growtopia | f7ba1f62f5168638cbe3ccf0df5af38f68b55962ea3a639f6d0e2a464ab180a0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ValosploitV3_Installer/Installer.exe
Size 12.6MB
Sample240220-w1b3fsdd62
SHA256 817cac7fcfdc0f48444c45be772997707761e2ca1e43e8d53f8f7e0e7a1e42b0
MD5 e560d8abab1b94fa698c5164b10c4fa5
SHA1 7b7e2334f06610ebcb9ac796c471961df6a6c377
SHA512 cc546819fbf9cb40c8bd7c9f686b2d7e189b624fc94a8075e0a43ebcf83d28ed4fc51227c3450e94de91e2c72ce6ce68d7f5e6f8e9e390406da4bcc32470af16
SSDEEP 196608:MgINJY5ucj/+mDZR65PzwNVnQwOsayF0RjPLIp+I3U84IXrTNtNp0GIUOueu/ty:MR+59nYRzw0wlF0RjPLIECU84EJ49h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/3980-58-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-60-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-63-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-66-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-54-0x0000000002EE0000-0x0000000002F4C000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-90-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-104-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-108-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-122-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-124-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-127-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-129-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-147-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-149-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-151-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-143-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-153-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-155-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-157-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-159-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-161-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-83-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-163-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-165-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-167-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-169-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-171-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-173-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-175-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-177-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-182-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-199-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-201-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1
behavioral2/memory/3980-196-0x0000000002EE0000-0x0000000002F45000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

pid	Process
3980	Ilkdt.exe
4536	WinHostMgr.exe
4400	WinErrorMgr.exe
2764	KeyGeneratorI.exe
1228	Sahyui1337.exe
2508	WinErrorMgr.exe
4992	KeyGeneratorI.exe
1436	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
4992	KeyGeneratorI.exe
4992	KeyGeneratorI.exe
4992	KeyGeneratorI.exe
4992	KeyGeneratorI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
40	discord.com
109	pastebin.com
110	pastebin.com
39	discord.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 2792	1436	bauwrdgwodhv.exe	173
PID 1436 set thread context of 4704	1436	bauwrdgwodhv.exe	178

