cybergate | 278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

Analysis

max time kernel
204s
max time network
209s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Size

282KB
MD5

08996160b29a26eb2750d5dd608e0438
SHA1

97d264a4bb7db1ae2ef07bfb337003bb584c5de2
SHA256

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081
SHA512

0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888
SSDEEP

6144:VxJsGLnF5oxDNT/xQphU+jrlgzfuzt91C9NDyWId98HhqbxtHGZO:HJsG554h/xQp6+tqOYy9zo0F

Score

10^/10

cybergate hacker persistence stealer trojan upx

Malware Config

Extracted

Family

cybergate

Version

v1.02.1

Botnet

Hacker

toto68.zapto.org:188

Mutex

Pluguin

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./
ftp_interval
30
injected_process
explorer.exe
install_dir
Microsoft
install_file
Pluguin.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Plugins java Updeter
message_box_title
Windows
password
0123456789
regkey_hkcu
Avirnt
regkey_hklm
Avgnt

Signatures

CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Adds policy Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pluguin.exePluguin.exe278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Pluguin.exe

Executes dropped EXE 9 IoCs

Processes:

Pluguin.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exe

pid process

876 Pluguin.exe
568 Pluguin.exe
472 Pluguin.exe
1820 Pluguin.exe
1120 Pluguin.exe
1520 Pluguin.exe
1008 Pluguin.exe
1880 Pluguin.exe
968 Pluguin.exe

pid	process
876	Pluguin.exe
568	Pluguin.exe
472	Pluguin.exe
1820	Pluguin.exe
1120	Pluguin.exe
1520	Pluguin.exe
1008	Pluguin.exe
1880	Pluguin.exe
968	Pluguin.exe

Modifies Installed Components in the registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Pluguin.exePluguin.exeexplorer.exePluguin.exe278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe Restart"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0OS8G3FX-OKN6-O4UC-5VYB-AR5N0QB182TU}\StubPath = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe Restart"	Pluguin.exe

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/960-56-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/960-65-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral1/memory/1760-70-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral1/memory/1760-73-0x0000000024070000-0x00000000240D0000-memory.dmp	upx
behavioral1/memory/472-105-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1520-110-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/568-111-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1820-116-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1520-117-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1820-118-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1120-130-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1008-135-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1008-136-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1520-137-0x0000000024010000-0x0000000024070000-memory.dmp	upx
behavioral1/memory/1820-145-0x0000000024010000-0x0000000024070000-memory.dmp	upx

Loads dropped DLL 13 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exeexplorer.exePluguin.exeWerFault.exe

pid	process
960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
1760	explorer.exe
1760	explorer.exe
876	Pluguin.exe
876	Pluguin.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
1760	explorer.exe
2000	WerFault.exe
2000	WerFault.exe
2000	WerFault.exe

Adds Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exeexplorer.exePluguin.exePluguin.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\SysWOW64\\Microsoft\\Pluguin.exe"	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Windows\\system32\\Microsoft\\Pluguin.exe"	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Pluguin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Pluguin.exe"	Pluguin.exe

Drops file in System32 directory 9 IoCs

Processes:

Pluguin.exe278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exePluguin.exePluguin.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File opened for modification	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	Pluguin.exe
File created	C:\Windows\SysWOW64\Microsoft\Pluguin.exe	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2000 1008 WerFault.exe Pluguin.exe

pid	pid_target	process	target process
2000	1008	WerFault.exe	Pluguin.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exePluguin.exePluguin.exePluguin.exePluguin.exe

pid	process
960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
876	Pluguin.exe
568	Pluguin.exe
472	Pluguin.exe
1120	Pluguin.exe
1880	Pluguin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Pluguin.exe

pid process

1820 Pluguin.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Pluguin.exe

description pid process

Token: SeDebugPrivilege 1820 Pluguin.exe
Token: SeDebugPrivilege 1820 Pluguin.exe

pid	process
1820	Pluguin.exe

description	pid	process
Token: SeDebugPrivilege	1820	Pluguin.exe
Token: SeDebugPrivilege	1820	Pluguin.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exePluguin.exe

pid	process
960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
876	Pluguin.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe

description	pid	process	target process
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE
PID 960 wrote to memory of 1216	960	278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe
"C:\Users\Admin\AppData\Local\Temp\278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
PID:1760

