Malware Analysis Report

2025-08-10 14:16

Sample ID 241016-bm5sdszbkj
Target http://rottenbypass.shop
Tags
bootkit defense_evasion discovery evasion persistence themida
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

Threat Level: Likely malicious

The file http://rottenbypass.shop was found to be: Likely malicious.

Malicious Activity Summary

bootkit defense_evasion discovery evasion persistence themida

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks BIOS information in registry

Executes dropped EXE

Loads dropped DLL

Themida packer

Writes to the Master Boot Record (MBR)

Suspicious use of NtCreateThreadExHideFromDebugger

Drops file in Windows directory

Subvert Trust Controls: Mark-of-the-Web Bypass

Browser Information Discovery

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SetWindowsHookEx

Suspicious use of SendNotifyMessage

NTFS ADS

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-16 01:16

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-16 01:16

Reported

2024-10-16 01:19

Platform

win11-20241007-en

Max time kernel

132s

Max time network

127s

Command Line

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rottenbypass.shop

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\soto.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\zjosee.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\antifekas.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\bl.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\kirogga.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\love.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\mata.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\rivero.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133735150167942190" C:\Program Files\Google\Chrome\Application\chrome.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\rivero.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\soto.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\zjosee.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\antifekas.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\bl.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\kirogga.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\love.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Users\Admin\Downloads\mata.exe:Zone.Identifier C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\antifekas.exe N/A
N/A N/A C:\Users\Admin\Downloads\antifekas.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\bl.exe N/A
N/A N/A C:\Users\Admin\Downloads\bl.exe N/A
N/A N/A C:\Users\Admin\Downloads\kirogga.exe N/A
N/A N/A C:\Users\Admin\Downloads\kirogga.exe N/A
N/A N/A C:\Users\Admin\Downloads\love.exe N/A
N/A N/A C:\Users\Admin\Downloads\love.exe N/A
N/A N/A C:\Users\Admin\Downloads\mata.exe N/A
N/A N/A C:\Users\Admin\Downloads\mata.exe N/A
N/A N/A C:\Users\Admin\Downloads\rivero.exe N/A
N/A N/A C:\Users\Admin\Downloads\rivero.exe N/A
N/A N/A C:\Users\Admin\Downloads\soto.exe N/A
N/A N/A C:\Users\Admin\Downloads\soto.exe N/A
N/A N/A C:\Users\Admin\Downloads\zjosee.exe N/A
N/A N/A C:\Users\Admin\Downloads\zjosee.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Users\Admin\Downloads\love.exe N/A
N/A N/A C:\Users\Admin\Downloads\love.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\antifekas.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: 0 N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: 1 N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: 31 N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: 32 N/A C:\Users\Admin\Downloads\antifekas.exe N/A
Token: 33 N/A C:\Users\Admin\Downloads\antifekas.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3324 wrote to memory of 4556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 4556 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 2304 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3588 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3324 wrote to memory of 3672 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rottenbypass.shop

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa748cc40,0x7fffa748cc4c,0x7fffa748cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1820 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2100 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2992,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3020 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3004,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3044 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4484,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:8

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5004,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5064 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4844,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5208 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5352 /prefetch:8

C:\Users\Admin\Downloads\antifekas.exe

"C:\Users\Admin\Downloads\antifekas.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5432,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5212 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4416,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5460 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5320,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5620 /prefetch:8

C:\Users\Admin\Downloads\bl.exe

"C:\Users\Admin\Downloads\bl.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5456,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4776 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5052,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5168 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5144,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5440 /prefetch:8

C:\Users\Admin\Downloads\kirogga.exe

"C:\Users\Admin\Downloads\kirogga.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5280,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5076 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5092,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5468 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5636,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5572 /prefetch:8

C:\Users\Admin\Downloads\love.exe

"C:\Users\Admin\Downloads\love.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5572,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5140 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5488,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5512 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5452,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5548 /prefetch:8

C:\Users\Admin\Downloads\mata.exe

"C:\Users\Admin\Downloads\mata.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5592,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5152 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5444,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5700 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4928,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5808 /prefetch:8

C:\Users\Admin\Downloads\rivero.exe

"C:\Users\Admin\Downloads\rivero.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5148,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5740 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5712,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5768 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5736,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5864 /prefetch:8

C:\Users\Admin\Downloads\soto.exe

"C:\Users\Admin\Downloads\soto.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5516,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5504 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5768,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5536 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5792,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5788 /prefetch:8

