pooi.moe

duckduckgo.com

adobe.com

raindrop.io

www.sysinternals.com

asp.net

beiramarliving-cycles.zip

zeronet-win-dist-win64.zip

wxhexeditor-v0.24-win32.zip

rootkitrevealer.zip

ultimatetemplate-master.zip

96.zip

js.zip

jackaudio.org

shapez.io

windows.management

don.h@free.fr

service.exe

coresync.exe

c:\program files\adobe\adobe creative cloud\acc\creative cloud helper.exe

displayfusionhookapp32.exe

old_overwolf.exe

overwolfhelper64.exe

insightscapture.exe

steam.exe

node.js

c:\program files\adobe\adobe creative cloud\acc\creative cloud.exe

c:\program files\common files\adobe\creative cloud libraries\libs\node.exe

c:\program files\libreoffice\program\soffice.exe

c:\program files\libreoffice\program\swriter.exe

c:\program files\malwarebytes\anti-malware\mbamtray.exe

alwaysontop.exe

fancyzones.exe

boardmanagerengine.exe

powerocr.exe

yourphoneappproxy.exe

index.exe

mpcopyaccelerator.exe

c:\riot games\league of legends\leagueclientux.exe

c:\riot games\league of legends\leaguecrashhandler.exe

c:\riot games\riot client\riotclientcrashhandler.exe

wow64hookhelper.exe

helper.exe

c:\users\tatrii\appdata\local\programs\bitwarden\bitwarden.exe

eartrumpet.exe

c:\program files\maxon\tools\mxnotify.exe

c:\laragon\bin\notepad++\notepad++.exe

c:\program files\loud technologies inc\mackie usb driver\w10_x64\mackie_cplapp.exe

c:\users\tatrii\appdata\local\programs\microsoft vs code\code.exe

services.exe

c:\program files\maxon\tools\mxredirect.exe

c:\program files\microsoft sql server\90\shared\sqlwriter.exe

steamservice.exe

svchost.exe

c:\windows\immersivecontrolpanel\systemsettings.exe

c:\windows\system32\dllhost.exe

c:\windows\system32\mousocoreworker.exe

webcam.exe

ccxprocess.exe

msedge.exe

c:\users\tatrii\appdata\local\programs\mobalytics-desktop\mobalytics desktop.exe

c:\program files\openvpn\bin\openvpn-gui.exe

c:\users\tatrii\appdata\roaming\spotify\spotify.exe

chrmstp.exe

launchy.exe

overwolfupdater.exe

c:\windows\explorer.exe

c:\program files\npcap\checkstatus.bat

newtab.html

npadobeaamdetect64.dll

adobeupdateservice.exe

easyanticheat.exe

gubootservice.exe

c:\windows\system32\lxss\wslclient.dll

gamemanagerservice.exe

c:\program files\windows defender advanced threat protection\mssense.exe

c:\program files\teracopy\teracopyservice.exe

c:\windows\system32\driverstore\filerepository\nv_dispsig.inf

containerlocalsystem.log

%programfiles(x86)%\winpcap\rpcapd.ini

c:\windows\system32\drivers\bthhfenum.sys

c:\program files\systeminformer\systeminformer.sys

c:\windows\system32\drivers\loudusbaudioks.sys

c:\windows\system32\drivers\mbamelam.sys

c:\windows\system32\drivers\neo6_x64_vpn.sys

c:\windows\system32\drivers\npf.sys

www.sys

c:\windows\system32\drivers\rspwhy64.sys

c:\windows\system32\drivers\rzdev_00b6.sys

c:\windows\system32\drivers\tap0901.sys

c:\windows\system32\drivers\vbaudio_vmvaio64_win10.sys

c:\windows\system32\drivers\wd\wdfilter.sys

c:\windows\system32\drivers\wintun.sys

c:\users\tatrii\desktop\frst64.exe

2.exe

c:\users\tatrii\downloads\laragon-wamp.exe

3.url

c:\users\tatrii\downloads\izotope_vocalsynth_pro_v2_5_0.exe

4-win64.zip

c:\users\tatrii\downloads\beiramarliving-cycles.zip

c:\windows\syswow64\synsoemu.dll

c:\users\tatrii\desktop\scripts   2022-11-26 04:41 - 2022-11-26 04:41 - 000000000 ____d c:\programdata\microsoft\windows\start menu\programs\node.js

