Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
setup_x86_...0).exe
windows10_x64
setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows10_x64
10setup_x86_...3).exe
windows10_x64
10setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows10_x64
setup_x86_...6).exe
windows10_x64
setup_x86_...7).exe
windows10_x64
10setup_x86_...8).exe
windows10_x64
10setup_x86_...9).exe
windows10_x64
10setup_x86_...2).exe
windows10_x64
setup_x86_...0).exe
windows10_x64
10setup_x86_...1).exe
windows10_x64
setup_x86_...2).exe
windows10_x64
setup_x86_...3).exe
windows10_x64
10setup_x86_...3).exe
windows10_x64
setup_x86_...4).exe
windows10_x64
setup_x86_...5).exe
windows10_x64
setup_x86_...6).exe
windows10_x64
setup_x86_...7).exe
windows10_x64
setup_x86_...8).exe
windows10_x64
setup_x86_...9).exe
windows10_x64
setup_x86_...я.exe
windows10_x64
setup_x86_...ll.exe
windows10_x64
Resubmissions
11/07/2024, 05:43
240711-gej4lstgrf 1006/09/2021, 14:13
210906-rjpvrsedbm 1008/07/2021, 11:08
210708-4gztl3mwl6 1008/07/2021, 08:02
210708-klfb4qeda6 1007/07/2021, 09:39
210707-nem57xyvf2 1006/07/2021, 17:51
210706-7pcrmjy3fa 1006/07/2021, 13:45
210706-eybelwcq86 10Analysis
-
max time kernel
5s -
max time network
333s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
25/06/2021, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install - копия (10).exe
Resource
win10v20210410
Behavioral task
behavioral2
Sample
setup_x86_x64_install - копия (11).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
setup_x86_x64_install - копия (12).exe
Resource
win10v20210410
Behavioral task
behavioral4
Sample
setup_x86_x64_install - копия (13).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
setup_x86_x64_install - копия (14).exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install - копия (15).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
setup_x86_x64_install - копия (16).exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
setup_x86_x64_install - копия (17).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
setup_x86_x64_install - копия (18).exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
setup_x86_x64_install - копия (19).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
setup_x86_x64_install - копия (2).exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
setup_x86_x64_install - копия (20).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
setup_x86_x64_install - копия (21).exe
Resource
win10v20210408
Behavioral task
behavioral14
Sample
setup_x86_x64_install - копия (22).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
setup_x86_x64_install - копия (23).exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
setup_x86_x64_install - копия (3).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
setup_x86_x64_install - копия (4).exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
setup_x86_x64_install - копия (5).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
setup_x86_x64_install - копия (6).exe
Resource
win10v20210410
Behavioral task
behavioral20
Sample
setup_x86_x64_install - копия (7).exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
setup_x86_x64_install - копия (8).exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
setup_x86_x64_install - копия (9).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
setup_x86_x64_install - копия.exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Errors
General
-
Target
setup_x86_x64_install - копия.exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral23/memory/2456-331-0x0000000002E70000-0x0000000003796000-memory.dmp family_glupteba behavioral23/memory/2456-337-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral23/memory/4324-238-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral23/memory/4324-241-0x0000000000417F26-mapping.dmp family_redline behavioral23/memory/5064-287-0x00000000048C0000-0x0000000004904000-memory.dmp family_redline behavioral23/memory/4400-298-0x0000000000417E22-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral23/memory/3772-315-0x0000000002600000-0x000000000269D000-memory.dmp Vidar behavioral23/memory/3772-316-0x0000000000400000-0x0000000000949000-memory.dmp Vidar behavioral23/memory/2124-325-0x00000000025A0000-0x000000000263D000-memory.dmp Vidar behavioral23/memory/2124-327-0x0000000000400000-0x0000000000949000-memory.dmp Vidar -
