ca1bc0add907dc57613153045b20fe65ee298f30e08124fe4d73b2ff3236cd07

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ssverify.exe
Size

6.4MB
MD5

9428cac229b75e29d82960f4f5721a7a
SHA1

bcc47b23479c5dcff5dfa9cc28b8a433f08e24ab
SHA256

ca1bc0add907dc57613153045b20fe65ee298f30e08124fe4d73b2ff3236cd07
SHA512

b8d8535d376644623bbb51501c00fce4fb14df802fdf63c90b1c335b0af4eba77635f8c6b46454ad2ee94983a82d7d9eb102b0633445c34aca1225aba3037cb9
SSDEEP

196608:EFbD7FLl0tHZNDiT3G4u3BEsa/9mTN9KT:EFTFxyHPku3BErwTNW

Score

9^/10

discovery evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ssverify.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ssverify.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ssverify.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	AZ-Launcher.exe

Executes dropped EXE 8 IoCs

pid	Process
2904	AZ-Launcher_Installer.exe
3856	AZ-Launcher_Installer.tmp
4704	AZ-Launcher_Setup.exe
2308	AZ-Launcher_Setup.tmp
452	vc_redist.x64.exe
1408	vc_redist.x64.exe
5060	AZ-Launcher.exe
3460	AZ-Launcher.exe

Loads dropped DLL 38 IoCs

pid	Process
3856	AZ-Launcher_Installer.tmp
1408	vc_redist.x64.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
5060	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	208.67.222.222

