32
bjEyM
CVDEm
CVDEm
tWLhi
CVDEm
OmjsR
afYWs
zrjjP
umxAG
indexOf
XPRMU
BGahd
indexOf
aKUSD
viZwn
afYWs
FSKfS
YRvpw
tZzap
afYWs
TEAcc
afYWs
bzjfd
uQQih
uQQih
pvNCr
sPJzT
win32
indexOf
XPRMU
pLRSm
indexOf
jXbcm
FghRi
RgAgz
yWbwy
10.0.18362
SwDlc
tWLhi
XEReh
QcYXN
win32
YRvpw
tZzap
QcYXN
10.0.19044
QcYXN
OXywN
UrFyp
TkGuJ
LVUJR
FiYTb
FSKfS
NLRaH
lFOzB
IDlPQ
indexOf
nVASz
indexOf
GtQWV
indexOf
bAljC
oLNDR
FiYTb
FSKfS
UVwcl
IDlPQ
indexOf
6.1
FiYTb
tOAcI
indexOf
ehdwW
tOAcI
OoXQf
whzYU
b75705
LJfZM
dLvgL
whzYU
FSKfS
aBJxf
leLVD
indexOf
GtQWV
indexOf
bAljC
DFffT
DFffT
TEAcc
oCKHI
indexOf
ehdwW
gVhGP
FSKfS
DFffT
viKhe
DFffT
c037
DFffT
lVQkI
oAssO
AKKsi
FSKfS
gLXVS
WoMHv
tWLhi
eemFW
eemFW
IjoFg
b5a0
IjoFg
MonDK
qoDev
FSKfS
gLXVS
UVwcl
NiVdS
tWLhi
NiVdS
fHwRj
scqiz
fHwRj
YttRT
Fjxrk
indexOf
XPRMU
PiUYx
indexOf
bAljC
HRJPP
vLFWq
139
HRJPP
FSKfS
wKjSL
indexOf
CUuad
HRJPP
PkCpg
msBUY
gLXVS
indexOf
ehdwW
ocmBe
indexOf
nzKHg
UmJHb
OmjsR
vgovA
10.0.19044
PiUYx
indexOf
NOHID
PZByE
xulTd
PZByE
7e73
PZByE
70b4
PZByE
XFKVa
lKqTC
indexOf
PVirC
zTbKQ
bWbKp
FSKfS
ocmBe
PGdrD
YWKpk
indexOf
10.0
indexOf
GtQWV
viKhe
hgntz
guLnQ
hgntz
XgSqn
141
hgntz
FSKfS
ocmBe
hgntz
10.0.19044
hgntz
pZKsH
FOTls
ppjTo
FOTls
d8716f
SzPYK
FOTls
FSKfS
OfNVf
GnJCx
MCgeD
10.0.19043
srfIE
cNSHl
cNSHl
LUZqy
eyIea
Aulip
Aulip
ZhIJR
QfXgm
ZhIJR
FSKfS
10.0.17763
ZhIJR
uHdqC
a4757d
DiAvR
IxHEW
FSKfS
10.0.17763
QfZhb
zhkWp
BPoKL
pCtTn
ZkIca
pCtTn
rygtq
DQEjN
ATvpo
FSKfS
ATvpo
tWLhi
Ziwsn
abblD
mTLhi
abblD
f94649
dPBFM
abblD
FSKfS
pCdHX
indexOf
lRDUN
6.1.7601
indexOf
Xeon
147
SozfR
FSKfS
SozfR
10.0.17763
Kpbsm
Kpbsm
YeiFw
Kpbsm
xhkDb
HQXCq
FSKfS
kATsh
pCdHX
6.1.7601
Kpbsm
Kpbsm
IPagF
indexOf
ehdwW
Roqnv
72c1f0
149
lrNLf
FSKfS
kOKMn
srfIE
kOKMn
kOKMn
qXyFM
lGJLM
bf0760
UGrNT
Qvpvl
lGJLM
FSKfS
pCdHX
ArnTB
HvXVL
dabON
2be941
10.0.19045
IPagF
indexOf
ehdwW
TRfet
dabON
win32
yFtEL
pCdHX
eWdrO
srfIE
eWdrO
eWdrO
6d05
zREQg
MnvsZ
qbIeZ
b38e56
152
qbIeZ
win32
UyzXk
qbIeZ
tWLhi
qbIeZ
kqpvN
UyzXk
indexOf
ehdwW
indexOf
XPRMU
YWKpk
indexOf
aKUSD
dbEXT
kqpvN
win32
uFvqA
vEwcq
uFvqA
uFvqA
7c1a
QBUAn
YEIXT
RLAhR
LEPFv
XykuT
FSKfS
pCdHX
YCDdG
tWLhi
HmgRV
jpVIx
jpVIx
zuSGA
rYxYW
d864df
rYxYW
AGWuK
jEEbF
lVVwZ
FSKfS
YWKpk
indexOf
CUuad
lVVwZ
CPJPt
indexOf
GtQWV
77bd
YvtaE
MjxiZ
LuXjT
FSKfS
eFngB
CaBhz
CPJPt
indexOf
nVASz
OeQkM
indexOf
goatuser
bCfNX
Fplgl
win32
eFngB
TSvTM
eFngB
indexOf
Xeon
hLKqf
vEwcq
hLKqf
oVRYW
indexOf
XPRMU
indexOf
bAljC
jyJsm
oVRYW
FSKfS
eFngB
oVRYW
611a3e
OycgS
6.1.7601
OycgS
OycgS
indexOf
ehdwW
rhzYF
indexOf
XPRMU
xYmcL
indexOf
PVirC
159
BKjUk
FSKfS
uThgR
10.0.18363
uThgR
tRUSM
XNDtK
aff8
kyuVx
oJTUP
FSKfS
nGSRl
10.0.19041
tqGex
tqGex
tqGex
LcbNQ
d76211
zFqrH
LcbNQ
FSKfS
eFngB
tALtw
UXZdk
6.1.7601
gfEPs
indexOf
gibzZ
CUuTD
indexOf
PVirC
FeMnE
FSKfS
PaaYM
nZZZz
indexOf
CUuad
cpZrF
iBySg
indexOf
GtQWV
iBySg
bzjfd
bac5dd
163
AQoke
FSKfS
XSwwF
aHLLe
AAGBJ
tWLhi
DGwdR
OAXws
indexOf
izbdo
oRgXH
AAGBJ
FSKfS
srfIE
AAGBJ
OxXqc
OxXqc
mBGKw
OHvBM
IrrxH
UKvEp
win32
KOEyZ
mqXpc
6.1.7601
TEAcc
mqXpc
xQJZB
fCwck
mqXpc
win32
XSwwF
jhnfp
tWLhi
VdgDX
indexOf
art-pc
VdgDX
indexOf
PVirC
gWXEt
mqXpc
FSKfS
lMXSD
jhnfp
QJTsT
indexOf
dillon
QJTsT
indexOf
bQwdS
rknZt
lnqWK
FSKfS
indexOf
CUuad
lMXSD
indexOf
hxpOt
lnqWK
JZOOF
lnqWK
GuGvk
vEwcq
QJTsT
indexOf
GtQWV
GuGvk
fFLXS
LAcnR
ShpBM
FSKfS
viKhe
MXDhi
MXDhi
32b1d5
CWZAI
MwuyI
FSKfS
CWZAI
tWLhi
RpqKG
RpqKG
QJTsT
indexOf
PVirC
oKwMT
zORjW
ndZEL
btsDN
FSKfS
lMXSD
UFprb
oKwMT
tWLhi
oKwMT
uakzP
indexOf
XPRMU
QJTsT
indexOf
aKUSD
uakzP
bOAsm
fYesx
FSKfS
tWLhi
uakzP
uakzP
yLmsU
wTZRB
yLmsU
173
yLmsU
win32
jqvBy
viKhe
jqvBy
jqvBy
rwuNT
SxAHR
jYoQs
JROdf
mgEEB
723943
Mlajo
mgEEB
FSKfS
indexOf
UywYP
vcrhJ
FSKfS
uoSeW
ZNXbv
uoSeW
uoSeW
fnxRB
fnxRB
eWKSZ
fnxRB
gLgnp
176
FSKfS
yljgY
hjGtt
tWLhi
voeBo
LNOoD
LNOoD
GHAhW
GHAhW
KSMMH
GHAhW
18126e
dyGjH
Wmeph
GHAhW
FSKfS
GHAhW
srfIE
GHAhW
GHAhW
WquKi
oqYJi
aMJRn
win32
txTju
qiRBC
txTju
BdKOJ
IQEgg
FSKfS
TKYXy
viKhe
jzLzK
jzLzK
jzLzK
jzLzK
sFUZO
NiWoI
yXyEI
167bfe
OllaZ
NmKDp
EyRmg
WauZZ
FSKfS
FvQGf
dsyBa
indexOf
CUuad
WauZZ
IUwEY
indexOf
bAljC
whUbC
FSKfS
WauZZ
tORzn
cRxNW
10.0.22621
DHSFp
SQRgD
bwMwc
hplyp
DHSFp
FSKfS
dAwhf
obalA
tWLhi
obalA
obalA
obalA
e8b9
obalA
fca565
sEgVG
BkIgP
BkXHi
FSKfS
sEgVG
srfIE
sEgVG
jonbl
yXtSs
oqYJi
wZgEj
lFiiL
rhDjo
FSKfS
rhDjo
srfIE
rhDjo
NKrvH
NKrvH
NKrvH
RlwQo
186
NKrvH
FSKfS
NKrvH
10.0.17134
ygxgV
vrcqG
pLNev
FSKfS
JVceZ
RAzhD
scqiz
RAzhD
5803c5
FRhHy
RAzhD
FSKfS
dAwhf
indexOf
uFKQz
indexOf
azure
zNhkC
tWLhi
zNhkC
JVceZ
indexOf
ehdwW
189
GxSrl
FSKfS
srfIE
GxSrl
b1a8
XCsgH
RBPuN
190
XCsgH
FSKfS
XCsgH
10.0.14393
pikQp
mGeqI
NTAhU
bPxOi
azdBu
AUbDo
length
vyQqK
length
substr
pcSgW
length
substr
length
substr
pcSgW
length
substr
hwrME
length
substr
tJDkk
createHash
XRaPu
sRbSH
sRbSH
statSync
createHash
sha256
update
uKLZw
digest
slice
JFPuF
JFPuF
5|2|4|1|0|10|6|8|12|3|11|7|9
aes-128-cbc
Vojzf
split
concat
from
writeUInt16BE
randomBytes
nJMAd
alloc
wVfPB
concat
update
final
nJMAd
Xtpfg
length
createCipheriv
aUNjO
slice
concat
alloc
IHHRR
XXAtb
createHash
ASkOG
8|5|0|9|4|10|7|2|1|3|6
aes-128-cbc
FnKdv
SjUqZ
PFDhX
PFDhX
gXUQf
split
lNmuZ
readUInt16BE
concat
update
slice
final
slice
toString
readUInt16BE
slice
createDecipheriv
vbLxk
slice
xcQqx
length
XZfsS
LAEnB
length
createHash
sha256
update
tRSPX
digest
slice
dJWBv
now
random
recv
OUhtG
SFAET
log
PSolI
tkstp
sha256
pjRxQ
VAhMe
PxtkI
lKDXR
JwGSF
dxLLN
gttk
uIsTb
test
PIQYS
SBfqV
createSocket
udp4
message
udwSr
sLtCS
wEfkX
mkdirSync
log
gttk
KAPox
realW
XwpCb
now
WAZIJ
exit
mSsEx
WCLRD
igJnZ
tiBIK
tiBIK
tiBIK
length
argv
split
join
stringify
ViQqP
WCLRD
length
NUWbj
Lpwkb
log
epmJZ
Gvhvd
oRIow
oRIow
env
sfxname
length
basename
toLowerCase
writeFileSync
trim
exit
isc
udwSr
awZCN
upaGX
readFileSync
toString
trim
yInMN
RqMbs
error
PyToS
tkstp
Gvhvd
PBhyL
PBhyL
createHash
WVOTa
update
createHash
digest
slice
ALLJg
ffpct
KomzX
oUqet
statSync
pf1
RoXbx
fdJUF
Gvhvd
usEOW
usEOW
0|2|4|1|5|3
split
RoXbx
tkstp
mSsEx
log
recv
close
send
length
aes-128-cbc
uYzRH
eshYJ
length
from
hex
RnCGJ
Bxraz
MAekm
createDecipheriv
concat
update
final
toString
UKbMF
10|7|2|0|8|5|4|6|1|9|3
split
readUInt16BE
createDecipheriv
enSwS
slice
RvYyg
BpYDI
length
concat
update
slice
BpYDI
final
slice
readUInt16BE
slice
toString
VnVfQ
FiVzA
length
UI16LE
1|4|3|6|0|5|2
wevcm
SYGdf
TZIWR
uZoZm
vwKWt
ZueTB
KfiLZ
wevcm
jpWbh
close
jBZWU
qKTMB
lbYVC
log
CLiSB
KJjQK
file
xeNuJ
zAfca
length
ueJFr
STR16
ZueTB
yLzbt
sCmfO
ywRSC
split
length
push
yDqTC
yDqTC
GgGSf
pid
name
rYVtq
ppid
ppid
jpWbh
UVHnY
wKBbQ
NnAJl
vwKWt
log
dujAG
cInqT
HGFPM
Iavpx
qKYiW
KXsES
uncaughtException
base64
ini
from
from
IZSVB
TCIxD
dujAG
writeFileSync
pf2
readFileSync
alloc
alloc
izoFR
izoFR
kill
fill
allocUnsafe
allocUnsafe
TSPjC
VLepj
FnXHK
EqsOU
ATHkJ
QwcjX
NiXCL
RJSan
pslo
lRiaz
OPIZl
zRAiu
versions
node
indexOf
uerepl
CNyRK
CNyRK
uerepl
strry
removeAllListeners
vUKzz
HmmRk
bJTYV
YfSkA
log
stack
log
stack
floor
taRHS
jyyxo
pop
writeFileSync
pf1
readFileSync
length
WxAjQ
length
length
exit
from
dQvUC
log
Ajtdb
UnKoJ
log
isc
isc
QhNNy
sceZT
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2059:08:09 01:27:35+02:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.3 |
| CodeSize: | 26624 |
| InitializedDataSize: | 3944448 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6d50 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.0.22621.1 |
| ProductVersionNumber: | 11.0.22621.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Win32 Cabinet Self-Extractor |
| FileVersion: | 11.00.22621.1 (WinBuild.160101.0800) |
| InternalName: | Wextract |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | WEXTRACT.EXE .MUI |
| ProductName: | Internet Explorer |