resource yara_rule behavioral23/files/0x000100000001ab52-118.dat aspack_v212_v242 behavioral23/files/0x000100000001ab52-119.dat aspack_v212_v242 behavioral23/files/0x000100000001ab50-127.dat aspack_v212_v242 behavioral23/files/0x000100000001ab50-129.dat aspack_v212_v242 behavioral23/files/0x000100000001ab4d-124.dat aspack_v212_v242 behavioral23/files/0x000100000001ab4e-122.dat aspack_v212_v242 behavioral23/files/0x000100000001ab4d-121.dat aspack_v212_v242 behavioral23/files/0x000100000001ab4e-120.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
pid Process 2496 setup_installer.exe 4052 setup_install.exe 3772 arnatic_1.exe 3956 arnatic_5.exe 3948 arnatic_4.exe 492 arnatic_2.exe 2192 arnatic_3.exe 3860 arnatic_6.exe 1808 arnatic_7.exe -
resource yara_rule behavioral23/files/0x000100000001ab56-184.dat upx behavioral23/files/0x000100000001ab56-183.dat upx behavioral23/files/0x000100000001ab65-308.dat upx behavioral23/files/0x000100000001ab65-307.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation arnatic_3.exe -
Loads dropped DLL 5 IoCs
pid Process 4052 setup_install.exe 4052 setup_install.exe 4052 setup_install.exe 4052 setup_install.exe 4052 setup_install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 145 ipinfo.io 10 ip-api.com 91 ipinfo.io 92 ipinfo.io 97 ipinfo.io 148 ipinfo.io 215 api.ipify.org 263 ipinfo.io 264 ipinfo.io 13 ipinfo.io 14 ipinfo.io 122 ipinfo.io 144 ipinfo.io -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4948 4784 WerFault.exe 99 -
Delays execution with timeout.exe 4 IoCs
pid Process 5220 timeout.exe 5112 timeout.exe 5208 timeout.exe 3180 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 296 taskkill.exe 752 taskkill.exe 5808 taskkill.exe 488 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance arnatic_3.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1808 wrote to memory of 2496 1808 arnatic_7.exe 76 PID 1808 wrote to memory of 2496 1808 arnatic_7.exe 76 PID 1808 wrote to memory of 2496 1808 arnatic_7.exe 76 PID 2496 wrote to memory of 4052 2496 setup_installer.exe 77 PID 2496 wrote to memory of 4052 2496 setup_installer.exe 77 PID 2496 wrote to memory of 4052 2496 setup_installer.exe 77 PID 4052 wrote to memory of 2792 4052 setup_install.exe 80 PID 4052 wrote to memory of 2792 4052 setup_install.exe 80 PID 4052 wrote to memory of 2792 4052 setup_install.exe 80 PID 4052 wrote to memory of 3264 4052 setup_install.exe 98 PID 4052 wrote to memory of 3264 4052 setup_install.exe 98 PID 4052 wrote to memory of 3264 4052 setup_install.exe 98 PID 4052 wrote to memory of 2124 4052 setup_install.exe 108 PID 4052 wrote to memory of 2124 4052 setup_install.exe 108 PID 4052 wrote to memory of 2124 4052 setup_install.exe 108 PID 4052 wrote to memory of 3400 4052 setup_install.exe 96 PID 4052 wrote to memory of 3400 4052 setup_install.exe 96 PID 4052 wrote to memory of 3400 4052 setup_install.exe 96 PID 4052 wrote to memory of 8 4052 setup_install.exe 95 PID 4052 wrote to memory of 8 4052 setup_install.exe 95 PID 4052 wrote to memory of 8 4052 setup_install.exe 95 PID 4052 wrote to memory of 3328 4052 setup_install.exe 94 PID 4052 wrote to memory of 3328 4052 setup_install.exe 94 PID 4052 wrote to memory of 3328 4052 setup_install.exe 94 PID 4052 wrote to memory of 4092 4052 setup_install.exe 93 PID 4052 wrote to memory of 4092 4052 setup_install.exe 93 PID 4052 wrote to memory of 4092 4052 setup_install.exe 93 PID 2792 wrote to memory of 3772 2792 cmd.exe 92 PID 2792 wrote to memory of 3772 2792 cmd.exe 92 PID 2792 wrote to memory of 3772 2792 cmd.exe 92 PID 8 wrote to memory of 3956 8 cmd.exe 90 PID 8 wrote to memory of 3956 8 cmd.exe 90 PID 3264 wrote to memory of 492 3264 cmd.exe 91 PID 3264 wrote to memory of 492 3264 cmd.exe 91 PID 3264 wrote to memory of 492 3264 cmd.exe 91 PID 3400 wrote to memory of 3948 3400 cmd.exe 88 PID 3400 wrote to memory of 3948 3400 cmd.exe 88 PID 3400 wrote to memory of 3948 3400 cmd.exe 88 PID 2124 wrote to memory of 2192 2124 mmNkZtAOyz5E4L9riXKJ7qbN.exe 89 PID 2124 wrote to memory of 2192 2124 mmNkZtAOyz5E4L9riXKJ7qbN.exe 89 PID 2124 wrote to memory of 2192 2124 mmNkZtAOyz5E4L9riXKJ7qbN.exe 89 PID 3328 wrote to memory of 3860 3328 cmd.exe 84 PID 3328 wrote to memory of 3860 3328 cmd.exe 84 PID 3328 wrote to memory of 3860 3328 cmd.exe 84 PID 4092 wrote to memory of 1808 4092 cmd.exe 81 PID 4092 wrote to memory of 1808 4092 cmd.exe 81 PID 4092 wrote to memory of 1808 4092 cmd.exe 81 PID 1808 wrote to memory of 2472 1808 arnatic_7.exe 132 PID 1808 wrote to memory of 2472 1808 arnatic_7.exe 132 PID 1808 wrote to memory of 2472 1808 arnatic_7.exe 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия.exe"1⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