c:\users\tatrii\downloads\filejuggler.exe

c:\windows\system32\freeimage.dll

24-win32.zip

c:\users\tatrii\downloads\hitmanpro_x64.exe

c:\windows\syswow64\npcap   2022-11-23 03:05 - 2022-11-23 03:05 - 000000000 ____d c:\windows\system32\npcap   2022-11-23 03:05 - 2022-11-23 03:05 - 000000000 ____d c:\users\tatrii\appdata\roaming\fingagent   2022-11-23 03:05 - 2022-11-23 03:05 - 000000000 ____d c:\users\tatrii\appdata\local\fing-updater   2022-11-23 03:05 - 2022-11-23 03:05 - 000000000 ____d c:\programdata\fingagent   2022-11-23 03:05 - 2022-11-23 03:05 - 000000000 ____d c:\program files\npcap   2022-11-23 03:05 - 2022-11-23 03:05 - 000000000 ____d c:\program files\fing   2022-11-23 02:50 - 2022-11-23 02:50 - 000468618 _____ c:\users\tatrii\downloads\depends22_x64.zip

c:\users\tatrii\downloads\googleearthprosetup.exe

c:\users\tatrii\downloads\advisorinstaller.exe

c:\windows\syswow64\ff_vfw.dll

c:\users\tatrii\desktop\gps.txt

c:\users\tatrii\downloads\gg011411.mp4

c:\users\tatrii\downloads\tumblr_mkzuekbssg1rjfqwso1_500.mp4

c:\users\tatrii\downloads\us-500.csv

c:\users\tatrii\downloads\mobalytics desktop - installer.exe

c:\users\tatrii\desktop\rootkitrevealer.zip

c:\users\tatrii\downloads\openhashtab_setup.exe

c:\users\tatrii\downloads\hello_p5_song_2022_11_20_11_29_17   2022-11-20 05:29 - 2022-11-20 05:29 - 004458926 _____ c:\users\tatrii\downloads\hello_p5_song_2022_11_20_11_29_17.zip

1.zip

6.zip

0_setup.exe

c:\windows\syswow64\directx   2022-11-18 02:45 - 2022-11-18 02:45 - 000000000 ____d c:\users\tatrii\appdata\roaming\microsoft\windows\start menu\programs\rivatuner statistics server   2022-11-18 02:45 - 2022-11-18 02:45 - 000000000 ____d c:\users\tatrii\appdata\roaming\microsoft\windows\start menu\programs\msi afterburner   2022-11-18 02:44 - 2022-11-18 02:44 - 055532428 _____ c:\users\tatrii\downloads\msiafterburnersetup.zip

56.zip

4_portable.zip

c:\programdata\sectaskman   2022-11-15 07:22 - 2022-11-15 07:22 - 003029920 _____ c:\users\tatrii\downloads\securitytaskmanager_setup.exe

c:\users\public\documents\adobeinstalledcodecstier2   2022-11-15 03:58 - 2022-11-15 03:58 - 000031286 _____ c:\users\tatrii\desktop\un_a.rar

c:\users\tatrii\appdata\local\eset   2022-11-15 03:45 - 2022-11-15 03:46 - 000001622 _____ c:\users\tatrii\desktop\rkill.txt

1806.msi

c:\windows\libjack64.dll

0_windows-64.exe

221027.zip

c:\users\tatrii\downloads\izotope_ozone_advanced_v10_2_0.exe

c:\users\tatrii\downloads\izotope_nectar_pro_v3_8_0.exe

c:\users\tatrii\downloads\whysoslowsetup.exe

8-i601-amd64.msi

c:\windows\system32\vpncmd.exe

830-release.msi

c:\windows\syswow64\wrap_oal.dll

c:\windows\syswow64\openal32.dll

c:\windows\syswow64\vp6vfw.dll

c:\programdata\iobit   2022-11-03 11:43 - 2022-11-03 11:44 - 000000000 ____d c:\users\tatrii\appdata\locallow\iobit   2022-11-03 11:42 - 2022-11-03 11:42 - 000000000 ____d c:\users\tatrii\appdata\local\elevateddiagnostics   2022-11-03 11:35 - 2022-11-03 13:43 - 000000000 ____d c:\users\tatrii\appdata\local\google   2022-11-03 11:13 - 2022-11-03 11:13 - 000688128 _____ c:\windows\system32\fsnvsdevicesource.dll

c:\windows\system32\nettraceex.dll

c:\users\tatrii\downloads\kms_vl_all_aio-48.7z

c:\windows\system32\drivers\nvhdap64.dll

c:\windows\system32\vulkaninfo.exe

c:\windows\syswow64\vulkaninfo.exe

c:\windows\system32\vulkan-1-999-0-0-0.dll

c:\windows\syswow64\opencl.dll

c:\windows\syswow64\vulkan-1.dll

c:\windows\syswow64\nvifr.dll

c:\windows\system32\nvml.dll

c:\windows\system32\nvfbc64.dll

c:\windows\system32\nvencodeapi64.dll

c:\windows\system32\nvidia-smi.exe

c:\windows\system32\nvcuvid.dll

c:\windows\system32\nvcpl.dll

c:\windows\system32\nvcuda.dll

c:\windows\system32\mcu.exe

c:\users\tatrii\appdata\local\displayfusion   2022-11-02 21:18 - 2022-11-02 21:18 - 000000000 ____d c:\programdata\binary fortress software   2022-11-02 21:17 - 2022-11-02 21:17 - 000000222 _____ c:\users\tatrii\desktop\displayfusion.url

