Malware Analysis Report

2024-09-11 05:42

Sample ID 240629-dyscjstall
Target H2 (2).exe
SHA256 d4d5d15a80019ad35455718f42d67ee828aa3a9fe7ed6433fb540d0182432c86
Tags
discovery evasion exploit trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d4d5d15a80019ad35455718f42d67ee828aa3a9fe7ed6433fb540d0182432c86

Threat Level: Known bad

The file H2 (2).exe was found to be: Known bad.

Malicious Activity Summary

discovery evasion exploit trojan

UAC bypass

Possible privilege escalation attempt

Disables RegEdit via registry modification

Modifies file permissions

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Program crash

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Defense Evasion
TA0005
Abuse Elevation Control Mechanism
T1548
Bypass User Account Control
T1548.002
Impair Defenses
T1562
Disable or Modify Tools
T1562.001
Modify Registry
T1112
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-29 03:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-29 03:25

Reported

2024-06-29 03:30

Platform

win7-20240220-en

Max time kernel

2s

Max time network

264s

Command Line

"C:\Users\Admin\AppData\Local\Temp\H2 (2).exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\H2.exe N/A
N/A N/A C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\Documents and Settings\V38X85K7V81L8YS3A17.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\MSOCache\P75J88Z0E64G2LN7D81.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\PerfLogs\L27B52A2L11N4YX2L57.exe N/A
N/A N/A C:\Program Files\G62B37Y2F62X5DP6O73.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\Program Files (x86)\O35S70Y0R72N5EC7D37.exe N/A
N/A N/A C:\$Recycle.Bin\V02X31P8S06N5NS7R48.exe N/A
N/A N/A C:\ProgramData\T42I71V5M21S7HU1D55.exe N/A
N/A N/A C:\Recovery\B15A23V2Z32H7IH1S00.exe N/A
N/A N/A C:\Users\V52M26K4H05C0VC5V83.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\Documents and Settings\U01R45U3P16E3XX8M31.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\O35S70Y0R72N5EC7D37.exe C:\H2.exe N/A
File created C:\Program Files\A06C73C8G47F7KU5F60.exe C:\H2.exe N/A
File created C:\Program Files (x86)\A06C73C8G47F7KU5F60.exe C:\H2.exe N/A
File created C:\Program Files\G62B37Y2F62X5DP6O73.exe C:\H2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\A06C73C8G47F7KU5F60.exe C:\H2.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 1740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 1740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 1740 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 2716 wrote to memory of 3024 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3024 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3024 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 3024 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3024 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3024 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3024 wrote to memory of 2560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 3024 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 3024 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 3024 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 3024 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 2716 wrote to memory of 2620 N/A C:\H2.exe C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe
PID 2716 wrote to memory of 2620 N/A C:\H2.exe C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe
PID 2716 wrote to memory of 2620 N/A C:\H2.exe C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe
PID 2716 wrote to memory of 2620 N/A C:\H2.exe C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe
PID 2620 wrote to memory of 2212 N/A C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe C:\H2.exe
PID 2620 wrote to memory of 2212 N/A C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe C:\H2.exe
PID 2620 wrote to memory of 2212 N/A C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe C:\H2.exe
PID 2620 wrote to memory of 2212 N/A C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe C:\H2.exe
PID 2716 wrote to memory of 2332 N/A C:\H2.exe C:\Documents and Settings\V38X85K7V81L8YS3A17.exe
PID 2716 wrote to memory of 2332 N/A C:\H2.exe C:\Documents and Settings\V38X85K7V81L8YS3A17.exe
PID 2716 wrote to memory of 2332 N/A C:\H2.exe C:\Documents and Settings\V38X85K7V81L8YS3A17.exe
PID 2716 wrote to memory of 2332 N/A C:\H2.exe C:\Documents and Settings\V38X85K7V81L8YS3A17.exe
PID 2212 wrote to memory of 1676 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 1676 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 1676 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2212 wrote to memory of 1676 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2900 N/A C:\H2.exe C:\MSOCache\P75J88Z0E64G2LN7D81.exe
PID 2716 wrote to memory of 2900 N/A C:\H2.exe C:\MSOCache\P75J88Z0E64G2LN7D81.exe
PID 2716 wrote to memory of 2900 N/A C:\H2.exe C:\MSOCache\P75J88Z0E64G2LN7D81.exe
PID 2716 wrote to memory of 2900 N/A C:\H2.exe C:\MSOCache\P75J88Z0E64G2LN7D81.exe
PID 2332 wrote to memory of 2740 N/A C:\Documents and Settings\V38X85K7V81L8YS3A17.exe C:\H2.exe
PID 2332 wrote to memory of 2740 N/A C:\Documents and Settings\V38X85K7V81L8YS3A17.exe C:\H2.exe
PID 2332 wrote to memory of 2740 N/A C:\Documents and Settings\V38X85K7V81L8YS3A17.exe C:\H2.exe
PID 2332 wrote to memory of 2740 N/A C:\Documents and Settings\V38X85K7V81L8YS3A17.exe C:\H2.exe
PID 1676 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1676 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1676 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 1676 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 2740 wrote to memory of 832 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 832 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 832 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 832 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 2900 wrote to memory of 2004 N/A C:\MSOCache\P75J88Z0E64G2LN7D81.exe C:\H2.exe
PID 2900 wrote to memory of 2004 N/A C:\MSOCache\P75J88Z0E64G2LN7D81.exe C:\H2.exe
PID 2900 wrote to memory of 2004 N/A C:\MSOCache\P75J88Z0E64G2LN7D81.exe C:\H2.exe
PID 2900 wrote to memory of 2004 N/A C:\MSOCache\P75J88Z0E64G2LN7D81.exe C:\H2.exe
PID 2716 wrote to memory of 904 N/A C:\H2.exe C:\PerfLogs\L27B52A2L11N4YX2L57.exe
PID 2716 wrote to memory of 904 N/A C:\H2.exe C:\PerfLogs\L27B52A2L11N4YX2L57.exe
PID 2716 wrote to memory of 904 N/A C:\H2.exe C:\PerfLogs\L27B52A2L11N4YX2L57.exe
PID 2716 wrote to memory of 904 N/A C:\H2.exe C:\PerfLogs\L27B52A2L11N4YX2L57.exe
PID 832 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\L41L08F3V25W3FM5B35.exe
PID 832 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\L41L08F3V25W3FM5B35.exe
PID 832 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\L41L08F3V25W3FM5B35.exe
PID 832 wrote to memory of 2320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\L41L08F3V25W3FM5B35.exe
PID 832 wrote to memory of 1832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 832 wrote to memory of 1832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 832 wrote to memory of 1832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 832 wrote to memory of 1832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\H2 (2).exe