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ssverify.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	ssverify.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\e3\e3f90fb5afaf84475dd31dca6f65378a455d17f7	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\84\84de86041757281c8b996df4d45b6276d5dac508	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\62\6226903c5dfd8ac388f9d64a5fa9968680ed3507	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\fd\fddba78b2426f8056be081c98fe82e8411a0a5cf	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\a4\a4cf4ebe4c475cd6a4852d6b4228a4b64cf5cb00	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\6f\6ff26a1439fb6f9f353c2bd623edeb936e760855	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\java-win64\bin\freetype.dll	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-natives-win\windows\x86\org\lwjgl\stb\lwjgl_stb.dll.sha1	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\a7\a772db3c8ac37dfeb3a761854fb96297257930ab	AZ-Launcher.exe
File created	C:\Program Files\AZ-Launcher\platforms\is-EQHOD.tmp	AZ-Launcher_Setup.tmp
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\18\188e05f8f12787ea22dd1836fe2c9c7e4efd03af	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\5e\5eb785154f53c82f0564b5a9b6f8842fd5621eda	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\48\4847e624311432aceeabe34c52176416be7e6278	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\1a\1a877430ccf6c3786fcaabad37778e7624df7a5b	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\e4\e4de21e6c359be164ca4fb59bc1e6351f7973dd9	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\f2\f26f9fffd85241554b003255766cd4dfbb731687	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\36\36adcbb0553274272777667992b363d857b80af9	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\34\3483650440deb3934255e044ddabff5b01a65356	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\3b\3bc8225914b1be20db68fcdae202d5acee3234c2	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\9d\9d034bf3ba36b297487b2380b908713982a83a3a	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\9d\9ddbc7a1e728b3fd4435913f7f3c1987f8a52b49	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\35\35c3f7efd2b7b5aad0007bf66133b6299f83b17c	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\5c\5c971029d9284676dce1dda2c9d202f8c47163b2	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\4d\4da9f12f979eba012c6f62e0820ca58cc49d8834	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\24\2452c64a55eaef86bf1b668bb4d5f3b641cd8f25	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\ea\ea3e315d681f43715637be19963b3e7d8497769e	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\66\66c6203abeca2f718f7bb09ded67d91fba0196cd	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\55\55f50ac148bcd345598f5b505e51aeec6ba85476	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\99\99cd73dda425ee03836c2274a0fcf331139773dc	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\60\608ce4dc409ef39df6b0409647b89f2f1a2d9ded	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\7c\7cb1e545a79ba270512c45b6c6ae6d6fcc76e39e	AZ-Launcher.exe
File created	C:\Program Files\AZ-Launcher\is-85O9K.tmp	AZ-Launcher_Setup.tmp
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-natives-win\win32-x86-64\discord-rpc.dll	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\62\627c939e2aa48a5e3f516848e66a76acb992c2a8	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\49\49874e07369c3bb0bc8a2fba4f2096d2e9a36c9a	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\22\22a491f266f5c3cdd6e669a9493daaf40c9c8575	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\java-win64\lib\meta-index	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-natives-win\windows\x64\org\lwjgl\openal\OpenAL.dll.sha1	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\3b\3b1bf3fc912f270a0b9a3c11c4f2949c649c3616	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\c8\c8dd60f7e7087da52a431c1dbc0f397317b374fb	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\3e\3e00bbc94adc9c7e6dc664dbc23bad4331327c5c	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\95\9580708c276c3ad24703ea7843e317b2845d272f	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\b2\b26f88cd2f0911f352f06a1bb1dd3bd4973bfdac	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\c3\c39e7ea5058b067987821164bda39e50fd2fe3c7	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\ec\ece0b410c81e9ba3e29440cc48005fc544aa5104	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\b9\b94f782f9762a5497f51b8065bdc7e495424bcbd	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\45\45f65be973d1929c2bd26d4fbc7912ad6bfc4834	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\ca\cabf5d0beb7d1b1dc50707b728c16143b8edf83d	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\ab\ab07279288fa49215bada5c17627e6a54ad0437c	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\3e\3e0d9b656292b909d53ade4d4f3fe61b7f665d32	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\86\86a2a7206c769aaa9435aabba70be201cb3e3a6b	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\81\813ebd91b9c3fe1ac8f89f13c85d0755678f2165	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\java-win64\lib\ext\jaccess.jar	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\8f\8fef0137bb86d722969ce6a0f28068c6966bd270	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\c7\c7b1005d4926f6a2e2387a41ab1fb48a72f18e98	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\2b\2b73dd8c1b27b629c841fe26b2c633edf3aa64c8	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\57\5738d7f49ef30adcfc4f2ab13e0b1d74f09a1289	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\14\144615a40b18a9977f632090219a7cf482c3258f	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\32\32317250b0c0ee18ed1e0c4ae3364fa796433b0a	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\b0\b049ab95eb3a6f7fba35259cda3df9437259f590	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\76\763cc79934a572b84c371cb49afad5912f29d2f1	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\d1\d14112bd7351ef48f193aa27b4517d4b0960f7b1	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\mc-assets\objects\c9\c986830ecbe740c2191ab70c49844725b8a44699	AZ-Launcher.exe
File opened for modification	C:\Program Files\AZ-Launcher\runtime\bin\java-win64\bin\j2pcsc.dll	AZ-Launcher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AZ-Launcher_Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AZ-Launcher_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AZ-Launcher_Installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AZ-Launcher_Setup.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133688827208730986"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5060	AZ-Launcher.exe
3460	AZ-Launcher.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4460	ssverify.exe
4460	ssverify.exe
4460	ssverify.exe
4460	ssverify.exe
2004	chrome.exe
2004	chrome.exe
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
7112	chrome.exe
7112	chrome.exe
7112	chrome.exe
7112	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	AZ-Launcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeCreatePagefilePrivilege	2004	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
3856	AZ-Launcher_Installer.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp
2308	AZ-Launcher_Setup.tmp

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
5060	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe
3460	AZ-Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 3056	2004	chrome.exe	98
PID 2004 wrote to memory of 3056	2004	chrome.exe	98
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 1960	2004	chrome.exe	99
PID 2004 wrote to memory of 5108	2004	chrome.exe	100
PID 2004 wrote to memory of 5108	2004	chrome.exe	100
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101
PID 2004 wrote to memory of 4320	2004	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\ssverify.exe
"C:\Users\Admin\AppData\Local\Temp\ssverify.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc5ac8cc40,0x7ffc5ac8cc4c,0x7ffc5ac8cc58
  2⤵
  PID:3056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1952,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  PID:5108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4048,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4868,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5080,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:2284
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x27c,0x280,0x284,0x258,0x288,0x7ff643c34698,0x7ff643c346a4,0x7ff643c346b0
    3⤵
    PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4808,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5076,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5296,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3276,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3212 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5564,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5824,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2836
- C:\Users\Admin\Downloads\AZ-Launcher_Installer.exe
  "C:\Users\Admin\Downloads\AZ-Launcher_Installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2904
- - C:\Users\Admin\AppData\Local\Temp\is-HJ1P2.tmp\AZ-Launcher_Installer.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-HJ1P2.tmp\AZ-Launcher_Installer.tmp" /SL5="$B0172,1044538,954880,C:\Users\Admin\Downloads\AZ-Launcher_Installer.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\is-FNQML.tmp\AZ-Launcher_Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\is-FNQML.tmp\AZ-Launcher_Setup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\is-M2G8R.tmp\AZ-Launcher_Setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-M2G8R.tmp\AZ-Launcher_Setup.tmp" /SL5="$102B2,32746044,947712,C:\Users\Admin\AppData\Local\Temp\is-FNQML.tmp\AZ-Launcher_Setup.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2308
      - C:\Program Files\AZ-Launcher\vc_redist.x64.exe
        