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3808	sc.exe
1588	sc.exe
4924	sc.exe
3848	sc.exe
208	sc.exe
3808	sc.exe
960	sc.exe
212	sc.exe
3680	sc.exe
3988	sc.exe
1916	sc.exe
1836	sc.exe
2944	sc.exe
1916	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000600000002322e-75.dat	pyinstaller
behavioral2/files/0x000600000002322e-97.dat	pyinstaller
behavioral2/files/0x000600000002322e-49.dat	pyinstaller
behavioral2/files/0x000600000002322e-36.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2064	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1228	Sahyui1337.exe
1228	Sahyui1337.exe
3196	powershell.exe
3196	powershell.exe
1428	msedge.exe
1428	msedge.exe
5104	msedge.exe
5104	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
4536	WinHostMgr.exe
1720	cmd.exe
1720	cmd.exe
1720	cmd.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
4536	WinHostMgr.exe
1436	bauwrdgwodhv.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
1436	bauwrdgwodhv.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe
4704	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	Sahyui1337.exe
Token: SeDebugPrivilege	3980	Ilkdt.exe
Token: SeDebugPrivilege	3196	powershell.exe
Token: SeDebugPrivilege	1720	cmd.exe
Token: SeShutdownPrivilege	4680	powercfg.exe
Token: SeCreatePagefilePrivilege	4680	powercfg.exe
Token: SeShutdownPrivilege	440	powercfg.exe
Token: SeCreatePagefilePrivilege	440	powercfg.exe
Token: SeShutdownPrivilege	2724	powercfg.exe
Token: SeCreatePagefilePrivilege	2724	powercfg.exe
Token: SeShutdownPrivilege	384	powercfg.exe
Token: SeCreatePagefilePrivilege	384	powercfg.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeShutdownPrivilege	1956	powercfg.exe
Token: SeCreatePagefilePrivilege	1956	powercfg.exe
Token: SeShutdownPrivilege	4448	powercfg.exe
Token: SeCreatePagefilePrivilege	4448	powercfg.exe
Token: SeShutdownPrivilege	440	powercfg.exe
Token: SeCreatePagefilePrivilege	440	powercfg.exe
Token: SeShutdownPrivilege	1080	powercfg.exe
Token: SeCreatePagefilePrivilege	1080	powercfg.exe
Token: SeLockMemoryPrivilege	4704	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 3196	856	Installer.exe	92
PID 856 wrote to memory of 3196	856	Installer.exe	92
PID 856 wrote to memory of 3196	856	Installer.exe	92
PID 856 wrote to memory of 3980	856	Installer.exe	94
PID 856 wrote to memory of 3980	856	Installer.exe	94
PID 856 wrote to memory of 3980	856	Installer.exe	94
PID 856 wrote to memory of 4536	856	Installer.exe	95
PID 856 wrote to memory of 4536	856	Installer.exe	95
PID 856 wrote to memory of 4400	856	Installer.exe	96
PID 856 wrote to memory of 4400	856	Installer.exe	96
PID 856 wrote to memory of 4400	856	Installer.exe	96
PID 856 wrote to memory of 2764	856	Installer.exe	97
PID 856 wrote to memory of 2764	856	Installer.exe	97
PID 856 wrote to memory of 1228	856	Installer.exe	101
PID 856 wrote to memory of 1228	856	Installer.exe	101
PID 2764 wrote to memory of 4992	2764	KeyGeneratorI.exe	100
PID 2764 wrote to memory of 4992	2764	KeyGeneratorI.exe	100
PID 4400 wrote to memory of 2508	4400	WinErrorMgr.exe	99
PID 4400 wrote to memory of 2508	4400	WinErrorMgr.exe	99
PID 4400 wrote to memory of 2508	4400	WinErrorMgr.exe	99
PID 4992 wrote to memory of 5104	4992	KeyGeneratorI.exe	102
PID 4992 wrote to memory of 5104	4992	KeyGeneratorI.exe	102
PID 5104 wrote to memory of 3976	5104	msedge.exe	103
PID 5104 wrote to memory of 3976	5104	msedge.exe	103
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105
PID 5104 wrote to memory of 4684	5104	msedge.exe	105

C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ValosploitV3_Installer\Installer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AbQBiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAcABpACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGcAbgBpACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHIAcQB2ACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3980
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    PID:1720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4188
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:2940
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3988
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3808
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1588
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3848
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:208
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4924
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:384
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1916
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    PID:440
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:1836
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3808
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:2508
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFC1.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:2064
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9319946f8,0x7ff931994708,0x7ff931994718
        5⤵
        
        PID:3976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1428
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        5⤵
        
        PID:4684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        5⤵
        
        PID:1464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
        5⤵
        
        PID:956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
        5⤵
        
        PID:796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
        5⤵
        
        PID:436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
        5⤵
        
        PID:3848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
        5⤵
        
        PID:3444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:3456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,580929628445413387,8642335819820260870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
        5⤵
        
        PID:4456
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1436
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4076
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:212
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2944
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1916
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1080
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2792
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:440
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

bauwrdgwodhv.exe

Path C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
Size 4.1MB
SHA256 47a02a0934e6af733319a571a9b7d0953aba93986021cd01db0057c7c498332d
MD5 d4590c58d28d7fba8a923192711feda5
SHA1 980cb52068d314d08636d1fce02de60c70f8a518
SHA512 6dabdf20bf0a45a7b4620ba526c82022ed518a72c682a860e335b33ee691c939ac304c7c78e7be26df57b436276d631d44e321791cc2d8515408308d37d8697d
SSDEEP 98304:vNsoCN7HENkGG3JqXwpKRyygqqFgcgSIqLak:vNUN7pJHMR+Fgcg0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