"C:\Users\Admin\AppData\Local\Temp\H2 (2).exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe

"C:\$Recycle.Bin\N64F43K1J70W0XF2M53.exe"

C:\H2.exe

"C:\H2.exe"

C:\Documents and Settings\V38X85K7V81L8YS3A17.exe

"C:\Documents and Settings\V38X85K7V81L8YS3A17.exe"

C:\MSOCache\P75J88Z0E64G2LN7D81.exe

"C:\MSOCache\P75J88Z0E64G2LN7D81.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\PerfLogs\L27B52A2L11N4YX2L57.exe

"C:\PerfLogs\L27B52A2L11N4YX2L57.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Program Files\G62B37Y2F62X5DP6O73.exe

"C:\Program Files\G62B37Y2F62X5DP6O73.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files (x86)\O35S70Y0R72N5EC7D37.exe

"C:\Program Files (x86)\O35S70Y0R72N5EC7D37.exe"

C:\$Recycle.Bin\V02X31P8S06N5NS7R48.exe

"C:\$Recycle.Bin\V02X31P8S06N5NS7R48.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\ProgramData\T42I71V5M21S7HU1D55.exe

"C:\ProgramData\T42I71V5M21S7HU1D55.exe"

C:\Recovery\B15A23V2Z32H7IH1S00.exe

"C:\Recovery\B15A23V2Z32H7IH1S00.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Documents and Settings\U01R45U3P16E3XX8M31.exe

"C:\Documents and Settings\U01R45U3P16E3XX8M31.exe"

C:\Users\V52M26K4H05C0VC5V83.exe

"C:\Users\V52M26K4H05C0VC5V83.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\$Recycle.Bin\T03Y67Q0C20H3PE8H00.exe

"C:\$Recycle.Bin\T03Y67Q0C20H3PE8H00.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\MSOCache\D77T56F6J25H4EZ5N82.exe

"C:\MSOCache\D77T56F6J25H4EZ5N82.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\L41L08F3V25W3FM5B35.exe

"C:\Windows\L41L08F3V25W3FM5B35.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\PerfLogs\T65S27A6X45A7OJ4T24.exe

"C:\PerfLogs\T65S27A6X45A7OJ4T24.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files\L52Q61U4A33A3WG3J24.exe

"C:\Program Files\L52Q61U4A33A3WG3J24.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\$Recycle.Bin\V65W63O5S20L8CQ0L61.exe

"C:\$Recycle.Bin\V65W63O5S20L8CQ0L61.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Program Files (x86)\M24I72Y3O43W7TX4H87.exe

"C:\Program Files (x86)\M24I72Y3O43W7TX4H87.exe"

C:\Documents and Settings\U40V06O1S43J3SP2E83.exe

"C:\Documents and Settings\U40V06O1S43J3SP2E83.exe"

C:\MSOCache\E63W12N6H48L8JF1B22.exe

"C:\MSOCache\E63W12N6H48L8JF1B22.exe"

C:\ProgramData\X57M34L8Y24I4YU7W53.exe

"C:\ProgramData\X57M34L8Y24I4YU7W53.exe"

C:\Documents and Settings\P05A55A2R20X5OC4P08.exe

"C:\Documents and Settings\P05A55A2R20X5OC4P08.exe"

C:\H2.exe

"C:\H2.exe"

C:\Recovery\X60R07B8D31M4OO5E42.exe

"C:\Recovery\X60R07B8D31M4OO5E42.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Users\U24V38N7S75G7IO5Y05.exe

"C:\Users\U24V38N7S75G7IO5Y05.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\MSOCache\F45O23Q6U48G3GW2A75.exe

"C:\MSOCache\F45O23Q6U48G3GW2A75.exe"

C:\$Recycle.Bin\D23Z41A0M02K6EX3X45.exe

"C:\$Recycle.Bin\D23Z41A0M02K6EX3X45.exe"

C:\PerfLogs\U26Z02C8X83L7YI2G84.exe

"C:\PerfLogs\U26Z02C8X83L7YI2G84.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1492331339-383879826-1413902254-40034604621409914911141351193742244431996279503"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files\W20V46O2I84M2KH6Z75.exe

"C:\Program Files\W20V46O2I84M2KH6Z75.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\W82P05Y7D10F6JL2L08.exe

"C:\Windows\W82P05Y7D10F6JL2L08.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=gta%206%20premium%20free%20download%20no%20virus%20undetected%203am%20challenge

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\$Recycle.Bin\H14O75X2I74N4XO8R86.exe

"C:\$Recycle.Bin\H14O75X2I74N4XO8R86.exe"

C:\$Recycle.Bin\E56H47Y4P11V6KY3Z53.exe

"C:\$Recycle.Bin\E56H47Y4P11V6KY3Z53.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files (x86)\S57R15E2U62V8DK1J43.exe

"C:\Program Files (x86)\S57R15E2U62V8DK1J43.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\PerfLogs\T35N54V6M47V1MQ5Y73.exe

