Analysis
- user interaction
yes - max time kernel
887s - max time network
895s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 17:18
General
- Target main.exe
- Size 83.9MB
- Sample260703-vvmfkac15s
- SHA256 53f4cb88f4769f076a0f2f4be9f7431b8185308d9ed2012a78361c1fe872ef01
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
- Executes dropped EXE 15 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 32 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 30 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 17 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 30 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 52 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 9 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious behavior: RenamesItself 2 IoCs
- Suspicious use of AdjustPrivilegeToken 52 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c move "C:\Users\Admin\AppData\Local\Temp\main.exe" "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious behavior: RenamesItself
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "?p 2""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "?p 2"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command ?w"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ?w4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command term"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command term4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\"""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path C:\YourFolder\file.txt""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path C:\YourFolder\file.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path C:\YourFolder\New Folder""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path C:\YourFolder\New Folder"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path C:\Users\Admin\Desktop\New Folder -Recurse -Force""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path C:\Users\Admin\Desktop\New Folder -Recurse -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\" -Recurse -Force""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\" -Recurse -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New\"""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New\""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "?p 100""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "?p 100"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command https://f002.backblazeb2.com/file/windows-turbo/TurboVPN_setup.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command https://f002.backblazeb2.com/file/windows-turbo/TurboVPN_setup.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "?purge 1000""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "?purge 1000"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Invoke-Item -Path \"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe\"""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Invoke-Item -Path \"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe\""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Expand-Archive -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\XenoExecutor.zip\" -DestinationPath \"C:\Users\Admin\Desktop\XenoExecutor\" -Force""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Expand-Archive -LiteralPath \"C:\Users\Admin\AppData\Local\Temp\XenoExecutor.zip\" -DestinationPath \"C:\Users\Admin\Desktop\XenoExecutor\" -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ChildItem -Path \"C:\Users\Admin\Desktop\XenoExecutor\"""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-ChildItem -Path \"C:\Users\Admin\Desktop\XenoExecutor\""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "dir \"C:\Users\Admin\Desktop\XenoExecutor\"""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "dir \"C:\Users\Admin\Desktop\XenoExecutor\""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ChildItem -Path \"C:\Users\Admin\Desktop\XenoExecutor\" -Filter *.exe""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-ChildItem -Path \"C:\Users\Admin\Desktop\XenoExecutor\" -Filter *.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "& \"C:\Users\Admin\Desktop\XenoExecutor\XenoExecutor.exe\"""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "& \"C:\Users\Admin\Desktop\XenoExecutor\XenoExecutor.exe\""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "% C:\Users\Admin\Desktop\XenoExecutor\XenoExecutor\XenoExecutor.exe""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "% C:\Users\Admin\Desktop\XenoExecutor\XenoExecutor\XenoExecutor.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\main.exeC:\Users\Admin\AppData\Local\Temp\main.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\main.exeC:\Users\Admin\AppData\Local\Temp\main.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c move "C:\Users\Admin\AppData\Local\Temp\main.exe" "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious behavior: RenamesItself
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "?p 2""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "?p 2"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command ?w"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ?w4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command term"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command term4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\"""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path C:\YourFolder\file.txt""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path C:\YourFolder\file.txt"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path C:\YourFolder\New Folder""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path C:\YourFolder\New Folder"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path C:\Users\Admin\Desktop\New Folder -Recurse -Force""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path C:\Users\Admin\Desktop\New Folder -Recurse -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\" -Recurse -Force""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New Folder\" -Recurse -Force"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New\"""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Remove-Item -Path \"C:\Users\Admin\Desktop\New\""4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Get-ChildItem -Path \"$HOME\Desktop\" -Directory"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "?p 100""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "?p 100"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command https://f002.backblazeb2.com/file/windows-turbo/TurboVPN_setup.exe"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command https://f002.backblazeb2.com/file/windows-turbo/TurboVPN_setup.exe4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "?purge 1000""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "?purge 1000"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command """3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command ""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -Command "Invoke-Item -Path \"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe\"""3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "Invoke-Item -Path \"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe\""4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" "c" /S6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" "C:\Program Files (x86)\TurboVPN" -removeCalloutDriver "C:\Program Files (x86)\TurboVPN" /S6⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" "C:\Program Files (x86)\TurboVPN" -installCalloutDriver "C:\Program Files (x86)\TurboVPN" /S6⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe"C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe" install6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bb32c2f7-faa3-0e46-b8f6-00a196fce657}\oemvista.inf" "9" "4d14a44ff" "0000000000000184" "WinSta0\Default" "0000000000000188" "208" "c:\program files (x86)\turbovpn\driver32\driver_win10_x64"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000184" "926c"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe"C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\TurboVPN\TurboVPN.exe"C:\Program Files (x86)\TurboVPN\TurboVPN.