bauwrdgwodhv.exe

Path C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
Size 3.8MB
SHA256 7a42072147edc5f4daec7ee46764e1422206c88c53b2d6d1340f1d326813c541
MD5 298811fc48577139b5e961f10e161821
SHA1 aea01ec9005bec877240cd48e0ccb7201c134278
SHA512 66e8f05e3bf49519db32ca2f10fc1e5f12e4be9a512da7c4eff608edcfee3272c8af7e82f59baa2c525800c1db165a5efcd69b575274e9f3f5d5baaf11daa108
SSDEEP 98304:vNsoCN7HENkGG3JqXwpKRyygqqFgcgSIqC:vNUN7pJHMR+Fgcg0C
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120
MD5 bcaf436ee5fed204f08c14d7517436eb
SHA1 637817252f1e2ab00275cd5b5a285a22980295ff
SHA512 7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 ac490cb48c3544d6b5ef1180f67087133356b2d1cd4a756fddbecfdc3ea277c2
MD5 556027a5f7825b113b5e0dc4e6cd918d
SHA1 37f43086ca7f2a6b9a9481553bfcb5828115bff2
SHA512 54be9ba7e0b027e7d82d6f9de296ded41266a79a8d956e4374eda3e2d2ed14c8dd10cbef2131f4f62a2c47ff5d4f0f5b054a74a5a5cdf92d0b766f3a1acbcb11
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 1e35e3d3c70f3cadfc63ca80ac4cbe8671da91499db7e19f67ea39bb3386dad6
MD5 47a97d9a15df1d6cec60ca4ac002137b
SHA1 b05e79afb47136c7dd3692be9b0e90b02c0d58d2
SHA512 6038da655352888dbdc687be8ea8b3e0b29f1f425c98ffa8fc57b3d3b102330a94931b1e7b80969f658b8766207598e616d5c123ebd36874a820cfc739133d09
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 38556a25ec2f884aeb4e49c9ffff9f72e0e8629caf9b17af795dde53561a9e59
MD5 1a14a664e41b39b82c8bdc4f14c89d67
SHA1 f0570c6f401f2ce6aaaa2041d18b2a1f781e4521
SHA512 488e2fb29bb283da7d129dd549f85ab17651a2c2409b710365ce04cd3527f792d4d771bda915f3a73c402213738185e04ca23bda3228effe57c9a9ad013e2080
SSDEEP 96:n+1kgOl1jOwpvWMoiVmdenIuU1jOyHFMAqUWQyV+VD7AiEwb:n+1kDlFOGWM3IuUhPlMAqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c0750f483af71d77d6cead9b3dc35f31eb704dd4113dffe818a130795f50a8eb
MD5 f0ba74c0fae4b6de4af47ffc56024035
SHA1 c14083c5ce2d4bfd7210bdfd54ef90e36d67c579
SHA512 ebfb3574a28e74ec841f82e71191d6403cb171e0946a5f17606df88637888da0eb1dfbfad164d9d0421035eeca0c35509559dd527753939526d9674fd51a3a27
SSDEEP 96:n+1kuVOl1/OwpvWMoiVmdenIuU1jOy6lFFMAprVUWQyV+VD7AiEwb:n+1kuklNOGWM3IuUhPQMABVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ba1644fe5fb28b5ed234a86c7f9483b40eed5baca843665b57622c384f947207
MD5 ea240f5b288dd4bf81ca73ca0e07cedc
SHA1 9d30e0b1028f4e74dff4059ebad26905937a4dc7
SHA512 e7210ba614233c47acee815e5fe351517c19364dcc490ac0e748c919057e071070e57d37cd56781de5319439349d2c48e19e5028ad91ff407242d98fd5a9fda7
SSDEEP 96:n+DkOOl1jOwpvWMoiVmdeHOVMAqUWQyV+VDCzia:n+Dk5lFOGWMXyMAqrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f
MD5 b0ba6f0eee8f998b4d78bc4934f5fd17
SHA1 589653d624de363d3e8869c169441b143c1f39ad
SHA512 e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9
SSDEEP 768:nJeWwk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaLlacrUo10SrZ/v:nJeWwku1ja3LsoGS9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 24418546b8399270ca74cd88cc07a4d5e537ae917faa45d3f961aa671e1a4d96
MD5 669e6112278cacdcb63c212425d18168
SHA1 5bef50142fa840af11b6d02e80d5e774efb58433
SHA512 9ce2e40a77e30228257b4cd01298f94b63975b37d34925d72b92c0d72410ae549a15a0a88a17980989773b97b3bb1bc20156dce330ddcb4b2a1a397cc83d3748
SSDEEP 384:A9iIxuERzA83h09RZxYFpghY+8Tso0/gO9C9E1MeuBOlw2:rIxuERzA83h09RZx1k0/gO0TO9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 762264482fec317737a964ce98b7cdc2e072bbec5e425eb690d770453cd702c5
MD5 eccf3bdaf4eae708d95c9269debc709c
SHA1 039f4cc704252bfc33af10c105a2a41ac15cab9d
SHA512 e4db21c262e1c65153f2b94e8d2d746635895629b54baa319b356f3273cd4a1885b630b051ed7a0614aeea7956c0990d81708afcdfc23081bacf662d77729905
SSDEEP 192:2oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFzVgh/Ce2RUos+ybJ9c9xE:y9iIxuERzA83h09RZxYFpgh/8TsF9c9a
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 177208fbc7d3400051a4b7b98904dec4aebad9543d8d673e9f385b756899570a
MD5 6666d85f0d001872c5c626030171749a
SHA1 de6613b32bb6f9b5138e95ef54852cc4daedec25
SHA512 f59504856e1bdbf35d29a976c83216de42ace82f0120796a5139475c679c7859784aaeb7adf88634efdffdddcbea97b140952b12f10a013cd7908f8e5aef48fe
SSDEEP 384:X6+BG9i+MC6mIBBiYJk+o9o2THK6seYWjm/a/H3SofqVrf+0Oz/Ypd0gDR+kKhD:KImsoZjo2THNK0XSxb+rz/1Is3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ilkdt.exe