"C:\PerfLogs\T35N54V6M47V1MQ5Y73.exe"

C:\H2.exe

"C:\H2.exe"

C:\Documents and Settings\N27L05R8G54B1WG5O34.exe

"C:\Documents and Settings\N27L05R8G54B1WG5O34.exe"

C:\Documents and Settings\W80W25V8G42O1EL5H38.exe

"C:\Documents and Settings\W80W25V8G42O1EL5H38.exe"

C:\ProgramData\W80W25V8G42O1EL5H38.exe

"C:\ProgramData\W80W25V8G42O1EL5H38.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-2146573299-1127421930-1677135656-19359582231606294831-939949093-1939395445-1354855128"

C:\MSOCache\J30F57A7L48K2CV7E54.exe

"C:\MSOCache\J30F57A7L48K2CV7E54.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus.exe

C:\PerfLogs\Z51T25A3J76S3IR4B80.exe

"C:\PerfLogs\Z51T25A3J76S3IR4B80.exe"

C:\Program Files\O40O38A2E55H1LN8J53.exe

"C:\Program Files\O40O38A2E55H1LN8J53.exe"

C:\Recovery\C80J10L4U07S8VP7O08.exe

"C:\Recovery\C80J10L4U07S8VP7O08.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files\M56Q78R7G67A4KF8N28.exe

"C:\Program Files\M56Q78R7G67A4KF8N28.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=club%20penguin

C:\Program Files (x86)\Q48K85D0H46H2UR2Q57.exe

"C:\Program Files (x86)\Q48K85D0H46H2UR2Q57.exe"

C:\Documents and Settings\G40W20Z2S67P6ZZ1O21.exe

"C:\Documents and Settings\G40W20Z2S67P6ZZ1O21.exe"

C:\MSOCache\N12F72N6M84U4VI0S33.exe

"C:\MSOCache\N12F72N6M84U4VI0S33.exe"

C:\PerfLogs\E52A25Y6S14M4EX6H37.exe

"C:\PerfLogs\E52A25Y6S14M4EX6H37.exe"

C:\Program Files\C28G71T0F50M7LE0W18.exe

"C:\Program Files\C28G71T0F50M7LE0W18.exe"

C:\Program Files (x86)\P50D11L7C17W4YT3P25.exe

"C:\Program Files (x86)\P50D11L7C17W4YT3P25.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20send%20virus%202%20friend%20undetected

C:\ProgramData\U77Y74X4D63F7SF3Y33.exe

"C:\ProgramData\U77Y74X4D63F7SF3Y33.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=gta%206%20premium%20free%20download%20no%20virus%20undetected%203am%20challenge

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus%20builder%20legit%20free%20download%20no%20virus

C:\Program Files (x86)\V55A86A5D84M4XJ6R76.exe

"C:\Program Files (x86)\V55A86A5D84M4XJ6R76.exe"

C:\H2.exe

"C:\H2.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20remove%20virus

C:\Recovery\L72X53U7H02F5EI5F45.exe

"C:\Recovery\L72X53U7H02F5EI5F45.exe"

C:\MSOCache\F00D26I5Q72U0DF7I23.exe

"C:\MSOCache\F00D26I5Q72U0DF7I23.exe"

C:\Users\B56U23B7Z05Y7LK6B50.exe

"C:\Users\B56U23B7Z05Y7LK6B50.exe"

C:\H2.exe

"C:\H2.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=best%20way%20to%20kill%20yourself%202024%20method%20free%20ultra%20undetected

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20tell%20if%20i%20pregunate

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=skrillex%20scary%20monster%20and%20nice%20sprites

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=minecraft%20hax%20download%202024%20free%20no%20virus%20undetected

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20buy%20large%20amounts%20of%20highly%20illegal%20substances%20undetected%202039%20method

C:\PerfLogs\O44Z26O3P55O7ZI1G85.exe

"C:\PerfLogs\O44Z26O3P55O7ZI1G85.exe"

C:\H2.exe

"C:\H2.exe"

C:\ProgramData\Q41H23B8X56E3HE4S07.exe

"C:\ProgramData\Q41H23B8X56E3HE4S07.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus%20builder%20legit%20free%20download%20no%20virus

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20get%20free%20money%20no%20virus

C:\ProgramData\N75U70L5Z45H3YP7A53.exe

"C:\ProgramData\N75U70L5Z45H3YP7A53.exe"

C:\Recovery\I00L75I4W22G7MF8F76.exe

"C:\Recovery\I00L75I4W22G7MF8F76.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20remove%20virus%202024%20free%20method

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=mcafee%20vs%20norton%202024%20free

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=best%20way%20to%20kill%20yourself%202024%20method%20free%20ultra%20undetected

C:\Users\S04E82K8Y28D6AM8A67.exe

"C:\Users\S04E82K8Y28D6AM8A67.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20remove%20virus%202024%20free%20method

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20tell%20if%20i%20pregunate

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=best%20way%20to%20kill%20yourself%202024%20method%20free%20ultra%20undetected

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:472067 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Users\Z03S88V8P57N3CO5S27.exe

"C:\Users\Z03S88V8P57N3CO5S27.exe"

C:\Windows\U48I50F1R83N1XX5U80.exe

"C:\Windows\U48I50F1R83N1XX5U80.exe"

C:\Windows\J07E52M7J18D7TX7K16.exe

"C:\Windows\J07E52M7J18D7TX7K16.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20remove%20virus

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20buy%20large%20amounts%20of%20highly%20illegal%20substances%20undetected%202039%20method

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20tell%20if%20i%20pregunate

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20do%20i%20make%20sure%20i%20deeply%20enjoy%20anal%20sex

C:\Windows\J20G18F6C30B6WI1P42.exe

"C:\Windows\J20G18F6C30B6WI1P42.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20get%20free%20money%20no%20virus

