Analysis
- max time kernel
779s - max time network
791s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
05/06/2024, 12:26
Errors
General
- Target проверка.exe
- Size 94KB
- Sample240605-pmlw6sfd2v
- SHA256 8967ae806bc8107efcf7aa3b20e1604d0a0aef971cac4c35d4789f700beda4b3
Malware Config
Extracted
-
xworm
-
19.ip.gl.ply.gg:65468
-
speed-wheat.gl.at.ply.gg:65468
-
XWorm V5.2:123
-
Install_directory
%AppData%
-
install_file
Delta.exe
Signatures
- Detect Xworm Payload 2 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 39 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 9 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\проверка.exe"C:\Users\Admin\AppData\Local\Temp\проверка.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\проверка.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'проверка.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Delta.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Delta.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Delta" /tr "C:\Users\Admin\AppData\Roaming\Delta.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\oqvlrc.exe"C:\Users\Admin\AppData\Local\Temp\oqvlrc.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\start_dobrota.bat" "3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mbr.exembr.exe4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\sound.vbs"4⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroricons.exeerroricons.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\INVERS.exeINVERS.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazywarningicons.execrazywarningicons.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\crazyinvers.execrazyinvers.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\erroriconscursor.exeerroriconscursor.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\toonel.exetoonel.exe4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages2.vbs"4⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\messages.vbs"4⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x534 0x5301⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8e157ab58,0x7ff8e157ab68,0x7ff8e157ab782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3116 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4340 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4484 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4632 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4800 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1948,i,2286005920402884413,2761081770805982519,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level2⤵
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff6c67aae48,0x7ff6c67aae58,0x7ff6c67aae683⤵
-
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\SU.exe"C:\SU.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
-
C:\SU.exe"C:\SU.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\SU.exe"C:\SU.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\oqvlrc.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\crazywarningicons.exe"C:\Users\Admin\Desktop\crazywarningicons.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\erroriconscursor.exe"C:\Users\Admin\Desktop\erroriconscursor.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\crazyinvers.exe"C:\Users\Admin\Desktop\crazyinvers.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\mbr.exe"C:\Users\Admin\Desktop\mbr.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\mbr.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\erroricons.exe"C:\Users\Admin\Desktop\erroricons.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\Desktop\erroriconscursor.exe"C:\Users\Admin\Desktop\erroriconscursor.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\erroricons.exe"C:\Users\Admin\Desktop\erroricons.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\crazyinvers.exe"C:\Users\Admin\Desktop\crazyinvers.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Users\Admin\AppData\Local\Temp\oqvlrc.exe"C:\Users\Admin\AppData\Local\Temp\oqvlrc.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\start_dobrota.bat" "2⤵
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\mbr.exembr.exe3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\sound.vbs"3⤵
- Enumerates connected drives
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\erroricons.exeerroricons.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\INVERS.exeINVERS.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\crazywarningicons.execrazywarningicons.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\crazyinvers.execrazyinvers.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\erroriconscursor.exeerroriconscursor.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\toonel.exetoonel.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\messages2.vbs"3⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX1\messages.vbs"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x534 0x5301⤵
-
C:\Users\Admin\AppData\Roaming\Delta.exeC:\Users\Admin\AppData\Roaming\Delta.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
2024-05-16_16-29-19.png
SU.exe
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
data_1
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Secure Preferences
Local State
Local State
Delta.exe.log
SU.exe.log
powershell.exe.log
CurrentDatabase_400.wmdb
WMSDKNS.XML.bak
iconcache_idx.db
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
Log.tmp
INVERS.exe
crazyinvers.exe
crazywarningicons.exe
dobrota.mp3
erroricons.exe
erroriconscursor.exe
mbr.exe
messages.vbs
messages2.vbs
sound.vbs
start_dobrota.bat
toonel.exe
__PSScriptPolicyTest_y5qgjizf.z4f.ps1
oqvlrc.exe
Delta.exe
Delta.lnk
memory/364-203-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-193-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-198-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-199-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-200-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-202-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-201-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-191-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/364-192-0x00000260113B0000-0x00000260113B1000-memory.dmp
memory/532-184-0x0000000000400000-0x0000000000582000-memory.dmp
memory/2228-294-0x0000000001260000-0x000000000126C000-memory.dmp
memory/2228-1-0x00007FF8E4853000-0x00007FF8E4855000-memory.dmp
memory/2228-61-0x000000001D7A0000-0x000000001DCC8000-memory.dmp
memory/2228-60-0x000000001C410000-0x000000001C4C0000-memory.dmp
memory/2228-58-0x00007FF8E4850000-0x00007FF8E5311000-memory.dmp
memory/2228-57-0x00007FF8E4853000-0x00007FF8E4855000-memory.dmp
memory/2228-0-0x0000000000800000-0x000000000081E000-memory.dmp
memory/2228-56-0x00007FF8E4850000-0x00007FF8E5311000-memory.dmp
memory/2244-17-0x00007FF8E4850000-0x00007FF8E5311000-memory.dmp
memory/2244-12-0x00007FF8E4850000-0x00007FF8E5311000-memory.dmp
memory/2244-13-0x00007FF8E4850000-0x00007FF8E5311000-memory.dmp
memory/2244-14-0x00007FF8E4850000-0x00007FF8E5311000-memory.dmp
memory/2244-7-0x000002C6D6930000-0x000002C6D6952000-memory.dmp
memory/2736-510-0x000002BCF6290000-0x000002BCF63C4000-memory.dmp
memory/2736-511-0x000002BCF6830000-0x000002BCF6876000-memory.dmp
memory/2956-182-0x0000000000400000-0x0000000000582000-memory.dmp
memory/3128-185-0x0000000000400000-0x0000000000454000-memory.dmp
memory/3564-183-0x0000000000400000-0x0000000000541000-memory.dmp
memory/3616-133-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3796-82-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-80-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-78-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-74-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-72-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-79-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-81-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-73-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-83-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3796-84-0x00000288FD170000-0x00000288FD171000-memory.dmp
memory/3948-167-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3948-162-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3948-163-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3948-164-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3948-166-0x0000000002880000-0x0000000002890000-memory.dmp
memory/3948-165-0x0000000002880000-0x0000000002890000-memory.dmp
memory/4020-186-0x0000000000400000-0x0000000000454000-memory.dmp
memory/5060-181-0x0000000000400000-0x0000000000454000-memory.dmp