growtopia | hxxps://www[.]mediafire[.]com/file/fv9veoyx2lf2x66/GX_Image_Logger[.]zip/file

Analysis

max time kernel
139s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
07-02-2024 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file

Score

10^/10

growtopia zgrat pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4128-446-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-451-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-459-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-456-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-461-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-463-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-439-0x0000000002CE0000-0x0000000002D4C000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-484-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-502-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-508-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-516-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-521-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-487-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-475-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-532-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-534-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-536-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-530-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-551-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-554-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-556-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-558-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-560-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-562-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-566-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-564-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-568-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-570-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-572-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-574-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-539-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-576-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-578-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1
behavioral1/memory/4128-580-0x0000000002CE0000-0x0000000002D45000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

143 discord.com
30 discord.com

flow	ioc
143	discord.com
30	discord.com

Detects Pyinstaller 4 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1216 schtasks.exe

pid	process
1216	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
4272	msedge.exe
4272	msedge.exe
3808	msedge.exe
3808	msedge.exe
2540	msedge.exe
2540	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
2092	msedge.exe
2092	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe
5424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

msedge.exe

pid	process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

Processes:

msedge.exe

pid	process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

GX_Builder.exe

pid process

5328 GX_Builder.exe

pid	process
5328	GX_Builder.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3808 wrote to memory of 3756	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3756	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4468	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4272	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 4272	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe
PID 3808 wrote to memory of 3556	3808	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/fv9veoyx2lf2x66/GX_Image_Logger.zip/file
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa16af3cb8,0x7ffa16af3cc8,0x7ffa16af3cd8
2⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1804 /prefetch:2
2⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1
2⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
2⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
2⤵
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
2⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
2⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
2⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6192 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7020 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
2⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
2⤵
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
2⤵
PID:5420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
2⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
2⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7872 /prefetch:1
2⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7776 /prefetch:1
2⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8028 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8184 /prefetch:1
2⤵
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7496 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:2752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
2⤵
PID:5736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1856,13030052452617836398,18138557363747671447,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:900

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3512

C:\Users\Admin\Downloads\GX_Image_Logger\GXImageLogger\GX_Builder.exe
"C:\Users\Admin\Downloads\GX_Image_Logger\GXImageLogger\GX_Builder.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5328

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="
2⤵
PID:5732

C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
"C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
2⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
"C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
2⤵
PID:1456

C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
"C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
2⤵
PID:5664

C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
3⤵
PID:5516

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC172.tmp" /F
4⤵
- Creates scheduled task(s)
PID:1216

C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
"C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
2⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
2⤵
PID:3596

C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
3⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
4⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa16af3cb8,0x7ffa16af3cc8,0x7ffa16af3cd8
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0307d75488a9def144d0373178e421da

SHA1
1e4351dd4a29b6340913848163b4df62628ad06c

SHA256
9e1bd506806510408dcb9d5e1eab6672d905780282361f2b9974ab9a9ed1ab9e

SHA512
993dbb0491352352ca89542922df735fc7b3cc0d14a4790f106c25ee9fd616d0722151d05e045ed5863e56b128c3308a561b958bbf5fe3bb87498e8a6d12a50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
97c96aaadc0048469d002c32b84d74ee

SHA1
7bd03ff347deff4654daa8a99939e54a89bc6ca4

SHA256
e907a99b766c2c3e92cf632d38b8d1027ed1c641659708a989e864fb25e6444c

SHA512
db239a60f99aa5c480b98220f25b80a356607e1ef4f7ff2a68de3258b5a4b4a111ae819db790d9c4ad0b4fae4bdc84909c7a770ed67f7e7c5b86dfcf304ba70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
5653e0e0cc59d2055720ef01f2f6c3f8

SHA1
f1563b563a2a60a52398bdeae54257b701936e15

SHA256
b612bb8f33c0c47636af8ebddeb71e4ef48709df5eb9bfa357fb23e2e76279f7

SHA512
3c62fd4f8e0e8eefb9d9ca1a2751953b80af20e5cd74498bfb98ee7948873838aa69237eb78417a8d096f28104adba8436b73d98c14ba48001208332ed4e777d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
18d9789bb0c92c855ba13910a9523062

SHA1
76ae65bddd0ac649a1f8de14cc72a7b3d2e579dc

SHA256
c7eea6ff1b5f53b1f6513d75d7b50422078eac82520325bebd8d74d3fa5604e4

SHA512
eb3deb7937e4352ef6caaddca8c1b906b6b4ad76e389dc494e2396ec1eb884dc0acd60fffca4824101ebe6317f1c269d144434629b1aa2d618a8077fb9ae56ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2bc8d372dce257fd65327a961476ddb0

