Analysis
- max time kernel
280s - max time network
298s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 17:02
General
- Target s2.exe
- Size 770.0MB
- Sample240125-vkeyqsbbh3
- SHA256 ddb2ab0e9897b57abc9e1c96a439e4c00be2e6ef45562506af8f2407331ac064
Score
10/10
Malware Config
Extracted
Family
-
stealc
C2
-
http://185.172.128.24
Attributes
-
url_path
/40d570f44e84a4�4.php
rc4.plain
Extracted
Family
-
djvu
C2
-
http://habrafa.com/test2/get.php
Attributes
-
extension
.cdtt
-
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
- payload_url
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0845OSkw
rsa_pubkey.plain
Extracted
Family
-
smokeloader
Botnet
-
pub3
Extracted
Family
-
amadey
Version
-
4.12
C2
-
http://185.172.128.19
Attributes
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
rc4.plain
Extracted
Family
-
redline
Botnet
-
24k
C2
-
91.92.245.15:80
Extracted
Family
-
risepro
C2
-
193.233.132.62:50500
Extracted
Family
-
redline
Botnet
-
LogsDiller Cloud (Telegram: @logsdillabot)
C2
-
45.15.156.60:12050
Extracted
Family
-
smokeloader
Version
-
2022
C2
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
rc4.i32
rc4.i32
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 13 IoCs
- Detected Djvu ransomware 5 IoCs
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 8 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Formbook payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Contacts a large (792) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates new service(s) 1 TTPs
- Downloads MZ/PE file
- Stops running service(s) 3 TTPs
- .NET Reactor proctector 15 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Modifies file permissions 1 TTPs 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 24 IoCs
Detects Themida, an advanced Windows software protection system.
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 4 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Launches sc.exe 18 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Program crash 37 IoCs
- Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\s2.exe"C:\Users\Admin\AppData\Local\Temp\s2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\GuardFox\n8lts3wu3LEK31H_8scS0swh.exe"C:\Users\Admin\Documents\GuardFox\n8lts3wu3LEK31H_8scS0swh.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\IEUpdater574\IEUpdater574.exe" /tn "IEUpdater574 HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\IEUpdater574\IEUpdater574.exe" /tn "IEUpdater574 LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\IEUpdater574\IEUpdater574.exe"C:\ProgramData\IEUpdater574\IEUpdater574.exe"4⤵
-
-
-
-
C:\Users\Admin\Documents\GuardFox\JW8JVK3h2UKJp3Mga4JfrDPi.exe"C:\Users\Admin\Documents\GuardFox\JW8JVK3h2UKJp3Mga4JfrDPi.exe"2⤵
-
-
C:\Users\Admin\Documents\GuardFox\tutjpA9F7ey1Qilb1V2axRiZ.exe"C:\Users\Admin\Documents\GuardFox\tutjpA9F7ey1Qilb1V2axRiZ.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 3403⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\GuardFox\jU7SJ07UicWF7hD0MaZuy4mY.exe"C:\Users\Admin\Documents\GuardFox\jU7SJ07UicWF7hD0MaZuy4mY.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Documents\GuardFox\jU7SJ07UicWF7hD0MaZuy4mY.exe" & del "C:\ProgramData\*.dll"" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5924 -s 23643⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\GuardFox\QWeM4i6raY5Hi6jGEd2QFH85.exe"C:\Users\Admin\Documents\GuardFox\QWeM4i6raY5Hi6jGEd2QFH85.exe"2⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s KVE~767O.KG -U3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\SO8uK9Sp2tKWtWgD2eBltM6S.exe"C:\Users\Admin\Documents\GuardFox\SO8uK9Sp2tKWtWgD2eBltM6S.exe"2⤵
-
-
C:\Users\Admin\Documents\GuardFox\QQw5SFBO7t77B3jDUdWt8lSr.exe"C:\Users\Admin\Documents\GuardFox\QQw5SFBO7t77B3jDUdWt8lSr.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-L6FK0.tmp\QQw5SFBO7t77B3jDUdWt8lSr.tmp"C:\Users\Admin\AppData\Local\Temp\is-L6FK0.tmp\QQw5SFBO7t77B3jDUdWt8lSr.tmp" /SL5="$7021C,6434705,337408,C:\Users\Admin\Documents\GuardFox\QQw5SFBO7t77B3jDUdWt8lSr.exe"3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\GjtKAmOQqOXlDAbTCFnU40uH.exe"C:\Users\Admin\Documents\GuardFox\GjtKAmOQqOXlDAbTCFnU40uH.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\h8JVvbxopEQSIIcJxn_r.exe"C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\h8JVvbxopEQSIIcJxn_r.