Resubmissions
30/06/2026, 11:49
260630-nzah8ses7k1016/06/2026, 03:33
260616-d4b8hshy8t1007/05/2026, 21:01
260507-zvbraaes7r1004/05/2026, 15:47
260504-s76c4aaz9p1015/04/2026, 19:23
260415-x3t7gsgy9k1011/04/2026, 01:51
260411-b9373sey8l1019/02/2026, 13:04
260219-qa283agv7b1011/02/2026, 00:05
260211-ac94pact4d1003/02/2026, 09:03
260203-k1dqhaaw4c1002/02/2026, 19:45
260202-yggvpsa18h10Analysis
- max time kernel
19s - max time network
272s - platform
windows11-21h2_x64 - resource
win11-20250905-en - resource tags
- submitted
09/10/2025, 01:47
Errors
Reason
Machine shutdown
General
- Target jewjewjewrapernigger.exe
- Size 66.0MB
- Sample251009-b7h45asj13
- SHA256 77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
jajaja
C2
-
176.46.152.46:1911
Extracted
Family
-
neconyd
C2
-
http://ow5dirasuek.com/
-
http://mkkuei4kdsz.com/
-
http://lousta.net/
Extracted
Family
-
stealc
Botnet
-
avtostopom
C2
-
http://45.141.233.187
Attributes
-
url_path
/7d1ca61c169b4862.php
rc4.plain
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1399894662365577257/NMqgSKeL5lfvgkhf3U7otcHEUlUdExlRehLumOM1uhIYrXB5YDsltdJihrITmZu28SVz
Extracted
Family
-
lumma
C2
-
https://stolewnica.ru/xjuf
-
https://mastwin.in/qsaz
-
https://ordinarniyvrach.ru/xiur
-
https://yamakrug.ru/lzka
-
https://vishneviyjazz.ru/neco
-
https://yrokistorii.ru/uqya
-
https://visokiywkaf.ru/mmtn
-
https://kletkamozga.ru/iwyq
Attributes
-
build_id
183c347859ef8d191a6ff2ec0670880da237bd8434
Extracted
Family
-
smokeloader
Botnet
-
555
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
understand-vip.gl.at.ply.gg:21304
Mutex
-
966bc060-4ea7-43bd-9b30-06988ea8ba79
Attributes
-
encryption_key
7FE83CB9F9DEA14FFA20DB6F8CD68A42656137B4
-
install_name
Cleaner.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MsEdge
-
subdirectory
SubDir
Extracted
Family
-
xworm
Version
-
3.0
C2
-
82.26.74.39:7000
Mutex
-
Pzco4SpJSHq0JUVI
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://venerynnet1.top/
-
http://kevonahira2.top/
-
http://vegangelist3.top/
-
http://kingriffaele4.top/
-
http://arakeishant5.top/
rc4.i32
rc4.i32
Extracted
Family
-
vidar
Version
-
14.9
Botnet
-
6ff1fd60fb5387f3c93619f2e30e125f
C2
-
https://t.me/ty5e4q
-
https://steamcommunity.com/profiles/76561199884432485
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Extracted
Family
-
redline
Botnet
-
rdp
C2
-
mail-eco.gl.at.ply.gg:15149
Signatures
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Cosmu
Cosmu is a Windows worm written in C++.
- Cosmu family
- Detect Blackmoon payload 19 IoCs
- Detect Vidar Stealer 1 IoCs
- Detect Xworm Payload 2 IoCs
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
- Detects Umbral payload 2 IoCs
- Gink
- Gink family
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Neconyd
Neconyd is a trojan written in C++.