| ProductVersion: | 11.00.22621.1 |
Total processes
42
Monitored processes
5
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 856 | cmd.exe /d /c bybwrwgaelm.bat 3094745511 | C:\Windows\System32\cmd.exe | — | 65ef2eef1ccf3146b44010406a235cb7.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1368 | "C:\Users\admin\Desktop\65ef2eef1ccf3146b44010406a235cb7.exe" | C:\Users\admin\Desktop\65ef2eef1ccf3146b44010406a235cb7.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 11.00.22621.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1648 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\Desktop\65ef2eef1ccf3146b44010406a235cb7.exe.vir" | C:\Windows\System32\rundll32.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1988 | faehelyy.exe lvncaqofh.dat 3094745511 | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\faehelyy.exe | cmd.exe | ||||||||||||
User: admin Company: Joyent, Inc Integrity Level: MEDIUM Description: Evented I/O for V8 JavaScript Exit code: 0 Version: 0.10.41 Modules
Lu0Bot(PID) Process(1988) faehelyy.exe С2 (2)aoa.aent78.sbs otl.dwt51.shop Strings (7525)61c73c03 *.aoa.aent78.sbs ba8e3e *.otl.dwt51.shop 5P6XoAdjG/sn1MY8e7DlNls1hOD/o6rsNERYOyMF2n7pvmx0DLp6rfYBxp2z8+ToxXGMxMZ/roC8EjP+gTP/ExXWZhuQaf/766TLUq/L0ZnqhUjUjb7v3oPli3K4mjv2URjiUV4oQNZiRKIDaChOzEinPm4FasyuRFQtPg2ISQFap01lV69lfO0NDgG61ZmNcol3DqcbkdwqiCzI09W7fmon5mG+SCJ5FV6ciMIk9Y8b4/70Dy8iqiAYPr2EpHVmTZbr+ijKlIjwIu5Ue2yA0VJA0a96ZwAU5xPxewa/N74p... require mainModule require crypto path sep dgram child_process env kpCxE toLowerCase toLowerCase env ignore cmd.exe object stdio xLeci detached windowsHide env env env env slice wusYU wusYU unshift unshift unshift unshift LqIwj shift spawn unref string false fIRKG zQAwV JaNhD UDVor undefined JGZBH pkTEU QCuiw mOUKe ilGyf SgbYU pipe close data VtsTc function LFClx TQEjW TQEjW att niDCN object stdio YSoDR detached windowsHide env env env env slice shift spawn timeout ktmr YTQcw QIKCI IpMdy HTChD DHUkW VtsTc AYkdv LFClx casCI iqWRH kill isArray IIwpj length mVmWl iTWVp length split kZJqx length RFodP sOKTQ IOPoU timeout once error pyjtA hzIIS error once exit xjvMF oCGQO JGZBH jhpEB jAnMJ MjdLg code EQgpl undefined signal oCGQO code PwPce oCGQO signal once NWCxL ZvkpF pkTEU ktmr LFClx cwYlq QCuiw ySaaP ktmr ktmr error AUDvD HTBLV readFileSync NpPJj error error oCGQO code undefined signal outbuf concat outbuf errbuf concat errbuf returnbuffer AZMlD AZMlD out outbuf toString outbuf err errbuf toString errbuf YTQcw nostr out Quad stdout ogbKB UIGAl ymwrb gzrcM outbuf outbuf push stderr ogbKB UIGAl xUDpi aNaAY statSync pf2 outerr outerr push 3|0|4|6|5|2|1 LnFRI split ppid push drFEE biwiw lgHxw pid name length ppid UI16LE UI8 2|3|5|0|4|6|1 .exe \Microsoft\Windows\Start Menu\Programs\Startup\ hex uncaughtException Gdfpl Node, oJJGJ lrvEE oVYyx LoBPp GWBgI executablepath path parentprocessid ppid name amozN Console Services lTsiN zUqMO gqbRl DArOu process get processid,parentprocessid,name,executablepath,commandline /format:csv release FkFIM indexOf kijCn indexOf 6.0 PxrBd wmic waNEW MBsZn hmVrU HPgaY 5|2|8|1|3|0|4|7|6 OXvak kenLe kenLe kenLe ajCJT AHZnz Nidit HglLa AHZnz AHZnz OHOBN DvKMD nUOSl qlbTU NqKan vasUe vasUe gGHhs izHlO NHwce ZxKEV log stack log stack vftZW length split join split length length shift bwUaF indexOf CfMKo ZHRfj WRnei EsbwZ split evZff EwShE evZff OlwDt XtPyf DpQMz aup OlwDt TXNEO LyNPD Nmmun RjSNB LyNPD BJYIc LyNPD kNXdn wWSmZ nigFj nigFj apd OdGiW oNIkq nigFj oNIkq .lnk oNIkq iZMeC oNIkq mkdirSync iZMeC AvKLk tmp split shift FCuxy length ynrJL MavHt MavHt uPRIM kBjaD UI8 push from kBjaD wEkFW push alloc split OHOBN length length izHlO LboLY Xtlvy dathq split push pid iAcrl nUOSl ppid ppid push path path length path name session push args args FCuxy length TEsbr PALTm GWBgI toLowerCase commandline args length ogeSx nhOlM length AGVGg aZuwp processid pid UfTYm name NKLEk length from eCrHh createDecipheriv concat update final toString pid Node pid TEsbr SwSDG SwSDG pid session path JAEUB lvpnY randomBytes RLsJW pJgue NEPju NEPju OXfMr ryzLK rQbox TEsbr mbWdd pGxDC uerepl HIuXo removeAllListeners log stack log stack pid ynrJL Icxpq BVTOB EmFqG ppid length tree statSync pf1 PxrBd systemroot allusersprofile appdata username \networkservice\ LXlyd network service system dwm- umfd- qbRBD isc FYKIN windir FYKIN JJAXX tmp temp aup lRiJm pSszI apd NiKwk usr wkwEA tmp isc isc ZhFfI tmp toLowerCase indexOf toLowerCase isc isc tmp toLowerCase indexOf tdFBq isc isc aup apd isc isc usr isc isc gvJZo gvJZo writeFileSync usr toLowerCase sycOh JMELV zqiFX somLB local service ZuoMm substr length kjCji indexOf IumJe kjCji indexOf kiqeF qNzjq qbRBD slAvI isc createHash sha256 update digest 7|2|0|8|5|3|9|6|1|4 computername oAKWd split prototype slice call pIqbU userdomain concat pIqbU CLdVe JaGtH username sWCZx push JaGtH uUuSk vBiKT ILZKB IbIFN JOATT u floor SVAea pop kqEYE fromCharCode WSvkS YrigE LEBOV 3|0|2|4|1 Undefined base64 2|5|0|4|1|3 aes-128-cbc nVMOz SiHop VvXJF gpiCF VlmRH PSBVY CZzhZ xgYTS uDKQz win32 linux darwin unknown openbsd freebsd intel celeron pentium core(tm)2 amd atom i3 i7 i9 epyc ryzen threadrip kvm qemu md5 hex DESKTOP AcNyG LntCH art-pc work amazing-av shadow- cape-pc janusz- compalexey dillon host1 user frank lisa shadow straznj joe smith john doe cape goatuser janusz stark a.monaldo alexeyzolotov peter wilson Unknown Intel Undefined Intel Celeron Intel i3 Intel Pentium Intel i5 Intel Core(TM)2 Intel i7 Intel Atom Intel i9 Intel Xeon AMD Ryzen AMD Threadripper AMD Undefined CPU KVM/QEMU syijL Duo qIKQf Quad avSmJ biPfQ NOHID my_pc_ AMAZING-AVOCADO DESKTOP-JTAPJCC azure- CompAlexey anna- gary-pc mars-pc UNKNOWNHID NOUID administrator admin john george STRAZNJICA.GRUBUTT azure UNKNOWNUID acHcK alloc floor RWAsE VBMgL writeUInt8 PbLsV KsxWg round ajVjg RWAsE sqkFF ukwjv ukwjv Wnmss PbeEZ uixTm LzoGr OysHM split file indexOf file xtVbS file sqkFF file uYchf file Wnmss MLUSE TuxpM gpiCF statSync Wnmss GGXVe ntmty eCtkf ppid length tree ijcIK ijcIK tEfNw oOIWw ppid ppid HCmyN ppid gIJBH BKDMg tllWY EqzQd VaaId writeUInt8 PbLsV length split min HCmyN min min writeUInt8 UBsbg gvyun eMyTa writeUInt16BE join doklM round ajVjg writeUInt8 ceil kuZDd Fjtpx SNBdn bJIzJ SNBdn MExLK YTqhK Ehoza YTqhK openbsd mOHdJ freebsd PHaEI bJIzJ MExLK darwin wKNvl vSHIp doklM doklM Wqeet eMyTa QNeHx eMyTa mOHdJ writeUInt8 length toLowerCase PIngo indexOf QeOJc PIngo indexOf iIUZx PIngo indexOf ZIony JyhUb indexOf YnAkD FEANN indexOf aaHWk BKDMg indexOf amd fqDeB indexOf OsJJJ fqDeB indexOf fTymw lwJfI indexOf i5 indexOf gRWyd SmjoE indexOf HCGYP indexOf xeon zdMOh indexOf jWwLI lDjaZ indexOf ddIfY lDjaZ indexOf VwWeB uVWyH indexOf xFpOE indexOf LKsBI ceil AxJmP YiXYT writeUInt8 urhlX eMyTa createHash Xgcck update digest slice toString IOhHC copy length split toLowerCase IUNVS length ClEIY vDpNk AwCnU ePZMi MBmuL parse muKUx from env LU0 HHBXT toString BKDMg indexOf my_pc_ ClEIY SusND ugzMA indexOf FFWTe indexOf bea-chi indexOf xwPvl ClEIY ZxlZK ClEIY JTAPJCC FDepy indexOf azure- XpMwT indexOf UAuMX ClEIY OCAfK JzvJC Jkznn AQHHW indexOf anna- gary-pc LiDkI mars-pc aTehi ifNRV writeUInt8 Fjtpx createHash Xgcck update digest slice toString IOhHC copy length split toLowerCase administrator admin phLCJ aTehi john aTehi jWkjh THoso george KpMTF YKasO aMUtu indexOf ZhPhk harry johnson yJpLV BVXIQ eRhSF JZOVe Udxwn UGYWB sYqSD UGYWB azure TteLn cavnK TteLn ARQcu butCg CQzik Waxuu fFSDY zdoqX writeUInt8 Fjtpx createHash Xgcck update digest slice toString IOhHC copy qdLWi XKzJj WcbWV QxinQ anZTi sfqmm dHsVY XLoDD bCcxY UVSZT frpwz AMD EPYC gUdyE IeVvL NSdvC jYLLb Waxuu Waxuu aMUtu