SHA1
5f36b8fc11db216e09da5c8009098e2ae74f05c2

SHA256
1fb1e0e42653eaa71044601ae1e71e0ca985ebf5269cb7e7b38b77cb81d42fee

SHA512
571ee82e741838c47191fb1296477aa9a4fa7bccd68bf2345df6959405f66dd70e3bd5a9c0226df93ee2342499962d21f72fd79cb2373995aa5369202909ab69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
08b7e6caf2bf82a1e01fd6f8ed14a8ed

SHA1
25a45489a509445cff84905b084acdaa7c2a8091

SHA256
b1e91d70f39fc48e2f9895f2442b28899a93c769632a02514eb64b5203ce74e7

SHA512
73aad120b4fffd99cf1fa460248dc305cf2a6aeae59c4a137f1012864082f648fc9d81127f22a27f3629dbc2c88d6e0d7632f47c428c1aefc95e57ed161b4efe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
0ace84d2f56d99d6b3318537be8d125b

SHA1
7af20fccd1505637d77a87fec53a4fd8a6f4583b

SHA256
db39a394c432581c6cf5b2d164407cb27af4d998bdf437ca43be05714dd95aa6

SHA512
4317898393123fde58a8604cf19d1156c21e67af8fb152c05a41ac10ae6e26dfd88b856c058a64f57d47be023d7530980f7caeb359e7ffd60a59b83fb3ab0a2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d8a629f2cb5198baca2b4a35f2587296

SHA1
c97b241aa1acc65484ca7b238f9ee68a9857fa15

SHA256
5238e00d0c76d8482db28a2165862ec716498ad40799bc58a4a9cf051ae0b5ea

SHA512
cb34da06f518f19479a83743de9cb87adddb9db44ff852866c6d31b63d585c8033cbcd7287617d8ebfd9bccc3f4220b3d333e96b68ae04b89c1135e42c029d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f0a9.TMP

Filesize
873B

MD5
6ce735d237f30f0548d5ea90bdb15f65

SHA1
f65097b6304ff3a4122f9312ccc11a0493c633ac

SHA256
f54616cf225a3702f7c35ab0dc81f3a34f96ea3b30adcf755d9f6225fd21af6e

SHA512
16086570625d0c934fc21cf009c25c3cb6912b1830f12849c6c8f7d64d819efa0af970ab118e28506d778deeded8557e5570b3337f72ad2f14b150604d6ab090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
24ea0538c9d97d041ea8da145d64e786

SHA1
cae19aa03df2cac3603b14854dccd3bdf264b313

SHA256
82d3eef2f10f02ac4a5fea90b219d860bc8028388d292a333d2b3e980507e630

SHA512
c6c15d39c4c22308405163074c4c3179f55ce7a0f5a05472cc1bf84cc9e38eb04323725ec1fb003eb82bf3c29b219ab5986d820b623cfc7c0dbcb7a6e0f4de60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
a2d5da72a6e1bf71febdebdcc0c2e8dd

SHA1
b199cc18b10ad334f37878c9e2773d291fc1ff58

SHA256
c58c1f60071dd95935e69540fd1992d8fafd068314897c24b3cd9e81c4452461

SHA512
d57db3c900e18a363093be749a275717d00f84789907646eba953ff264cca55f09dd143de784b25035e9f061b041147a99c9cb13843d203341d08fbf966b72b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ecb5d9e4fc31653e633bc5b5aedcec81

SHA1
edc8c912e128c10e1891f0ba7717e72c54d11ba1

SHA256
8cf606a02d0ba0bc6efd1ec19ef1ce187b2f33f059faaccb5b5bb9baa7e9027e

SHA512
45322368308701e125f085c0dd82a98db9207a289b40c96bb5ce62a33752e62ab5d7ec310080cc0e924a9b229a8b9dc7f015d778efeec97c1b13f68830c9babf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d4d60b2ce2ffa1611d2493e8104a7bbf

SHA1
eaf1c76bc2ee19ca4af49f3c332fa22d1f137497

SHA256
b31a5674962649a06d37ad09538905d862ac06d957404339d2725486337b82d3

SHA512
c18df09692e2d2889efc1f705918b31877e38a8909841ddd97faf226499ff1bd1984a229673f726fbbdedde0ed44b1fb0b1a05a82b9d02dfae03d2c9dd29f76e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
14KB