- Neconyd family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Ramnit family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Redline family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
- Sectoprat family
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Umbral family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- XMRig Miner payload 64 IoCs
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
- Downloads MZ/PE file
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s) 2 TTPs
- Drops startup file 2 IoCs
- Executes dropped EXE 63 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 37 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 9 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Delays execution with timeout.exe 1 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Kills process with taskkill 1 IoCs
- Modifies registry class 6 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny67.exe"C:\Users\Admin\AppData\Local\Temp\funny67.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\qhduWby.exeC:\Windows\System32\qhduWby.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\KIEwMKG.exeC:\Windows\System32\KIEwMKG.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rhxVKRt.exeC:\Windows\System32\rhxVKRt.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\NRENsOQ.exeC:\Windows\System32\NRENsOQ.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\eYCHugC.exeC:\Windows\System32\eYCHugC.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\YfIMiMq.exeC:\Windows\System32\YfIMiMq.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\aqReyCj.exeC:\Windows\System32\aqReyCj.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\IypCoKB.exeC:\Windows\System32\IypCoKB.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\SFJIMVZ.exeC:\Windows\System32\SFJIMVZ.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\BGZDija.exeC:\Windows\System32\BGZDija.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\yrpgmzh.exeC:\Windows\System32\yrpgmzh.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\aAciAnG.exeC:\Windows\System32\aAciAnG.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\MWbiPdC.exeC:\Windows\System32\MWbiPdC.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\AHLPzdY.exeC:\Windows\System32\AHLPzdY.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\fotwdbm.exeC:\Windows\System32\fotwdbm.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\nWcznte.exeC:\Windows\System32\nWcznte.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\GxkhUgJ.exeC:\Windows\System32\GxkhUgJ.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\iDmmHPt.exeC:\Windows\System32\iDmmHPt.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\ZJVfvZh.exeC:\Windows\System32\ZJVfvZh.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\menuMtU.exeC:\Windows\System32\menuMtU.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\yenLEBL.exeC:\Windows\System32\yenLEBL.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\KxTZrUo.exeC:\Windows\System32\KxTZrUo.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\dNFqXeB.exeC:\Windows\System32\dNFqXeB.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\RzAcyoW.exeC:\Windows\System32\RzAcyoW.