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:568

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
6⤵
- Executes dropped EXE
PID:968

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\SysWOW64\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 500
6⤵
- Loads dropped DLL
- Program crash
PID:2000

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Windows\SysWOW64\Microsoft\Pluguin.exe
"C:\Windows\system32\Microsoft\Pluguin.exe"
3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:876

C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:472

C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe"
5⤵
- Executes dropped EXE
PID:1520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
113aaaa5837d8124d8338a54df9e2116

SHA1
25fdf3d7793d6955d0bd542edc2dba9d41430445

SHA256
674703a586b8803fe4ba9d8e4d1b26346a0736dd4d0e60ef8a922e40a9185606

SHA512
59c928930ebaf54e3d2b043e4f88d6a79a20bb37cac9cafb27bae2b797c39c60b252980746b7868f2a82de4e96b4b82144a20223ca6a346c86ce77f7e8d274fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
113aaaa5837d8124d8338a54df9e2116

SHA1
25fdf3d7793d6955d0bd542edc2dba9d41430445

SHA256
674703a586b8803fe4ba9d8e4d1b26346a0736dd4d0e60ef8a922e40a9185606

SHA512
59c928930ebaf54e3d2b043e4f88d6a79a20bb37cac9cafb27bae2b797c39c60b252980746b7868f2a82de4e96b4b82144a20223ca6a346c86ce77f7e8d274fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
7c20220dec20262572e7d3f5d278617e

SHA1
375f859c077a5433eb481e64ff0c73e5f950fd52

SHA256
871eda86246a73f340cd609f9152d573a424d1372fed445c73d73ff0264d20d6

SHA512
7cceaca6304fbbfaac5e15f80b2eb42cddcd1462ed76761a94fc0c86241c458d758688a27e937908a17e42f9bf341eb7f7dd8040a0adeff0d18bcb0c23e12fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
Filesize
221KB

MD5
113aaaa5837d8124d8338a54df9e2116

SHA1
25fdf3d7793d6955d0bd542edc2dba9d41430445

SHA256
674703a586b8803fe4ba9d8e4d1b26346a0736dd4d0e60ef8a922e40a9185606

SHA512
59c928930ebaf54e3d2b043e4f88d6a79a20bb37cac9cafb27bae2b797c39c60b252980746b7868f2a82de4e96b4b82144a20223ca6a346c86ce77f7e8d274fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
C:\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
\Windows\SysWOW64\Microsoft\Pluguin.exe
Filesize
282KB

MD5
08996160b29a26eb2750d5dd608e0438

SHA1
97d264a4bb7db1ae2ef07bfb337003bb584c5de2

SHA256
278e803d720e3df9f64d987e06736c9ff58620ebc4c597b8eceb978042f5c081

SHA512
0ff1fe90695ddddc38a7401c7843b292f28cfff146612be41e5b311a8f2baacc6fd1d81642349238ecff131d9814f8b161aabd2c4820cd7a712dea07e33b6888

Download Submit
memory/472-86-0x0000000000000000-mapping.dmp

Download
memory/472-105-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/568-111-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/568-81-0x0000000000000000-mapping.dmp

Download
memory/876-76-0x0000000000000000-mapping.dmp

Download
memory/960-65-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/960-56-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/960-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/968-139-0x0000000000000000-mapping.dmp

Download
memory/1008-135-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1008-136-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1008-121-0x0000000000000000-mapping.dmp

Download
memory/1120-98-0x0000000000000000-mapping.dmp

Download
memory/1120-130-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1216-59-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1520-110-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1520-117-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1520-102-0x0000000000000000-mapping.dmp

Download
memory/1520-137-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1760-62-0x0000000000000000-mapping.dmp

Download
memory/1760-64-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download
memory/1760-70-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/1760-73-0x0000000024070000-0x00000000240D0000-memory.dmp

Filesize
384KB

Download
memory/1820-118-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1820-116-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1820-93-0x0000000000000000-mapping.dmp

Download
memory/1820-145-0x0000000024010000-0x0000000024070000-memory.dmp

Filesize
384KB

Download
memory/1880-125-0x0000000000000000-mapping.dmp

Download
memory/2000-138-0x0000000000000000-mapping.dmp

Download