MKnch MKnch BsBbs AlYbB split createCipheriv OxpEd slice slice writeFileSync prs from stringify concat update final randomBytes Waxuu Unhjt Unhjt from stringify randomBytes createCipheriv OxpEd slice slice concat update final writeFileSync prs cEBoJ aMUtu TWDMJ jamIa length model model trim speed speed VaaId xtVbS qlTXd IRtaF vDpNk HhthQ SusND ugzMA NBhzF bea-chi xwPvl ZxlZK cGtrI JvuNp UAuMX jvDiV Jkznn vonAR QBcqD hwycA Host1 iTXMT qlTXd ispwB XCKER wHHPh UUEEr phLCJ QlfwJ frank THoso Fkmfy YKasO NrKSs harry johnson yJpLV eRhSF Udxwn goatuser pGwVO cavnK stark a.monaldo fFSDY zdoqX Owifh MPhnM kwbDT BfIpN uYchf uYchf toString IOhHC 7|0|1|10|12|9|4|14|2|11|15|3|8|5|6|13 string false jfMGf split jyccV owiRY length split skJMq isArray sqnLl length SHPgQ length win32 9a50 351468 275dec e1e853 6.1.7601 570a90 a.monaldo azure- Xeon NOHID user 10.0.18362 10.0.10586 3151 NOUID 10.0.19041 00181a a8776a e94c92 9ab4de f7e0fe 55d8 CompAlexey alexeyzolotov bf7e 35ae2e d8716f anna- 97a9d3 Host1 2be941 10.0.19045 10.0 10.0.10240 10.0.19044 a888 7e73 70b4 d580 DESKTOP admin b71c cd4ee8 bac5dd 56aee3 4b418f 74529b a65640 5bc06f AMAZING-AVOCADO harry johnson 10.0.19043 administrator art-pc john KVM/QEMU 46502a 6.1 10.0.15063 50ab44 9639a3 10.0.22621 0fdc cc1a 88dba0 18275d 1285 abcf10 b3c775 e379b3 72c1f0 6f2958 10.0.18363 dillon peter wilson 9ec750 badfad 77bd bea-chi 2a4494 10.0.22000 f1dd EPYC shadow- shadow my_pc_ 6.1. STRAZNJICA.GRUBUTT joe smith george goatuser 10.0.17134 DESKTOP-JTAPJCC janusz- janusz gary-pc stark 5a1d bc54f4 611a3e 11d4d6 86438b 10.0.14393 7aed lisa 25cd40 2088 3635 1cce9e 835669 10.0.17763 1e75 c589 cb0013 dd15 6e6551 2253 e8c630 3f9b99 c8b63d 7b7bc2 582a34 851c 061613 7bf5 f3f0c6 167bfe 4085c6 a739 d60869 75c891 86131a e06b 6a29b3 52acd9 3a83fe d38e35 7f8794 aff8 72f6c0 f4cb33 e32aca 092f16 48fdf5 cc9adb 5803c5 9db1e4 93a77b 033bd9 c350 32b1d5 5fd4c0 9a8599 10.0.19042 fb6ab4 379a7d 9d5196 10.0. b624 03fea1 4b33b6 24889e bot 115 W7 Xeon H 24889e U 18126e 6.1.7600 a592e8 0b6631 d76211 4ed984 2652ee a98d efba14 930d8a 7c1a cd4ec1 b4a2c8 436f e717 646a8b 41c07c 4f5cec 3322 bca236 723943 471915 9f72 bd9ff1 c39efd d04f74 2bf408 f6b8ae a6f2 5b2e9c 9ca5a0 32b5 9f9d51 6bd1 d864df bb2e4c b1a8 7db39b 62efb9 6d05 6cfdbc b38e56 04159b 299243 d1457b a30c 4b9de2 591acb e8b9 fca565 f2886f 13b4 6e64 747890 73a080 0bd650 709b f5faf7 f94649 bf0760 9114 db9a51 64ca98 b7e24d b6f4a2 62327b d61484 d0062c 26112 2988b8 2970 8e776c 6.3.9600 72e748 2048 16a7c1 isArray QuaMP length Mogaw wOKnQ MIDnx RYhWS 275dec RYhWS 351468 waZdp wOKnQ mOLrJ AThhc MIDnx ZMhoB KqeBx wOKnQ HGdkf hHPVp KqeBx MIDnx KqeBx TbuyJ wOKnQ josng Zvkie 275dec Zvkie ZMhoB pXAJB wOKnQ hHPVp vggcx NOLdb txqbi pXAJB wOKnQ 10.0.16299 soEPH ClMtr soEPH wOKnQ YxNnx hHPVp abBgd indexOf KhwuB txqbi TMIaP huoCu indexOf Xeon Iyuoz wOKnQ sjxOT ctJAc indexOf tGBhc NQFkt indexOf azure eJTxT txqbi eJTxT huoCu indexOf bmnjo sqUjT wOKnQ huoCu sjxOT QEtro indexOf ierUt RtVNZ indexOf jDgoJ EebRk EebRk jDuYY txqbi BudYT win32 BudYT BudYT BudYT zbGVn NWJoR txqbi Zjuve Zjuve JigFS RtVNZ indexOf ierUt iagCi indexOf NOUID Zjuve wOKnQ Zjuve SfrnF iagCi indexOf ierUt indexOf PfBxU YQAbA SfrnF zbGVn SfrnF JigFS XjTAM SfrnF MaZfV SfrnF yWmAy SfrnF spTNH SfrnF 129654 uaHxZ aOBHQ wOKnQ FWGUt CDJYu CDJYu 6.1.7601 CDJYu 10.0.10240 tfxmJ ttzff indexOf ierUt indexOf PfBxU CDJYu wOKnQ Sikod QxvwV aGSOh indexOf xDFIX aGSOh indexOf nZbpl CDJYu wOKnQ indexOf xDFIX aGSOh indexOf nZbpl allna win32 Sikod aGIIl 10.0.19044 allna MQDbS uhNVF MQDbS SrNZu cXdfQ ZQqoH cXdfQ wOKnQ cXdfQ aGSOh indexOf CjATT cXdfQ wPBCQ wOKnQ aGIIl aGSOh indexOf anna- cXdfQ cXdfQ wPBCQ cXdfQ wOKnQ aGIIl Sikod indexOf bmnjo aGSOh indexOf ycYNK aGSOh indexOf jDgoJ wOKnQ Sikod oMwtx Gumww indexOf Xeon LWCcS indexOf Host1 indexOf jDgoJ dIWpg wOKnQ iPwBc JxtmM 64ccb5 AqsmO zGMKL Ylipn iPwBc indexOf Xeon wOKnQ iPwBc YjlVr xrpqq indexOf qVeKo ifins ZfSQr ZfSQr iPwBc indexOf Xeon indexOf AMD EPYC ZfSQr XEnne gSXoA zTWLI wDyTW indexOf ierUt gSXoA bHvER buGMP NnYfO iBrSK uJHTX indexOf administrator wOKnQ iPwBc dXxvx indexOf esdRV uJHTX indexOf lScgJ MZTuo jDuYY vRlJm indexOf bmnjo MZTuo win32 txqbi MZTuo MZTuo MZTuo hOxlQ PqxDK IynLr PqxDK OaZHU PqxDK 7fa24d PqxDK kutlr GUEJb 2b22 SYSNZ Elder ohffm RQVuz ohffm wOKnQ dXxvx ohffm txqbi cmYZk cmYZk cmYZk indexOf Xeon VEtuB vQOCS VEtuB RLWZm win32 uJHTX indexOf mFvma uJHTX indexOf odEqX lFEmr wOKnQ OJgfj TgEOT lFEmr oMqvv hkXLP indexOf odEqX lFEmr wOKnQ TgEOT lFEmr 6.1.7601 nDFfD indexOf mars-pc nDFfD indexOf KcYPl DwhkT win32 TgEOT DwhkT txqbi indexOf MlHqp nDFfD indexOf KcYPl wOKnQ OJgfj txqbi lDYgK indexOf ierUt dlDql indexOf NOUID 52c9 lDYgK wOKnQ OJgfj lDYgK txqbi 953225 UbKmV indexOf gqYyv vKEtT wOKnQ sTyFF indexOf SXRqR vKEtT vKEtT WhFBG wOKnQ sTyFF TgEOT indexOf SXRqR mLayk mLayk wOKnQ sTyFF TgEOT sTyFF indexOf SXRqR IxYCu IxYCu win32 sTyFF VSguD HlGSw txqbi HlGSw kBNWn UbKmV indexOf KcYPl nEsrh wOKnQ sTyFF LfGsX gWNiP indexOf ycHOs XcGWo sHUvT SUwUt sTyFF indexOf Xeon NexVx 4f81e3 NrJLC b75705 qsdRB wOKnQ izyeE LfGsX gWNiP indexOf 10.0 qsdRB EPZFi indexOf Xeon xFQlt LnXwb hgyPU amuCn win32 EPZFi gWNiP indexOf 10.0 rVelq indexOf DESKTOP amuCn amuCn GxoOM gGzUe 8920 BNcya 0cbc66 BNcya win32 OGaBa OplyY bsXXF bsXXF MpasZ twhrA PrZEi DMHFm FWCgY indexOf KcYPl vqsTK wOKnQ CGKrF indexOf qVeKo GZKFe IfKeA IfKeA yqeHm IamCt wwYdb IamCt FHZLU wOKnQ LfGsX NuLEx txqbi AcUpv TmEse WWqqV idFOW indexOf bmnjo tVxep IQSRE tVxep YLVAc XzLXZ wOKnQ mLHnv LfGsX wqYWU indexOf qVeKo gqLFD wqYWU indexOf gqYyv wOKnQ LfGsX wqYWU indexOf 10.0 PWqPD reDDx 804a tfAiZ tfAiZ wqYWU indexOf esdRV DLxEu indexOf frank tfAiZ wOKnQ dxeHF ZzHqA indexOf YhCCm ytlPV indexOf lYWqy wOKnQ vZrLN yorTa indexOf qVeKo tfAiZ yorTa indexOf esdRV hOxlQ tfAiZ OaZHU BTDnG wOKnQ BNHhk dxeHF BTDnG txqbi BTDnG 56d4 BTDnG d33e1f FduQa WjlTo FduQa win32 TmBUn fSLNY TQcJD indexOf 10.0 FduQa fOcYj fOcYj badfad TQcJD indexOf admin wOKnQ fYVdW indexOf 10.0 fOcYj fOcYj fOcYj MyUwo MLkXx indexOf lScgJ fOcYj win32 OhpGX indexOf qVeKo vOodx OhpGX indexOf esdRV vOodx evdUC vOodx 736b19 gvolL wOKnQ IJyIi UDZeI indexOf FljAk indexOf john doe jPIGo wOKnQ iPTYr YQAbA iPTYr AOfWw MYFbd MYFbd wOKnQ MYFbd MYFbd 10.0.19041 AOfWw cCJuT win32 mgBti oaTyP oaTyP ZkaLT GxoOM ZkaLT AOfWw ZkaLT wOKnQ SLMxE SQoOt indexOf esdRV SLMxE OETqg pKYtq OETqg wOKnQ indexOf qVeKo XbNCr indexOf TCjjX zTJdu indexOf bmnjo SPLlq indexOf RbIhh SPLlq indexOf yovNJ iQzdY win32 zTJdu igIzv SPLlq indexOf 6.1. SPLlq indexOf JFfTd SPLlq indexOf KcYPl iQzdY wOKnQ igIzv SPLlq indexOf dPBhX wxfZr indexOf esdRV ZXSIm indexOf lScgJ wOKnQ PzaDO QzCCC indexOf dPBhX GENLL indexOf VqmBh nATuz wOKnQ cuEDQ PHkyX GENLL indexOf DESKTOP GENLL indexOf QuKlu nATuz wOKnQ nATuz GENLL indexOf 6.1. GENLL indexOf work indexOf lScgJ zLVcT wOKnQ RTxcv indexOf qVeKo zLVcT Pnqtz indexOf hUDSQ tNFlg wOKnQ cuEDQ vpiXx MwGci indexOf dPBhX sNzfP indexOf ejaWn GvSrM wOKnQ wjhnX indexOf DESKTOP-JTAPJCC GvSrM wOKnQ sNzfP indexOf wOPpP wOKnQ PnIcj JcRqg indexOf yUcVP JcRqg indexOf LhpmB SoLTy win32 JcRqg indexOf dPBhX twVBR indexOf idYyV indexOf EHOHc wOKnQ PnIcj 6.1.7601 SoLTy twVBR indexOf administrator enNIK rlklG pOMRM eobOM 6adf97 eobOM wOKnQ 6.1.7601 eobOM eobOM twVBR indexOf ierUt JDEWF indexOf john SJjYK wOKnQ kFkYS indexOf qVeKo cuEDQ indexOf KVM/QEMU SJjYK 5d0c hyVCM rHLex zTWLI indexOf DESKTOP bemIU xSWIb wOKnQ cuEDQ PzZxF uIUrm AisJX FwnUm 6.1.7601 indexOf Xeon kFkYS indexOf NOHID indexOf administrator FwnUm wOKnQ cuEDQ QkGDF txqbi FwnUm FwnUm kdMjc rVsYs OSOTJ MAtVB indexOf KcYPl rVsYs wOKnQ tUBwb rVsYs txqbi VxASH OSOTJ jMwqE indexOf KcYPl VxASH win32 uOSNG VxASH txqbi