MD5
9e50ea3fdbc9e276323b335caa71ecbb

SHA1
b6cacc900a18ff7b30f12dbc4125ade925c19023

SHA256
12c174e67b3f3ae0b6bd921d9c6d78d61f43ddc4ce68666fc55d1f1cc9768103

SHA512
8524189fbe1bb28eac45a8e67c5375cc83d9fefd6543584f6cf325568cca82a617c000e7e9d57ec9a14e7b4d88e2bb4c48a86213ea874a8855c45aaead9e88e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
167KB

MD5
2378e1b3fa36927107609b7d2795d179

SHA1
99882682fb08820a86a1eee9a422283a7bef00ec

SHA256
92c8622afa632dad5b26bc6232c5445382037583bf11b9c40d667ebc818a8175

SHA512
65e0bb48e2202cfb78c8ebcd3f8482988d9a4fa70b74b7620fc8f18cf98dd12db326f992ae19809ca4061ea7d524cbc45231e560974efd4be683d9072bb381e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
35KB

MD5
2ca65f3d97ec6df6c6c70da527f1154a

SHA1
de81d2b6b7e06948e87c477b34da7631aac0f28a

SHA256
e7cd0797b5f2147227260e407089a87801999321c717e8a7d21e00f823300667

SHA512
348d690c3ee286933f4bb443774ffccd2e2214bc200f122170889c287b265aaeac7066996dbeae33f143d7fff0fe28f5171c0967dc4e727adf6de41227dec9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
419KB

MD5
e6e8e6f4bd0d3fa83c5a3aad5f584266

SHA1
efbf3deed6096e8c2d17c00853f9a4101fa9c479

SHA256
07b031f6574678abbba5febfb64edb36cf3cd1e1de87433e3a03eb0ba266503d

SHA512
fa64bee38ee481955e1b7ca63265ecb87e5b255b8808ead8ca58523ea4bb3922fd09479d967a221a51570dfa05443a55f2386dddb060b7a6db9c55a689944112

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
239KB

MD5
a53fc6be766e36a5585d617adf57b720

SHA1
967a2e66d1142c1b58b90949879de961c22a8d74

SHA256
841ceaa63968074ad3fce9f5a0ade06e5a16b5d1401265cb82ea722ea5bf5f54

SHA512
577d1219ae49898f4a944648f6174a8cf8e4b02071c2e7a58cf04deb082cc743e5c0b9ab1fb11973c7335ae408b3df109d8f4e1b5b52d9cc54c929699d27c4bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
128KB

MD5
97ad06864a2f0fa98d64344033f0d83a

SHA1
715a7b1764d1df1a4cc7909e7aae10cafd2f04fd

SHA256
fad274fd2224abec75ac5e8862ef6f890b32bab8579dbb6a3e3cd09f5d9bc4f7

SHA512
7f605aaa36355e4aa09c41704413dff25ce4d96be07940efe3742544c15e6afcec46524d5585ea90a87f2bb5025466e5a034af783468d2236a7059cf57be5cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.4MB

MD5
e2180c86f26b23be4efe5ac33d378d79

SHA1
32c2fadef52dbd6a9229d998994dd2d9fa05553e

SHA256
2b0e4834b11e14b4b101d1e9b8488d361862ca1a5f62b592f04fc3ea30e4e147

SHA512
6b3532284cd0a8f7fe6c95cd6a2d19c923b23a674ec24d1ebc0b9f0fcba4fe5c4f5f37630031580328202098488139e9b9e70fec08bf248b1afc0d12948892cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
613KB

MD5
3ca689a2fce3dfbba25f5bb84b4d87e0

SHA1
6f5b28368f51415e89e8dd3ec2682e264d5cc013

SHA256
58af4ac2b484369eecde9604457c624483bca21d6abbbd20272722a1350d8981

SHA512
b98810313b584c83ef0030a0ae013347f9ae8cd6064444f35ec6c6a0ae8b561de27d17a41d561a5b2ff2360492ba6ac0afc26092e0791286b8f2ecfc90f90a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
1.2MB

MD5
6872f0553206f5482fa522dc14b82889

SHA1
3bec0006348f2f6af2caab8ebcf6eb81c4e67344

SHA256
1a4b1f53f1d0b2ab22c1989f3a202897c07d9c9f90f786797c991e99b4dabbb6

SHA512
8b696bcda756c9eb8fb77e958fb14d8b39fb4a66b96255acc5b6baaa333a8cab450164952239e4eb398e87c4f3432687573e42e78e144657985a7b1d80ddb25d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\_decimal.pyd