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\euKqBxJ.exeC:\Windows\System32\euKqBxJ.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\ExsiMCQ.exeC:\Windows\System32\ExsiMCQ.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WIPSUMX.exeC:\Windows\System32\WIPSUMX.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\oaMfBvr.exeC:\Windows\System32\oaMfBvr.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\fIWllhK.exeC:\Windows\System32\fIWllhK.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\BWrAmSF.exeC:\Windows\System32\BWrAmSF.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\EBFxJuu.exeC:\Windows\System32\EBFxJuu.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\TMhaHmb.exeC:\Windows\System32\TMhaHmb.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\eglOZxx.exeC:\Windows\System32\eglOZxx.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\ZkSmIUn.exeC:\Windows\System32\ZkSmIUn.exe3⤵
-
-
C:\Windows\System32\mAZGGIw.exeC:\Windows\System32\mAZGGIw.exe3⤵
-
-
C:\Windows\System32\khoiigr.exeC:\Windows\System32\khoiigr.exe3⤵
-
-
C:\Windows\System32\NGWeaeZ.exeC:\Windows\System32\NGWeaeZ.exe3⤵
-
-
C:\Windows\System32\iecVCcu.exeC:\Windows\System32\iecVCcu.exe3⤵
-
-
C:\Windows\System32\kZsJbjM.exeC:\Windows\System32\kZsJbjM.exe3⤵
-
-
C:\Windows\System32\ztBNpMO.exeC:\Windows\System32\ztBNpMO.exe3⤵
-
-
C:\Windows\System32\yjGyGSR.exeC:\Windows\System32\yjGyGSR.exe3⤵
-
-
C:\Windows\System32\vqLuNHR.exeC:\Windows\System32\vqLuNHR.exe3⤵
-
-
C:\Windows\System32\KGfFMrj.exeC:\Windows\System32\KGfFMrj.exe3⤵
-
-
C:\Windows\System32\wcGOzEC.exeC:\Windows\System32\wcGOzEC.exe3⤵
-
-
C:\Windows\System32\LYLOXkP.exeC:\Windows\System32\LYLOXkP.exe3⤵
-
-
C:\Windows\System32\efMCGBB.exeC:\Windows\System32\efMCGBB.exe3⤵
-
-
C:\Windows\System32\UWPDjxy.exeC:\Windows\System32\UWPDjxy.exe3⤵
-
-
C:\Windows\System32\WCsSwCM.exeC:\Windows\System32\WCsSwCM.exe3⤵
-
-
C:\Windows\System32\scymLuy.exeC:\Windows\System32\scymLuy.exe3⤵
-
-
C:\Windows\System32\MgmiTVH.exeC:\Windows\System32\MgmiTVH.exe3⤵
-
-
C:\Windows\System32\likENBC.exeC:\Windows\System32\likENBC.exe3⤵
-
-
C:\Windows\System32\RQPRGhZ.exeC:\Windows\System32\RQPRGhZ.exe3⤵
-
-
C:\Windows\System32\cCoCUtz.exeC:\Windows\System32\cCoCUtz.exe3⤵
-
-
C:\Windows\System32\KxaOHAj.exeC:\Windows\System32\KxaOHAj.exe3⤵
-
-
C:\Windows\System32\WvIgVip.exeC:\Windows\System32\WvIgVip.exe3⤵
-
-
C:\Windows\System32\UcyxNvN.exeC:\Windows\System32\UcyxNvN.exe3⤵
-
-
C:\Windows\System32\OSgAGnN.exeC:\Windows\System32\OSgAGnN.exe3⤵
-
-
C:\Windows\System32\ounIWrz.exeC:\Windows\System32\ounIWrz.exe3⤵
-
-
C:\Windows\System32\wodaOpB.exeC:\Windows\System32\wodaOpB.exe3⤵
-
-
C:\Windows\System32\POPXfRD.exeC:\Windows\System32\POPXfRD.exe3⤵
-
-
C:\Windows\System32\auAejes.exeC:\Windows\System32\auAejes.exe3⤵
-
-
C:\Windows\System32\ZJLytqX.exeC:\Windows\System32\ZJLytqX.exe3⤵
-
-
C:\Windows\System32\jaGweRg.exeC:\Windows\System32\jaGweRg.exe3⤵
-
-
C:\Windows\System32\pnqFUhZ.exeC:\Windows\System32\pnqFUhZ.exe3⤵
-
-
C:\Windows\System32\fxvcOFB.exeC:\Windows\System32\fxvcOFB.exe3⤵
-
-
C:\Windows\System32\tugVaYg.exeC:\Windows\System32\tugVaYg.exe3⤵
-
-
C:\Windows\System32\lqSVlhj.exeC:\Windows\System32\lqSVlhj.exe3⤵
-
-
