Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
294s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 04:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1wIKBSsetUrRBUSK6427SdNFPHBS2F_OD/view?usp=sharing
Resource
win10v2004-20240802-en
14 signatures
150 seconds
General
-
Target
https://drive.google.com/file/d/1wIKBSsetUrRBUSK6427SdNFPHBS2F_OD/view?usp=sharing
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 208 theultimateastra.exe 4012 theultimateastra.exe 4764 theultimateastra.exe 4512 theultimateastra.exe 524 theultimateastra.exe 4896 theultimateastra.exe 4372 theultimateastra.exe 4404 theultimateastra.exe 216 theultimateastra.exe 4120 theultimateastra.exe 1032 theultimateastra.exe 3496 theultimateastra.exe 4488 theultimateastra.exe 4052 theultimateastra.exe 3200 theultimateastra.exe 1924 theultimateastra.exe 4888 theultimateastra.exe 540 theultimateastra.exe 1696 theultimateastra.exe 3704 theultimateastra.exe 3668 theultimateastra.exe 604 theultimateastra.exe 4144 theultimateastra.exe 3044 theultimateastra.exe 4948 theultimateastra.exe 1416 theultimateastra.exe 4388 theultimateastra.exe 948 theultimateastra.exe 2364 theultimateastra.exe 832 theultimateastra.exe 4048 theultimateastra.exe 4556 theultimateastra.exe 400 theultimateastra.exe 1500 theultimateastra.exe 2632 theultimateastra.exe 3772 theultimateastra.exe 2416 theultimateastra.exe 5024 theultimateastra.exe 3008 theultimateastra.exe 3176 theultimateastra.exe 1340 theultimateastra.exe 3124 theultimateastra.exe 3172 theultimateastra.exe 1144 theultimateastra.exe 2044 theultimateastra.exe 3920 theultimateastra.exe 2300 theultimateastra.exe 4360 theultimateastra.exe 776 theultimateastra.exe 3664 theultimateastra.exe 2740 theultimateastra.exe 972 theultimateastra.exe 5136 theultimateastra.exe 5176 theultimateastra.exe 5212 theultimateastra.exe 5248 theultimateastra.exe 5284 theultimateastra.exe 5324 theultimateastra.exe 5372 theultimateastra.exe 5408 theultimateastra.exe 5444 theultimateastra.exe 5480 theultimateastra.exe 5516 theultimateastra.exe 5552 theultimateastra.exe -
Loads dropped DLL 64 IoCs
pid Process 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 drive.google.com 7 drive.google.com -
Detects Pyinstaller 1 IoCs
resource yara_rule behavioral1/files/0x0009000000023520-134.dat pyinstaller -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000_Classes\Local Settings msedge.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 242714.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3992 msedge.exe 3992 msedge.exe 3312 msedge.exe 3312 msedge.exe 3980 identity_helper.exe 3980 identity_helper.exe 1460 msedge.exe 1460 msedge.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4512 theultimateastra.exe 4512 theultimateastra.exe 4512 theultimateastra.exe 4512 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 524 theultimateastra.exe 524 theultimateastra.exe 524 theultimateastra.exe 524 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4896 theultimateastra.exe 4896 theultimateastra.exe 4896 theultimateastra.exe 4896 theultimateastra.exe 4512 theultimateastra.exe 4512 theultimateastra.exe 4372 theultimateastra.exe 4372 theultimateastra.exe 4372 theultimateastra.exe 4372 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe 524 theultimateastra.exe 524 theultimateastra.exe 4404 theultimateastra.exe 4404 theultimateastra.exe 4404 theultimateastra.exe 4404 theultimateastra.exe 4764 theultimateastra.exe 4764 theultimateastra.exe 4896 theultimateastra.exe 4896 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 216 theultimateastra.exe 4512 theultimateastra.exe 4512 theultimateastra.exe 4372 theultimateastra.exe 4372 theultimateastra.exe 4012 theultimateastra.exe 4012 theultimateastra.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4012 theultimateastra.exe Token: SeDebugPrivilege 4764 theultimateastra.exe Token: SeDebugPrivilege 4512 theultimateastra.exe Token: SeDebugPrivilege 524 theultimateastra.exe Token: SeDebugPrivilege 4896 theultimateastra.exe Token: SeDebugPrivilege 4372 theultimateastra.exe Token: SeDebugPrivilege 4404 theultimateastra.exe Token: SeDebugPrivilege 216 theultimateastra.exe Token: SeDebugPrivilege 4120 theultimateastra.exe Token: SeDebugPrivilege 1032 theultimateastra.exe Token: SeDebugPrivilege 3496 theultimateastra.exe Token: SeDebugPrivilege 4488 theultimateastra.exe Token: SeDebugPrivilege 4052 theultimateastra.exe Token: SeDebugPrivilege 3200 theultimateastra.exe Token: SeDebugPrivilege 1924 theultimateastra.exe Token: SeDebugPrivilege 4888 theultimateastra.exe Token: SeDebugPrivilege 540 theultimateastra.exe Token: SeDebugPrivilege 1696 theultimateastra.exe Token: SeDebugPrivilege 3704 theultimateastra.exe Token: SeDebugPrivilege 3668 theultimateastra.exe Token: SeDebugPrivilege 604 theultimateastra.exe Token: SeDebugPrivilege 4144 theultimateastra.exe Token: SeDebugPrivilege 3044 theultimateastra.exe Token: SeDebugPrivilege 4948 theultimateastra.exe Token: SeDebugPrivilege 1416 theultimateastra.exe Token: SeDebugPrivilege 4388 theultimateastra.exe Token: SeDebugPrivilege 948 theultimateastra.exe Token: SeDebugPrivilege 2364 theultimateastra.exe Token: SeDebugPrivilege 832 theultimateastra.exe Token: SeDebugPrivilege 4048 theultimateastra.exe Token: SeDebugPrivilege 4556 theultimateastra.exe Token: SeDebugPrivilege 400 theultimateastra.exe Token: SeDebugPrivilege 1500 theultimateastra.exe Token: SeDebugPrivilege 2632 theultimateastra.exe Token: SeDebugPrivilege 3772 theultimateastra.exe Token: SeDebugPrivilege 2416 theultimateastra.exe Token: SeDebugPrivilege 5024 theultimateastra.exe Token: SeDebugPrivilege 3008 theultimateastra.exe Token: SeDebugPrivilege 3176 theultimateastra.exe Token: SeDebugPrivilege 1340 theultimateastra.exe Token: SeDebugPrivilege 3124 theultimateastra.exe Token: SeDebugPrivilege 3172 theultimateastra.exe Token: SeDebugPrivilege 1144 theultimateastra.exe Token: SeDebugPrivilege 2044 theultimateastra.exe Token: SeDebugPrivilege 3920 theultimateastra.exe Token: SeDebugPrivilege 2300 theultimateastra.exe Token: SeDebugPrivilege 4360 theultimateastra.exe Token: SeDebugPrivilege 776 theultimateastra.exe Token: SeDebugPrivilege 3664 theultimateastra.exe Token: SeDebugPrivilege 2740 theultimateastra.exe Token: SeDebugPrivilege 972 theultimateastra.exe Token: SeDebugPrivilege 5136 theultimateastra.exe Token: SeDebugPrivilege 5176 theultimateastra.exe Token: SeDebugPrivilege 5212 theultimateastra.exe Token: SeDebugPrivilege 5248 theultimateastra.exe Token: SeDebugPrivilege 5284 theultimateastra.exe Token: SeDebugPrivilege 5324 theultimateastra.exe Token: SeDebugPrivilege 5372 theultimateastra.exe Token: SeDebugPrivilege 5408 theultimateastra.exe Token: SeDebugPrivilege 5444 theultimateastra.exe Token: SeDebugPrivilege 5480 theultimateastra.exe Token: SeDebugPrivilege 5516 theultimateastra.exe Token: SeDebugPrivilege 5552 theultimateastra.exe Token: SeDebugPrivilege 5588 theultimateastra.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3312 wrote to memory of 4816 3312 msedge.exe 83 PID 3312 wrote to memory of 4816 3312 msedge.exe 83 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 1020 3312 msedge.exe 84 PID 3312 wrote to memory of 3992 3312 msedge.exe 85 PID 3312 wrote to memory of 3992 3312 msedge.exe 85 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86 PID 3312 wrote to memory of 1084 3312 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1wIKBSsetUrRBUSK6427SdNFPHBS2F_OD/view?usp=sharing1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba0547182⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:12⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5316 /prefetch:82⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6280 /prefetch:82⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2068,11833942438807700031,6972289466676834389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1092