C:\Users\Admin\Downloads\zjosee.exe

"C:\Users\Admin\Downloads\zjosee.exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5620,i,10744140108240632457,12110974520709111598,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6088 /prefetch:8

C:\Users\Admin\Downloads\love.exe

"C:\Users\Admin\Downloads\love.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rottenbypass.shop udp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:443 rottenbypass.shop tcp
US 18.224.215.197:443 rottenbypass.shop tcp
US 8.8.8.8:53 197.215.224.18.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 104.26.1.61:443 skript.gg tcp
US 104.26.1.61:443 skript.gg tcp
US 104.26.1.61:443 skript.gg tcp
DE 162.19.170.118:52330 tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp
US 18.224.215.197:80 rottenbypass.shop tcp

Files

\??\pipe\crashpad_3324_CTPGUVKEBHREMVPF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\Downloads\Unconfirmed 872225.crdownload

MD5 a70cbe2a2cee4ae998c5737fd3a9c178
SHA1 03a42adf13bfa7dd19f1a2b17265fa6d68685fd3
SHA256 eefc72341a7c1cd9fe6a8c5ec186e24523b79c33307a2030302a6a61dcb75bea
SHA512 0ea2a9126d0f17f4f962d020878b5b4cb36c93346847a8d52c38e53211309cd4e94fd1cd68f012296901ca5877d4f7a6e60be554c1ef3da77876858602fc010c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

MD5 570bc7dfa65a14ad27f6eb49a3264700
SHA1 26b89b7850d93c3561fc2c4acace3dd6c4c68edc
SHA256 c2340cc3364786eff3f764cb6da52ae50b0461b0b5b6e65d783e440f6cfc332d
SHA512 e67412814e668cfb3af88aaf4065f92779d0ca44c89cc8dd1651cb782bb4203a6439e543461b603e3d33fd4a7b072a79621f6309f1151a02ebb2773dd759fe1a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 0c60691bff033445c78df4fa5e0a87b2
SHA1 29f5d59c520d084a9e404db4118cda8327c418de
SHA256 aa0dd927d8d14f9dcff9b16c6bd4c402a7484219d254a835a5c4cbdbcfb51709
SHA512 8574c30c2708b7a7aa9e1565e46f416cfee65a0f9feb6e57ea69d3654330bbd1ddf64baa907292c2f4216d78c84d50a2599619159a0c0ca59cd62c9432c320ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 31f3591544af5f3c75e854415178f245
SHA1 d9d15b10b27a7b7800c42bb0ccb21225cc9ab28f
SHA256 f79bc847d319bc09334e80cbe1a56f11a5840f3b0ab7e5faa0d02d52511d1b56
SHA512 cc4895756d7d50fcbe75ad1bb725f22b47d3228673be4649f95d698389badf847ee203fae324c28bbdd94af7cede3ac50dcb94f5249e3bbc419b7c5871277f42

C:\Users\Admin\Downloads\antifekas.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

memory/4028-56-0x00007FF7619F3000-0x00007FF7619F6000-memory.dmp

memory/4028-57-0x000001F3C8F70000-0x000001F3C8F71000-memory.dmp

memory/4028-59-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-62-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-65-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-68-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-71-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

C:\Users\Admin\Downloads\antifekas.dll

MD5 b2ff64181eb48491691a5da9ca1e9ca4
SHA1 f1cb605eb411175a0af2e3acf5d261f07779b426
SHA256 55baae63fcf17088f7a9ab5aafed2f4429c5f43420e5e1d812a7387c02231a08
SHA512 a2f872189db6f5fd3162848f3b813ad9784f0cd009d45e9fe56b83fd7390794c6839bf1c2ab93bdc8551ed2e7147740052f292aaa57c768953c2c6925ea19409

memory/4028-75-0x00007FF7619F3000-0x00007FF7619F6000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 8dadc5096e83dbe40319a324da6bd611
SHA1 c86b9c56b06ec1f1373029a9ba19ac6135dc2de6
SHA256 621d121efa89dd257a442cf4a76bd9ed2ef0db42e0091d992279733e23ca3cc6
SHA512 37c198482451213d46e0627d42e61721044206523a4df8407d9312573f2a2903ea133cd840d252d9c17da732bb2c7dc0160fe69e95ae21070a222f763923ba77

memory/4028-85-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-86-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-87-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-88-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-90-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