HCpQJ MfCgH eJiKw indexOf lScgJ wOKnQ lqANN oIwve MfCgH txqbi eJiKw mrhHg indexOf admin MfCgH wOKnQ lqANN oIwve jeSqX hlAHR iBcng mrhHg indexOf esdRV mrhHg indexOf lScgJ OPZwG win32 oIwve OPZwG txqbi OPZwG caESR nQZDH caESR b445bf mrhHg indexOf PtUKi lXNOE wOKnQ ilPEe qiuQa txqbi zCpTU b445bf cvcbR indexOf lisa wOKnQ zCpTU txqbi UuzYs UuzYs KUqWm UuzYs 59a422 UuzYs wOKnQ ilPEe UuzYs UuzYs PGLwR wjhnX PGLwR 10.0.18362 ihTDq indexOf esdRV pFAWW indexOf PfBxU gwDFl wOKnQ iJPfn tKNdS gwDFl BGnnH wjhnX 10.0.18362 BGnnH ihTDq pFAWW indexOf esdRV pFAWW indexOf NOUID khrzn wOKnQ iJPfn tKNdS khrzn RknOE txqbi RknOE jDuYY JemeN ihTDq JemeN wOKnQ HQKdf tKNdS JemeN txqbi JemeN RyfVN xOeeU zexrv rXAwr indexOf lScgJ zexrv wOKnQ dAneF tKNdS zexrv zexrv waCPL 1cce9e pFAWW indexOf admin waCPL wOKnQ dAneF uNGnm 10.0.19044 ewPcI RyfVN ewPcI dMGnb dMGnb lmBTL pFAWW indexOf lScgJ peNVo wOKnQ dAneF tKNdS peNVo txqbi UHMKj xFQlt UHMKj UHMKj indexOf ierUt indexOf admin EIosP 709b pWjzB win32 dAneF pWjzB txqbi SixJj SixJj pFAWW indexOf esdRV pFAWW indexOf admin sFwFh wOKnQ dAneF pFAWW indexOf esdRV lAGQN 10.0.10240 lAGQN XGHnq win32 XGHnq QGHFO zTWLI EiXba EiXba EiXba indexOf esdRV mEfkA IAnzl mEfkA win32 AOwyf QGHFO zTWLI AOwyf pFAWW indexOf esdRV AOwyf wOKnQ dAneF dAneF indexOf bmnjo AOwyf 6.1.7601 HjWJp HjWJp HjWJp CfIMu HjWJp AisJX indexOf KcYPl nJMjV win32 nJMjV 10.0.22621 indexOf esdRV nJMjV 95deb5 QmHJg wOKnQ mCdyE indexOf Xeon QmHJg 10.0.19044 QmHJg QmHJg QmHJg indexOf NOHID aTzpo indexOf lScgJ QmHJg wOKnQ c23200 769fc7 QmHJg wOKnQ QmHJg txqbi QmHJg xzazH xzazH uTZci indexOf Xeon wOKnQ MjCcR VEuGm RLWZm MjCcR wOKnQ jBggA VusIu MjCcR txqbi wQfQm hcZkE zSbEj zSbEj bHvER zSbEj 2001f7 aTzpo indexOf administrator zSbEj wOKnQ VusIu eOAxl 6.1.7601 BifLz mkXXB HahpQ IXppR indexOf bmnjo aTzpo indexOf ierUt TUJOs indexOf PfBxU wlzLA wOKnQ CLtwI wlzLA txqbi wlzLA RzWAc CEMbW RzWAc WNSog TUJOs indexOf KcYPl Txmnz win32 CLtwI VusIu Txmnz GxoOM CEIek aVrIw DPKls DPKls 2293 VWzdE tAPlV HehuH SdaFn TUJOs indexOf ierUt indexOf PfBxU DqcXZ wOKnQ DqcXZ reDDx DqcXZ 3e45fc 46e6f8 wOKnQ aWxAi 6.3.9600 hlQtp yKTDB sqJUH HSBxH JnoEN wOKnQ Ylipn FEczF FEczF AsLyc 990d1b nOLAm tknXj copKe win32 copKe copKe Gcaig Kzaml b0f8e1 Kzaml 061613 Kzaml win32 VusIu Kzaml FgyMp Gcaig CkrEL FrKMN dvTNH PStAY VjhOw win32 KWhCU 6.1.7601 jdxSJ jdxSJ jdxSJ win32 CLtwI KWhCU txqbi jdxSJ jdxSJ tsLlx tsLlx mguvo tsLlx 2cb5a5 tsLlx nCKNH XkNhN wOKnQ lAlOf lAlOf GxoOM MCsAE MCsAE MCsAE lsXOS lsXOS lsXOS RkmLH qDPxC d6a5b0 RkmLH wOKnQ oMqvv nUGwN 10.0.19045 zCdVO zCdVO zCdVO zCdVO zCdVO PqpgM PqpgM win32 PqpgM Ylipn PqpgM PqpgM HYivK qspNU win32 LMbUR jeSqX qspNU qspNU Epcwk Epcwk yVKGQ Epcwk Epcwk wOKnQ AYTAV 6.1.7601 AYTAV AYTAV hqAFz RoxZF RoxZF yVKGQ wFkxv mZALZ RoxZF win32 LMbUR KWhCU 6.1.7601 HJyTD HJyTD Qpadm zZICf YShsQ sLMsc sLMsc gJVHt sLMsc win32 LMbUR 10.0.19044 KMoJp pFuOR bpZhy WGfHa jyCWZ WGfHa RcciA Yzsnk wOKnQ tqYCt Ylipn tqYCt tqYCt tqYCt oiXPc win32 GxoOM tqYCt SLxGD SFtHT wOKnQ tqYCt reDDx eqPSi KfNWh eqPSi eqPSi MeZiM win32 eqPSi reDDx Gbmst Gbmst KfNWh Gbmst YRpdJ win32 Ylipn YRpdJ WyPdx WyPdx YcWlG WyPdx win32 WyPdx Ylipn yJCTB yJCTB gljKu YcWlG UvxZM wOKnQ PpjoD zTWLI afTxu afTxu QfKqI ed6464 QfKqI wOKnQ LMbUR KWhCU zTWLI BgPQK qANtJ qANtJ hLsLp qANtJ wOKnQ LMbUR KWhCU qANtJ Ylipn qANtJ qANtJ ccdjE win32 qANtJ 6.1.7601 qANtJ WyGYv zoAmB WyGYv sXjhj WyGYv wOKnQ wjhnX YxMrB YxMrB HMiHJ wOKnQ HMiHJ reDDx VNyQm qbOoM qbOoM igIjd wOKnQ LMbUR KWhCU qbOoM GxoOM LiZLy lFtXC 2cd67e wOKnQ UCwoG KWhCU lFtXC txqbi UkXkh cCsnc YjNRL YjNRL YjNRL wOKnQ krMAl KWhCU GnbVY xFQlt GnbVY rxTdm rxTdm vOSpX Atbyd wOKnQ krMAl Atbyd txqbi VrSyH 3219 VrSyH Uhvot TMgET gHlLs TMgET win32 krMAl 10.0.19044 motbl KKqlz KKqlz KKqlz CRFUR KKqlz wOKnQ uKjAp GxoOM uKjAp 32b1d5 xLWTh Spamo jsncE wOKnQ uZyWb GxoOM PqZnP PqZnP vJLcK PqZnP lbUyM wOKnQ lbUyM GxoOM fZPkZ fZPkZ hjTWC 7e0c8b YowEu 7b7cd2 YowEu win32 YowEu 10.0.22621 qxFkv qxFkv qxFkv qxFkv oEvTt qxFkv wOKnQ mmvbu EjOeK 10.0.19044 yBhwg yBhwg yBhwg yBhwg sbJVy wOKnQ YGunJ tDags YGunJ YGunJ aqyRX aqyRX aqyRX qwUdt aqyRX wOKnQ bdEpY TYVYV txqbi aqyRX VxqBM VxqBM bHvER HaRRt indexOf KcYPl qagCE wOKnQ CbUqY 10.0.22000 CbUqY Uqxlo fnMEo CBzzl tjNuv epdyi vRsVX win32 xVSSc vKKnW aqspj indexOf brCLp gCKCe bhPMn bhPMn sZOkj SnJyu sZOkj oMtXB UgsNT wRjHC wOKnQ zggFl fyLsj MiufK 6.1.7601 MiufK MiufK MiufK CgRub pIrdn blyUe bdDoQ 18126e LdfwW win32 WMQSr fyLsj bdDoQ 6.1.7601 Aftgk sgKfH dJsJa WcnTu WcnTu win32 xmrrl fyLsj WcnTu CvUGy XuGVw XuGVw XuGVw lfNeg lfNeg bXjqw vdmOE iMEjv wOKnQ iMEjv YQAbA iMEjv jSvgh IjzEr HmraW HmraW HmraW loFzr yvqXs wOKnQ GxpwP yxdDY OWWfU Ylipn liNQb fBxWc fBxWc win32 ghmTb TQNmz fBxWc Ylipn fBxWc mGpuh ZeRjl yvxUY yvxUY wOKnQ sMqBS txqbi pmMbl pmMbl pmMbl YzwFD YzwFD KcfiC zFbdy qMncG wOKnQ zFbdy 10.0.22000 kEkhI JSQRc iKMKU iKMKU CqWjy NfVjJ iKMKU wOKnQ VshfD GxoOM GZOpC cJYUY YvCMk cJYUY 8726e3 YlZYa riWYq YlZYa wOKnQ OiDFD GxoOM vSSjG vSSjG vSSjG c037 vSSjG fjDRH vSSjG wOKnQ mbNcI oMqvv mbNcI mbNcI mbNcI zshdx mbNcI wOKnQ 10.0.22621 vNTCE GjeDH mrJUr iwadr DHMzD vduzl wOKnQ sMqBS IiDih IMTaL txqbi mdnfP mdnfP hgzrQ hgzrQ QmDdO kSUIG QmDdO Qxonm wOKnQ sMqBS kMuIm Qxonm zTWLI Qxonm SeYdN TEPOT TEPOT XIKtc wOKnQ dVExP GxoOM dVExP dVExP NLkTQ dVExP EOsEJ dVExP VuJWp qkOfr wOKnQ eFeRu qkOfr Ylipn ROjuM pTEED pTEED pTEED JdFCA sdiAI win32 sdiAI QGHFO ooGCo ooGCo qyMWr qyMWr SqONG HquHy SqONG etfRc vGitB wOKnQ Ylipn vGitB HOhAo ogVbg Fjlhj rDAWL wOKnQ rDAWL txqbi rDAWL ZgSAd jwlzB b71c NnPzd FWWTZ HzhTH cEMEI FBbDW wOKnQ ONnKw txqbi ONnKw ONnKw ONnKw uccwt ONnKw wOKnQ txqbi ONnKw ONnKw rNXLv OVQGA hOzWd YAQYg fauaw YAQYg BFGUZ YAQYg faaZg wOKnQ OVQGA hOzWd NgZej 6.1.7601 NgZej NgZej NgZej iIOCx VOGyw iIOCx iIOCx win32 iIOCx Ylipn iIOCx iIOCx PlxFg PlxFg PlxFg iLjCA YBKZM oHeij KNlSM oHeij wOKnQ ntezn hOzWd bcmDH txqbi bcmDH OsWDB OsWDB CSJBZ cGouA TUpkn kDgGj VpkJl nGjTa wOKnQ Ylipn jCTpZ jCTpZ lJaTJ lJaTJ 5a1d lJaTJ lJaTJ lJaTJ win32 jNTvB hOzWd lJaTJ jDuYY RSsda hOxlQ RSsda hrdvH hrdvH wOKnQ Ylipn hrdvH JKxhS hrdvH HjQeg EmVBb win32 jNTvB ZzMvo txqbi eCDvi eCDvi mgEPK pKLwt #56d4# ufkpW pKLwt win32 SLLtg QpjTd Ylipn QpjTd hEtQx kOKhh hEtQx CGGgh iVLGr YstWF Gzatl wOKnQ jNTvB gNsIX 6.3.9600 RJfIe dRVKa oThSy dRVKa wOKnQ VeJAu 10.0.17763 VeJAu Cdpvc gaDrZ rcHxI rcHxI afRTo uuCtj rcHxI wOKnQ USMMJ GxoOM USMMJ USMMJ OxOCp jUmDO AOoRO mkWZM 6eb45e mkWZM wOKnQ zTWLI oqxmY EhcHD jruAk YvCMk jruAk QAXUc mUvOb wOKnQ hIVVp 6.1.7601 AJDWJ gvFCN CSFGt pagbf jgMsQ Qulil GNyXU Qulil wOKnQ XNVBw 10.0.16299 XNVBw vVGZc DLghd yuUVM ekwvO ab86a1 dgIoj dc599a dgIoj wOKnQ Ylipn dgIoj fTjxS WPSom giQXt WPSom WPSom MQTZB mthYf wOKnQ hIVVp TZikQ YPlhm txqbi YPlhm YPlhm YPlhm b5a0 YPlhm BhUer jZFLv ovBQG wOKnQ ovBQG 10.0.18363 ovBQG RGqkv WWEBs WWEBs WWEBs RegIx WWEBs 8215e4 win32 OXSRo TZikQ WWEBs txqbi VQOPp VQOPp YmXTT kzEzS YmXTT 8fdf0b Mejsm Mejsm wOKnQ Mejsm Ylipn dCdCo dCdCo e2c5 veMHT 12a5b6 OXSRo veMHT veMHT wOKnQ iqiDQ txqbi xoTLC xoTLC VumwR VumwR XhxIo SnlyQ chyXo SnlyQ wOKnQ OXSRo MucFN 10.0.19045 MucFN MucFN dUvSP dUvSP Vvoau TOYmH SUrBC TOYmH OYYqJ wOKnQ kmZDH GxoOM kmZDH JiZzk GTZmc LaYno tniZQ LaYno VNREQ LaYno wOKnQ 10.0.19045 LaYno tzQFC fblzz XOyEg wOKnQ oxitq 10.0.17763 BTEHL GthtC tKUjH tKUjH gWNBR tKUjH a4757d wOKnQ TZikQ tKUjH RwsYn pKSDc tKUjH win32 OXSRo bjiGs reDDx UMBTw VKsfA rsxCS UMBTw RaEmi wOKnQ SrLta bjiGs EWeFS xFQlt EWeFS WmaXj IMqdQ IMqdQ VbBhV jBFwS wOKnQ YvJyz jBFwS ZgAvf daGmV ZgAvf xhiBQ win32 SrLta bjiGs xhiBQ txqbi KiOfb Twowq KiOfb LXKIp jgmCv UrPlO 39549c UI32LE UI16BE hex GUID UI16LE FTIME DTSTP STR16 undefined ysGls wtMvn oCrHv alloc writeUInt32LE UI32BE alloc writeUInt32BE UI16LE alloc writeUInt16LE axlKs alloc writeUInt16BE UI8 alloc writeUInt8 HEX from XCLpJ HEhqW split xVWjt oCrHv AILVX wPprS LpfBu FsrOy rKIIX LpfBu rKIIX HEX EUlVx HEX concat qhmKE VydvP szBvI YjhnQ xyWnd floor szBvI floor EUlVx oCrHv EUlVx oCrHv concat HpOAG cpsXo YjhnQ getFullYear cpsXo PPBNi getMonth cpsXo getDate EUlVx UI16LE ioVUo getHours ioVUo getMinutes floor getSeconds uvxWv UI16LE concat oyGPL alloc kvIzz length PdPXW length writeUInt16LE charCodeAt NDIjW bfKqW EkKJK jNIxk ONzTT ONzTT push jNIxk wtMvn EaIOJ statSync pf2 4|5|3|1|2|0 \.