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:216
-
C:\Users\Admin\Downloads\theultimateastra.exe"C:\Users\Admin\Downloads\theultimateastra.exe"1⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\Downloads\theultimateastra.exe"C:\Users\Admin\Downloads\theultimateastra.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:524 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4120 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4488 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4052 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3200 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1696 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3704 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3668 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:604 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4388 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:948 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:832 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4048 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:400 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1500 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3772 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2416 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5024 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3176 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3124 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1144 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2300 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4360 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:776 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3664 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:972 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5176 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5212 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5248 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5284 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5324 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5372 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5408 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5444 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5480 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5516 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5552 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe65⤵
- Suspicious use of AdjustPrivilegeToken
PID:5588 -
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe66⤵PID:5624
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe67⤵PID:5660
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe68⤵PID:5700
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe69⤵PID:5740
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe70⤵PID:5780
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe71⤵PID:5816
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe72⤵PID:5852
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe73⤵PID:5888
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe74⤵PID:5924
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe75⤵PID:5960
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe76⤵PID:5996
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe77⤵PID:6032
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe78⤵PID:6068
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe79⤵PID:6112
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe80⤵PID:5132
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe81⤵PID:5280
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe82⤵PID:1628
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe83⤵PID:5532
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe84⤵PID:5656
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe85⤵PID:5776
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe86⤵PID:5940
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe87⤵PID:6108
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe88⤵PID:3344
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe89⤵PID:5732
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe90⤵PID:5440
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe91⤵PID:6156
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe92⤵PID:6196
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe93⤵PID:6232
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe94⤵PID:6272
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe95⤵PID:6308
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe96⤵PID:6344
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe97⤵PID:6384
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe98⤵PID:6420
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe99⤵PID:6456
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe100⤵PID:6496
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe101⤵PID:6532
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe102⤵PID:6568
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe103⤵PID:6604
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe104⤵PID:6660
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe105⤵PID:6696
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe106⤵PID:6736
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe107⤵PID:6776
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe108⤵PID:6812
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe109⤵PID:6852
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe110⤵PID:6888
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe111⤵PID:6924
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe112⤵PID:6960
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe113⤵PID:6996
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe114⤵PID:7032
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe115⤵PID:7068
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe116⤵PID:7108
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe117⤵PID:7144
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe118⤵PID:6188
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe119⤵PID:6376
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe120⤵PID:6528
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe121⤵PID:6712
-
C:\Users\Admin\Downloads\theultimateastra.exeC:\Users\Admin\Downloads\theultimateastra.exe122⤵PID:6884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-