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc823b46f8,0x7ffc823b4708,0x7ffc823b47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13354385603861284690,15003466240795696997,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:15⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/login4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc823b46f8,0x7ffc823b4708,0x7ffc823b47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,5869664984242584907,9721453986783170696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,5869664984242584907,9721453986783170696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:25⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc823b46f8,0x7ffc823b4708,0x7ffc823b47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,10952870413389283843,2005136854693400141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 /prefetch:35⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9991900077285983046,2363093535801731692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:35⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/login4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc823b46f8,0x7ffc823b4708,0x7ffc823b47185⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,18072916294253413203,1765599729463325459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:35⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffc823b46f8,0x7ffc823b4708,0x7ffc823b47185⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1960 --field-trial-handle=2028,i,12064770790383997706,7823112598127460262,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=2028,i,12064770790383997706,7823112598127460262,131072 /prefetch:25⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/login4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc72e89758,0x7ffc72e89768,0x7ffc72e897785⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1912 --field-trial-handle=1948,i,1527621679058514605,12473658403978102727,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1948,i,1527621679058514605,12473658403978102727,131072 /prefetch:25⤵
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc72e89758,0x7ffc72e89768,0x7ffc72e897785⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4592 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4840 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3944 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:15⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:25⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4692 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:85⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5128 --field-trial-handle=1928,i,5868315499484849610,828339526587506877,131072 /prefetch:85⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="708.1.35756523\454901518" -parentBuildID 20221007134813 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff025545-1fc5-47e6-bef7-c5ef3223b9cc} 708 "\\.\pipe\gecko-crash-server-pipe.708" 2436 232703ef258 socket6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="708.2.628374538\1600509942" -childID 1 -isForBrowser -prefsHandle 3468 -prefMapHandle 2924 -prefsLen 21668 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffcd6668-542e-4ced-9059-ee4a70478603} 708 "\\.\pipe\gecko-crash-server-pipe.708" 3464 23274632958 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="708.3.452445957\1036058701" -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23c392fa-6818-480c-8a62-95a7d37868bb} 708 "\\.\pipe\gecko-crash-server-pipe.708" 3916 23263c2db58 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="708.4.667003886\1815394424" -childID 3 -isForBrowser -prefsHandle 4724 -prefMapHandle 4720 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77a35555-90c8-436a-9dc7-d45949c35e37} 708 "\\.\pipe\gecko-crash-server-pipe.708" 4736 23275970458 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="708.5.1665713384\792737824" -childID 4 -isForBrowser -prefsHandle 4944 -prefMapHandle 4888 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec479983-0074-4703-b8e7-33f8eb8a68ae} 708 "\\.\pipe\gecko-crash-server-pipe.708" 4932 232769d2e58 tab6⤵
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/login5⤵