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20send%20virus%202%20friend%20undetected

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=best%20way%20to%20kill%20yourself%202024%20method%20free%20ultra%20undetected

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20do%20i%20make%20sure%20i%20deeply%20enjoy%20anal%20sex

C:\Recovery\X80V36U1P27H5WL4F46.exe

"C:\Recovery\X80V36U1P27H5WL4F46.exe"

C:\$Recycle.Bin\U82V74Y5W12Z7SV5A74.exe

"C:\$Recycle.Bin\U82V74Y5W12Z7SV5A74.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files\P06R82H2V67F2JD4N84.exe

"C:\Program Files\P06R82H2V67F2JD4N84.exe"

C:\H2.exe

"C:\H2.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20buy%20large%20amounts%20of%20highly%20illegal%20substances%20undetected%202039%20method

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=my%20computer%20is%20doing%20very%20weird%20things%20help%20me%20pls%20what%20is%20happening%20plz%20help

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20buy%20large%20amounts%20of%20highly%20illegal%20substances%20undetected%202039%20method

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20remove%20virus

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=best%20way%20to%20kill%20yourself%202024%20method%20free%20ultra%20undetected

C:\$Recycle.Bin\T32H37K6O10I2MY1J00.exe

"C:\$Recycle.Bin\T32H37K6O10I2MY1J00.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20buy%20large%20amounts%20of%20highly%20illegal%20substances%20undetected%202039%20method

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Users\B34O16B8W76J3ZT8Z24.exe

"C:\Users\B34O16B8W76J3ZT8Z24.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus.exe

C:\Windows\G08O75J8A20W7TE7S86.exe

"C:\Windows\G08O75J8A20W7TE7S86.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20tell%20if%20i%20pregunate

C:\Documents and Settings\L47U17V0N63U8GD6B61.exe

"C:\Documents and Settings\L47U17V0N63U8GD6B61.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20get%20free%20money%20no%20virus

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\MSOCache\I33L08N0D87Z4NI8F68.exe

"C:\MSOCache\I33L08N0D87Z4NI8F68.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Documents and Settings\D84Z58Z1P76Y8RH1K54.exe

"C:\Documents and Settings\D84Z58Z1P76Y8RH1K54.exe"

C:\MSOCache\Q78J03J4S53U2YU4J64.exe

"C:\MSOCache\Q78J03J4S53U2YU4J64.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\PerfLogs\A27E25X6Z62R7DO3I78.exe

"C:\PerfLogs\A27E25X6Z62R7DO3I78.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20do%20i%20make%20sure%20i%20deeply%20enjoy%20anal%20sex

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5032 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4400 CREDAT:275457 /prefetch:2

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=skrillex%20scary%20monster%20and%20nice%20sprites

C:\H2.exe

"C:\H2.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4120 CREDAT:275457 /prefetch:2

C:\$Recycle.Bin\P57G70B0U52O2KN2O46.exe

"C:\$Recycle.Bin\P57G70B0U52O2KN2O46.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\H2.exe

"C:\H2.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus.exe

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4972 CREDAT:275457 /prefetch:2

C:\PerfLogs\C83Z58U1F82S5DO5N88.exe

"C:\PerfLogs\C83Z58U1F82S5DO5N88.exe"

C:\Program Files\L43L23L6Z21E1EA7K33.exe

"C:\Program Files\L43L23L6Z21E1EA7K33.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5560 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3504 CREDAT:275457 /prefetch:2

C:\Program Files\M80K45Z4E47H1WU3N60.exe

"C:\Program Files\M80K45Z4E47H1WU3N60.exe"

C:\Documents and Settings\R06B46W0A85M4ZM6N88.exe

"C:\Documents and Settings\R06B46W0A85M4ZM6N88.exe"

C:\$Recycle.Bin\Z45L14U6M62W2GW1K15.exe

"C:\$Recycle.Bin\Z45L14U6M62W2GW1K15.exe"

C:\Program Files (x86)\W85B67L3R51C1VR1C27.exe

"C:\Program Files (x86)\W85B67L3R51C1VR1C27.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4696 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\$Recycle.Bin\D47M74R5V05K4MF2Q47.exe

"C:\$Recycle.Bin\D47M74R5V05K4MF2Q47.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5840 CREDAT:275457 /prefetch:2

C:\$Recycle.Bin\Q78J03J4S53U2YU4J64.exe

"C:\$Recycle.Bin\Q78J03J4S53U2YU4J64.exe"

C:\$Recycle.Bin\P68L53Q0Z68S2AI8W35.exe

"C:\$Recycle.Bin\P68L53Q0Z68S2AI8W35.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=gta%205%20mobile%20apk%20no%20virus%20free%20download

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\ProgramData\O04O08L6F56Q4ZB5I02.exe

"C:\ProgramData\O04O08L6F56Q4ZB5I02.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=virus.exe

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\$Recycle.Bin\C33E32Z1P80X2GG5J48.exe

"C:\$Recycle.Bin\C33E32Z1P80X2GG5J48.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20to%20send%20virus%202%20friend%20undetected

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Program Files (x86)\S52C87V1G64Q7JO8E47.exe

"C:\Program Files (x86)\S52C87V1G64Q7JO8E47.exe"

C:\H2.exe

"C:\H2.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6096 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Documents and Settings\A65E54B3D76Q2BQ1O57.exe

"C:\Documents and Settings\A65E54B3D76Q2BQ1O57.exe"

C:\Documents and Settings\R47U46C5B58D4CP1X38.exe

"C:\Documents and Settings\R47U46C5B58D4CP1X38.exe"

C:\Documents and Settings\M11Z27L0C10W4JA7T33.exe

"C:\Documents and Settings\M11Z27L0C10W4JA7T33.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Documents and Settings\Y80N33P8I21R0WJ4P43.exe