        "C:\Program Files\AZ-Launcher\vc_redist.x64.exe" /install /quiet /norestart
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:452
        
        C:\Windows\Temp\{524FAD9E-2AFA-43AD-8732-000FB03B6CFA}\.cr\vc_redist.x64.exe
        
        "C:\Windows\Temp\{524FAD9E-2AFA-43AD-8732-000FB03B6CFA}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\AZ-Launcher\vc_redist.x64.exe" -burn.filehandle.attached=672 -burn.filehandle.self=680 /install /quiet /norestart
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1408
      - C:\Program Files\AZ-Launcher\AZ-Launcher.exe
        
        "C:\Program Files\AZ-Launcher\AZ-Launcher.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        C:\Program Files\AZ-Launcher\AZ-Launcher.exe
        
        "C:\Program Files\AZ-Launcher\AZ-Launcher.exe" --is-elevated --launcher-datadir "C:/Program Files/AZ-Launcher/runtime" --legacy-launcher-datadir "C:/Program Files/Pactify Launcher" --launcher-update-source "" --client-datadir C:/Users/Admin/AppData/Roaming/.az-client --legacy-client-datadir C:/Users/Admin/AppData/Roaming/.pactify --client-update-source ""
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5408,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5136,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5260,i,12035624571072644685,12226389178653617398,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7112

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:5640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\AZ-Launcher\AZ-Launcher.exe

Filesize
1.5MB

MD5
8b3a0e6e244d651eb057e34739932877

SHA1
ecaacafc7f235a9eaf56f32d55ed5703da0bec15

SHA256
22d235bce8b76c8df6fcbf92f15929910460c24fb60c0cf52602c81597a2ddc9

SHA512
48f5dd254883c83e86ec00721ed41bdca6330f5ab3b3a3b6b30de1aa25ae18e481c9b61a948c1e9eb004e278d5597aff829f6d9d52e53adc57be29fe94e3710b

Download Submit
C:\Program Files\AZ-Launcher\Qt5Core.dll

Filesize
5.7MB

MD5
817520432a42efa345b2d97f5c24510e

SHA1
fea7b9c61569d7e76af5effd726b7ff6147961e5

SHA256
8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a

SHA512
8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441

Download Submit
C:\Program Files\AZ-Launcher\Qt5Gui.dll

Filesize
6.7MB

MD5
47307a1e2e9987ab422f09771d590ff1

SHA1
0dfc3a947e56c749a75f921f4a850a3dcbf04248

SHA256
5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e

SHA512
21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14

Download Submit
C:\Program Files\AZ-Launcher\Qt5Network.dll

Filesize
1.3MB

MD5
3569693d5bae82854de1d88f86c33184

SHA1
1a6084acfd2aa4d32cedfb7d9023f60eb14e1771

SHA256
4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1

SHA512
e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32

Download Submit
C:\Program Files\AZ-Launcher\Qt5Widgets.dll

Filesize
5.2MB

MD5
4cd1f8fdcd617932db131c3688845ea8

SHA1
b090ed884b07d2d98747141aefd25590b8b254f9

SHA256
3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358

SHA512
7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199

Download Submit
C:\Program Files\AZ-Launcher\Qt5WinExtras.dll

Filesize
231KB

MD5
c842e53c70d966569f1c15cee142a813

SHA1
33e88b286374dbe49e77988c1e30d78f8dccd88e

SHA256
9987b4bff62ef5c0c75dfcdbe50b1d02d0ae38a8123a816fbe4326ea8538069a

SHA512
062897dd47312dc6886db9c5a4c948c42608f9ede6d9863cf0445c5ab3c87c8c6f1ff8ca6168e73c1e29f3f512a42d31886a07abca7e2ddbb059072317e975bf

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qgif.dll

Filesize
38KB

MD5
52fd90e34fe8ded8e197b532bd622ef7

SHA1
834e280e00bae48a9e509a7dc909bea3169bdce2

SHA256
36174dd4c5f37c5f065c7a26e0ac65c4c3a41fdc0416882af856a23a5d03bb9d

SHA512
ef3fb3770808b3690c11a18316b0c1c56c80198c1b1910e8aa198df8281ba4e13dc9a6179bb93a379ad849304f6bb934f23e6bbd3d258b274cc31856de0fc12b

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qicns.dll

Filesize
43KB

MD5
ad84af4d585643ff94bfa6de672b3284

SHA1
5d2df51028fbeb7f6b52c02add702bc3fa781e08

SHA256
f4a229a082d16f80016f366156a2b951550f1e9df6d4177323bbedd92a429909

SHA512
b68d83a4a1928eb3390deb9340cb27b8a3eb221c2e0be86211ef318b4dd34b37531ca347c73cce79a640c5b06fbd325e10f8c37e0cee2581f22abfbff5cc0d55

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qico.dll

Filesize
37KB

MD5
a9abd4329ca364d4f430eddcb471be59

SHA1
c00a629419509929507a05aebb706562c837e337

SHA256
1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b

SHA512
004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qjpeg.dll

Filesize
411KB

MD5
16abcceb70ba20e73858e8f1912c05cd

SHA1
4b3a32b166ab5bbbee229790fdae9cbc84f936ba

SHA256
fb4e980cb5fafa8a4cd4239329aed93f7c32ed939c94b61fb2df657f3c6ad158

SHA512
3e5c83967bf31c9b7f1720059dd51aa4338e518b076b0461541c781b076135e9cb9cbceb13a8ec9217104517fbcc356bdd3ffaca7956d1c939e43988151f6273

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qsvg.dll

Filesize
31KB

MD5
c0de135782fa0235a0ea8e97898eaf2a

SHA1
fcf5fd99239bf4e0b17b128b0ebec144c7a17de2

SHA256
b3498f0a10ac4cb42cf7213db4944a34594ff36c78c50a0f249c9085d1b1ff39

SHA512
7bd5f90ccab3cf50c55eaf14f7ef21e05d3c893fa7ac9846c6ca98d6e6d177263ac5eb8a85a34501bcfca0da7f0b6c39769726f4090fca2231ee64869b81cf0b

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qtga.dll

Filesize
30KB

MD5
a913276fa25d2e6fd999940454c23093

SHA1
785b7bc7110218ec0e659c0e5ace9520aa451615

SHA256
5b641dec81aec1cf7ac0cce9fc067bb642fbd32da138a36e3bdac3bb5b36c37a

SHA512
cebe48e6e6c5cdf8fc339560751813b8de11d2471a3dab7d648df5b313d85735889d4e704e8eec0ad1084ab43be0ebdfbacd038aeac46d7a951efb3a7ce838eb

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qtiff.dll

Filesize
380KB

MD5
9c0acf12d3d25384868dcd81c787f382

SHA1
c6e877aba3fb3d2f21d86be300e753e23bb0b74e

SHA256
825174429ced6b3dab18115dbc6c9da07bf5248c86ec1bd5c0dcaeca93b4c22d

SHA512
45594fa3c5d7c4f26325927bb8d51b0b88e162e3f5e7b7f39a5d72437606383e9fdc8f83a77f814e45aff254914514ae52c1d840a6c7b98767f362ed3f4fc5bd

Download Submit
C:\Program Files\AZ-Launcher\imageformats\qwbmp.dll

Filesize
29KB

MD5
68919381e3c64e956d05863339f5c68c

SHA1
ce0a2ad1f1a46b61cb298cec5aa0b25ff2c12992

SHA256
0f05969fb926a62a338782b32446ea3e28e4bfbffc0dbd25ed303fab3404abac

SHA512
6222a3818157f6bcd793291a6c0380ef8c6b93ecea2e0c9a767d9d9163461b541afaf8c6b21c5a020f01c95c6ee9b2b74b358ba18da120f520e87e24b20836aa

Download Submit
C:\Program Files\AZ-Launcher\platforms\qwindows.dll

Filesize
1.4MB

MD5
4931fcd0e86c4d4f83128dc74e01eaad

SHA1
ac1d0242d36896d4dda53b95812f11692e87d8df

SHA256
3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85

SHA512
0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d

Download Submit
C:\Program Files\AZ-Launcher\runtime\bin\java-win64\lib\images\cursors\win32_CopyNoDrop32x32.gif