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\4U5oN8ynaIMYFPuZ8Xpz.exe"C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\4U5oN8ynaIMYFPuZ8Xpz.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F5⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000583001\store.exe"C:\Users\Admin\AppData\Local\Temp\1000583001\store.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000609001\stan.exe"C:\Users\Admin\AppData\Local\Temp\1000609001\stan.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000612001\TrueCrypt_NyNIUi.exe"C:\Users\Admin\AppData\Local\Temp\1000612001\TrueCrypt_NyNIUi.exe"5⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"6⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"6⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"6⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe"6⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"6⤵
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe"6⤵
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000617001\moto.exe"C:\Users\Admin\AppData\Local\Temp\1000617001\moto.exe"5⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "FLWCUERA"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000617001\moto.exe"6⤵
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 37⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "FLWCUERA"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000622001\leg221.exe"C:\Users\Admin\AppData\Local\Temp\1000622001\leg221.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000623001\latestrocki.exe"C:\Users\Admin\AppData\Local\Temp\1000623001\latestrocki.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 3527⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 3727⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 3767⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 3927⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 6807⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 6927⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 6927⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 7487⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 7567⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 7727⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 8247⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 6607⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 8847⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 8047⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 3368⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 3528⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 3528⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 4048⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 6728⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 6728⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7208⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7288⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 7328⤵
- Program crash
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rty25.exe"C:\Users\Admin\AppData\Local\Temp\rty25.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\FirstZ.exe"C:\Users\Admin\AppData\Local\Temp\FirstZ.exe"6⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force7⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart7⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart8⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "WSNKISKT"7⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 07⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 07⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 07⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 07⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "WSNKISKT"7⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog7⤵
- Launches sc.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000624001\crypted.exe"C:\Users\Admin\AppData\Local\Temp\1000624001\crypted.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000625001\2024.exe"C:\Users\Admin\AppData\Local\Temp\1000625001\2024.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000626001\alex.exe"C:\Users\Admin\AppData\Local\Temp\1000626001\alex.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"7⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"7⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 38⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000627001\rdx1122.exe"C:\Users\Admin\AppData\Local\Temp\1000627001\rdx1122.