"C:\Documents and Settings\Y80N33P8I21R0WJ4P43.exe"

C:\ProgramData\R34H83C3E58O3HQ3F07.exe

"C:\ProgramData\R34H83C3E58O3HQ3F07.exe"

C:\H2.exe

"C:\H2.exe"

C:\MSOCache\Q55U01I4Y62A1BR5T36.exe

"C:\MSOCache\Q55U01I4Y62A1BR5T36.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20remove%20virus%202024%20free%20method

C:\MSOCache\O56T34S0T82S0PV4E43.exe

"C:\MSOCache\O56T34S0T82S0PV4E43.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6264 CREDAT:275457 /prefetch:2

C:\Recovery\D88U10Z6M34M8QS2O07.exe

"C:\Recovery\D88U10Z6M34M8QS2O07.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=gta%206%20premium%20free%20download%20no%20virus%20undetected%203am%20challenge

C:\$Recycle.Bin\U80Y44N7P55R5EP4Z04.exe

"C:\$Recycle.Bin\U80Y44N7P55R5EP4Z04.exe"

C:\Users\R50U17F7E86Z3QQ1X30.exe

"C:\Users\R50U17F7E86Z3QQ1X30.exe"

C:\PerfLogs\P44M66M2Z72M0JR4Q20.exe

"C:\PerfLogs\P44M66M2Z72M0JR4Q20.exe"

C:\PerfLogs\N08B01L3W65T7OL4P02.exe

"C:\PerfLogs\N08B01L3W65T7OL4P02.exe"

C:\Program Files\G43D35P8X41B8VR3F88.exe

"C:\Program Files\G43D35P8X41B8VR3F88.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6584 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6628 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6768 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\MSOCache\D88U10Z6M34M8QS2O07.exe

"C:\MSOCache\D88U10Z6M34M8QS2O07.exe"

C:\$Recycle.Bin\S74E54O0Z05O5LY1K74.exe

"C:\$Recycle.Bin\S74E54O0Z05O5LY1K74.exe"

C:\Documents and Settings\S51U18J8O71F6EJ6U06.exe

"C:\Documents and Settings\S51U18J8O71F6EJ6U06.exe"

C:\$Recycle.Bin\S51U18J8O71F6EJ6U06.exe

"C:\$Recycle.Bin\S51U18J8O71F6EJ6U06.exe"

C:\$Recycle.Bin\S74E54O0Z05O5LY1K74.exe

"C:\$Recycle.Bin\S74E54O0Z05O5LY1K74.exe"

C:\$Recycle.Bin\P25J32I8L64M3JE6S77.exe

"C:\$Recycle.Bin\P25J32I8L64M3JE6S77.exe"

C:\Documents and Settings\Q43B75V5T16E5JV8X82.exe

"C:\Documents and Settings\Q43B75V5T16E5JV8X82.exe"

C:\$Recycle.Bin\K18T32L3Q26H0FL3S50.exe

"C:\$Recycle.Bin\K18T32L3Q26H0FL3S50.exe"

C:\$Recycle.Bin\K11M12O3N84Z6KL0V20.exe

"C:\$Recycle.Bin\K11M12O3N84Z6KL0V20.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6400 CREDAT:275457 /prefetch:2

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6724 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\MSOCache\C77O68U1B46A7NB4R35.exe

"C:\MSOCache\C77O68U1B46A7NB4R35.exe"

C:\$Recycle.Bin\S86J27D0E12S5CS7R63.exe

"C:\$Recycle.Bin\S86J27D0E12S5CS7R63.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\MSOCache\C55S20D8J74F4US1X40.exe

"C:\MSOCache\C55S20D8J74F4US1X40.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%20do%20i%20make%20sure%20i%20deeply%20enjoy%20anal%20sex

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=how%202%20remove%20virus

C:\Program Files (x86)\G23B08A4I12W6BM6L88.exe

"C:\Program Files (x86)\G23B08A4I12W6BM6L88.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp

Files

memory/1740-0-0x000000007456E000-0x000000007456F000-memory.dmp

memory/1740-1-0x0000000000870000-0x000000000087C000-memory.dmp

C:\H2.exe

MD5 b014736055c3a7cf6af257dd7f84af7d
SHA1 d2ac0fb6482c2551a72fac685312c007e3e294d7
SHA256 d4d5d15a80019ad35455718f42d67ee828aa3a9fe7ed6433fb540d0182432c86
SHA512 c7401a8dc2c977628f145ff47c162a202709d24ed921ffd4448eb5d97adaaaf8c20244d85649a3dbc17721399b6988b35c4eb6c7b57d17f8492035a93176cb27

memory/2716-8-0x0000000001170000-0x000000000117C000-memory.dmp

memory/2716-9-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/2716-30-0x0000000074560000-0x0000000074C4E000-memory.dmp