Filesize
164KB

MD5
3a2fa8c2a7d59c99b797a89193a8ede2

SHA1
0b59de5beede75a0a2614bbc1784caac181f39b8

SHA256
d82139061a289c2b0e31ff3fb803fb581211e8e9b84a94a08e2a5a073a5e83b1

SHA512
1a8d4e48ea40287b4e65a8279fc8a2dfd6a86a9b318a700c9dc7afc462396a6e59b2c6a9a86a5f3b25d98392a396fa26ac45d2bc07c0427e38e1898baa70c344

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\_lzma.pyd

Filesize
134KB

MD5
0cf531c285519ebfbfbb738f6c49a63f

SHA1
402380f75ee2f57a8aa69c2a7a1ea5fc3c215e85

SHA256
387d43642a3b86c8be338a93ec8fe9b5cc7fefaa9e5ecea06ec3ebc89e0b77dd

SHA512
0f39c0452a179b7257664f8ee17449fc117712f11090453a3ebfd9cb6f92a334d027ece4c499b202517f9e4255fc8abbf561a45ec3776ad059231c80bf6fb1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\_lzma.pyd

Filesize
137KB

MD5
f7025c7da2f7d8ff09be764e67fc815f

SHA1
48eccd4ba7581c75f0863e040c120c994e742b7c

SHA256
d949581136d1a32aba06637348b23c659c6c23dfa07750ec4bfba8a18a59d462

SHA512
e466300d3f2fc9dd48a9752216a79ad7ecc9e8854ab2c4ea09ad60c091103cdbd04a3c18417c3d8fbd0e776d65fbe78aee3f47309ada47249bf0643faa1652c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\base_library.zip

Filesize
149KB

MD5
0371d90a5de0690af68f50bd5ac0d1b1

SHA1
7cbf85aeeb02fbbd780dba9997807073063a07eb

SHA256
370dcddbf80e513e7136b72b81c523440712d2011b8aa696127bf9089319f5e2

SHA512
197098445be720f7e2508753f91a5908d0eb4e9860850d7165c3125c0292b26a431aa9124fd489a7e54fe7ed4742fe8eb10081aa9535e5c5ba797ef33be8b6c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\libcrypto-3.dll

Filesize
927KB

MD5
0a6a843a8628f5d474ab7239b266b245

SHA1
783cdb136d40e37dbd7d1fff422efca9f35a9da4

SHA256
087151b73329cd2b8da861e4779354428dd5abb8f380c21069b92d35ff3d5fbc

SHA512
8f5530ea6be2baeefcf905cceb0ff3d995fdaefffe40cc62f6c70a2f2a13b613407bf47288b99d065fd059e118c818e2d3941a9f54ff1203c4af5a110dce57f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\python312.dll

Filesize
493KB

MD5
9bdb2727b0ccfc62a04c7b07ba394237

SHA1
203967ac07d51b546920c5d2321749e3087e8617

SHA256
319336cbf2fccc74b189ea159a8c0dbe3122fb0264229bce0911e30b0231608e

SHA512
ac902e51e2432b03f1a586f60ef2006a1fc117b1d852fdb9399353a06292cc6170cf922559b96c66fe2063ababc2c44eaba67b01dc5c80baa37eb6a54796ec17

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\python312.dll

Filesize
284KB

MD5
4a0913fb69d79a8ed73641aa9e18a8c0

SHA1
405efcfea818438492a8dd0847e41eb79ead0126

SHA256
7bfc2c8b070e0d4edcd1e35bd022ea76ae712936cc4ca68540485d6007c7fb53

SHA512
5e7f0e16b854aacb5bed472970702795f9ae41f992d0442fb937ef2c3da1b92c59c0e09fcc6d72a5a3d5602aeccacb996398709e039ae4f3e082ed3db2c65f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI35962\unicodedata.pyd

Filesize
168KB

MD5
cedf2f0a165c8b097b12b82745794da9

SHA1
77d0968b35f5732acd97001fe97427feceb5855e

SHA256
da6db0a9bc07605b862cce1435914bf15ebc4fd9486f77551133d70d9f995552

SHA512
1037fa16234ac854215672118956c26619dde5b505c9236bf685b238876fa936d86640d7d1fa5b76903ea7fba16db78f375064bb90065c6856420284895ff987

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_whikantr.w3k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC172.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\Downloads\GX_Image_Logger.zip

Filesize
11.6MB

MD5
0320cabde39fe61ef6e6aa1a30aa9304

SHA1
f8683922467ed12c978216a480646da2736b43d1

SHA256
aa094222e49bcf065d68a71ae3ee75b23d6117b991b48a6dc26e38187fc43e76

SHA512
b6892e282a7687019b4a52c467c6d94c18bfefd84aa296c3b478443e0a6773112cdba0a59e78ea935da16df2a82228f5495dcc5ca47179ace275fac976373141