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc72b19758,0x7ffc72b19768,0x7ffc72b197788⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1956 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4460 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4028 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:18⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5244 --field-trial-handle=1884,i,12425335401544110283,5897065034745467891,131072 /prefetch:88⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000628001\gold1201001.exe"C:\Users\Admin\AppData\Local\Temp\1000628001\gold1201001.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 5527⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000629001\installs.exe"C:\Users\Admin\AppData\Local\Temp\1000629001\installs.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 6646⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 11006⤵
- Program crash
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\_mq5QkEoHyRX1Tz9EBfc.exe"C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\_mq5QkEoHyRX1Tz9EBfc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\49YgtRVnm44zkHTi8Sly.exe"C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\49YgtRVnm44zkHTi8Sly.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\ENVq517tiOWBsKOTmr8V.exe"C:\Users\Admin\AppData\Local\Temp\jobA4ziPtO5hAClfMZ\ENVq517tiOWBsKOTmr8V.exe"3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\hpyyixkRm6Wny8XDpx52VFFK.exe"C:\Users\Admin\Documents\GuardFox\hpyyixkRm6Wny8XDpx52VFFK.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\WinTrackerSP\WinTrackerSP.exe" /tn "WinTrackerSP HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\Documents\GuardFox\w5Lf1N4ErTFYfCw1MdICIKF3.exe"C:\Users\Admin\Documents\GuardFox\w5Lf1N4ErTFYfCw1MdICIKF3.exe"2⤵
-
-
C:\Users\Admin\Documents\GuardFox\rn57asznEP_ooX3h_4l7PyoD.exe"C:\Users\Admin\Documents\GuardFox\rn57asznEP_ooX3h_4l7PyoD.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\Z_aNIQGQvDICmgvUH1CicY9e.exe"C:\Users\Admin\Documents\GuardFox\Z_aNIQGQvDICmgvUH1CicY9e.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH1\MPGPH1.exe" /tn "MPGPH1 LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 13804⤵
- Program crash
-
-
-
-
C:\Users\Admin\Documents\GuardFox\LIt9vu_JfOkv1gObfODgn5vc.exe"C:\Users\Admin\Documents\GuardFox\LIt9vu_JfOkv1gObfODgn5vc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 9723⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\GuardFox\rQXZgMqhos5xuslx24PhY0rG.exe"C:\Users\Admin\Documents\GuardFox\rQXZgMqhos5xuslx24PhY0rG.exe"2⤵
-
-
C:\Users\Admin\Documents\GuardFox\wGltadLuoDTS0V2cHtWka4dO.exe"C:\Users\Admin\Documents\GuardFox\wGltadLuoDTS0V2cHtWka4dO.exe"2⤵
-
C:\Users\Admin\Documents\GuardFox\qemu-ga.exe"C:\Users\Admin\Documents\GuardFox\qemu-ga.exe"3⤵
-
-
-
C:\Users\Admin\Documents\GuardFox\TQQ0xmPBCt_xVf6bm5xuslyp.exe"C:\Users\Admin\Documents\GuardFox\TQQ0xmPBCt_xVf6bm5xuslyp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\msvcp_win\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\msvcp_win\UniversalInstaller.exe3⤵
-
C:\Users\Admin\AppData\Roaming\msvcp_win\UniversalInstaller.exe"C:\Users\Admin\AppData\Roaming\msvcp_win\UniversalInstaller.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe"C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe"2⤵
-
-
C:\Users\Admin\Documents\GuardFox\p65tzIrYYt1dXE8eGE1C8a0j.exe"C:\Users\Admin\Documents\GuardFox\p65tzIrYYt1dXE8eGE1C8a0j.exe"2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc72b19758,0x7ffc72b19768,0x7ffc72b197784⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2896 --field-trial-handle=1704,i,800700162255148476,2695259915063331389,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1704,i,800700162255148476,2695259915063331389,131072 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1704,i,800700162255148476,2695259915063331389,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1704,i,800700162255148476,2695259915063331389,131072 /prefetch:84⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 --field-trial-handle=1704,i,800700162255148476,2695259915063331389,131072 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1704,i,800700162255148476,2695259915063331389,131072 /prefetch:84⤵
-
-
-
-
C:\Users\Admin\Documents\GuardFox\yzzuLArvtRtf4YRRZrW8wLXz.exe"C:\Users\Admin\Documents\GuardFox\yzzuLArvtRtf4YRRZrW8wLXz.exe"2⤵