memory/2620-33-0x00000000010D0000-0x00000000010DC000-memory.dmp

memory/2332-44-0x0000000000E10000-0x0000000000E1C000-memory.dmp

memory/2900-49-0x0000000000880000-0x000000000088C000-memory.dmp

memory/904-56-0x0000000000EA0000-0x0000000000EAC000-memory.dmp

memory/1104-95-0x00000000000E0000-0x00000000000EC000-memory.dmp

memory/2880-101-0x0000000000A10000-0x0000000000A1C000-memory.dmp

memory/2816-114-0x00000000001F0000-0x00000000001FC000-memory.dmp

memory/1572-124-0x0000000000290000-0x000000000029C000-memory.dmp

memory/2328-119-0x0000000000190000-0x000000000019C000-memory.dmp

memory/1248-140-0x0000000000E90000-0x0000000000E9C000-memory.dmp

memory/708-132-0x0000000000D50000-0x0000000000D5C000-memory.dmp

memory/936-137-0x00000000013D0000-0x00000000013DC000-memory.dmp

memory/2664-142-0x0000000000F20000-0x0000000000F2C000-memory.dmp

memory/2320-146-0x0000000001330000-0x000000000133C000-memory.dmp

memory/3064-152-0x0000000000BD0000-0x0000000000BDC000-memory.dmp

memory/2172-162-0x0000000000230000-0x000000000023C000-memory.dmp

memory/2092-175-0x0000000001090000-0x000000000109C000-memory.dmp

memory/2464-173-0x00000000003B0000-0x00000000003BC000-memory.dmp

memory/1648-172-0x0000000000320000-0x000000000032C000-memory.dmp

memory/1816-171-0x0000000000370000-0x000000000037C000-memory.dmp

memory/3168-174-0x0000000001390000-0x000000000139C000-memory.dmp

memory/1928-170-0x0000000001370000-0x000000000137C000-memory.dmp

memory/3540-188-0x0000000001190000-0x000000000119C000-memory.dmp

memory/3896-192-0x0000000001100000-0x000000000110C000-memory.dmp

memory/3912-191-0x0000000001150000-0x000000000115C000-memory.dmp

memory/3820-190-0x00000000003D0000-0x00000000003DC000-memory.dmp

memory/3472-206-0x00000000013E0000-0x00000000013EC000-memory.dmp

memory/2016-216-0x0000000001230000-0x000000000123C000-memory.dmp

memory/2320-219-0x0000000000F10000-0x0000000000F1C000-memory.dmp

memory/2664-226-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

memory/2068-229-0x0000000000B00000-0x0000000000B0C000-memory.dmp

memory/792-235-0x0000000001280000-0x000000000128C000-memory.dmp

memory/4836-285-0x0000000000DA0000-0x0000000000DAC000-memory.dmp

memory/4736-298-0x0000000000280000-0x000000000028C000-memory.dmp

memory/2804-313-0x0000000000F00000-0x0000000000F0C000-memory.dmp

memory/3740-317-0x00000000008A0000-0x00000000008AC000-memory.dmp

memory/4212-322-0x0000000001110000-0x000000000111C000-memory.dmp

memory/3560-325-0x00000000011C0000-0x00000000011CC000-memory.dmp

memory/4384-324-0x0000000000200000-0x000000000020C000-memory.dmp

memory/4380-326-0x0000000000940000-0x000000000094C000-memory.dmp

memory/1964-339-0x0000000001060000-0x000000000106C000-memory.dmp

memory/4348-344-0x0000000000970000-0x000000000097C000-memory.dmp

memory/3564-353-0x0000000001220000-0x000000000122C000-memory.dmp

memory/5156-362-0x0000000000300000-0x000000000030C000-memory.dmp

memory/5164-377-0x00000000010B0000-0x00000000010BC000-memory.dmp

memory/5876-380-0x00000000012E0000-0x00000000012EC000-memory.dmp

memory/4208-397-0x0000000001070000-0x000000000107C000-memory.dmp

memory/2620-400-0x0000000000F40000-0x0000000000F4C000-memory.dmp

memory/6608-416-0x0000000000AE0000-0x0000000000AEC000-memory.dmp

memory/7864-417-0x0000000001020000-0x000000000102C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-29 03:25

Reported

2024-06-29 03:27

Platform

win10v2004-20240611-en

Max time kernel

116s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\H2 (2).exe"

Signatures

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\H2 (2).exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\H2.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\takeown.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\H2.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A
N/A N/A C:\H2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeDebugPrivilege N/A C:\H2.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\takeown.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5044 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 5044 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 5044 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\H2 (2).exe C:\H2.exe
PID 3468 wrote to memory of 4628 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 4628 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 3468 wrote to memory of 4628 N/A C:\H2.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 1392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 4628 wrote to memory of 1392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 4628 wrote to memory of 1392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\takeown.exe
PID 4628 wrote to memory of 1104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 4628 wrote to memory of 1104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe
PID 4628 wrote to memory of 1104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\icacls.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\H2.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" C:\H2.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\H2 (2).exe

"C:\Users\Admin\AppData\Local\Temp\H2 (2).exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\$Recycle.Bin\G55V52B1O50X8YX7V77.exe

"C:\$Recycle.Bin\G55V52B1O50X8YX7V77.exe"

C:\Documents and Settings\M60Y44H4V85S1UM2V48.exe

"C:\Documents and Settings\M60Y44H4V85S1UM2V48.exe"

C:\PerfLogs\T33Q86H1H06H0UZ2J83.exe

"C:\PerfLogs\T33Q86H1H06H0UZ2J83.exe"

C:\Program Files\B07H30H8T17W0VM3Y46.exe

"C:\Program Files\B07H30H8T17W0VM3Y46.exe"

C:\Program Files (x86)\Y01V74Z2S43B7GB4O55.exe

"C:\Program Files (x86)\Y01V74Z2S43B7GB4O55.exe"

C:\H2.exe

"C:\H2.exe"

C:\ProgramData\L30I45G3I03Y4MB2U75.exe

"C:\ProgramData\L30I45G3I03Y4MB2U75.exe"

C:\H2.exe

"C:\H2.exe"

C:\Recovery\M88Q10F2L88L0CE0D51.exe

"C:\Recovery\M88Q10F2L88L0CE0D51.exe"

C:\H2.exe

"C:\H2.exe"

C:\Users\M40G06A7B87A4KO7H05.exe

"C:\Users\M40G06A7B87A4KO7H05.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\J80L41K7T22W6OV2P04.exe

"C:\Windows\J80L41K7T22W6OV2P04.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\$Recycle.Bin\F48Q81G5K78Q8SW8T61.exe

"C:\$Recycle.Bin\F48Q81G5K78Q8SW8T61.exe"