PID:3772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_1.exe" & del C:\ProgramData\*.dll & exit6⤵PID:4272
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_1.exe /f7⤵
- Kills process with taskkill
PID:752
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:3180
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3328
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:8
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3400
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵PID:2124
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3264
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_7.exearnatic_7.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_7.exe2⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_7.exe2⤵PID:4324
-
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub1⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_6.exearnatic_6.exe1⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\Documents\_VAdo_i5Vp7L1jEOQ3_yyIKw.exe"C:\Users\Admin\Documents\_VAdo_i5Vp7L1jEOQ3_yyIKw.exe"2⤵PID:5048
-
C:\Users\Admin\Documents\_VAdo_i5Vp7L1jEOQ3_yyIKw.exe"C:\Users\Admin\Documents\_VAdo_i5Vp7L1jEOQ3_yyIKw.exe"3⤵PID:4088
-
-
-
C:\Users\Admin\Documents\iy0Qf0i6adzLwKLFYUY1fNcR.exe"C:\Users\Admin\Documents\iy0Qf0i6adzLwKLFYUY1fNcR.exe"2⤵PID:5028
-
C:\Users\Admin\Documents\iy0Qf0i6adzLwKLFYUY1fNcR.exeC:\Users\Admin\Documents\iy0Qf0i6adzLwKLFYUY1fNcR.exe3⤵PID:4400
-
-
-
C:\Users\Admin\Documents\mmNkZtAOyz5E4L9riXKJ7qbN.exe"C:\Users\Admin\Documents\mmNkZtAOyz5E4L9riXKJ7qbN.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im mmNkZtAOyz5E4L9riXKJ7qbN.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\mmNkZtAOyz5E4L9riXKJ7qbN.exe" & del C:\ProgramData\*.dll & exit3⤵PID:4628
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mmNkZtAOyz5E4L9riXKJ7qbN.exe /f4⤵
- Kills process with taskkill
PID:296
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5208
-
-
-
-
C:\Users\Admin\Documents\0WwXVCakEMDfZdrP2Iww43Uw.exe"C:\Users\Admin\Documents\0WwXVCakEMDfZdrP2Iww43Uw.exe"2⤵PID:2456
-
C:\Users\Admin\Documents\0WwXVCakEMDfZdrP2Iww43Uw.exe"C:\Users\Admin\Documents\0WwXVCakEMDfZdrP2Iww43Uw.exe"3⤵PID:5620
-
-
-
C:\Users\Admin\Documents\Nug0wCm_us_E_3r29KvReAxV.exe"C:\Users\Admin\Documents\Nug0wCm_us_E_3r29KvReAxV.exe"2⤵PID:2180
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\85075625071.exe"3⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\85075625071.exe"C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\85075625071.exe"4⤵PID:5324
-
C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\85075625071.exe"C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\85075625071.exe"5⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\1624583840575.exe"C:\Users\Admin\AppData\Local\Temp\1624583840575.exe"6⤵PID:3988
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\06785168631.exe" /mix3⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\06785168631.exe"C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\06785168631.exe" /mix4⤵PID:5956
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\RGKinVJTlYYn & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{UMxj-KQkoj-Ogfx-o5uUX}\06785168631.exe"5⤵PID:5844
-
C:\Windows\SysWOW64\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
PID:5112
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Nug0wCm_us_E_3r29KvReAxV.exe" /f & erase "C:\Users\Admin\Documents\Nug0wCm_us_E_3r29KvReAxV.exe" & exit3⤵PID:5932
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Nug0wCm_us_E_3r29KvReAxV.exe" /f4⤵
- Kills process with taskkill
PID:5808
-
-
-
-
C:\Users\Admin\Documents\yQyUZC_270YTVgEzP_yhZyy2.exe"C:\Users\Admin\Documents\yQyUZC_270YTVgEzP_yhZyy2.exe"2⤵PID:1068
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:4244
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵PID:2184
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.0.1987652407\1076346235" -parentBuildID 20200403170909 -prefsHandle 1452 -prefMapHandle 1444 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 1548 gpu5⤵PID:5272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.3.655837247\683729383" -childID 1 -isForBrowser -prefsHandle 5500 -prefMapHandle 5496 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 5512 tab5⤵PID:4000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2184.13.1469156761\291386129" -childID 2 -isForBrowser -prefsHandle 4100 -prefMapHandle 4080 -prefsLen 7014 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2184 "\\.\pipe\gecko-crash-server-pipe.2184" 1308 tab5⤵PID:5996