Filesize
153B

MD5
1e9d8f133a442da6b0c74d49bc84a341

SHA1
259edc45b4569427e8319895a444f4295d54348f

SHA256
1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b

SHA512
63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

Download Submit
C:\Program Files\AZ-Launcher\styles\qwindowsvistastyle.dll

Filesize
140KB

MD5
53a85f51054b7d58d8ad7c36975acb96

SHA1
893a757ca01472a96fb913d436aa9f8cfb2a297f

SHA256
d9b21182952682fe7ba63af1df24e23ace592c35b3f31eceef9f0eabeb5881b9

SHA512
35957964213b41f1f21b860b03458404fbf11daf03d102fbea8c2b2f249050cefbb348edc3f22d8ecc3cb8abfdc44215c2dc9da029b4f93a7f40197bd0c16960

Download Submit
C:\Program Files\AZ-Launcher\translations\qt_en.qm

Filesize
33B

MD5
aaea7ba475c961f941d0a23488457beb

SHA1
2bf0054002c8f7d85dd080df332553bf9b3a8e26

SHA256
494ac9a2b2cb2fdeced353f4a9f898ed8dcf616e9bc667438c62681e3f7f79cf

SHA512
5b408c36c8f93f71e73e3d3b1c0c2ad699e92a6088604b8adf8e588e8a75fc3fc92828199b7f00f5b05b224ae819220d07e56d610a76a267594870bec77172be

Download Submit
C:\Program Files\AZ-Launcher\vc_redist.x64.exe

Filesize
14.2MB

MD5
ba584d9886d6eaee8daa852a0605dd00

SHA1
1effe7db3f42d670a1352c5c9b451c4db3e57ab5

SHA256
c2d74d9b85d0030eaa134679a2392268baa773185c5a21657390e43f8b518f69

SHA512
3076aa5583c2ee719f9755fb6aefc1f01f37a33491a7d336c39f9ad303e671574498a0dc16b64e3744098c86ac43ccb916557a4866caf1a5f4b1f5ec68446d47

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ff9483b725d0d6210e7b1e0c5ff29e33

SHA1
bdd5f3a2cb820908c68f6f7454a62e62ab3b19cd

SHA256
96d66de76534555b428353e6d05ad1060cebb3bb58558f68667bfeaa29834eb0

SHA512
57ae13bac9890e666f552f8ad75299a38b0617ad060aa53da7913011562ffeefd73bd29cd3a4bd96a70e913aa8ebf4965816470c86e2ce39092ba333463948a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
edc825dec4210309eb4c4f2c711b3479

SHA1
bbbe97a27b462dd3d7035b96b1e57d98d06d203f

SHA256
73efb2a6264c22af0daf9712e31548b4113faff79b5c04744c30ea3000af2917

SHA512
b045b2637ccf149969e54395b798fdaf1c64ba94153ff5ee45dc26cee4b0688316442d8025893c89f4c27e14cd9b9a5edcc8181f9af13515cce89864d178abce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
83c4ec277fbb2011825fff01250e1edc

SHA1
c6a28f442a4e6e4fae61f99ede32daaffff5b65b

SHA256
a56823520cec3f8913a6b6048cf2d1645f1d06a479e0f11a23fcabc8ecb12219

SHA512
04983498e56db8bd4193437efb227191b53e68b5a6cfe8a1e231f14270613189d15836709f49304eea5c8d25f7735829c0d2aa44a1628fd72a2a7b8fadd89f96

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
3633a5ceb5ca5dbcae0c83b55546233d

SHA1
6eec10e7dad75ae5224672b2945fe9ff18e1a167

SHA256
3c71ab7ec1a74df4b3722802c50e5d529211bd78e1d91a100767b763f1da7c57

SHA512
12646d08a07e3590a5faa198875ce84c0b877e02f65fb97ac47982e76e246bcff3dee03469125f52d3e84a3cefa70d509ec14d78e422858562aeaef9006c4090

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
55b49edbe8dfed49105bb75a5b98a120

SHA1
f9e3d5a2666a7aed849c284e1abeaacb50881108

SHA256
fdf20e4dd3a59d2c53c093023f5839f3495a618072aeeddcd3c9d783abb02a7d

SHA512
a8041e0f5b81da22c2b3734d03a8d9f43839bb8f0f49d80200e4107cf8c8249d1f115c5c354bd00cde863df1fc7315d046b9242c72ed499336ffe26130b62cc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
23ee2d8b90ce24774a34fcfbd51c7cce