-
C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe"C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tpoyBHopaqQxso0Btt4FF7fE.exe /TR "C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe" /F4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\Documents\GuardFox\v45HMWE4NwLCcmbZT7FlI17g.exe"C:\Users\Admin\Documents\GuardFox\v45HMWE4NwLCcmbZT7FlI17g.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 6004⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 9884⤵
- Program crash
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5940 -ip 59401⤵
-
C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe"C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe" -i1⤵
-
C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe"C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe" -s1⤵
-
C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe"C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe"1⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\5dc07894-4694-47cb-9696-420e2bcb5b96" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
-
C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe"C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe" --Admin IsNotAutoStart IsNotTask2⤵
-
C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe"C:\Users\Admin\Documents\GuardFox\bhwt2o5b1SvUwqu3qybySrSo.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 5684⤵
- Program crash
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5240 -ip 52401⤵
-
C:\Users\Admin\AppData\Local\Temp\726C.exeC:\Users\Admin\AppData\Local\Temp\726C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\726C.exeC:\Users\Admin\AppData\Local\Temp\726C.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7D2B.exeC:\Users\Admin\AppData\Local\Temp\7D2B.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 10003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5676 -ip 56761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5676 -ip 56761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2616 -ip 26161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5924 -ip 59241⤵
-
C:\Users\Admin\AppData\Local\Temp\9D85.exeC:\Users\Admin\AppData\Local\Temp\9D85.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 10122⤵
- Program crash
-
-
C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exeC:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1404 -ip 14041⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc823b46f8,0x7ffc823b4708,0x7ffc823b47181⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc72e89758,0x7ffc72e89768,0x7ffc72e897781⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1180 -ip 11801⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="708.0.664098056\2030547651" -parentBuildID 20221007134813 -prefsHandle 1864 -prefMapHandle 1848 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64386da5-3b92-47b5-ae03-c2784253c7f1} 708 "\\.\pipe\gecko-crash-server-pipe.708" 1956 23271608158 gpu1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\D530.exeC:\Users\Admin\AppData\Local\Temp\D530.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PLOGQ.tmp\D530.tmp"C:\Users\Admin\AppData\Local\Temp\is-PLOGQ.tmp\D530.tmp" /SL5="$20406,6135014,54272,C:\Users\Admin\AppData\Local\Temp\D530.exe"2⤵
-
C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe"C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe" -i3⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe"C:\Users\Admin\AppData\Local\Betasoft Sound Booster\SoundBooster.exe" -s3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6124 -ip 61241⤵
-
C:\Users\Admin\AppData\Local\Temp\2D63.exeC:\Users\Admin\AppData\Local\Temp\2D63.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3CC6.exeC:\Users\Admin\AppData\Local\Temp\3CC6.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 3482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4912 -ip 49121⤵
-
C:\Users\Admin\AppData\Local\Temp\435E.exeC:\Users\Admin\AppData\Local\Temp\435E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\47F3.exeC:\Users\Admin\AppData\Local\Temp\47F3.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x474 0x4901⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\60FA.dll1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\60FA.dll2⤵