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵PID:200
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ff982524f50,0x7ff982524f60,0x7ff982524f704⤵PID:5704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1688 /prefetch:84⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 /prefetch:84⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:24⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2564 /prefetch:14⤵PID:6096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:14⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:14⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:14⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:14⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:14⤵PID:5780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:84⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:84⤵PID:5148
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings4⤵PID:5820
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x240,0x244,0x248,0x21c,0x1f4,0x7ff6e19fa890,0x7ff6e19fa8a0,0x7ff6e19fa8b05⤵PID:5300
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:84⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:84⤵PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:84⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:84⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6396 /prefetch:84⤵PID:5284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6852 /prefetch:84⤵PID:5580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7112 /prefetch:84⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5372 /prefetch:84⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7364 /prefetch:84⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:84⤵PID:5572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7096 /prefetch:84⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:84⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7384 /prefetch:84⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5668 /prefetch:84⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6132 /prefetch:84⤵PID:3116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8048 /prefetch:84⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7924 /prefetch:84⤵PID:5676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7800 /prefetch:84⤵PID:5168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:84⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6196 /prefetch:84⤵PID:6104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7512 /prefetch:84⤵PID:5132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:84⤵PID:5692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:84⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6484 /prefetch:84⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5412 /prefetch:84⤵PID:5596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6376 /prefetch:84⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1344 /prefetch:84⤵PID:5944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6260 /prefetch:84⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4264 /prefetch:84⤵PID:6012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:84⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3812 /prefetch:84⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 /prefetch:84⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:84⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:84⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:84⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6012 /prefetch:84⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5536 /prefetch:84⤵PID:5452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 /prefetch:84⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:84⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:14⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:14⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=8176 /prefetch:24⤵PID:5788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,1842761146913368588,16823640480817143399,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:14⤵PID:5600
-
-
-
-
C:\Users\Admin\Documents\l8KPFWlZFPjdvqieC1L0rs3B.exe"C:\Users\Admin\Documents\l8KPFWlZFPjdvqieC1L0rs3B.exe"2⤵PID:4208