C:\Users\Admin\Downloads\bl.exe

MD5 6d2ea829eb24d9ebd78d919e45c158c1
SHA1 2b707588148577a0f32b2009ab549c35078c8888
SHA256 f47cbf4e49562a28fbb908b7446b7f3a7c9869ae2bb4f72fd085191b09c87211
SHA512 3f1fed3680901b8dd69dbc0ce657e5e284d33e6e80b5e7a6f7b9e2c231a3c898c8d6946dfddfd82d1a08cbdca713bc7da7d057198629d52158c2a06243157172

memory/1184-106-0x00007FF7E3C53000-0x00007FF7E3C56000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b5cb1321d99f3d90edf298041990ecef
SHA1 c7b125e3e1c86120303567cdfd504ce53a595db3
SHA256 e4792bbee8d4864bfb6049e315930250768737c33186c67dd7c42dcebbed519a
SHA512 833e550c835a647dee416de219774a0880fb8493246860293f2fd194ccf928bdd13a247cac167a8ff205a4b075237143453b78242614d52b8921c5ffceeeaa9f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 2c2659b06e182eb377e68416fa5fd800
SHA1 7e7e7ffa8805ca20e0b05ece6839270edb48cdf4
SHA256 f377becefa7742a04e729f41a3664a4aa7440440c1bf1c4e864fd4a04dfddfee
SHA512 ddeb3379af4b23bae49a01cf3d33fa50d848b7cc2ba91da5baad97464aab67973cbf7f9d331908a61a082201d675c9aad53157263884e8471af985d6778f71d8

C:\Users\Admin\Downloads\Unconfirmed 454.crdownload

MD5 f3592b115d8bb9456d4df62b6bccb1fc
SHA1 4735117d94b9eeb17494482e45f94da49a9626f4
SHA256 3ae55dcd519530d636089e72d71b08db1e36c8a7c4828cbff0e92fc1f50d7743
SHA512 99ce703be1e932339cbba6e4e1cd3838267c4078aad6d619eadd1702615d6e09245b895e7a6e35b2254bfdb1b25603fd46e0bcf820f6cf692699a2fc8a71a3e6

memory/4028-134-0x00007FF761830000-0x00007FF761A5C000-memory.dmp

memory/4028-133-0x00007FF7619F3000-0x00007FF7619F6000-memory.dmp

memory/1184-135-0x00007FF7E3C53000-0x00007FF7E3C56000-memory.dmp

C:\Users\Admin\Downloads\kirogga.exe:Zone.Identifier

MD5 d158c80d2cdc73264899d0031d8a8621
SHA1 51d5bf5728c1887fb6a70448a61241510176c7a6
SHA256 044bc655236b03e24ce25999597ddadab844792192bd9931a9568bf558e20a18
SHA512 692c8d27791fde9cc08f6aff958a518b2b607e7a34ae7bc303fc73e9305909c9ae28c8bb831cc4849dce6a0793a317fcf1645d78e861334fd05193f551571806

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b1e4a1e06e20af1d2d0898ec44a81404
SHA1 6c9e2028a914efdf9723d663b2b926eed4c48de6
SHA256 1e8d6d0fc67db63fa4b637181b00450ab2efd52fce75cde6a28dca3f99ed63fd
SHA512 8cafaf29ff4993c84800aacd679918584374eb59cc15d4b159bdd392ac0947ad2fe76738a2eb1574284174ca261394ec4259a4dd3adf69ef4e7162b3258d58d2

C:\Users\Admin\Downloads\Unconfirmed 979782.crdownload

MD5 d876a770d13e15272c93e7da0531ba42
SHA1 816314bb08550b0a8b4a10a056a88c2c4d4047fd
SHA256 e4238dcbc33d3563984a285d6c184b5330b033108fac9e178d6668dd8536ca73
SHA512 101fce11608e6a9169e5ba50ba60866ce03f69a96e20d582d1f50a34ba40cc1302a1f9286c5923782efc830c8e0e49ed1ebbd087b2e1a109c41b622f4ac3f7e7

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 be7d55dc7c181826c7670f93dc265683
SHA1 d503df29df7829502bcc5923217631afee1e1a33
SHA256 3f2953ce9e1446ea19a71f612dac12dde418be3f57eb63397ea488103ed088db
SHA512 81f70b843e8b897ad2d5517d82285873ca2cd06022a98a47b405e98bf54f260bb934aecfc4375fbcb6930bca7021d0741e7df65264c360112583b10886d70b0d