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\6fcd292fd77f48b7b88d4cd897f8fdab /t 6320 /p 68961⤵
-
C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exeC:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3008 -ip 30081⤵
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exeC:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe1⤵
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
-
C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"3⤵
-
C:\Windows\system32\conhost.execonhost.exe4⤵
-
-
-
-
C:\Windows\system32\conhost.execonhost.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 212 -ip 2121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5276 -ip 52761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5276 -ip 52761⤵
-
C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exeC:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7420 -ip 74201⤵
-
C:\Users\Admin\AppData\Roaming\rcaifbgC:\Users\Admin\AppData\Roaming\rcaifbg1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 2282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 7420 -ip 74201⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1044 -ip 10441⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 7420 -ip 74201⤵
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exeC:\ProgramData\wikombernizc\reakuqnanrkn.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
-
C:\ProgramData\wikombernizc\reakuqnanrkn.exe"C:\ProgramData\wikombernizc\reakuqnanrkn.exe"3⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7420 -ip 74201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3740 -ip 37401⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exeC:\Users\Admin\Documents\GuardFox\tpoyBHopaqQxso0Btt4FF7fE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exeC:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3740 -ip 37401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3740 -ip 37401⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
IPTV Channel Browser 6.6.exe
mozglue.dll
nss3.dll
103621DE9CD5414CC2538780B4B75751
ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
103621DE9CD5414CC2538780B4B75751
A65DBECD82A40019E873CE4ED0A79570
ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C
SoundBooster.exe
SoundBooster.exe
SoundBooster.exe
settings.dat
the-real-index
the-real-index
1787341fc8c7e0f3b6ff771c627be1fe
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5937c0.TMP
index.txt
index.txt
index.txt
index.txt~RFe59143a.TMP
CURRENT
MANIFEST-000001
the-real-index
the-real-index
the-real-index~RFe593791.TMP
the-real-index~RFe5b79a1.TMP
edb38fa2-1802-4ed0-8c51-711a81fed4f4.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
settings.dat
Local State
Local State
Local State
store.exe
stan.exe
TrueCrypt_NyNIUi.exe
leg221.exe
latestrocki.exe
crypted.exe
2024.exe
alex.exe
gold1201001.exe
installs.exe
288c47bbc1871b439df19ff4df68f076.exe
31839b57a4f11171d6abc8bbc4451ee4.exe
cached-microdesc-consensus.tmp
cached-microdescs.new
F59E91F8
FirstZ.exe
InstallSetup7.exe
InstallSetup9.exe
KVE~767O.KG
KvE~767O.Kg
Protect544cd51a.dll
__PSScriptPolicyTest_2yosvbjp.0qa.ps1
_iscrypt.dll
_isdecmp.dll
_isdecmp.dll
_shfoldr.dll
QQw5SFBO7t77B3jDUdWt8lSr.tmp
QQw5SFBO7t77B3jDUdWt8lSr.tmp
information.txt
information.txt
screenshot.png
information.txt
passwords.txt
3b6N2Xdh3CYwplaces.sqlite
8ghN89CsjOW1Login Data For Account
D87fZN3R3jFeWeb Data
UPG2LoPXwc7OWeb Data
oOPEmFmu_xsJCookies
02zdBXl47cvzHistory
02zdBXl47cvzcookies.sqlite
4U5oN8ynaIMYFPuZ8Xpz.exe
ENVq517tiOWBsKOTmr8V.exe
_mq5QkEoHyRX1Tz9EBfc.exe
h8JVvbxopEQSIIcJxn_r.exe
l6w3NVXsgpmDCookies
o0qT3dWYBP7ZHistory
INetC.dll
rty25.exe
toolspub1.exe
clip64.dll
cred64.dll
data.safe.bin
34bd89f7-4cd3-4fec-bcc3-4990b314131f
c4658451-f050-44f5-b027-40c648831589
prefs-1.js
prefs.js
prefs.js
sessionCheckpoints.json.tmp
recovery.jsonlz4
sessionstore.jsonlz4
3870112724rsegmnoittet-es.sqlite
Logs.exe
olehps.exe
7zHPd52JCRvp6H7EEeZWzeF4.exe
FfObRUUuZA9snXO_6k96GmqP.exe
GjtKAmOQqOXlDAbTCFnU40uH.exe
GjtKAmOQqOXlDAbTCFnU40uH.exe
GjtKAmOQqOXlDAbTCFnU40uH.exe
JW8JVK3h2UKJp3Mga4JfrDPi.exe
JW8JVK3h2UKJp3Mga4JfrDPi.exe
LIt9vu_JfOkv1gObfODgn5vc.exe
LIt9vu_JfOkv1gObfODgn5vc.exe
LIt9vu_JfOkv1gObfODgn5vc.exe
LIt9vu_JfOkv1gObfODgn5vc.exe
OQJdtCu704hBxV_IzEG4wJPR.exe
QQw5SFBO7t77B3jDUdWt8lSr.exe
QQw5SFBO7t77B3jDUdWt8lSr.exe
QQw5SFBO7t77B3jDUdWt8lSr.exe
QWeM4i6raY5Hi6jGEd2QFH85.exe