SHA1
13479c8606ce213b9907215b1ce5b677578e45db

SHA256
451453065e3d86ef061e910e11e43029e47ecb63fb90f8d0484d5e8d3f53b0e6

SHA512
b73aaf578a74288ff24d80ea0e9a657237b9fa8803041b91117fa00f58974b4a10847ab30b9d4e83c28913838930e3ab4be899d030a6a23814286c8ab8d2258a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
295c81d95a7cfbb51730a1b44adfb067

SHA1
19fd4adf1035eba6c3b73184f4c9a3960ce7f7d1

SHA256
f0a18f5a429c1bc5333585d75b565aceb2883ead057a0971abb1b1e0a7790037

SHA512
1caf4eea8a65ef8704cb60078dee5aefb081149c02201857760bea05e988bc3774aed44283deee11026cd11112370641c6507846d2ce3dcac721e05d74b96ffa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
5d1e736ad2aebfede611bd6ce42d95fb

SHA1
11297047961aedaa37b2593ac9de17745575b9d2

SHA256
c71efef70f87b7fb9ea3a270f7fa327dd71b312dfa45d558913acdb71bfe8434

SHA512
5024ee24d5e3e7261af2258f8abaf1e518b24abd7434a64d87837ac14fb5fcf0461c6be01a8dac015ae8fa828f04ece3cf6ae994c170cb958a69d50e48851b51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2fbca2b6d801b085ddf63932505bf24c

SHA1
14ab11629d008a40a3f85edeeb221354a67a5a94

SHA256
30665eb5bd571d6aca5e474e5149a04f57d3f6dacf06f1f1c9ba4eb1bad70e60

SHA512
e212ad4a066dcecd93fb321612ec4e0c9a0109b06590759472c8f733e94e3f9e319691f92679c140faeba3f8c3449e6eaa00a847376ea3475b567a1f7ec2159b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2ad0867c60a3cab9f4b17f16a491c320

SHA1
84f28db9e605809fb6c2e666257a541b07104bca

SHA256
9fce7043bac174f669a33c1ce6b7a0daca5b8b5a61a71874357a48b3231fe075

SHA512
f5f80c32c2a4e7958838b7df1d1e895a3fc15c8befb77a3d6857bacbd63be0eb2e5b717b9de7e4198a8b386917385d73c8c6e8dd0cafc7e0b48c0a86683d2e2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a7023d3fda29c7386688c87da8383796

SHA1
995b5caf15577532ca9dd3f4ae629ffeac272036

SHA256
731300b07acf3a55e6387a9fa9acaef471f97f578448b83e093e7a3046837208

SHA512
c63438a390f55addf4716e79c6d409a56abd5eb3a80712445c7c70497ee53f41feffc1f8c4d9434fb8241fe7cc476ce730207e0ebbef706a8a7b6b16fdfad2f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8c62a5fe44a37f0fd862c016e13931dc

SHA1
64fe904bb9c266aed766a13ac838beb8fa8086f3

SHA256
d9672765b9cda9ba319c944e1f505c8722789031fc65c2f59c90c2c99b341c49

SHA512
f5b75e7d6de42b0662fbd9813c2af3c7f7fd1ce1d580064f101eb0c6186cf12d8a8e28450250beba20935ede27e06edbf5d31fa1055338ae967054a60fd78a9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
89bb803e4a502f0c93a8742fdf1cda64

SHA1
c587c2865919ca6762ed18c4b08280466dff2bff

SHA256
190382528e35ae412114753a598a51e0c525cca098841a0be8938dbb1a5d7f89

SHA512
e296cf7b94721b7690792c477ccbd4d595d079a30716bac8c3737fce08e7f79d81f0f35d57f3d9d938e6c2c78eb1da5f3f8eceea3c6857f1f210e2e241d659cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ee4ccd99fe10490d8639e65439dedd76

SHA1
a399e09c0dd887d0d7c822f5895dc061bb420dd6

SHA256
74660cff46ff57bbf583ec82904309afc19bf7d71ddbf1de7c110afa1ead0093

SHA512
dc6886b23c605b26cdaac8be970f5595c8a54e3c2922b6ea5f77e9d49603463263466833f02f1a5f1dcbe938e815f309dd3b281e5a3c754044d08d2e131061c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e5fac6df9950186450703752b625b3ea