Path C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
Size 191KB
SHA256 d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db
MD5 e004a568b841c74855f1a8a5d43096c7
SHA1 b90fd74593ae9b5a48cb165b6d7602507e1aeca4
SHA512 402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af
SSDEEP 3072:tqlD4M+72hZJN9PxrPgxy5d96YrfFW8Wj2VpWKmTsfkdgPeZ1w9JwveK5YlFEc:4Z0oZJbPxr4s5dvrdLVpBfkd6Jwv+lW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sahyui1337.exe

Path C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
Size 316KB
SHA256 0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d
MD5 675d9e9ab252981f2f919cf914d9681d
SHA1 7485f5c9da283475136df7fa8b62756efbb5dd17
SHA512 9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb
SSDEEP 6144:C2aU6MDdbBCydeWE1sMLwPM8WVXTTayGdTpSVZyXbd:C2xqsMLwPLqT8SVAbd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinErrorMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
Size 42KB
SHA256 bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e
MD5 d499e979a50c958f1a67f0e2a28af43d
SHA1 1e5fa0824554c31f19ce01a51edb9bed86f67cf0
SHA512 668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763
SSDEEP 768:Ba7HmiY7iDr6pKvhSirGDo1aRqcVrwjhORaNIVIbEVHq3YH5E:XiY0ryqhrGkkRq0wj4RcIVIbEQ3Y2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinHostMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
Size 2.6MB
SHA256 fb5b8cf97c6329c0b259faa2662908eaf230d5b24a26b24423d2fe3a8641e32d
MD5 473aa58ba305e7aba8c35dd7c8bd0c53
SHA1 0fe22e1c981b0e62ae328af5de356946ba8677cf
SHA512 468479b5378d6e163c3a93bdfeafef8dc00510be834c77bdef98dda70b65ec56aa63b0e70d2798513208c70c4f608501e584a4963f626d77936f121572afe59f
SSDEEP 49152:jzZXu8ooiXNzXa4l2+xiNkG+Qk36gqD1pwpKRV8yd+meQqq:vNsoCN7HENkGG3JqXwpKRyygqqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinHostMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
Size 2.6MB
SHA256 4517ed0d82e1d47cfcdcdd5f42dbd91cfcfda563280871c109b3d536d2701278
MD5 5a7a3c43bea04a929f306ded49acc618
SHA1 66af91947bae38f2b0615302355b0c44e8d68ee5
SHA512 8a1808ab1d3a57a2f1e2ec035f5a7ef6600053af032a623b5ba49727935cda865e8d5f08ac53ef491b8d68f82ff3b7d99e2487c693190202382345492a7ce4e9
SSDEEP 49152:jzZXu8ooiXNzXa4l2+xiNkG+Qk36gqD1pwpKRV8yd+meQR:vNsoCN7HENkGG3JqXwpKRyygqR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinHostMgr.exe