C:\Windows\System32\uTCJIYC.exeC:\Windows\System32\uTCJIYC.exe3⤵
-
-
C:\Windows\System32\HgRWEmT.exeC:\Windows\System32\HgRWEmT.exe3⤵
-
-
C:\Windows\System32\CnjTHVP.exeC:\Windows\System32\CnjTHVP.exe3⤵
-
-
C:\Windows\System32\ECFlrMu.exeC:\Windows\System32\ECFlrMu.exe3⤵
-
-
C:\Windows\System32\mRJncbh.exeC:\Windows\System32\mRJncbh.exe3⤵
-
-
C:\Windows\System32\EoqxLjf.exeC:\Windows\System32\EoqxLjf.exe3⤵
-
-
C:\Windows\System32\yRIQkuN.exeC:\Windows\System32\yRIQkuN.exe3⤵
-
-
C:\Windows\System32\JikKRJs.exeC:\Windows\System32\JikKRJs.exe3⤵
-
-
C:\Windows\System32\YENNBrS.exeC:\Windows\System32\YENNBrS.exe3⤵
-
-
C:\Windows\System32\uTgjrjT.exeC:\Windows\System32\uTgjrjT.exe3⤵
-
-
C:\Windows\System32\KOVbuhX.exeC:\Windows\System32\KOVbuhX.exe3⤵
-
-
C:\Windows\System32\BnWofXW.exeC:\Windows\System32\BnWofXW.exe3⤵
-
-
C:\Windows\System32\FCdkVqj.exeC:\Windows\System32\FCdkVqj.exe3⤵
-
-
C:\Windows\System32\KIMCFRq.exeC:\Windows\System32\KIMCFRq.exe3⤵
-
-
C:\Windows\System32\eNFZNYy.exeC:\Windows\System32\eNFZNYy.exe3⤵
-
-
C:\Windows\System32\yjeopml.exeC:\Windows\System32\yjeopml.exe3⤵
-
-
C:\Windows\System32\cJymbZB.exeC:\Windows\System32\cJymbZB.exe3⤵
-
-
C:\Windows\System32\YBoQphX.exeC:\Windows\System32\YBoQphX.exe3⤵
-
-
C:\Windows\System32\LENPOEv.exeC:\Windows\System32\LENPOEv.exe3⤵
-
-
C:\Windows\System32\jNNpAFP.exeC:\Windows\System32\jNNpAFP.exe3⤵
-
-
C:\Windows\System32\cGGUfRc.exeC:\Windows\System32\cGGUfRc.exe3⤵
-
-
C:\Windows\System32\UWHyurF.exeC:\Windows\System32\UWHyurF.exe3⤵
-
-
C:\Windows\System32\XBizbac.exeC:\Windows\System32\XBizbac.exe3⤵
-
-
C:\Windows\System32\oHQAQCX.exeC:\Windows\System32\oHQAQCX.exe3⤵
-
-
C:\Windows\System32\CBRBaba.exeC:\Windows\System32\CBRBaba.exe3⤵
-
-
C:\Windows\System32\PwRHpIz.exeC:\Windows\System32\PwRHpIz.exe3⤵
-
-
C:\Windows\System32\rZlTTvy.exeC:\Windows\System32\rZlTTvy.exe3⤵
-
-
C:\Windows\System32\hKBrcOA.exeC:\Windows\System32\hKBrcOA.exe3⤵
-
-
C:\Windows\System32\eGmsHea.exeC:\Windows\System32\eGmsHea.exe3⤵
-
-
C:\Windows\System32\rIvUnAy.exeC:\Windows\System32\rIvUnAy.exe3⤵
-
-
C:\Windows\System32\JvcFAwX.exeC:\Windows\System32\JvcFAwX.exe3⤵
-
-
C:\Windows\System32\hSHacRY.exeC:\Windows\System32\hSHacRY.exe3⤵
-
-
C:\Windows\System32\KbzEjvS.exeC:\Windows\System32\KbzEjvS.exe3⤵
-
-
C:\Windows\System32\FtVLAAK.exeC:\Windows\System32\FtVLAAK.exe3⤵
-
-
C:\Windows\System32\AiQqVNt.exeC:\Windows\System32\AiQqVNt.exe3⤵
-
-
C:\Windows\System32\Znvdfrv.exeC:\Windows\System32\Znvdfrv.exe3⤵
-
-
C:\Windows\System32\qejBPCu.exeC:\Windows\System32\qejBPCu.exe3⤵
-
-
C:\Windows\System32\CFtuQXO.exeC:\Windows\System32\CFtuQXO.exe3⤵
-
-
C:\Windows\System32\TMWsLht.exeC:\Windows\System32\TMWsLht.exe3⤵
-
-
C:\Windows\System32\dQdUfUj.exeC:\Windows\System32\dQdUfUj.exe3⤵
-
-
C:\Windows\System32\BVlJgfm.exeC:\Windows\System32\BVlJgfm.exe3⤵
-
-
C:\Windows\System32\iGxRxFa.exeC:\Windows\System32\iGxRxFa.exe3⤵
-
-
C:\Windows\System32\GYtvAwX.exeC:\Windows\System32\GYtvAwX.exe3⤵
-
-
C:\Windows\System32\NQtAOSc.exeC:\Windows\System32\NQtAOSc.exe3⤵
-
-
C:\Windows\System32\rxYkevF.exeC:\Windows\System32\rxYkevF.exe3⤵
-
-
C:\Windows\System32\orTBagR.exeC:\Windows\System32\orTBagR.exe3⤵
-
-
C:\Windows\System32\VbCwkhb.exeC:\Windows\System32\VbCwkhb.exe3⤵
-
-