C:\Documents and Settings\E85P31M0M05L4DP6Z07.exe

"C:\Documents and Settings\E85P31M0M05L4DP6Z07.exe"

C:\$Recycle.Bin\Q37M53N6N47T8RL5Z27.exe

"C:\$Recycle.Bin\Q37M53N6N47T8RL5Z27.exe"

C:\PerfLogs\E05H05K8C00E3LH4H20.exe

"C:\PerfLogs\E05H05K8C00E3LH4H20.exe"

C:\$Recycle.Bin\M31U13J4K03Q6LF8K38.exe

"C:\$Recycle.Bin\M31U13J4K03Q6LF8K38.exe"

C:\$Recycle.Bin\R47K14G0F41V8PX2L56.exe

"C:\$Recycle.Bin\R47K14G0F41V8PX2L56.exe"

C:\Documents and Settings\C16I23L0M22Y1OT5Y61.exe

"C:\Documents and Settings\C16I23L0M22Y1OT5Y61.exe"

C:\$Recycle.Bin\Z60H74R6A53M2RF5R58.exe

"C:\$Recycle.Bin\Z60H74R6A53M2RF5R58.exe"

C:\Program Files\U10N63T0Y26E4XT5I86.exe

"C:\Program Files\U10N63T0Y26E4XT5I86.exe"

C:\Documents and Settings\Y26X78V0R64B6LQ0E06.exe

"C:\Documents and Settings\Y26X78V0R64B6LQ0E06.exe"

C:\Documents and Settings\L06F22S3Z24V8PV4T78.exe

"C:\Documents and Settings\L06F22S3Z24V8PV4T78.exe"

C:\PerfLogs\H48Y85U5G61D1BF8B35.exe

"C:\PerfLogs\H48Y85U5G61D1BF8B35.exe"

C:\Documents and Settings\H31K03L7V74O2KI8B03.exe

"C:\Documents and Settings\H31K03L7V74O2KI8B03.exe"

C:\Program Files (x86)\D42G35Q4D16Z8WA1N46.exe

"C:\Program Files (x86)\D42G35Q4D16Z8WA1N46.exe"

C:\H2.exe

"C:\H2.exe"

C:\PerfLogs\O23O15O7V88O8DS7T60.exe

"C:\PerfLogs\O23O15O7V88O8DS7T60.exe"

C:\Program Files\I26T28W6X50A4KE5N34.exe

"C:\Program Files\I26T28W6X50A4KE5N34.exe"

C:\PerfLogs\N33J20T2T08F7NX8O52.exe

"C:\PerfLogs\N33J20T2T08F7NX8O52.exe"

C:\PerfLogs\P82X70N6Y74A4TU5B55.exe

"C:\PerfLogs\P82X70N6Y74A4TU5B55.exe"

C:\ProgramData\S58R76O5F41E0YG0W02.exe

"C:\ProgramData\S58R76O5F41E0YG0W02.exe"

C:\H2.exe

"C:\H2.exe"

C:\Program Files\B81L07S5S46X3ZB0O33.exe

"C:\Program Files\B81L07S5S46X3ZB0O33.exe"

C:\$Recycle.Bin\E62E78T5A04Z6VT4G88.exe

"C:\$Recycle.Bin\E62E78T5A04Z6VT4G88.exe"

C:\Program Files\Q77E73S0D77I5TQ1Q66.exe

"C:\Program Files\Q77E73S0D77I5TQ1Q66.exe"

C:\Program Files (x86)\V34F07U0J26Y3OY5N41.exe

"C:\Program Files (x86)\V34F07U0J26Y3OY5N41.exe"

C:\Program Files\O61T40Q8Z06S5DG4D05.exe

"C:\Program Files\O61T40Q8Z06S5DG4D05.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x520 0x51c

C:\Documents and Settings\X60I05V0D02I2NZ0H34.exe

"C:\Documents and Settings\X60I05V0D02I2NZ0H34.exe"

C:\H2.exe

"C:\H2.exe"

C:\$Recycle.Bin\B53H62R5O40T6ZN3E07.exe

"C:\$Recycle.Bin\B53H62R5O40T6ZN3E07.exe"

C:\Program Files (x86)\F83L51B1Z04I6FC2R33.exe

"C:\Program Files (x86)\F83L51B1Z04I6FC2R33.exe"

C:\Program Files (x86)\P64T31Z5R75X6MU8X57.exe

"C:\Program Files (x86)\P64T31Z5R75X6MU8X57.exe"

C:\Recovery\D26P04T5L22H2YC4J26.exe

"C:\Recovery\D26P04T5L22H2YC4J26.exe"

C:\H2.exe

"C:\H2.exe"

C:\ProgramData\K41Q48S2L51D4RE4W06.exe

"C:\ProgramData\K41Q48S2L51D4RE4W06.exe"

C:\Program Files (x86)\S14I81T8X52S4SR5K50.exe

"C:\Program Files (x86)\S14I81T8X52S4SR5K50.exe"

C:\$Recycle.Bin\W04T40X2S86S7VC8H56.exe

"C:\$Recycle.Bin\W04T40X2S86S7VC8H56.exe"

C:\H2.exe

"C:\H2.exe"

C:\Documents and Settings\C40C82F6B47R8BA8W33.exe

"C:\Documents and Settings\C40C82F6B47R8BA8W33.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Users\J83W81D1R61G1CT6R45.exe

"C:\Users\J83W81D1R61G1CT6R45.exe"

C:\H2.exe

"C:\H2.exe"

C:\Recovery\E14K25H6Z30E4AQ0B52.exe

"C:\Recovery\E14K25H6Z30E4AQ0B52.exe"

C:\Recovery\S02L45J2U66W7LN3U74.exe

"C:\Recovery\S02L45J2U66W7LN3U74.exe"

C:\Program Files\N85V45M6Z27R4IV0U55.exe

"C:\Program Files\N85V45M6Z27R4IV0U55.exe"