c:\programdata\microsoft\windows\start menu\programs\steam   2022-11-02 17:37 - 2022-11-02 17:37 - 000000000 ____d c:\program files\microsoft update health tools   2022-11-02 17:27 - 2022-11-29 20:34 - 000042966 _____ c:\users\tatrii\appdata\roaming\voicemeeterbananadefault.xml

c:\users\tatrii\appdata\roaming\microsoft\windows\start menu\programs\winrar   2022-11-02 05:45 - 2022-11-11 04:07 - 000000000 ____d c:\programdata\microsoft\windows\start menu\programs\winrar   2022-11-02 05:45 - 2022-11-02 05:45 - 000000000 ____d c:\users\tatrii\appdata\roaming\winrar   2022-11-02 05:45 - 2022-11-02 05:45 - 000000000 ____d c:\program files\winrar   2022-11-02 05:29 - 2022-11-02 14:04 - 000000000 ____d c:\users\tatrii\downloads\3d   2022-11-02 05:28 - 2022-11-02 05:28 - 000000000 ____d c:\users\tatrii\appdata\roaming\microsoft\windows\start menu\programs\blender   2022-11-02 05:28 - 2022-11-02 05:28 - 000000000 ____d c:\program files\blender foundation   2022-11-02 05:11 - 2022-11-02 05:11 - 000000000 ___rd c:\users\tatrii\onedrive   2022-11-02 05:11 - 2022-11-02 05:11 - 000000000 ____d c:\programdata\microsoft onedrive   2022-11-02 05:10 - 2022-12-01 06:37 - 000000000 ____d c:\users\tatrii\appdata\local\packages   2022-11-02 05:10 - 2022-11-29 20:41 - 000000000 ____d c:\programdata\packages   2022-11-02 05:10 - 2022-11-16 23:45 - 000000000 ____d c:\users\tatrii\appdata\local\virtualstore   2022-11-02 05:10 - 2022-11-15 06:40 - 000000000 ____d c:\users\tatrii\appdata\roaming\adobe   2022-11-02 05:10 - 2022-11-02 14:24 - 000000000 ____d c:\users\tatrii\appdata\local\connecteddevicesplatform   2022-11-02 05:10 - 2022-11-02 14:19 - 000000000 __rhd c:\users\public\accountpictures   2022-11-02 05:10 - 2022-11-02 05:10 - 000000000 ___rd c:\users\tatrii\3d objects   2022-11-02 05:10 - 2022-11-02 05:10 - 000000000 ____d c:\windows\csc   2022-11-02 05:10 - 2022-11-02 00:24 - 000000000 ____d c:\users\tatrii\appdata\local\publishers   2022-11-02 05:09 - 2022-12-01 16:18 - 000000000 ____d c:\users\tatrii   2022-11-02 05:09 - 2022-11-02 05:09 - 000000020 ___sh c:\users\tatrii\ntuser.ini

c:\dumpstack.log

c:\programdata\riot games   2022-12-02 16:42 - 2022-11-01 22:15 - 000840878 _____ c:\windows\system32\perfstringbackup.ini

c:\windows\syswow64\dplayx.dll

c:\windows\syswow64\dpwsockx.dll

c:\windows\syswow64\dpnsvr.exe

c:\windows\syswow64\dpnhupnp.dll

c:\windows\syswow64\dpnlobby.dll

c:\windows\system32\dpnet.dll

c:\windows\system32\dpnsvr.exe

c:\windows\system32\dpnhpast.dll

c:\windows\system32\dpnaddr.dll

c:\windows\system32\wslconfig.exe

c:\windows\system32\drivers\lxss.sys

c:\windows\system32\drivers\p9rdr.sys

c:\windows\system32\mrt.exe

c:\users\tatrii\appdata\roaming\voicemeeterbananadefault.xml

frst.txt

0.208.1.4

192.168.0.1

8.8.8.8

3.0.17.4

2.1.0.45

https://duckduckgo.com/?q={searchterms}

https://duckduckgo.com/ac/?q={searchterms}&type=list

HKLM\...\Run

HKU\S-1-5-21-3004531056-1595194505-3402979578-1001\...\Run

HKCU\Software\Microsoft\Windows\CurrentVersion\Run