\ qkisN split substr substr FbEHm length XGEoj substr SHOxx substr length substr length Xlujb indexOf split join Xlujb indexOf \.\ split HFINk join STR16 6|4|5|1|11|12|2|0|3|8|10|7|9 aes-128-cbc C:\ reg.exe add HKCU\Software\SPoloCleaner Installed REG_DWORD object YCuOk SgUIV xsYSl nIJqC WRYbs tgWOX IKwVZ NDyra kguLW bTWDX max GUID 00021401-0000-0000-c000-000000000046 UI32LE FTIME UI16LE xwCeu UI8 20d04fe0-3aea-1069-a2d8-08002b30309d pNXPN DTSTP VPjRA mmdkI XzDJY vLyIO iUKcm VQbIo EhhBp EObrc length rCquB epJPo name name length name file file length file workdir workdir length workdir args args length args icon icon length icon now workdir NTooR pFBve workdir workdir workdir indexOf XLKmP workdir iHkLf icon WBvkA UI16LE length OZkKF hngwf file ItxlP ORXxL ORXxL file RFFcr file file indexOf tNtLV LziAx SjyYn ItxlP ZxIsW Nrytp MTHfr gQzry gQzry pLysj pslo aCPOK file Bssjy goFAZ goFAZ ktmr ktmr vIsHe file env ItxlP toLowerCase toLowerCase env RFFcr split flg flg flg flg SjUmT flg SjUmT name flg file flg SjUmT workdir flg SjUmT args flg SjUmT icon flg SjUmT att att file ItxlP gEctd agIGV pojfA OmwOn length 6|2|3|1|5|0|4 split push args args push pid session zgWjj ppid ppid push path path length path name att agful PmyqJ WFIzt writeFileSync readFileSync att shcm show ExiuK shcm show min agful show shcm UI32LE OZkKF LIzni kdtSE OZkKF GrKbF flg GrKbF att OZkKF FeKRy ftc ftc FeKRy fta fta FeKRy ftw ftw GrKbF fsz fsz TXSMJ GrKbF icidx icidx GrKbF shcm ksSdU UzOhb hky hky ksSdU UzOhb pHhwE GrKbF pHhwE UI32LE concat jXfjO cSewS flg JrUbH QesNU xwCeu log pHhwE UzOhb qywDh UI16LE qywDh vfvvV qywDh vfvvV LIzni xUATp length substr hUDlk YiBVH YiBVH UdCBr split TeIMz length writeUInt16BE concat update final FtQLR HfTHl randomBytes alloc zsiTz WwwYb taOax concat alloc concat from createCipheriv hIktG slice jlJrO UzOhb jlJrO vfvvV push from jlJrO UI8 push alloc LDIgS length mGnNr pNXPN aSzhS length from file veIPK TeIMz length jWXHK UzOhb vIsHe length NAxzb vfvvV Gzvav UI8 GrKbF Gzvav XNGPR ftw ftw UzOhb push vfvvV vfvvV Gzvav UzOhb Gzvav UzOhb Gzvav GrKbF XNGPR ftc ftc Gzvav DTSTP fta fta length UzOhb vIsHe vIsHe length vKjTG UzOhb vKjTG hngwf UzOhb UzOhb concat writeUInt16LE length push concat writeUInt16LE length push readdirSync VaNDj Isieg UI16LE concat length writeUInt16LE length jXfjO flg tawXX IEURW IEURW fromCharCode JjYKk RFFcr VPXhD name Isieg UzOhb length AiLoD hngwf WoUQa flg qeCwt EAVwe hiYun vIsHe tRGRc file JMOFI UI16LE length WNvWq STR16 XIEsM dVZct naxdZ SSyNn svduU tRsEX CmSNx flg KkTiY IYHoZ ydsii RGCpY MTHfr HfTHl tvhmF SapDz workdir FNhPl length UzOhb length hngwf FNhPl CmSNx flg qeCwt EDIms boKer args trim BbBuL UzOhb length hngwf log rYvcl jeJdF flg GNWWq HbgtV iaoeT icon BbBuL UzOhb length asxEv hngwf GxUnz ASRXd taOax tvhmF YMbGA rSHVZ HfTHl YMbGA length LvJyn GrKbF concat concat tpkCa jtkhM KUjPL writeFileSync pid SODzW MLanV MLanV outbuf outbuf push .exe \Microsoft\Windows\Start Menu\Programs\Startup\ .lnk vMTuL PBYDt xcXIv PBYDt xcXIv xcXIv aup MsDOb xcXIv MsDOb WcsWv tmp CVkUM CVkUM CVkUM jEgiU vApeZ vApeZ MsDOb VwzGn BZGWN BZGWN apd UGYXi kAHEz BZGWN HApKP dJrns NDvlt JBUqe fill mkdirSync gttk UI16LE STR16 appdata network service local service umfd- \networkservice\ windir systemroot allusersprofile temp aes-128-cbc Duo prsv carAS DILVK OtcVD wTaqv Urexc QFHyi nNTok log vsVmu pf1 pf2 RgVXJ vUVDr mkdirSync file existsSync resolve argv resolve argv bXvlD rsyNq log RlWVo AKWXz JNgoG statSync pf1 LQlQI xwfjI wTaqv args trim Whkii length mBFAc piMVq statSync CbAzL size size LQlQI wJYBb mlLWI writeFileSync pf1 readFileSync AVJnx AVJnx statSync pf1 8|5|6|9|7|0|3|10|11|4|12|1|2 split apd IAyJZ SuCRa isc usr isc isc usr toLowerCase eHCbF muexM zuxoL system zuxoL ldHxt NLlns substr BFiCB length prtfj indexOf dwm- LbClv indexOf XxDjl isc usr username isc tmp toLowerCase indexOf zwnse isc IAyJZ DvWqo pwONH MbCwj aup pWPBp roVvO isc tmp kLsej tmp isc isc tmp toLowerCase indexOf toLowerCase isc isc aup apd isc CbAzL size size HBRvq qveSB WLudC statSync pf2 s1e s1e LbClv dKBkJ HjjJj pf1 pf2 resolve pf1 resolve pf2 resolve argv resolve argv HgWgJ statSync CbAzL size size HBRvq lbpmW lbpmW readFileSync prs createDecipheriv ZYGIk slice slice concat update slice final parse toString writeFileSync pf2 readFileSync mmTZh ruoyk argxI statSync pf2 dZnsd size size basename pf1 basename pf2 argv join 2|3|6|7|0|5|4|1 split resolve argv pf1 pf2 resolve pf1 FCjDi FCjDi resolve pf2 resolve argv \Fonts\micross.ttf HDCrI hex Microsoft Root jjFxl uMarA mBJez ctPKT ctPKT gybja readFileSync length hXxbN length toString YaOLo from Washington1 toString YaOLo indexOf from NLZHt toString YaOLo SdGWp indexOf network service system umfd- 2|6|1|5|0|3|4 dINbJ length ISbZp weOJo vfayu usr toLowerCase izOTa knVWk sMdtd VMcfP lmLdz local service substr QgDuZ length indexOf dwm- ISbZp indexOf mWNSB isc CoTmw split push path path length path name session push args args wOIPN ppid ppid push pid test sha256 x64 20|9|10|0|21|30|18|1|14|23|19|7|25|2|8|3|12|5|11|17|29|22|26|16|27|15|31|6|24|28|4|13 USER PROCESSOR_ARCHITECTURE PROCESSOR_ARCHITEW6432 Unknown xnVgx rbiTg aWmzT ZMSEO msiexec.exe wlvxc ktcWV psls FBhGv cFONR FCbIE ercDx HJgCs HnksX Ghigw HJgCs xDqZu yIJro JFVnJ USERNAME vsKOW string vnJBS XmUhe NdMwr log cmuPs writeFileSync trim exit pid hdsfD ercDx YQZqj ppid ppid ercDx KbhGf ppid ppid radiU ppid ppid zbKon length length hdsfD hdsfD vnJBS UhMBJ UhMBJ hdsfD TaOuQ RAHFa fByuA ALKov jCfEd length WAhAp toLowerCase indexOf createHash vsimW update digest vnJBS mDLzW wlvxc env sfxname length basename toLowerCase mkdirSync vnJBS HfpLt HfpLt path path toLowerCase name name toLowerCase pid SSfvF indexOf WAhAp indexOf push KPHlf length VUXav aYbnE aYbnE WXwjc ThkgP wOGch ppid ppid wOGch ppid fGssx vsKOW ZazBX split freemem cusOv tmpdir UyURd length substr length substr hostname cwd platform arch rsCog GExuM versions node BdKzQ length cpus qtoPC kQQfs totalmem release xmUop string indexOf exJec length substr YymWK EcPpy length length model model trim speed speed lrVcT length substr QUeKr indexOf uptime lrVcT length substr XDPFz length log qvKfY FBhGv KBzEn 5|3|0|1|2|4 aes-128-cbc OannJ EeAcf EeAcf PeEQQ split createCipheriv PByjY slice slice concat update final writeFileSync prs randomBytes from stringify error MAAfC SfuFG 4|2|0|3|1 aes-128-cbc TmhYR oCqrL kWjcN out outbuf toString outbuf err errbuf toString errbuf dxVVm split concat update slice final createDecipheriv QYkVT slice slice parse toString readFileSync prs randomBytes pWdtj pWdtj pWdtj Xoyxe bYvkv UuDYB yTXHo UuDYB BWgSp Console Services mqzMz GrJTG JNuxJ lcjQl OKRvX jbKno pid session path BMOBG BOTIU JbNne TkBgx egWyc cmd.exe computername username u .exe liUhO OZjiZ DzLgG hMHWy C:\ rpcsrv LU0TO _i_ .txt tqyJm oRaqb hwv wfr atct argv indexOf GhmxR argv GhmxR AhsUX dWSuC argv piLfz ixvfR argv kTNDT LU0TO lzmGf BJGqB EVLvB unshift unshift unshift unshift oZRZb lzmGf rTelY rTelY readdirSync C:\ writeFileSync trim xBKmr indexOf rpcsrv bqAvm gWSaO ATJDN kTNDT userdomain kTNDT IJaFU xijmC push kTNDT eIeMZ eIeMZ eIeMZ iQlTi concat prototype slice call nUwpu OSJJn HMNrl xiaOs xiaOs xiaOs CIUjR apUOR tmpbuild ImDlx wDDLR OLXvl nZXgp CZKiM NmrkS readFileSync toString trim createDecipheriv concat update final toString nMcZU TgPJw log dhbah log jyJSS isc log sfre log VkpIB kTNDT prsf tpyWk undefined 0|4|1|3|2 aes-128-cbc UI16LE STR16 sbchn oUfLR TmdtE bfrin zdWKl TjGqe Rnjhk RjWbg eGTnN usdFQ KwuWn ixmNk LsCvg QhpWu fqBtY prsi 331db0 vTnTS GmiPU reg.exe add Installed REG_DWORD s1b nawPc base64 zEKzK log TyzUN gNbui now prs pslo jBVdr QeZdX HOyUo push now ata cta prs HIInR fjtaX HIInR iHCZf fjtaX GJGiy bfrin etGYj jBVdr HSwUi HSwUi wPDfR pslo rzgOn HfXqa prsi log NXPun rzgOn outerr outerr push jBeGB iNEHC iNEHC workdir sfiUv workdir workdir indexOf jBeGB workdir fjtaX log log Unpacking installer archive ... oKzuv oKzuv oKzuv jFUBw fjtaX jFUBw fnYAJ LgjdA ZAcsh ktmr fjtaX ktmr ktmr error fjtaX error error cEtNW code UVMOd cEtNW signal outbuf concat outbuf errbuf concat errbuf returnbuffer out outbuf toString outbuf err errbuf toString errbuf nostr out prs fjtaX prs exit argv fjtaX argv slice oKzuv jvjLc cGFnN zwXug resolve resolve dirname resolve jgCBP sep basename KbgmR fkfBc sep basename jvjLc jdmFa xzlym mkdirSync ITAnx split readFileSync prs concat update slice final parse toString createDecipheriv JVFzq slice slice wmRuD JZRnX workdir length oXkdH UI16LE length oXkdH STR16 writeFileSync readFileSync vTgMf uvPiK LwNzp name rmMda hcXwQ length LzBmv YcPqp writeFileSync readFileSync qwfYS qwfYS chdir msiexec.exe KnUDD length WJXxe toLowerCase indexOf LzBmv rUwou XwOxR fqBtY HZzuG file prsi log prsf tHyhr fkfBc prs prs log tbJjc prsi pIfkR FvITq Wgrwc HaQYs YXWZl lXacM mmXFi rDGSa HKCU\Software\SPoloCleaner Woljp sOwLA gNbui log nQnLB Wgrwc bShYH bShYH parse mlkaK from env LU0 CSAip toString fjtaX env LU0 LU0 s1e hMSkD zEKzK SwdCr att s1e s1e vrsav jMPLj 2|4|3|0|5|1 \.\ 0|182|114|90|64|119|20|178|146|188|130|88|65|128|8|80|141|113|39|75|69|150|139|135|30|4|2|52|161|166|171|163|42|26|13|98|133|58|140|70|63|148|66|7|167|162|56|180|117|155|17|29|25|181|27|118|108|132|41|46|74|35|156|21|174|18|96|170|71|168|158|123|53|6|38|31|112|32|106|77|19|165|116|16|1|138|48|33|10|... win32 3635 835669 AMAZING-AVOCADO harry johnson 10.0.19045 32b5 9f9d51 6.1.7601 Xeon a65640 5bc06f 10.0.22621 d38e35 86438b 10.0 10.0.18363 DESKTOP frank alexeyzolotov 2253 2293 e8c630 3f9b99 NOHID NOUID 10.0.17763 10.0.19044 1e75 b71c d04f74 2bf408 ed6464 KVM/QEMU 10.0.15063 2970 8e776c e32aca admin john doe 10.0.17134 10.0.18362 2088 e1e853 52acd9 a739 d60869 b6f4a2 10.0.19041 2a4494 f1dd 3219 9db1e4 93a77b cd4ee8 bac5dd 7fa24d 4b418f 10.0.14393 10.0.10240 4ed984 2652ee george a888 2001f7 administrator anna- 97a9d3 7c1a 8726e3 6.1. STRAZNJICA.GRUBUTT c8b63d 7b7bc2 990d1b 582a34 747890 joe smith a6f2 5b2e9c cc9adb 10.0.16299 13b4 ab86a1 dc599a 10.0.19043 11d4d6 2048 7bf5 2cb5a5 f3f0c6 56d4 10.0. b624 4b33b6 50ab44 9639a3 48fdf5 851c 061613 1285 abcf10 b3c775 9a50 275dec 10.0.10586 00181a a8776a e94c92 9ab4de f7e0fe 6f2958 john 10.0.22000 9d5196 user cc1a 88dba0 18275d dd15 6e6551 work Host1 41c07c 9ca5a0 #56d4# 62efb9 CompAlexey 95deb5 c23200 5a1d 6a29b3 10.0.19042 fb6ab4 3151 7f8794 351468 c589 611a3e cb0013 a98d efba14 930d8a 86131a gary-pc stark e2c5 12a5b6 46502a 6.3.9600 100 6.1.7600 a592e8 0b6631 101 9a8599 103 04159b 104 105 46e6f8 106 25cd40 59a422 107 26112 2988b8 108 my_pc_ 7e0c8b 7b7cd2 110 379a7d 111 f4cb33 112 7aed b445bf lisa 113 114 115 d61484 d0062c 116 1cce9e badfad 118 EPYC shadow- shadow 119 120 b0f8e1 436f 122 709b 8fdf0b 123 124 125 db9a51 64ca98 126 127 646a8b 128 55d8 129 130 131 033bd9 132 133 4f81e3 134 135 136 b4a2c8 137 73a080 138 AMD EPYC d580 140 8920 0cbc66 bf7e 35ae2e 142 143 62327b 144 299243 d1457b 145 f5faf7 146 a.monaldo 9f72 bd9ff1 148 e379b3 9114 150 64ccb5 151 6cfdbc 153 4b9de2 591acb 154 6bd1 bb2e4c 155 736b19 156 157 158 160 161 mars-pc 162 953225 164 c39efd 165 166 167 peter wilson 168 5d0c bc54f4 169 170 6adf97 171 52c9 172 f6b8ae 3322 bca236 174 DESKTOP-JTAPJCC 175 0bd650 8215e4 24889e bot 115 W7 Xeon H 24889e U 18126e 177 72f6c0 178 570a90 179 d6a5b0 180 181 182 183 f2886f 184 185 4085c6 187 188 azure- 7db39b USERNAME USER PROCESSOR_ARCHITECTURE PROCESSOR_ARCHITEW6432 string tMmRw dhGKD x64 lKlTM yQDdW platform arch release uptime totalmem freemem Unknown hostname VZqYa idSob sHZmf cwd tmpdir versions node nbHAL AcCtl VbDAa azdBu CpsNZ JVceZ indexOf xqFrf CpsNZ indexOf dsyBa aNzbi ocvFp RlsXt split GapCT substr substr BlpAi indexOf split join GapCT substr UUljf length substr CMjzo length tLMfk indexOf \.\ split FUbbJ join hXNeY length gWWFG substr sWeAk cpus length DImtG WGFzi HeuOR length model model trim speed speed Lzixn split isArray AUbDo length odIMu FSKfS tLMfk pSHKR 10.0.19044 IBAWU vjOlO IBAWU IBAWU gIRRP KlWaI Szogp indexOf admin ZgCqf FSKfS indexOf gqaAo indexOf oPiBj ZgCqf win32 ZgCqf srfIE DhyQU DhyQU wGjYi rRBiX Fsnqg Fsnqg vGVQY Fsnqg IHdus FSKfS tLMfk pSHKR FkxTb tWLhi FkxTb WhGWJ WhGWJ indexOf ehdwW jrSMs hlNce jrSMs GkjfI eihce FSKfS hEUwT viKhe hEUwT hEUwT 3a83fe OssTp hEUwT FSKfS tLMfk hNudB tWLhi EbyJF EbyJF EbyJF EbyJF iCOZc Szogp indexOf admin FSKfS Szogp indexOf CUuad EbyJF ZNXbv 804a PUutZ indexOf GtQWV Szogp indexOf DSQFA PUutZ FSKfS VIbla indexOf CompAlexey indexOf TgRyA PUutZ win32 tLMfk hNudB viKhe PUutZ KnDui sNiyA hrKOS dmmVc sNiyA DhnAZ VIbla indexOf XPRMU indexOf aKUSD mfwOh FSKfS XUNbj dONxl XUNbj vEwcq zpqwv zpqwv VIbla indexOf GtQWV zpqwv ODYWO wjbHu FSKfS GZkDJ cjnHS tWLhi cjnHS XJXZA MGEiF MGEiF bzjfd rtqsH MGgPi YdQDO dIpGe FSKfS dIpGe vEwcq WqQJv lOmAf FSKfS tLMfk GZkDJ indexOf hxpOt fQkPm fQkPm FSKfS tLMfk hQkQb hstMP scqiz TCjvb PLiny HKhnV SquIZ FSKfS gSJzQ HKhnV 10.0.19045 CYJJH FjoDe fzLoE FSKfS snhWX FjoDe dqiiZ dqiiZ 1cce9e VIbla indexOf bAljC dqiiZ FSKfS gSJzQ JyXNj XaMEI indexOf bea-chi lDxZf indexOf qVcGl koPbi FSKfS gSJzQ JyXNj CsVCz indexOf janusz- indexOf janusz FSKfS JyXNj koPbi FoYMV fvJPK TEAcc ASYFW xQJZB bBQyt indexOf GtQWV bBQyt indexOf NOUID ASYFW win32 LcRBe HHWAY qPSPq 6.1.7601 eFeJI FSKfS FoYMV bBQyt indexOf DESKTOP-JTAPJCC IpHrO FSKfS IpHrO 10.0.19045 tHgMR XERcQ tOzDw fwqIF tOzDw win32 LcRBe JyXNj tWLhi tOzDw tOzDw tOzDw tOzDw tOzDw tOzDw bPxOi tOzDw wQkte 75c891 tOzDw FSKfS MqCLe 10.0.19045 JDXNL JDXNL JDXNL ZYLmU b7e24d nCjsD pmejy FSKfS LPCym JjpOx JjpOx hbijd jAOEZ pQZzR SQRgD FSKfS tPmCS GMxJb indexOf hxpOt pRlJf pRlJf FSKfS 10.0.22000 bBQyt indexOf GtQWV mtZzm mtZzm mtZzm puiIn win32 mtZzm tWLhi mtZzm hzoIp hzoIp pxWhH KTvId pFXpZ KTvId uvcgt KTvId win32 BtaJZ BtaJZ ptexN ptexN jAOEZ SQRgD ptexN ptexN FSKfS ZkfOa tWLhi xgnhd xgnhd xgnhd ztDad XiPqu bzjfd adiZN XiPqu wEyku rleJq XiPqu 56aee3 2b22 WkTEe GQAbY GWBXy 74529b GWBXy win32 GMxJb cXpgv HKtlJ kkIRy HKtlJ QWEmT LClwc indexOf GtQWV LClwc indexOf admin FSKfS QWEmT 6.1.7601 b445bf indexOf lisa QWEmT FSKfS rRlrm cXpgv yScVN indexOf GtQWV OmjsR QWEmT Wwfql txlYw oVfDz win32 cXpgv tWLhi oVfDz xzPgN WRHCW hPnoJ uoYXt ETvDo FSKfS UcMtt indexOf CUuad ETvDo UcMtt indexOf yLDpl ETvDo win32 6.1.7601 ETvDo ETvDo ETvDo ETvDo win32 YCPJz aKKho ETvDo 6.1.7601 ETvDo ETvDo ETvDo xulTd XUrhd RHiYl indexOf PVirC XUrhd win32 nNygR aKKho XUrhd tWLhi XUrhd iCOZc UcMtt indexOf bAljC WySRe FSKfS nNygR indexOf EYknu LkFod QbPtQ BEbbs FSKfS qshQu 10.0.22621 qshQu kxxdH Ufiuf kxxdH PPnHe kxxdH cd4ec1 kxxdH win32 UcMtt indexOf nVASz UcMtt indexOf uMVPc sxhOU FSKfS fPxsV aKKho indexOf hxpOt sxhOU sxhOU itahV FSKfS fDIyo 6.3.9600 fDIyo bvcPR gPGfP FSKfS SaSHA srfIE SaSHA CbRge htFQG hvggJ vcKdu FSKfS hvggJ srfIE yRpey cIGLI cIGLI DcICd uPiUv 6e64 RvkHG eKhRJ FSKfS qadpw aKKho DcOoX indexOf GtQWV DcOoX