C:\Windows\System32\zViUBcd.exeC:\Windows\System32\zViUBcd.exe3⤵
-
-
C:\Windows\System32\nGafTlg.exeC:\Windows\System32\nGafTlg.exe3⤵
-
-
C:\Windows\System32\BAUYRdT.exeC:\Windows\System32\BAUYRdT.exe3⤵
-
-
C:\Windows\System32\XcxOPlT.exeC:\Windows\System32\XcxOPlT.exe3⤵
-
-
C:\Windows\System32\eBKfwrT.exeC:\Windows\System32\eBKfwrT.exe3⤵
-
-
C:\Windows\System32\RIWhDOh.exeC:\Windows\System32\RIWhDOh.exe3⤵
-
-
C:\Windows\System32\rjfIaRp.exeC:\Windows\System32\rjfIaRp.exe3⤵
-
-
C:\Windows\System32\uoUKqDI.exeC:\Windows\System32\uoUKqDI.exe3⤵
-
-
C:\Windows\System32\GKCFGYm.exeC:\Windows\System32\GKCFGYm.exe3⤵
-
-
C:\Windows\System32\HsvGuEi.exeC:\Windows\System32\HsvGuEi.exe3⤵
-
-
C:\Windows\System32\qDwoFPL.exeC:\Windows\System32\qDwoFPL.exe3⤵
-
-
C:\Windows\System32\xmAlOVM.exeC:\Windows\System32\xmAlOVM.exe3⤵
-
-
C:\Windows\System32\YQvwvaM.exeC:\Windows\System32\YQvwvaM.exe3⤵
-
-
C:\Windows\System32\eISQFRF.exeC:\Windows\System32\eISQFRF.exe3⤵
-
-
C:\Windows\System32\YANgEsj.exeC:\Windows\System32\YANgEsj.exe3⤵
-
-
C:\Windows\System32\VmULZKm.exeC:\Windows\System32\VmULZKm.exe3⤵
-
-
C:\Windows\System32\hplUVwB.exeC:\Windows\System32\hplUVwB.exe3⤵
-
-
C:\Windows\System32\vxNpqcH.exeC:\Windows\System32\vxNpqcH.exe3⤵
-
-
C:\Windows\System32\mOUdiLI.exeC:\Windows\System32\mOUdiLI.exe3⤵
-
-
C:\Windows\System32\APvfngg.exeC:\Windows\System32\APvfngg.exe3⤵
-
-
C:\Windows\System32\WyCGzXU.exeC:\Windows\System32\WyCGzXU.exe3⤵
-
-
C:\Windows\System32\izQLMXL.exeC:\Windows\System32\izQLMXL.exe3⤵
-
-
C:\Windows\System32\zczCXvH.exeC:\Windows\System32\zczCXvH.exe3⤵
-
-
C:\Windows\System32\tVSPvIF.exeC:\Windows\System32\tVSPvIF.exe3⤵
-
-
C:\Windows\System32\PfiLgWI.exeC:\Windows\System32\PfiLgWI.exe3⤵
-
-
C:\Windows\System32\OvTxJQN.exeC:\Windows\System32\OvTxJQN.exe3⤵
-
-
C:\Windows\System32\CaEFvVJ.exeC:\Windows\System32\CaEFvVJ.exe3⤵
-
-
C:\Windows\System32\QZocDjR.exeC:\Windows\System32\QZocDjR.exe3⤵
-
-
C:\Windows\System32\uFUAohd.exeC:\Windows\System32\uFUAohd.exe3⤵
-
-
C:\Windows\System32\lDAXCvE.exeC:\Windows\System32\lDAXCvE.exe3⤵
-
-
C:\Windows\System32\OmCjVIK.exeC:\Windows\System32\OmCjVIK.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\funny78.exe"C:\Users\Admin\AppData\Local\Temp\funny78.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny78Srv.exeC:\Users\Admin\AppData\Local\Temp\funny78Srv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 3204⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 3243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exeC:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 5323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\k1t.exe"C:\Users\Admin\AppData\Local\Temp\k1t.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
C:\ProgramData\5297.tmp"C:\ProgramData\5297.tmp"3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\5297.tmp >> NUL4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /C DEL /F /Q C:\PROGRA~3\5297.tmp >> NUL5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\wZ6I8MH.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\wZ6I8MH.exeC:\Users\Admin\AppData\Local\Temp\a\wZ6I8MH.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\NAYOEw4.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\NAYOEw4.exeC:\Users\Admin\AppData\Local\Temp\a\NAYOEw4.exe4⤵