SHA1
386440e562e7ddab7789d5ccde1642b96403fe65

SHA256
4a4456c9bec72849a769ca9c9c45b3c1bf3346959dfefee185d9bb2cc5997c15

SHA512
cc469bce2a3af6728935782f4a54a4690ee1fa5fbc4be0c30e82f4a8002dd7b71cf46334d14e308a94c16bd645a587c5101348b860e9b8987cbc3cc103d9891e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
78ae3cbb15105defc855d8b16f03bb47

SHA1
f1a00e1f29f7c9d52f8057a6cfe4e3d43c92968e

SHA256
f83d857f1398fdce9df1d9990c455566c24d1558db92cbd4f575edb6d2083fa2

SHA512
68ba7bc429099e9685ab537a4915f7513b84a07aea7e2576bd39e466ca5935c32172b8357637f35baedbb2e986727771a1d1004b89de256cddb6cf78b91a3ac1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d4364c06-405f-42cd-9e07-52b4677dcdd0.tmp

Filesize
9KB

MD5
3a46a8038a4ddae5e40c99a3a473a84c

SHA1
a6dc827c2a32ecf8a7d5f6f47decd58589af1a5f

SHA256
2250d3b1312ebb823d33c7a7e9a388bf293d55d441c704b089c1fea0561c18c3

SHA512
4c84955ec6f828ec191264483a8d406443afa95070d0e44f83e03f72a68985eca7990828412137c66a7998fa08e431f90813b4823fcc603019d336f9f9102a59

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
197KB

MD5
4aa4e6b6ad84b198c25e6cf65e7f51f2

SHA1
f2a4af4ceeb76b8ac292ee9e10c1c7765e66b0a6

SHA256
bddbca6aabb9ebff58a38bfca39a76b6e7fa9c66b487ec87b14ecdac150b649c

SHA512
12f61fa279337210e68a97bcd9271247d462e56bbc25d49449ed96a5dc04f7c74a52bdbc72d6d54dfbd095c18e4af7c30cfbdef462cee0ce8c581a85533e22f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
197KB

MD5
41cf252f00467ccff69c5b3d544dd24c

SHA1
3b567a5836bb71641f501ca9f73f475ca037b92a

SHA256
5553c1eec7cf8b3599086eb902df007eab00a87b0da57b4a3fcd5d260097c021

SHA512
687d0ba128bab38a994dadd112d5bdbeba0065e2bcf44c62eb47a722d8f25dec291b702ddc5ede3bb18cc817be16c555036ae43f4a196163d5d08f081dd85a1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
197KB

MD5
0f412f0d16de1eb0c9ba10c337b42988

SHA1
6d6e48f75dcf98599b1c9a840937a0e22b680157

SHA256
44c6880bd3d2c79259cf15cb9fd4ebed23d9a663a26724ee3aec6093bfaeff0f

SHA512
7c41e3dbdf17509724ad583738ce933fca023b3a82bb46bd0d74ffd4825f817dc987047cf272663907ce11d2ae62c98e31b0458e0b73522e9c139b969bc06745

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
197KB

MD5
e3aae1b6857ca2260e2c1471a7e03263

SHA1
51cf1aba870a2cfc1660424c3a06461ee392f042

SHA256
fa857672041c1a0aae6886f5cf586f9cabd49d75440b99de173372bc52d9402f

SHA512
0c8400696f04cf4e2ee0ebaabd02b5df91f2b07a23653479991eb3ec453f7f59d4ff4538f420aaf2065ea4d67696a9533998101095198007a70e420e6048ee50

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FNQML.tmp\AZ-Launcher_Setup.exe

Filesize
32.1MB

MD5
8f473afabc5c9b536dfe005b6d563a95

SHA1
9fc6c9a568036485999684cb6abaab379fbf0815

SHA256
36aa6b992da5cb44ae6e5c66bd142cb0d1eeb60e5784343eeaef59defc4f3293

SHA512
3e4b783907a1ef90706dbaa000e59aae31631e6385d9ff3f54e557b3e67de2d2d471a5595a21874130c90ac6ea09ca462655521c8a8aeff4eba1b3042302b5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FNQML.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HJ1P2.tmp\AZ-Launcher_Installer.tmp