indexOf UAWCf RvkHG FSKfS sOPYj tWLhi nmLlL qadpw aKKho QIvNT nmLlL FAeuP PgkDy PgkDy FSKfS tWLhi PCsOF hbgiT NXRoF DcOoX indexOf GtQWV indexOf bAljC NXRoF FSKfS rneSn ZNXbv azMOG azMOG gPwwW azMOG FSKfS oiIBY hzzKk tWLhi hzzKk ULzdt IAuXD IAuXD Aobyb Aobyb FSKfS Aobyb qiRBC DtTeb pqpTr pqpTr pqpTr uxHGG zbIEw OvPoI win32 qadpw oiIBY pqpTr sKdkG DcOoX indexOf harry johnson pqpTr win32 Yfszt pqpTr tWLhi mhKYp MtMmz pcxpc indexOf PVirC mhKYp FSKfS BPxQN tWLhi VofUt Ouenw wpvFK ircQS ircQS 16a7c1 ircQS 39549c ircQS FSKfS wwBaU tWLhi fzKLG djVaT XXqzy XXqzy CMqRc XXqzy Xmava kILnF WwQtg LhOcz win32 BPxQN uLTrO tWLhi KTKWu ZduZp ZduZp xzKuB ZduZp d33e1f 9ec750 QkWoJ FSKfS uLTrO SpmnU indexOf nXDHx rrgPu rrgPu rrgPu rrgPu GMfwZ ICzfl 03fea1 XZDYz mKFch XZDYz FSKfS BPxQN uLTrO indexOf 10.0 XZDYz dAQyI BPxQN indexOf ehdwW scqiz dAQyI rCwHg dAQyI oIuUx qQmWx FSKfS uLTrO qQmWx viKhe qQmWx 2cd67e CaEAQ FSKfS tWLhi CaEAQ nbEGm 092f16 bVGfm TBfms ANpYN FSKfS jeqXB dONxl jeqXB vEwcq jeqXB jeqXB indexOf GtQWV jeqXB FSKfS BPxQN uLTrO Yrpuz Yrpuz yZlTp HPeVH JAlVH oTmJQ JAlVH FSKfS bXBul indexOf 10.0 MEsVN MEsVN MEsVN MEsVN woTjD zRKiU InVTy xceZO InVTy win32 hUHjF uLTrO ePuIO NVyKy IxaSn ftfjl FSKfS ftfjl ftfjl bXBul indexOf NOHID NRCTX indexOf aKUSD vyeDA jAOEZ Kslxh dvHOs NjAUu 3151 uxpVo IJpLW QYtMM MbbVC qFney uxpVo 129654 DDVjM MbJpi FSKfS hvXwA erIrS indexOf CUuad MbJpi AQvcl NRCTX indexOf izbdo MbJpi FSKfS lplwk viKhe lplwk NlzaL sWSxL WVqdE a30c 6eb45e FSKfS WVqdE XfEER WVqdE WVqdE lyLvO WVqdE FSKfS hvXwA hvXwA indexOf Xeon indexOf Host1 NRCTX indexOf jXbcm win32 WVqdE fgWJN pqvcf 0fdc jqsNq Sexjq YbVEB RgqXH svAIT yrdCE indexOf PVirC win32 lcSnM 6.1.7601 tnRlu soElN indexOf XPRMU yrdCE indexOf izbdo TwzfF win32 ItmsL erIrS EgqjP srfIE EgqjP yzEEy yzEEy bzmsJ bzmsJ ntbrC ntbrC win32 ntbrC tWLhi ntbrC cGHIr ynBtJ VHBbL XSJXx icVYq indexOf administrator XSJXx FSKfS XSJXx indexOf nVASz indexOf mHsQq NuMbA indexOf bAljC XSJXx win32 ItmsL erIrS indexOf Xeon NuMbA indexOf LWtaX gimIP indexOf jXbcm win32 ItmsL tWLhi XSJXx XSJXx XSJXx lLJhu XSJXx zOKOi FSKfS ItmsL erIrS qkLiM fcdHf XTUjJ 10.0.17134 bMSFC 10.0.18362 XErIb xQJZB puEZF indexOf GtQWV HgrGR indexOf aKUSD FSKfS ItmsL ykCPu 6.1.7601 COKUY COKUY jFHrz cAGGa VXKcj VXKcj win32 ykCPu VXKcj tWLhi aXthL aXthL nAaYe aXthL OlmiC kceOG win32 indexOf StAIO HgrGR indexOf alexeyzolotov dzXDJ FSKfS dzXDJ 10.0.22621 uMesz indexOf DESKTOP IHLxG Mbdtt hkzOg FSKfS hkzOg mUDSv 769fc7 zVhEj FSKfS srfIE zVhEj CvnJD CvnJD zORjW ehkaA ehkaA FSKfS uhbpG ykCPu 10.0.19044 ehkaA ehkaA tgCmN e06b tgCmN QvLuw tgCmN FSKfS uhbpG LEiEM tgCmN 6.1.7601 LpJZS IMtCt viPSy viPSy FSKfS viPSy NKgqS viPSy viPSy viPSy mrLQo LdiZI gNsqx BgQBW win32 zRgPL cIKUx vEwcq xvQnI FhntQ QQxhn 4f5cec QQxhn FSKfS QQxhn QQxhn QQxhn dvHOs 6.1.7601 DaUAD KbAer KbAer Sjanm uMesz indexOf NOHID PJuww indexOf aKUSD FSKfS 10.0.18363 grARF XNDtK tKZBT FSKfS VtFUM NVyKy COivL pJtTP COivL FSKfS VtFUM uhbpG indexOf Xeon tWLhi COivL COivL COivL CDSof ufpFe ESeYe PJuww indexOf PVirC ufpFe win32 ufpFe TgcZz ufpFe GkjfI AWGuO win32 XfEER Dmpyj pCjuM Dmpyj lYTNX Dmpyj QGqGm Dmpyj win32 rCCjw 6.1.7601 rCCjw rCCjw rxUtd indexOf ehdwW pqrld FSKfS Bqaek ZZvHV tWLhi DCIBl DCIBl DCIBl DCIBl XgiGl rDJci FSKfS XgiGl indexOf 6.1. indexOf gZWKl PJuww indexOf ggWMN XgiGl FSKfS XgiGl srfIE OXBnW Xxoyr Xxoyr PzXjd Xxoyr fbANB Xxoyr gKTni win32 rxUtd Bqaek gKTni 6.1.7601 gdHgh PJuww indexOf administrator FSKfS yEgqm wrOMG yEgqm yEgqm BOCJW 72e748 BOCJW ykMmN BOCJW FSKfS AGJDl KYZAU UojgD qsGlk VvJrJ xDQew orLtz xDQew bbWEH ALyXe nIzTD FSKfS AGJDl WoKDp vEwcq WoKDp WoKDp knmqG Jmnnc UgfhK 102 admuw FSKfS AGJDl KYZAU oJosd srfIE oJosd cIqie 471915 SfPLC acjLM FSKfS AGJDl KYZAU OaMyT 6.3.9600 LtKce LtKce gnvQF YMlet nBQhT FSKfS fqmLw viKhe fqmLw JxtWI JxtWI JxtWI JxtWI 5fd4c0 hGYbx JxtWI FSKfS JxtWI ZNXbv JxtWI 3e45fc wsuFD vapSc UiBgL PXVTC FSKfS PXVTC 6.1.7601 PXVTC PXVTC udMtf MwoNu PUdaa ETkeF MwoNu FSKfS AGJDl XTliu MwoNu ZNXbv MwoNu zhkEY xiSWN MwoNu wENzy MwoNu FSKfS PJuww indexOf nVASz gpkzf indexOf fpsZk NbZJa indexOf PVirC 109 FSKfS iwjhz viKhe CIGfN hAhCj xSsfE DvUsX nYtks oSPLx FSKfS puNKz oSPLx tWLhi RHABd RHABd xulTd qDyJT BhalZ sHgTo indexOf PVirC eaylx GeGGj FSKfS XTliu vEwcq GeGGj fsZks LgDqi HAXrV FSKfS HqPas tWLhi HAXrV GcYsO GcYsO hPPpm MVigM PryfN kzrbV indexOf gzVpU hyMut MVigM win32 MVigM MVigM FQvHv indexOf EYknu Ndrny 97a9d3 vjEJa ZBuQz FSKfS 9a50 ZBuQz IxaSn OLYrg pJtTP zTTSR OLYrg FSKfS AhtAg ToYdt bbJOw JCguA CQWHf IJCWx FSKfS NwpOt FFcub ylKcQ tWLhi vjOlO AvIsm iOOzU ZWToJ indexOf bAljC 117 dTWnk FSKfS ZoQbj nAAQV FQvHv indexOf 10.0 IUwEY FQvHv indexOf admin EmSMF dTWnk FSKfS bhGdY indexOf CUuad indexOf pZFwd URBSP indexOf ehdwW vVyjV indexOf LuZEb CyDcr indexOf DXJez xVYYd dTWnk FSKfS HdGNu dTWnk IxaSn 351468 tSNmH dTWnk win32 bjEyM tZzap dTWnk yqCKI yqCKI 851c UqBJN dUZek oTmJQ 121 UqBJN FSKfS iSpuk 10.0.19043 ADwtv BFREI OOWhj vnrOv nehXo wpFpg nsjgr qClEH FSKfS tZzap tWLhi qClEH qClEH eBOwS eBOwS vLFWq ZPqVO qtsTK ZPqVO fuvFL aetbW FSKfS bjEyM tZzap aetbW tWLhi aetbW aetbW aetbW leSnm 11d4d6 indexOf PVirC nJYIY PQrIW FSKfS bjEyM TLaif 10.0.19045 FaamG FaamG FaamG FaamG VmLOG SXyqu FSKfS 10.0.22621 JPqCI ujqRj TQqZX UjxLZ LTLRj TQqZX win32 PTtTT 10.0.22621 PTtTT 32b1d5 c350 ihuUi PTtTT FSKfS viKhe PrIZr PrIZr e717 PrIZr CVDEm STMaJ ZRuhd win32 bjEyM CVDEm CVDEm tWLhi CVDEm OmjsR afYWs zrjjP umxAG indexOf XPRMU BGahd indexOf aKUSD viZwn afYWs FSKfS YRvpw tZzap afYWs TEAcc afYWs bzjfd uQQih uQQih pvNCr sPJzT win32 indexOf XPRMU pLRSm indexOf jXbcm FghRi RgAgz yWbwy 10.0.18362 SwDlc tWLhi XEReh QcYXN win32 YRvpw tZzap QcYXN 10.0.19044 QcYXN OXywN UrFyp TkGuJ LVUJR FiYTb FSKfS NLRaH lFOzB IDlPQ indexOf nVASz indexOf GtQWV indexOf bAljC oLNDR FiYTb FSKfS UVwcl IDlPQ indexOf 6.1 FiYTb tOAcI indexOf ehdwW tOAcI OoXQf whzYU b75705 LJfZM dLvgL whzYU FSKfS aBJxf leLVD indexOf GtQWV indexOf bAljC DFffT DFffT TEAcc oCKHI indexOf ehdwW gVhGP FSKfS DFffT viKhe DFffT c037 DFffT lVQkI oAssO AKKsi FSKfS gLXVS WoMHv tWLhi eemFW eemFW IjoFg b5a0 IjoFg MonDK qoDev FSKfS gLXVS UVwcl NiVdS tWLhi NiVdS fHwRj scqiz fHwRj YttRT Fjxrk indexOf XPRMU PiUYx indexOf bAljC HRJPP vLFWq 139 HRJPP FSKfS wKjSL indexOf CUuad HRJPP PkCpg msBUY gLXVS indexOf ehdwW ocmBe indexOf nzKHg UmJHb OmjsR vgovA 10.0.19044 PiUYx indexOf NOHID PZByE xulTd PZByE 7e73 PZByE 70b4 PZByE XFKVa lKqTC indexOf PVirC zTbKQ bWbKp FSKfS ocmBe PGdrD YWKpk indexOf 10.0 indexOf GtQWV viKhe hgntz guLnQ hgntz XgSqn 141 hgntz FSKfS ocmBe hgntz 10.0.19044 hgntz pZKsH FOTls ppjTo FOTls d8716f SzPYK FOTls FSKfS OfNVf GnJCx MCgeD 10.0.19043 srfIE cNSHl cNSHl LUZqy eyIea Aulip Aulip ZhIJR QfXgm ZhIJR FSKfS 10.0.17763 ZhIJR uHdqC a4757d DiAvR IxHEW FSKfS 10.0.17763 QfZhb zhkWp BPoKL pCtTn ZkIca pCtTn rygtq DQEjN ATvpo FSKfS ATvpo tWLhi Ziwsn abblD mTLhi abblD f94649 dPBFM abblD FSKfS pCdHX indexOf lRDUN 6.1.7601 indexOf Xeon 147 SozfR FSKfS SozfR 10.0.17763 Kpbsm Kpbsm YeiFw Kpbsm xhkDb HQXCq FSKfS kATsh pCdHX 6.1.7601 Kpbsm Kpbsm IPagF indexOf ehdwW Roqnv 72c1f0 149 lrNLf FSKfS kOKMn srfIE kOKMn kOKMn qXyFM lGJLM bf0760 UGrNT Qvpvl lGJLM FSKfS pCdHX ArnTB HvXVL dabON 2be941 10.0.19045 IPagF indexOf ehdwW TRfet dabON win32 yFtEL pCdHX eWdrO srfIE eWdrO eWdrO 6d05 zREQg MnvsZ qbIeZ b38e56 152 qbIeZ win32 UyzXk qbIeZ tWLhi qbIeZ kqpvN UyzXk indexOf ehdwW indexOf XPRMU YWKpk indexOf aKUSD dbEXT kqpvN win32 uFvqA vEwcq uFvqA uFvqA 7c1a QBUAn YEIXT RLAhR LEPFv XykuT FSKfS pCdHX YCDdG tWLhi HmgRV jpVIx jpVIx zuSGA rYxYW d864df rYxYW AGWuK jEEbF lVVwZ FSKfS YWKpk indexOf CUuad lVVwZ CPJPt indexOf GtQWV 77bd YvtaE MjxiZ LuXjT FSKfS eFngB CaBhz CPJPt indexOf nVASz OeQkM indexOf