C:\Users\Z58K11F6T00O5FI4E77.exe

"C:\Users\Z58K11F6T00O5FI4E77.exe"

C:\Program Files (x86)\I88X08N0T73F0NU3B58.exe

"C:\Program Files (x86)\I88X08N0T73F0NU3B58.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\ProgramData\Q00U76O7J01Y5OV1A37.exe

"C:\ProgramData\Q00U76O7J01Y5OV1A37.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files (x86)\Y05J40L1V17J1PB2K14.exe

"C:\Program Files (x86)\Y05J40L1V17J1PB2K14.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\A71X61R5Z83E5FS7A53.exe

"C:\Windows\A71X61R5Z83E5FS7A53.exe"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=system%20to%20user%20exploit%20bypass%20undetect%202027%20method%20free%20fud

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3049057496391170466,9533232448114646982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3049057496391170466,9533232448114646982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3049057496391170466,9533232448114646982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3049057496391170466,9533232448114646982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Users\O30O55A6H36M2TO8E57.exe

"C:\Users\O30O55A6H36M2TO8E57.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how%202%20buy%20large%20amounts%20of%20highly%20illegal%20substances%20undetected%202039%20method

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how%20do%20i%20make%20sure%20i%20deeply%20enjoy%20anal%20sex

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=my%20computer%20is%20doing%20very%20weird%20things%20help%20me%20pls%20what%20is%20happening%20plz%20help

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\Windows\N61O20H2G63I0OB6O75.exe

"C:\Windows\N61O20H2G63I0OB6O75.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=my%20computer%20is%20doing%20very%20weird%20things%20help%20me%20pls%20what%20is%20happening%20plz%20help

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how%20to%20send%20virus%202%20friend%20undetected

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how%20to%20tell%20if%20i%20pregunate

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\takeown.exe

takeown /f C:\Windows\System32

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=gta%206%20premium%20free%20download%20no%20virus%20undetected%203am%20challenge

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=virus.exe

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Documents and Settings\W71C26S6W42S0XK2K54.exe

"C:\Documents and Settings\W71C26S6W42S0XK2K54.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3049057496391170466,9533232448114646982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\H2.exe

"C:\H2.exe"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\PerfLogs\S70R70U8Y01X7TA0K76.exe

"C:\PerfLogs\S70R70U8Y01X7TA0K76.exe"

C:\$Recycle.Bin\X34E76M1V35X4NR5E37.exe

"C:\$Recycle.Bin\X34E76M1V35X4NR5E37.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3049057496391170466,9533232448114646982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\icacls.exe

icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "Admin:F"

C:\$Recycle.Bin\L60B87N5K62M3HU2Q06.exe

"C:\$Recycle.Bin\L60B87N5K62M3HU2Q06.exe"

C:\Documents and Settings\A64K18G5H11M5NB0F67.exe

"C:\Documents and Settings\A64K18G5H11M5NB0F67.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files\T85R47X0T07Y7CO3H10.exe

"C:\Program Files\T85R47X0T07Y7CO3H10.exe"

C:\Program Files\B00I11M0Y04O3WI5U43.exe

"C:\Program Files\B00I11M0Y04O3WI5U43.exe"

C:\Program Files\L17O44D8V85X0TF0A56.exe

"C:\Program Files\L17O44D8V85X0TF0A56.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=virus.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8108 -ip 8108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbfc8e46f8,0x7ffbfc8e4708,0x7ffbfc8e4718

C:\$Recycle.Bin\M25A86G0Y65O0JP6M28.exe

"C:\$Recycle.Bin\M25A86G0Y65O0JP6M28.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6648 -ip 6648

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5748 -ip 5748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=how%20do%20i%20make%20sure%20i%20deeply%20enjoy%20anal%20sex

C:\Program Files\S06A60L2Z12F7NK4F35.exe

"C:\Program Files\S06A60L2Z12F7NK4F35.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?q=virus.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6620 -ip 6620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4628 -ip 4628

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 2268

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp

Files

memory/5044-0-0x000000007530E000-0x000000007530F000-memory.dmp

memory/5044-1-0x0000000000B80000-0x0000000000B8C000-memory.dmp

C:\H2.exe

MD5 b014736055c3a7cf6af257dd7f84af7d
SHA1 d2ac0fb6482c2551a72fac685312c007e3e294d7
SHA256 d4d5d15a80019ad35455718f42d67ee828aa3a9fe7ed6433fb540d0182432c86
SHA512 c7401a8dc2c977628f145ff47c162a202709d24ed921ffd4448eb5d97adaaaf8c20244d85649a3dbc17721399b6988b35c4eb6c7b57d17f8492035a93176cb27

memory/3468-13-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/3468-25-0x0000000075300000-0x0000000075AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\L30I45G3I03Y4MB2U75.exe.log

MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d91a23877c0348e66c6119048df66677
SHA1 685a8fef8bc81f674eaa26666d6dc921d5ba3e4e
SHA256 802fd8e7578ec821e2e2deba190cfedd5ce7001361625ec0a16cd92b20dbdc33
SHA512 47cbe1c43125707cd609bc3342ff0f05196c018d47837373bbc63dbdc650741867ffd4c4548b0e9d20bf2fd430a5b370bcb81356784985a3ba1612fcc7421a67

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 3c0268b80d0c79dc9ea6dfab6b194f8f
SHA1 f45df87c4bee0fee1f35dc03bd8700d13c89bffe
SHA256 e42cf4e7d2ff62fb8de19acb4ac327af502f3b8ed09ff3df931ef8f6e095483c
SHA512 a7aa124375ffe9bfe5b3f4569d17a586e537e1df189e122af4ee3c30ee2a822fa498f895e38c80204d032410eddf4e398ae23277ccdcf96f6a0a1498268436e3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c