-
C:\Users\Admin\AppData\Roaming\RiotClient\manager.exe"C:\Users\Admin\AppData\Roaming\RiotClient\manager.exe"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\YHZSKO~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\YHZSKO~1.EXEC:\Users\Admin\AppData\Local\Temp\a\YHZSKO~1.EXE4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\YHZSKO~1.EXE"C:\Users\Admin\AppData\Local\Temp\a\YHZSKO~1.EXE"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\T7V02QZ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\T7V02QZ.exeC:\Users\Admin\AppData\Local\Temp\a\T7V02QZ.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\jy45Wqr.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\jy45Wqr.exeC:\Users\Admin\AppData\Local\Temp\a\jy45Wqr.exe4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\FFQ43I~1\TI6PY2~1.EXE"5⤵
-
C:\Users\Admin\AppData\Roaming\FFQ43I~1\TI6PY2~1.EXEC:\Users\Admin\AppData\Roaming\FFQ43I~1\TI6PY2~1.EXE6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /Create /TN "jmfBb3LxYrdd" /TR "C:\ProgramData\F6ekqYrboMWs.exe" /SC ONLOGON /RL HIGHEST /F7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN "jmfBb3LxYrdd" /TR "C:\ProgramData\F6ekqYrboMWs.exe" /SC ONLOGON /RL HIGHEST /F8⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "$([System.Environment]::GetEnvironmentVariable('SystemDrive'))\"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $([System.Environment]::GetEnvironmentVariable('SystemDrive'))\8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /pid 6212 & timeout /t 1 /nobreak & fsutil file setzerodata offset = 0 length = 2579398 "C:\Users\Admin\AppData\Local\Temp\a\jy45Wqr.exe" & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\jy45Wqr.exe"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 62126⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 1 /nobreak6⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setzerodata offset = 0 length = 2579398 "C:\Users\Admin\AppData\Local\Temp\a\jy45Wqr.exe"6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\viewer.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\viewer.exeC:\Users\Admin\AppData\Local\Temp\a\viewer.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-U7M55.tmp\viewer.tmp"C:\Users\Admin\AppData\Local\Temp\is-U7M55.tmp\viewer.tmp" /SL5="$90252,1007681,830976,C:\Users\Admin\AppData\Local\Temp\a\viewer.exe"5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\viewer.exe" /VERYSILENT6⤵
-
C:\Users\Admin\AppData\Local\Temp\a\viewer.exeC:\Users\Admin\AppData\Local\Temp\a\viewer.exe /VERYSILENT7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CE8C2.tmp\viewer.tmp"C:\Users\Admin\AppData\Local\Temp\is-CE8C2.tmp\viewer.tmp" /SL5="$902EC,1007681,830976,C:\Users\Admin\AppData\Local\Temp\a\viewer.exe" /VERYSILENT8⤵
-
C:\ProgramData\InstTradingwi\TradeViewer.exe"C:\ProgramData\InstTradingwi\TradeViewer.exe"9⤵
-
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\SCREEN~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SCREEN~1.EXEC:\Users\Admin\AppData\Local\Temp\a\SCREEN~1.EXE4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.6.9.9400\7fb8171425ae1102\ScreenConnect.ClientSetup.msi"5⤵