QWeM4i6raY5Hi6jGEd2QFH85.exe
QWeM4i6raY5Hi6jGEd2QFH85.exe
SO8uK9Sp2tKWtWgD2eBltM6S.exe
SO8uK9Sp2tKWtWgD2eBltM6S.exe
TQQ0xmPBCt_xVf6bm5xuslyp.exe
TQQ0xmPBCt_xVf6bm5xuslyp.exe
TQQ0xmPBCt_xVf6bm5xuslyp.exe
TQQ0xmPBCt_xVf6bm5xuslyp.exe
Z_aNIQGQvDICmgvUH1CicY9e.exe
Z_aNIQGQvDICmgvUH1CicY9e.exe
Z_aNIQGQvDICmgvUH1CicY9e.exe
Z_aNIQGQvDICmgvUH1CicY9e.exe
bhwt2o5b1SvUwqu3qybySrSo.exe
bhwt2o5b1SvUwqu3qybySrSo.exe
bhwt2o5b1SvUwqu3qybySrSo.exe
bhwt2o5b1SvUwqu3qybySrSo.exe
hpyyixkRm6Wny8XDpx52VFFK.exe
hpyyixkRm6Wny8XDpx52VFFK.exe
hpyyixkRm6Wny8XDpx52VFFK.exe
hpyyixkRm6Wny8XDpx52VFFK.exe
jU7SJ07UicWF7hD0MaZuy4mY.exe
jU7SJ07UicWF7hD0MaZuy4mY.exe
jU7SJ07UicWF7hD0MaZuy4mY.exe
n8lts3wu3LEK31H_8scS0swh.exe
n8lts3wu3LEK31H_8scS0swh.exe
n8lts3wu3LEK31H_8scS0swh.exe
p65tzIrYYt1dXE8eGE1C8a0j.exe
p65tzIrYYt1dXE8eGE1C8a0j.exe
p65tzIrYYt1dXE8eGE1C8a0j.exe
p65tzIrYYt1dXE8eGE1C8a0j.exe
qAThGLCCM4z3Oq15KdUOVcXo.exe
qemu-ga.exe
rQXZgMqhos5xuslx24PhY0rG.exe
rQXZgMqhos5xuslx24PhY0rG.exe
rQXZgMqhos5xuslx24PhY0rG.exe
rQXZgMqhos5xuslx24PhY0rG.exe
rn57asznEP_ooX3h_4l7PyoD.exe
rn57asznEP_ooX3h_4l7PyoD.exe
rn57asznEP_ooX3h_4l7PyoD.exe
rn57asznEP_ooX3h_4l7PyoD.exe
tpoyBHopaqQxso0Btt4FF7fE.exe
tpoyBHopaqQxso0Btt4FF7fE.exe
tpoyBHopaqQxso0Btt4FF7fE.exe
tutjpA9F7ey1Qilb1V2axRiZ.exe
tutjpA9F7ey1Qilb1V2axRiZ.exe
tutjpA9F7ey1Qilb1V2axRiZ.exe
v45HMWE4NwLCcmbZT7FlI17g.exe
v45HMWE4NwLCcmbZT7FlI17g.exe
v45HMWE4NwLCcmbZT7FlI17g.exe
w5Lf1N4ErTFYfCw1MdICIKF3.exe
w5Lf1N4ErTFYfCw1MdICIKF3.exe
w5Lf1N4ErTFYfCw1MdICIKF3.exe
w5Lf1N4ErTFYfCw1MdICIKF3.exe
wGltadLuoDTS0V2cHtWka4dO.exe
wGltadLuoDTS0V2cHtWka4dO.exe
wGltadLuoDTS0V2cHtWka4dO.exe
wGltadLuoDTS0V2cHtWka4dO.exe
yzzuLArvtRtf4YRRZrW8wLXz.exe
yzzuLArvtRtf4YRRZrW8wLXz.exe
yzzuLArvtRtf4YRRZrW8wLXz.exe
yzzuLArvtRtf4YRRZrW8wLXz.exe
iOUPAPdUxmKbUpq.pdf
Registry.pol
gpt.ini
gpt.ini
memory/880-1035-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-7-0x00007FFC80000000-0x00007FFC80002000-memory.dmp
memory/880-1067-0x00007FFC91250000-0x00007FFC91445000-memory.dmp
memory/880-9-0x00007FFC80030000-0x00007FFC80031000-memory.dmp
memory/880-0-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-10-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-11-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-8-0x00007FFC8EA70000-0x00007FFC8ED39000-memory.dmp
memory/880-12-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-19-0x00007FFC91250000-0x00007FFC91445000-memory.dmp
memory/880-790-0x00007FFC80000000-0x00007FFC80002000-memory.dmp
memory/880-782-0x00007FFC90590000-0x00007FFC9064E000-memory.dmp
memory/880-6-0x00007FFC90590000-0x00007FFC9064E000-memory.dmp
memory/880-1010-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-1055-0x00007FFC90590000-0x00007FFC9064E000-memory.dmp
memory/880-13-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-564-0x00007FFC80010000-0x00007FFC80011000-memory.dmp
memory/880-1061-0x00007FFC8EA70000-0x00007FFC8ED39000-memory.dmp
memory/880-14-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-15-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-193-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-16-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-27-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-1-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-17-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/880-18-0x00007FF747D60000-0x00007FF748749000-memory.dmp
memory/1404-1068-0x0000000000400000-0x0000000000830000-memory.dmp
memory/2212-1065-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/2332-1032-0x0000000000400000-0x0000000000454000-memory.dmp
memory/2332-1058-0x0000000005540000-0x00000000055D2000-memory.dmp
memory/2332-1072-0x0000000005700000-0x000000000570A000-memory.dmp
memory/3492-971-0x0000000004F90000-0x000000000502C000-memory.dmp
memory/3492-979-0x0000000073F90000-0x0000000074740000-memory.dmp
memory/3492-924-0x00000000001F0000-0x00000000006CA000-memory.dmp
memory/3500-1006-0x00000000027B0000-0x00000000027C6000-memory.dmp
memory/3524-1036-0x0000000010000000-0x000000001026E000-memory.dmp
memory/3612-1120-0x0000000140000000-0x0000000140876000-memory.dmp
memory/3612-1107-0x0000000140000000-0x0000000140876000-memory.dmp
memory/3612-990-0x00007FFC91450000-0x00007FFC91452000-memory.dmp
memory/3612-994-0x0000000140000000-0x0000000140876000-memory.dmp
memory/3696-1003-0x0000000000CD0000-0x0000000001C83000-memory.dmp