Filesize
2.6MB

MD5
21859158a7237a2d020fac372cbff650

SHA1
753aa98464b40f668708de5e0de131edbe3b4f57

SHA256
66b73bf3a0e19dbf0294c1992dea75f5d7261c1db988b0d4c7e3c6a9174c0b7f

SHA512
3f62c9711a691b65c9502dde8f47a275901fac46963419bced63199015a5de988c13d3b67d7a58f2ef635f8260d2016bb448a493f7bfd9acd332f04c8c6222db

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M2G8R.tmp\AZ-Launcher_Setup.tmp

Filesize
3.0MB

MD5
472e18785f5b7dde3833d479c25252fb

SHA1
148e62ed69366e15cdfb7eb26ab904cbecf7e5cb

SHA256
2e412be377eb28e5a6bb54adc56d015d81c0186b240083063e8f136ebfda6cb4

SHA512
51ffc68ff37bbed86e9275aee1fea62bb37b34cdec3950dd8c459c78973c08f5f6d801561aa98745863760e2e947686df0d03abe0f982d4aecc12bbcbf945936

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 594066.crdownload

Filesize
1.7MB

MD5
12b02ac3f9684c36f6e1be49a5b59774

SHA1
c75aa83b449f45642bb608de05acd92f53d63c8f

SHA256
8d6fb523a1e0859f7ca8d138526a80b8f0a99830dc0b1eebf6cd107559f5f734

SHA512
91534a5b3b57e6b10e79e23aedfff1c6595c715ae789a35f39ddc4a61c4f5a8e39423514e01542823ae3373b2bca128f119e4dd2945bbeab14135b1c6ec27b44

Download Submit
C:\Windows\Temp\{524FAD9E-2AFA-43AD-8732-000FB03B6CFA}\.cr\vc_redist.x64.exe

Filesize
632KB

MD5
bb19de612367abeeec4fdf07a8b29ee6

SHA1
0a914d54c9f0cdff929f1ccb7533cab79c4a32d0

SHA256
2e238c5f5454e5ace1828932799768d8cb1edc7ad06b5c2f412b47adff466d39

SHA512
65b1f261844fc9316c9ca662d38ad393f8dee5699fa56ebeb85dd8459b5c4405b477232d2e48d16cb294c7333454029e91dd3145c2eacb9fc75ffcbfc973b153

Download Submit
C:\Windows\Temp\{74B8EF71-AF9A-4992-A0D3-D24E7A7C2437}\.ba\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Temp\{74B8EF71-AF9A-4992-A0D3-D24E7A7C2437}\.ba\wixstdba.dll

Filesize
191KB

MD5
eab9caf4277829abdf6223ec1efa0edd

SHA1
74862ecf349a9bedd32699f2a7a4e00b4727543d

SHA256
a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

SHA512
45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

Download Submit
memory/2308-495-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/2308-519-0x0000000000400000-0x0000000000717000-memory.dmp

Filesize
3.1MB

Download
memory/2904-232-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2904-296-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/2904-534-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3460-3824-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3753-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3726-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-528-0x00007FFC559D0000-0x00007FFC55F11000-memory.dmp

Filesize
5.3MB

Download
memory/3460-3754-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3804-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3725-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3744-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3742-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3799-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3810-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3822-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3815-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3819-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3755-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3756-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3735-0x00000149A17F0000-0x00000149A17F1000-memory.dmp

Filesize
4KB

Download
memory/3460-3829-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3833-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3757-0x00000149A3A20000-0x00000149A4A20000-memory.dmp

Filesize
16.0MB

Download
memory/3460-3603-0x00000149A17F0000-0x00000149A17F1000-memory.dmp

Filesize
4KB

Download
memory/3856-533-0x0000000000400000-0x00000000006AD000-memory.dmp

Filesize
2.7MB

Download
memory/3856-297-0x0000000000400000-0x00000000006AD000-memory.dmp

Filesize
2.7MB

Download
memory/4460-134-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-217-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-0-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-1535-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-41-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-552-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-91-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-103-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-3-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-113-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-763-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-1-0x00007FFC794F0000-0x00007FFC794F2000-memory.dmp

Filesize
8KB

Download
memory/4460-271-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-451-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4460-2-0x00007FF763830000-0x00007FF7646DB000-memory.dmp

Filesize
14.7MB

Download
memory/4704-275-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/4704-458-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/4704-530-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/5060-516-0x00007FFC559D0000-0x00007FFC55F11000-memory.dmp

Filesize
5.3MB

Download