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\System32\msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.6.9.9400\7fb8171425ae1102\ScreenConnect.ClientSetup.msi6⤵
- Event Triggered Execution: Installer Packages
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\random.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\random.exeC:\Users\Admin\AppData\Local\Temp\a\random.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Alger.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Alger.exeC:\Users\Admin\AppData\Local\Temp\a\Alger.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\nigganet.exe"C:\Users\Admin\AppData\Local\Temp\nigganet.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\oi.exe"C:\Users\Admin\AppData\Local\Temp\oi.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\oi.exeC:\Users\Admin\AppData\Local\Temp\oi.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe6⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe7⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe9⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe10⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe11⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe12⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe13⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13036 -s 4329⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10124 -s 4607⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2464 -s 3005⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 3003⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Restter.exe"C:\Users\Admin\AppData\Local\Temp\Restter.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"3⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MsEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\9frrlll.exec:\9frrlll.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\2248266.exec:\2248266.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\frffxfr.exec:\frffxfr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\06248.exec:\06248.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\djppp.exec:\djppp.exe7⤵
-
\??\c:\btnnth.exec:\btnnth.exe8⤵
-
\??\c:\88666.exec:\88666.exe9⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe10⤵
-
\??\c:\xflfxxx.exec:\xflfxxx.exe11⤵
-
\??\c:\000828.exec:\000828.exe12⤵
-
\??\c:\22826.exec:\22826.exe13⤵
-
\??\c:\666044.exec:\666044.exe14⤵
-
\??\c:\hhntnb.exec:\hhntnb.exe15⤵
-
\??\c:\62262.exec:\62262.exe16⤵
-
\??\c:\hhnttn.exec:\hhnttn.exe17⤵
-
\??\c:\4006628.exec:\4006628.exe18⤵
-
\??\c:\o826048.exec:\o826048.exe19⤵
-
\??\c:\5ttttb.exec:\5ttttb.exe20⤵
-
\??\c:\600462.exec:\600462.exe21⤵
-
\??\c:\1lfrfxl.exec:\1lfrfxl.exe22⤵
-
\??\c:\88626.exec:\88626.exe23⤵
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe24⤵
-
\??\c:\xrllrrx.exec:\xrllrrx.exe25⤵
-
\??\c:\thbttb.exec:\thbttb.exe26⤵
-
\??\c:\nnbbbb.exec:\nnbbbb.exe27⤵
-
\??\c:\224484.exec:\224484.exe28⤵
-
\??\c:\hbnnbb.exec:\hbnnbb.exe29⤵
-
\??\c:\nnttnh.exec:\nnttnh.exe30⤵
-
\??\c:\9nntnb.exec:\9nntnb.exe31⤵
-
\??\c:\88288.exec:\88288.exe32⤵
-
\??\c:\ppjdp.exec:\ppjdp.exe33⤵
-
\??\c:\2266662.exec:\2266662.exe34⤵
-
\??\c:\pjjjj.exec:\pjjjj.exe35⤵
-
\??\c:\pvvvj.exec:\pvvvj.exe36⤵
-
\??\c:\s4444.exec:\s4444.exe37⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe38⤵