memory/3696-1071-0x0000000000CD0000-0x0000000001C83000-memory.dmp
memory/4052-793-0x00007FF733340000-0x00007FF733392000-memory.dmp
memory/4224-1151-0x0000000000400000-0x0000000000D40000-memory.dmp
memory/4224-1019-0x0000000000400000-0x0000000000D40000-memory.dmp
memory/4224-1013-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
memory/5080-1074-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/5228-1000-0x00000000008E1000-0x0000000000973000-memory.dmp
memory/5228-1009-0x0000000002590000-0x00000000026AB000-memory.dmp
memory/5240-960-0x00000000001A0000-0x0000000000672000-memory.dmp
memory/5256-993-0x0000000005510000-0x0000000005760000-memory.dmp
memory/5256-1007-0x00000000052B0000-0x00000000054FE000-memory.dmp
memory/5256-1088-0x00000000052A0000-0x00000000052B0000-memory.dmp
memory/5256-1098-0x0000000073F90000-0x0000000074740000-memory.dmp
memory/5264-1026-0x0000000073F90000-0x0000000074740000-memory.dmp
memory/5264-896-0x00000000000E0000-0x0000000000162000-memory.dmp
memory/5264-1064-0x0000000073F90000-0x0000000074740000-memory.dmp
memory/5800-986-0x00007FF6ACB40000-0x00007FF6ACE21000-memory.dmp
memory/5820-1031-0x0000000005120000-0x000000000522A000-memory.dmp
memory/5820-1063-0x0000000004FB0000-0x0000000004FFC000-memory.dmp
memory/5820-1043-0x0000000004F50000-0x0000000004F8C000-memory.dmp
memory/5820-1140-0x0000000005000000-0x0000000005010000-memory.dmp
memory/5820-1109-0x0000000005330000-0x0000000005396000-memory.dmp
memory/5820-989-0x00000000005E0000-0x0000000000662000-memory.dmp
memory/5820-1025-0x0000000004EF0000-0x0000000004F02000-memory.dmp
memory/5820-1020-0x0000000005630000-0x0000000005C48000-memory.dmp
memory/5820-1096-0x0000000073F90000-0x0000000074740000-memory.dmp
memory/5844-1081-0x0000000000EC0000-0x0000000001708000-memory.dmp
memory/5844-1133-0x0000000075ED0000-0x0000000075FC0000-memory.dmp
memory/5844-1146-0x0000000075ED0000-0x0000000075FC0000-memory.dmp
memory/5844-1077-0x0000000000EC0000-0x0000000001708000-memory.dmp
memory/5844-1127-0x0000000075ED0000-0x0000000075FC0000-memory.dmp
memory/5844-1129-0x0000000075ED0000-0x0000000075FC0000-memory.dmp
memory/5844-1143-0x0000000075ED0000-0x0000000075FC0000-memory.dmp
memory/5888-1033-0x0000000000180000-0x0000000000663000-memory.dmp
memory/5888-787-0x0000000000180000-0x0000000000663000-memory.dmp
memory/5896-1039-0x0000000000400000-0x0000000000459000-memory.dmp
memory/5896-783-0x0000000000400000-0x0000000000459000-memory.dmp
memory/5904-830-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5904-1018-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5904-808-0x00000000005A0000-0x00000000005AB000-memory.dmp
memory/5904-1024-0x00000000005D9000-0x00000000005E7000-memory.dmp
memory/5920-992-0x0000000000400000-0x0000000000645000-memory.dmp
memory/5920-982-0x0000000000400000-0x0000000000645000-memory.dmp
memory/5924-881-0x0000000000400000-0x000000000062E000-memory.dmp
memory/5924-1053-0x0000000000400000-0x000000000062E000-memory.dmp
memory/5924-853-0x0000000000810000-0x0000000000910000-memory.dmp
memory/5924-871-0x0000000000790000-0x00000000007AC000-memory.dmp
memory/5940-1105-0x0000000000789000-0x0000000000797000-memory.dmp
memory/5940-923-0x0000000000400000-0x000000000043E000-memory.dmp
memory/5940-897-0x0000000000590000-0x000000000059B000-memory.dmp
memory/5952-977-0x0000000005130000-0x0000000005392000-memory.dmp
memory/5952-1005-0x0000000005130000-0x000000000538D000-memory.dmp
memory/5952-1125-0x00000000023E0000-0x00000000023F0000-memory.dmp
memory/5952-1069-0x00000000023E0000-0x00000000023F0000-memory.dmp
memory/5952-958-0x0000000005600000-0x0000000005BA4000-memory.dmp
memory/5952-1027-0x0000000005130000-0x000000000538D000-memory.dmp
memory/5952-1070-0x0000000005130000-0x000000000538D000-memory.dmp
memory/5952-1040-0x0000000005130000-0x000000000538D000-memory.dmp
memory/5952-997-0x0000000005130000-0x000000000538D000-memory.dmp
memory/5952-882-0x00000000053A0000-0x0000000005604000-memory.dmp
memory/5952-1060-0x0000000005130000-0x000000000538D000-memory.dmp
memory/5952-1015-0x0000000005130000-0x000000000538D000-memory.dmp
memory/6012-996-0x0000000000400000-0x0000000000537000-memory.dmp
memory/6012-1004-0x0000000000400000-0x0000000000537000-memory.dmp
memory/6012-991-0x0000000000400000-0x0000000000537000-memory.dmp
memory/6012-1174-0x0000000000400000-0x0000000000537000-memory.dmp