-
-
C:\Users\Admin\Documents\wEbvCfskuKFsj8Emei7hhlGm.exe"C:\Users\Admin\Documents\wEbvCfskuKFsj8Emei7hhlGm.exe"2⤵PID:4352
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"3⤵PID:1536
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"3⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:504
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵PID:3516
-
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"3⤵PID:2368
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl4⤵PID:1556
-
-
-
-
C:\Users\Admin\Documents\oxnt8Fd__6cWCdMQ8axSB3xd.exe"C:\Users\Admin\Documents\oxnt8Fd__6cWCdMQ8axSB3xd.exe"2⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:4752
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:4000
-
-
-
C:\Users\Admin\Documents\OPuCt56qoAbfbOYPJzwS3TZM.exe"C:\Users\Admin\Documents\OPuCt56qoAbfbOYPJzwS3TZM.exe"2⤵PID:2824
-
-
C:\Users\Admin\Documents\FEpTa_Jj9iPECug2uHhpUCjb.exe"C:\Users\Admin\Documents\FEpTa_Jj9iPECug2uHhpUCjb.exe"2⤵PID:4308
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im FEpTa_Jj9iPECug2uHhpUCjb.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\FEpTa_Jj9iPECug2uHhpUCjb.exe" & del C:\ProgramData\*.dll & exit3⤵PID:5452
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im FEpTa_Jj9iPECug2uHhpUCjb.exe /f4⤵
- Kills process with taskkill
PID:488
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
PID:5220
-
-
-
-
C:\Users\Admin\Documents\seXsuCux_Lol_3tPUGqpS4NZ.exe"C:\Users\Admin\Documents\seXsuCux_Lol_3tPUGqpS4NZ.exe"2⤵PID:2472
-
-
C:\Users\Admin\Documents\e1EGulWEUYyebHJ6OqGcqzfH.exe"C:\Users\Admin\Documents\e1EGulWEUYyebHJ6OqGcqzfH.exe"2⤵PID:5264
-
C:\Users\Admin\Documents\e1EGulWEUYyebHJ6OqGcqzfH.exe"C:\Users\Admin\Documents\e1EGulWEUYyebHJ6OqGcqzfH.exe"3⤵PID:2456
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt1⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_4.exearnatic_4.exe1⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:740
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_3.exearnatic_3.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:2192
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_5.exearnatic_5.exe1⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Roaming\6029489.exe"C:\Users\Admin\AppData\Roaming\6029489.exe"2⤵PID:4784
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4784 -s 9363⤵
- Program crash
PID:4948
-
-
-
C:\Users\Admin\AppData\Roaming\5393005.exe"C:\Users\Admin\AppData\Roaming\5393005.exe"2⤵PID:4964
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵PID:4696
-
-
-
C:\Users\Admin\AppData\Roaming\2279002.exe"C:\Users\Admin\AppData\Roaming\2279002.exe"2⤵PID:5064
-
-
C:\Users\Admin\AppData\Roaming\1590313.exe"C:\Users\Admin\AppData\Roaming\1590313.exe"2⤵PID:4560
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0C908E14\arnatic_2.exearnatic_2.exe1⤵
- Executes dropped EXE
PID:492
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:5172
-
C:\Users\Admin\AppData\Local\Temp\6DF8.exeC:\Users\Admin\AppData\Local\Temp\6DF8.exe1⤵PID:196
-
C:\Users\Admin\AppData\Local\Temp\B340.exeC:\Users\Admin\AppData\Local\Temp\B340.exe1⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\FE24.exeC:\Users\Admin\AppData\Local\Temp\FE24.exe1⤵PID:5316
-
C:\Users\Admin\AppData\Local\Temp\76C.exeC:\Users\Admin\AppData\Local\Temp\76C.exe1⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\D49.exeC:\Users\Admin\AppData\Local\Temp\D49.exe1⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\19CE.exeC:\Users\Admin\AppData\Local\Temp\19CE.exe1⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\2B43.exeC:\Users\Admin\AppData\Local\Temp\2B43.exe1⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\463F.exeC:\Users\Admin\AppData\Local\Temp\463F.exe1⤵PID:3268
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5540
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4720
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:5988
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4584
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2004
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:2676
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5176
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:5220
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3080
-
C:\Users\Admin\AppData\Roaming\cesagjdC:\Users\Admin\AppData\Roaming\cesagjd1⤵PID:6028
-
C:\Users\Admin\AppData\Roaming\rgsagjdC:\Users\Admin\AppData\Roaming\rgsagjd1⤵PID:2004