Path C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
Size 1.3MB
SHA256 294df5a2a8090a1e4385ef54ef8757b54f19637125cc87a8124bd5359ac160de
MD5 ee87b615fd8626e4704208d1fde8e03d
SHA1 5c2800c868e96bdc347194ccb9bb3f5004ddd6a9
SHA512 4014ba67b74a6a1f4a7c5c774da690ac39982658805635f2cba38ac7c8fb88446d47c745da1c063507c2104aca64cde9d84328bb53fa8776db5460890a81be96
SSDEEP 24576:QmHzZtF9o8wvoFQ6MNNhYSu2XZbBmrhR2FBlDq3RExiNkh1:jzZXu8ooiXNzXa4l2+xiNk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\_decimal.pyd
Size 247KB
SHA256 d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
MD5 f78f9855d2a7ca940b6be51d68b80bf2
SHA1 fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA512 6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
SSDEEP 6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\base_library.zip
Size 712KB
SHA256 1623fb9c48a4eaec7d4ed04df9d7ef0929dce34ca2599a406e2d8c0b54d6563e
MD5 d3b92a8e844991017db041c08015609b
SHA1 3ceee19d1ffc86873d599059e47fd7c2bdf5d3bf
SHA512 9085ecf6f3167b8cfbd2f1802378a2b0cd9157eb81b0663fe272c8cf4f6028506ed77be4ad7aaa83f9c56219adcf7c835e27b67462fa0c0fc2f48a4e9329d3d1
SSDEEP 6144:X+ttcY+bu8WwiZUUtS9AAOOmVHi22FkUa4hQmyZ+N16CEcphzt92nFs+dB7EMbMf:uttcY+bStOmgRF1+fYNXPh26UZWAzau0
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\libcrypto-3.dll
Size 625KB
SHA256 ad29f985da85d98a8f798fac4590f88068c3ec8a8341050c9628c1e04f9043d8
MD5 2d5a8e5294fed34263c911552eee1b20
SHA1 fa449c76fc562d21da1c00c3e303a7d7f21295cb
SHA512 68d0e23c53576e487cc9a9eef2b70e26282a629a7be411d64ccc573dcebebfe83241d8bbbe047ec677d7f67c3569ae2761b73259c7ec3afacc1d060ddfa58259
SSDEEP 12288:5mKaurTKuk2qcWhPAIttY3reTjD06MlNyNrllOjPWn:JTKuk2IPAVIH06iyN3OjPWn
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\python312.dll
Size 955KB
SHA256 fa28eb076f69452c3d8b3b76d1189d0cad6f6c7c7a6c0c644ec7104ab76c367f
MD5 a2e45927051c9ae842efff4baf419151
SHA1 3edb31e58d9b93dd507e77d2d34c826b7e3143b9
SHA512 d00eeb3f306ed2afa97961fb6789c56afd6061430253fe29ddf040966b1269a2958f2125f67f7e8c7eca92bdb6eb723fd8e4381d54302767d01866f1e1175621
SSDEEP 24576:2OH7//1aaSRT0lnjGi5lrEHB6O84uZ1fv:2O/cau0lnlpqB6O/uZ1fv
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\python312.dll
Size 868KB
SHA256 b64c7d3f8da192736b124acb87e263023bf29b9f92b37bfcd2f28a56c7977cff
MD5 1f42150a650d093cec7ec4e911a43d6f
SHA1 959b058c484a2266d41175785b0b07d416d6c294
SHA512 f08803720de2462af4d6c45471a7de39493e39ee91541e707ad917cae7a8f26716c96e4482cd87496f5314badc58c6f40206bce8d7716f3942c773931372294a
SSDEEP 12288:+BOH7/BR1aazpsRT0lE2Va4GS9hrJDrAdJzHlC0Ss7uO84xf:2OH7//1aaSRT0lnjGi5lrEHB6O841
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI27642\unicodedata.pyd
Size 708KB
SHA256 d212ade33a70a683ba080c04273d94db6c9aefe207aae47f2bca4e8002fc69cc
MD5 1b645c5c5034395d2ecf8b49b3d79fda
SHA1 da0090fa487816337fc01ac1fa2ab26293dcbe0c
SHA512 935e56abc754cae12e405bfbf16cc856deda752ccf1c7536d64680c090d0adc20b1857f8e74245958df431bf83b242f3059e5e7ced8df82ba83f5984639d7fa4
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQu:PrEXQCjfk7bPNfvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ihkwdiis.bhu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihkwdiis.bhu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmpDFC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDFC1.tmp
Size 1KB
SHA256 da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4
MD5 7f673f709ab0e7278e38f0fd8e745cd4
SHA1 ac504108a274b7051e3b477bcd51c9d1a4a01c2c
SHA512 e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132
MD5 SHA1 SHA512