-
\??\c:\5nbbtb.exec:\5nbbtb.exe39⤵
-
\??\c:\djppp.exec:\djppp.exe40⤵
-
\??\c:\3jpvv.exec:\3jpvv.exe41⤵
-
\??\c:\4006626.exec:\4006626.exe42⤵
-
\??\c:\9hntnn.exec:\9hntnn.exe43⤵
-
\??\c:\tnnhbh.exec:\tnnhbh.exe44⤵
-
\??\c:\nnthnn.exec:\nnthnn.exe45⤵
-
\??\c:\0280006.exec:\0280006.exe46⤵
-
\??\c:\hntnnt.exec:\hntnnt.exe47⤵
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe48⤵
-
\??\c:\1ffrlfx.exec:\1ffrlfx.exe49⤵
-
\??\c:\xfxxrll.exec:\xfxxrll.exe50⤵
-
\??\c:\00226.exec:\00226.exe51⤵
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe52⤵
-
\??\c:\5ppjj.exec:\5ppjj.exe53⤵
-
\??\c:\8620422.exec:\8620422.exe54⤵
-
\??\c:\c002888.exec:\c002888.exe55⤵
-
\??\c:\9jjvp.exec:\9jjvp.exe56⤵
-
\??\c:\0020240.exec:\0020240.exe57⤵
-
\??\c:\7rrfxrl.exec:\7rrfxrl.exe58⤵
-
\??\c:\pvddp.exec:\pvddp.exe59⤵
-
\??\c:\ddjjj.exec:\ddjjj.exe60⤵
-
\??\c:\48444.exec:\48444.exe61⤵
-
\??\c:\004488.exec:\004488.exe62⤵
-
\??\c:\dpdpp.exec:\dpdpp.exe63⤵
-
\??\c:\20048.exec:\20048.exe64⤵
-
\??\c:\668840.exec:\668840.exe65⤵
-
\??\c:\88220.exec:\88220.exe66⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe67⤵
-
\??\c:\bnhbnn.exec:\bnhbnn.exe68⤵
-
\??\c:\k68044.exec:\k68044.exe69⤵
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe70⤵
-
\??\c:\nnntnt.exec:\nnntnt.exe71⤵
-
\??\c:\pppdp.exec:\pppdp.exe72⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe73⤵
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe74⤵
-
\??\c:\bnhhht.exec:\bnhhht.exe75⤵
-
\??\c:\4828266.exec:\4828266.exe76⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe77⤵
-
\??\c:\dvpjv.exec:\dvpjv.exe78⤵
-
\??\c:\002828.exec:\002828.exe79⤵
-
\??\c:\jjddv.exec:\jjddv.exe80⤵
-
\??\c:\88004.exec:\88004.exe81⤵
-
\??\c:\5vpjd.exec:\5vpjd.exe82⤵
-
\??\c:\08864.exec:\08864.exe83⤵
-
\??\c:\hbtnhh.exec:\hbtnhh.exe84⤵
-
\??\c:\rrrlllf.exec:\rrrlllf.exe85⤵
-
\??\c:\82222.exec:\82222.exe86⤵
-
\??\c:\000262.exec:\000262.exe87⤵
-
\??\c:\44226.exec:\44226.exe88⤵
-
\??\c:\djppp.exec:\djppp.exe89⤵
-
\??\c:\08822.exec:\08822.exe90⤵
-
\??\c:\2288284.exec:\2288284.exe91⤵
-
\??\c:\60686.exec:\60686.exe92⤵
-
\??\c:\2662600.exec:\2662600.exe93⤵
-
\??\c:\5hnhhb.exec:\5hnhhb.exe94⤵
-
\??\c:\3htnnb.exec:\3htnnb.exe95⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe96⤵
-
\??\c:\60828.exec:\60828.exe97⤵
-
\??\c:\g8428.exec:\g8428.exe98⤵
-
\??\c:\26828.exec:\26828.exe99⤵
-
\??\c:\3fffrxx.exec:\3fffrxx.exe100⤵
-
\??\c:\04048.exec:\04048.exe101⤵
-
\??\c:\2248828.exec:\2248828.exe102⤵
-
\??\c:\440000.exec:\440000.exe103⤵
-
\??\c:\dvjdp.exec:\dvjdp.exe104⤵
-
\??\c:\jdpjp.exec:\jdpjp.exe105⤵
-
\??\c:\w00262.exec:\w00262.exe106⤵
-
\??\c:\lflfxxx.exec:\lflfxxx.exe107⤵
-
\??\c:\884828.exec:\884828.exe108⤵
-
\??\c:\vppvd.exec:\vppvd.exe109⤵
-
\??\c:\0448264.exec:\0448264.exe110⤵
-
\??\c:\26844.exec:\26844.exe111⤵
-
\??\c:\04000.exec:\04000.exe112⤵
-
\??\c:\9jdvp.exec:\9jdvp.exe113⤵
-
\??\c:\666082.exec:\666082.exe114⤵
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe115⤵
-
\??\c:\26262.exec:\26262.exe116⤵
-
\??\c:\m2600.exec:\m2600.exe117⤵
-
\??\c:\i860448.exec:\i860448.exe118⤵
-
\??\c:\w66666.exec:\w66666.exe119⤵
-
\??\c:\ddpvv.exec:\ddpvv.exe120⤵
-
\??\c:\7nbtnt.exec:\7nbtnt.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-