goatuser bCfNX Fplgl win32 eFngB TSvTM eFngB indexOf Xeon hLKqf vEwcq hLKqf oVRYW indexOf XPRMU indexOf bAljC jyJsm oVRYW FSKfS eFngB oVRYW 611a3e OycgS 6.1.7601 OycgS OycgS indexOf ehdwW rhzYF indexOf XPRMU xYmcL indexOf PVirC 159 BKjUk FSKfS uThgR 10.0.18363 uThgR tRUSM XNDtK aff8 kyuVx oJTUP FSKfS nGSRl 10.0.19041 tqGex tqGex tqGex LcbNQ d76211 zFqrH LcbNQ FSKfS eFngB tALtw UXZdk 6.1.7601 gfEPs indexOf gibzZ CUuTD indexOf PVirC FeMnE FSKfS PaaYM nZZZz indexOf CUuad cpZrF iBySg indexOf GtQWV iBySg bzjfd bac5dd 163 AQoke FSKfS XSwwF aHLLe AAGBJ tWLhi DGwdR OAXws indexOf izbdo oRgXH AAGBJ FSKfS srfIE AAGBJ OxXqc OxXqc mBGKw OHvBM IrrxH UKvEp win32 KOEyZ mqXpc 6.1.7601 TEAcc mqXpc xQJZB fCwck mqXpc win32 XSwwF jhnfp tWLhi VdgDX indexOf art-pc VdgDX indexOf PVirC gWXEt mqXpc FSKfS lMXSD jhnfp QJTsT indexOf dillon QJTsT indexOf bQwdS rknZt lnqWK FSKfS indexOf CUuad lMXSD indexOf hxpOt lnqWK JZOOF lnqWK GuGvk vEwcq QJTsT indexOf GtQWV GuGvk fFLXS LAcnR ShpBM FSKfS viKhe MXDhi MXDhi 32b1d5 CWZAI MwuyI FSKfS CWZAI tWLhi RpqKG RpqKG QJTsT indexOf PVirC oKwMT zORjW ndZEL btsDN FSKfS lMXSD UFprb oKwMT tWLhi oKwMT uakzP indexOf XPRMU QJTsT indexOf aKUSD uakzP bOAsm fYesx FSKfS tWLhi uakzP uakzP yLmsU wTZRB yLmsU 173 yLmsU win32 jqvBy viKhe jqvBy jqvBy rwuNT SxAHR jYoQs JROdf mgEEB 723943 Mlajo mgEEB FSKfS indexOf UywYP vcrhJ FSKfS uoSeW ZNXbv uoSeW uoSeW fnxRB fnxRB eWKSZ fnxRB gLgnp 176 FSKfS yljgY hjGtt tWLhi voeBo LNOoD LNOoD GHAhW GHAhW KSMMH GHAhW 18126e dyGjH Wmeph GHAhW FSKfS GHAhW srfIE GHAhW GHAhW WquKi oqYJi aMJRn win32 txTju qiRBC txTju BdKOJ IQEgg FSKfS TKYXy viKhe jzLzK jzLzK jzLzK jzLzK sFUZO NiWoI yXyEI 167bfe OllaZ NmKDp EyRmg WauZZ FSKfS FvQGf dsyBa indexOf CUuad WauZZ IUwEY indexOf bAljC whUbC FSKfS WauZZ tORzn cRxNW 10.0.22621 DHSFp SQRgD bwMwc hplyp DHSFp FSKfS dAwhf obalA tWLhi obalA obalA obalA e8b9 obalA fca565 sEgVG BkIgP BkXHi FSKfS sEgVG srfIE sEgVG jonbl yXtSs oqYJi wZgEj lFiiL rhDjo FSKfS rhDjo srfIE rhDjo NKrvH NKrvH NKrvH RlwQo 186 NKrvH FSKfS NKrvH 10.0.17134 ygxgV vrcqG pLNev FSKfS JVceZ RAzhD scqiz RAzhD 5803c5 FRhHy RAzhD FSKfS dAwhf indexOf uFKQz indexOf azure zNhkC tWLhi zNhkC JVceZ indexOf ehdwW 189 GxSrl FSKfS srfIE GxSrl b1a8 XCsgH RBPuN 190 XCsgH FSKfS XCsgH 10.0.14393 pikQp mGeqI NTAhU bPxOi azdBu AUbDo length vyQqK length substr pcSgW length substr length substr pcSgW length substr hwrME length substr tJDkk createHash XRaPu sRbSH sRbSH statSync createHash sha256 update uKLZw digest slice JFPuF JFPuF 5|2|4|1|0|10|6|8|12|3|11|7|9 aes-128-cbc Vojzf split concat from writeUInt16BE randomBytes nJMAd alloc wVfPB concat update final nJMAd Xtpfg length createCipheriv aUNjO slice concat alloc IHHRR XXAtb createHash ASkOG 8|5|0|9|4|10|7|2|1|3|6 aes-128-cbc FnKdv SjUqZ PFDhX PFDhX gXUQf split lNmuZ readUInt16BE concat update slice final slice toString readUInt16BE slice createDecipheriv vbLxk slice xcQqx length XZfsS LAEnB length createHash sha256 update tRSPX digest slice dJWBv now random recv OUhtG SFAET log PSolI tkstp sha256 pjRxQ VAhMe PxtkI lKDXR JwGSF dxLLN gttk uIsTb test PIQYS SBfqV createSocket udp4 message udwSr sLtCS wEfkX mkdirSync log gttk KAPox realW XwpCb now WAZIJ exit mSsEx WCLRD igJnZ tiBIK tiBIK tiBIK length argv split join stringify ViQqP WCLRD length NUWbj Lpwkb log epmJZ Gvhvd oRIow oRIow env sfxname length basename toLowerCase writeFileSync trim exit isc udwSr awZCN upaGX readFileSync toString trim yInMN RqMbs error PyToS tkstp Gvhvd PBhyL PBhyL createHash WVOTa update createHash digest slice ALLJg ffpct KomzX oUqet statSync pf1 RoXbx fdJUF Gvhvd usEOW usEOW 0|2|4|1|5|3 split RoXbx tkstp mSsEx log recv close send length aes-128-cbc uYzRH eshYJ length from hex RnCGJ Bxraz MAekm createDecipheriv concat update final toString UKbMF 10|7|2|0|8|5|4|6|1|9|3 split readUInt16BE createDecipheriv enSwS slice RvYyg BpYDI length concat update slice BpYDI final slice readUInt16BE slice toString VnVfQ FiVzA length UI16LE 1|4|3|6|0|5|2 wevcm SYGdf TZIWR uZoZm vwKWt ZueTB KfiLZ wevcm jpWbh close jBZWU qKTMB lbYVC log CLiSB KJjQK file xeNuJ zAfca length ueJFr STR16 ZueTB yLzbt sCmfO ywRSC split length push yDqTC yDqTC GgGSf pid name rYVtq ppid ppid jpWbh UVHnY wKBbQ NnAJl vwKWt log dujAG cInqT HGFPM Iavpx qKYiW KXsES uncaughtException base64 ini from from IZSVB TCIxD dujAG writeFileSync pf2 readFileSync alloc alloc izoFR izoFR kill fill allocUnsafe allocUnsafe TSPjC VLepj FnXHK EqsOU ATHkJ QwcjX NiXCL RJSan pslo lRiaz OPIZl zRAiu versions node indexOf uerepl CNyRK CNyRK uerepl strry removeAllListeners vUKzz HmmRk bJTYV YfSkA log stack log stack floor taRHS jyyxo pop writeFileSync pf1 readFileSync length WxAjQ length length exit from dQvUC log Ajtdb UnKoJ log isc isc QhNNy sceZT | |||||||||||||||
| 2616 | wmic process get processid,parentprocessid,name,executablepath,commandline /format:csv | C:\Windows\System32\wbem\WMIC.exe | — | faehelyy.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
639
Read events
639
Write events
0
Delete events
0
Modification events
Executable files
3
Suspicious files
4
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\eljgycclue.dat.3 | — | |
MD5:— | SHA256:— | |||
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\gfpyuhvgk.dat | executable | |
MD5:60051B6744A21A75CAA38D2FA827769F | SHA256:E7A8298E3BBB92B3FE0E8F9992F5CC49222AA3D643AD91235F21E3CFC69D76D7 | |||
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\bybwrwgaelm.bat | text | |
MD5:24E177FC30F4073048F402D717A7F147 | SHA256:C88026E200B77E68615CBFBCAE61BD52CBA7B68BC8A3FC4284C5556FC9A27530 | |||
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\eljgycclue.dat | binary | |
MD5:69691C7BDCC3CE6D5D8A1361F22D04AC | SHA256:08F271887CE94707DA822D5263BAE19D5519CB3614E0DAEDC4C7CE5DAB7473F1 | |||
| 1988 | faehelyy.exe | C:\ProgramData\BuqiqDcX\wdAwBlWFrp | binary | |
MD5:EB88707602717B81861C3F19CD47EDC4 | SHA256:D9655FCF34A7856DA96635B2537D06CBAED347164C0BD04B7837C14E549BC681 | |||
| 1988 | faehelyy.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WiKBpHuKisI.lnk | binary | |
MD5:E5739B2751118DF98FCAD754073CCEB1 | SHA256:72B3272D10A093893BF4D24EAD383DAD6BE9D80C5B1C681E81B4C96B0B782770 | |||
| 1988 | faehelyy.exe | C:\ProgramData\BuqiqDcX\VTWyiceoiV | text | |
MD5:14FC3BD3D72AA309A5FB6F4E769D0CAF | SHA256:4DC2333D6853B10046802D22A501B6ED7FD55A74B3A89A58D8A7CEC675DA03EA | |||
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\lvncaqofh.dat | text | |
MD5:14FC3BD3D72AA309A5FB6F4E769D0CAF | SHA256:4DC2333D6853B10046802D22A501B6ED7FD55A74B3A89A58D8A7CEC675DA03EA | |||
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\eljgycclue.dat.2 | binary | |
MD5:500BA63E2664798939744B8A8C9BE982 | SHA256:4EBC21177EE9907F71A1641A0482603CED98E9D43389CAC0FFB0B59F7343EEBA | |||
| 1368 | 65ef2eef1ccf3146b44010406a235cb7.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\eljgycclue.dat.1 | text | |
MD5:158B365B9EEDCFAF539F5DEDFD82EE97 | SHA256:39561F8AF034137905F14CA7FD5A2C891BC12982F3F8EF2271E75E93433FFA90 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
2
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2656 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1988 | faehelyy.exe | 172.67.184.100:18223 | 61c73c03380316965576823230004611db11e14b53635001cce9e0221232f.aoa.aent78.sbs | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
61c73c03380316965576823230004611db11e14b53635001cce9e0221232f.aoa.aent78.sbs |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1088 | svchost.exe | A Network Trojan was detected | ET MALWARE [ANY.RUN] Lu0bot-Style DNS Query in DNS Lookup M1 |
1088 | svchost.exe | A Network Trojan was detected | BOTNET [ANY.RUN] Lu0bot DNS Query M1 |