C:\Users\Admin\Downloads\Unconfirmed 882853.crdownload

MD5 313413036de12b91325e9cbdecb5e51b
SHA1 c3087969aa2da602ee83e3ca94557031e32239f8
SHA256 1ee681cdaabbfc5303f224ecd6773641816712621aaa4b4a039564c2f580d58b
SHA512 18faf36c3da2a10f427409b4f56d32640d688662b0666a3e4350aef37b55975d59dc85f469ffa056912427e53d1badf19a496b32cace74b89ee8ae477bfd7150

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 17a3bed1b2e883c46f10df374f3045ce
SHA1 c135d1de1f756573c25cacd36ba5a130af4d3468
SHA256 043dd72ca21bee9ad85205cbb0fd56e2d21251f4d4faf7c9ea7bbc79c6c81795
SHA512 3c22668f30c806e438399f730a799c3d7264806343fa80159de3918e52f6b3b6425c72717d139af06f832a1df063cd350f8cb54a0dddab9dadc50df29c93d3ee

C:\Users\Admin\Downloads\Unconfirmed 25351.crdownload

MD5 a9bce7b69efbc8f396ff695dbdfb6ff1
SHA1 10e702a4aeec48609f923e4b7ab4ec3403f1f9da
SHA256 564c8bc367dbf80906a7cd4920020d4d9a39da3356a44685fb1cd827194b54cc
SHA512 770ff46f7ca82acad3f6a42eb7edcdfeef85965828ccd6f4667af3cc434d20610922541d5e13e4e4fb8573d76956624794960d879cb6e2dbbd3572ef198c2325

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 d9081275690b2d600258e3bb1b67c04e
SHA1 b2396bab7177fe3614d98fd01bbe51faa1f50f89
SHA256 2db8fc571ef427a04168157b3fe8547987acf57c52eaf8da8c06c806b24328e7
SHA512 4fbcc2e3a750615bd9a1d817426f21e5e4e1efe79ae01bbf02ec8c5dc2374e8be54e1e6c6c1256e2ab5abaffb9422610e633cf266a5b27fa5bcf09669054843a

C:\Users\Admin\Downloads\soto.exe

MD5 faf905dfc0d7d16f9e923144b0906b7e
SHA1 64b458f200181c2ade34dc55afe70fd17eecae75
SHA256 099196bded5b2d89f27a53b9f0fdaaf84d1092225b3079d37421d71e116c5d0a
SHA512 47bab36d31059029c2ec8e6d0cddf0fbe577bcc34549b095c194880aad5cb71f5c2aace19cb265c4493db6694a3df620284095838542967ac82ff0016e7279b4

C:\Users\Admin\Downloads\Unconfirmed 315908.crdownload

MD5 a4ddb99a8a8554287c4cbe126b6e60ba
SHA1 f3715cb4cbb306569b0246388c726286c12fe020
SHA256 39896f8ccb6eabe98fcf9df1c1a14aced08e0c0f728e5ed20cdf6b0ea9b52111
SHA512 bf8c51de6757906ca021213333d1cfd3f9649e5082704b3219f97b3ba7dbc734f80640df006e9e1f948c402a18ee79c819d0717bd6dbdb36c73dc589d1e00267

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60b902fe-728f-4aa1-a7a6-27b91cdabc4f.tmp

MD5 b194a9240381c36d46aaeb0ebe6d52b0
SHA1 22255eaa6102a9bce42f9a43dd961dea0265b07e
SHA256 8eb9f6241a1e294771dda93c8467920c952d1fc76791bce10a70059b35d5b9cd
SHA512 85c729b6269af122511dff584e03d92d914490cb7018e277aa851723cc904d8b8e4bb8e837148e87721a9e190e9bb46bc9f4937f3c161898ede01eba8fdc3c60

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 b840241cd93cf49e81f000e4670e8e4a
SHA1 15bbd90aae148f7fa556ef640b34e6a4c394ddf2
SHA256 b7a7324d923882246413c6358b84002fb930a5a8ea3ace03f249c3efaf51f033
SHA512 ea7500e7cb15c7c6df8e44841272ebefa709bfba95f22a8051dd1165ab06a60d0c040b85f7cbf344cdda0a0dac58e39799b70954ee3464192c3d6f775f5c9914