Download Submit
memory/4128-566-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-446-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-410-0x00000000008E0000-0x0000000000916000-memory.dmp

Filesize
216KB

Download
memory/4128-484-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-580-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-502-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-508-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-578-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-516-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-439-0x0000000002CE0000-0x0000000002D4C000-memory.dmp

Filesize
432KB

Download
memory/4128-576-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-463-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-461-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-521-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-539-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-574-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-455-0x0000000073240000-0x00000000739F1000-memory.dmp

Filesize
7.7MB

Download
memory/4128-572-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-487-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-475-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-570-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-532-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-534-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-536-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-530-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-456-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-568-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-459-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-564-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-458-0x00000000053D0000-0x00000000053E0000-memory.dmp

Filesize
64KB

Download
memory/4128-551-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-554-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-562-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-451-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-556-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-560-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/4128-558-0x0000000002CE0000-0x0000000002D45000-memory.dmp

Filesize
404KB

Download
memory/5516-513-0x0000000073240000-0x00000000739F1000-memory.dmp

Filesize
7.7MB

Download
memory/5516-518-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/5664-437-0x0000000000BC0000-0x0000000000BD0000-memory.dmp

Filesize
64KB

Download
memory/5664-445-0x0000000073240000-0x00000000739F1000-memory.dmp

Filesize
7.7MB

Download
memory/5664-514-0x0000000073240000-0x00000000739F1000-memory.dmp

Filesize
7.7MB

Download
memory/5732-628-0x0000000006BE0000-0x0000000006C84000-memory.dmp

Filesize
656KB

Download
memory/5732-658-0x0000000006FB0000-0x0000000006FBA000-memory.dmp

Filesize
40KB

Download
memory/5732-424-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/5732-807-0x0000000007260000-0x0000000007268000-memory.dmp

Filesize
32KB

Download
memory/5732-499-0x0000000005700000-0x0000000005A57000-memory.dmp

Filesize
3.3MB

Download
memory/5732-423-0x0000000073240000-0x00000000739F1000-memory.dmp

Filesize
7.7MB

Download
memory/5732-549-0x0000000005C80000-0x0000000005CCC000-memory.dmp

Filesize
304KB

Download
memory/5732-438-0x0000000004E80000-0x00000000054AA000-memory.dmp

Filesize
6.2MB

Download
memory/5732-757-0x0000000007270000-0x000000000728A000-memory.dmp

Filesize
104KB

Download
memory/5732-746-0x0000000007180000-0x0000000007195000-memory.dmp

Filesize
84KB

Download
memory/5732-733-0x0000000007170000-0x000000000717E000-memory.dmp

Filesize
56KB

Download
memory/5732-425-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/5732-581-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/5732-476-0x0000000004D30000-0x0000000004D52000-memory.dmp

Filesize
136KB

Download
memory/5732-411-0x00000000026F0000-0x0000000002726000-memory.dmp

Filesize
216KB

Download
memory/5732-604-0x000000007FD10000-0x000000007FD20000-memory.dmp

Filesize
64KB

Download
memory/5732-615-0x0000000006BA0000-0x0000000006BD4000-memory.dmp

Filesize
208KB

Download
memory/5732-626-0x00000000061B0000-0x00000000061CE000-memory.dmp

Filesize
120KB

Download
memory/5732-616-0x0000000074580000-0x00000000745CC000-memory.dmp

Filesize
304KB

Download
memory/5732-480-0x0000000005620000-0x0000000005686000-memory.dmp

Filesize
408KB

Download
memory/5732-648-0x0000000006F40000-0x0000000006F5A000-memory.dmp

Filesize
104KB

Download
memory/5732-645-0x0000000007590000-0x0000000007C0A000-memory.dmp

Filesize
6.5MB

Download
memory/5732-538-0x0000000004A50000-0x0000000004A6E000-memory.dmp

Filesize
120KB

Download
memory/5732-675-0x00000000071B0000-0x0000000007246000-memory.dmp

Filesize
600KB

Download
memory/5732-485-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/5732-689-0x0000000007140000-0x0000000007151000-memory.dmp

Filesize
68KB

Download
memory/6064-447-0x00000212CA3B0000-0x00000212CA3C0000-memory.dmp

Filesize
64KB

Download
memory/6064-444-0x00000212C8600000-0x00000212C8654000-memory.dmp

Filesize
336KB

Download
memory/6064-522-0x00007FFA00E70000-0x00007FFA01932000-memory.dmp

Filesize
10.8MB

Download
memory/6064-474-0x00007FFA00E70000-0x00007FFA01932000-memory.dmp

Filesize
10.8MB

Download