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\route.exeC:\Windows\system32\route delete mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" -removeCalloutDriver C:\Program Files (x86)\TurboVPN /S2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" -removeCalloutDriver C:\Program Files (x86)\TurboVPN /S2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3068.5412.3974467307056211951 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\.TurboVPN\EBWebView /prefetch:4 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.TurboVPN\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa10c15fd8,0x7ffa10c15fe4,0x7ffa10c15ff03⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2480 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3392 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3980 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=828 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4808 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.5.2.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4364 --field-trial-handle=1752,i,10184697580435948109,3762153889448469925,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a407f8dc1d901e76b7e5891228efe67a0ce74c5f3⤵
-
-
-
C:\Windows\SysWOW64\route.exeC:\Windows\system32\route delete mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\route.exeroute delete2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.0.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.12.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.25.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\route.exeroute delete 0.0.0.0 mask 128.0.0.02⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\route.exeroute delete 128.0.0.02⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\TurboVPN\ssrxray\ssrxray.exessrxray.exe --xray-config xray.json --ssr-config ssr.xray --auth-type 81922⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\TurboVPN\xray\xray.exerun -config xray.json -format json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\TurboVPN\ssrxray\ssrxray.exessrxray.exe --xray-config xray.json --ssr-config ssr.xray --auth-type 81922⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\TurboVPN\xray\xray.exerun -config xray.json -format json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\TurboVPN\tun2socks.exe"C:\Program Files (x86)\TurboVPN/tun2socks.exe" -tunAddr 10.0.0.2 -tunGw 10.0.0.1 -tunDns 8.8.8.8,8.8.4.4 -proxyType socks -proxyServer 127.0.0.1:35274 10.0.0.12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh interface ip set address "Local Area Connection" dhcp3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh interface ip set dns "Local Area Connection" dhcp3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
TurboVPN.exe
3c278d95abc02e5bbbc436837308814b.zip
f7757a77dd18d0446f68f2708b6fa3e9.zip
settings.dat
settings.dat
7786f933-6f3b-4cf7-8104-09c175bd95fd.tmp
f_000009
the-real-index
the-real-index
the-real-index
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe60cc8b.TMP
SCT Auditing Pending Reports
Preferences
Preferences
CURRENT
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State~RFe60060f.TMP
StartupProfileData-NonInteractive
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_http_parser.cp313-win_amd64.pyd
_http_writer.cp313-win_amd64.pyd
mask.cp313-win_amd64.pyd
reader_c.cp313-win_amd64.pyd
_audioop.pyd
base_library.zip
_frozenlist.cp313-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_multidict.cp313-win_amd64.pyd
_helpers_c.cp313-win_amd64.pyd
_pydantic_core.cp313-win_amd64.pyd
python3.dll
python313.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
_quoting_c.cp313-win_amd64.pyd
INSTALLER
__PSScriptPolicyTest_12ommlfi.gcd.ps1
BgWorker.dll
myinternet.dll
nsExec.dll
nsNiuniuSkin.dll
nsProcess.dll
System.dll
logo.ico
skin.zip
oemvista.inf_amd64_6d4bec28a2ef0cdf.ini
memory/456-3189-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3188-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3190-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3191-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3192-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3193-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3182-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/456-3184-0x000001F10DFB0000-0x000001F10DFB1000-memory.dmp
memory/1784-2345-0x00000159F6A40000-0x00000159F6AF2000-memory.dmp
memory/1844-3050-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-4001-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3968-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3906-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3964-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3960-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3956-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3070-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3946-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3942-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3090-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3110-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3117-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3120-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3938-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3934-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3169-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3181-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3989-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3975-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-4005-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-4009-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-4013-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-4017-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3930-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-4021-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3926-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3922-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3918-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3284-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3914-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3910-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3654-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3860-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3877-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3892-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/1844-3899-0x0000000000400000-0x00000000011F1000-memory.dmp
memory/2032-3201-0x000001FAFC880000-0x000001FAFC932000-memory.dmp
memory/2032-3203-0x000001FAFC860000-0x000001FAFC86A000-memory.dmp
memory/2032-3202-0x000001FAFCBA0000-0x000001FAFCBB2000-memory.dmp
memory/3048-2434-0x000002A1C1B40000-0x000002A1C1BF2000-memory.dmp
memory/3504-2825-0x00007FFA23980000-0x00007FFA23981000-memory.dmp
memory/3504-2952-0x000002941BF50000-0x000002941BFF7000-memory.dmp
memory/4276-2309-0x0000016DEB120000-0x0000016DEB128000-memory.dmp
memory/4276-2311-0x0000016DEB160000-0x0000016DEB16A000-memory.dmp
memory/4276-2310-0x0000016DEB150000-0x0000016DEB156000-memory.dmp
memory/4276-2306-0x0000016DEB130000-0x0000016DEB14E000-memory.dmp
memory/4276-2307-0x0000016DEB110000-0x0000016DEB11A000-memory.dmp
memory/4424-2296-0x0000019D55250000-0x0000019D55272000-memory.dmp
memory/4424-2308-0x0000019D6D530000-0x0000019D6D54C000-memory.dmp
memory/4424-2301-0x0000019D6D3E0000-0x0000019D6D3FE000-memory.dmp
memory/4424-2303-0x0000019D6D4C0000-0x0000019D6D4CA000-memory.dmp
memory/4424-2302-0x0000019D6D400000-0x0000019D6D4B2000-memory.dmp
memory/4648-2444-0x000001A33A8F0000-0x000001A33A9A2000-memory.dmp
memory/4784-2407-0x00000289E07B0000-0x00000289E0862000-memory.dmp
memory/5272-2955-0x000002139DD40000-0x000002139DDE7000-memory.dmp
memory/5360-2326-0x000001E434450000-0x000001E434502000-memory.dmp
memory/5900-2951-0x0000020793B70000-0x0000020793C17000-memory.dmp
memory/5900-2737-0x00007FFA23980000-0x00007FFA23981000-memory.dmp
memory/6032-3132-0x00007FFA23180000-0x00007FFA23181000-memory.dmp
memory/6032-3133-0x00007FFA22870000-0x00007FFA22871000-memory.dmp