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 1.7MB
SHA256 47363b1a47ade33f9c3d283ffad06941761954e5bd7ab857ddac2058912c241c
MD5 facb78858af0e62dcab56fb19ee15b4d
SHA1 efe8dc95ccbb31742d01341a1e73a8c7e49f7877
SHA512 9d68bb8fabfb44d9d44d6bc9bd49e1daabd5ed26a3ca3cbb5eb9545663a9c57836f746bbca7ab3265426749fcd7a1f11f0742aee5905dd22b779a7e24e3a2ad0
SSDEEP 49152:zQDTl8ylGbIzfd1I1FhqCiACyAaQO6g9M:wZ8pUcU1W9M
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 1.9MB
SHA256 30963ddbcb9d4c1e16c21abaec37eaebc3c8db2a50d64e1d49c65a2dd63f4b15
MD5 f9e0c0a5b2230faf5bf8d20dae0e9702
SHA1 3d45251686e5c9485b3371258c357aa41cfca567
SHA512 f2b5bf9c10b258353e665868105f01abf2eb7aab45d0b7c91a01a906e94cb114b1dba0771ce3ed55bf5aa8a88ce6974af5e5c2be5b8b8a1e301997c87a6bd060
SSDEEP 49152:zQDTl8ylGbIzfd1I1FhqCiACyAaQO6g90n3AI:wZ8pUcU1W903AI
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 187KB
SHA256 265b9c1feeadc427376b8b62b2c2afecc91b7b358bbb8109952da4ed53e135e1
MD5 f07808442ed1e169cce16fa5cc942835
SHA1 dd3e17a14bcc70a9f0af05dfc62b4513fc60c07a
SHA512 cd613a11760845a57c24c8c50c6970e6f6024b48a301ef166e88cea42de38e0d59a09e16a8f4b7ca1b0f288afb09f5dc71fe09eff4a8461177cbdddfcde28147
SSDEEP 3072:WvE3oct8fNwfbp+IZen0H2RiF0SLpGmpj8TIL6I2Gcvqedr0OXzjTE1VUOr4:z3gibQ+c0Hh2Op/WMLV2G4/rrXQg
MD5 SHA1 SHA512 SSDEEP

Submit Download

KeyGeneratorI.exe

Path C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
Size 817KB
SHA256 cdfd910f45bf03c783791711259f76e5912b089892e191fc200795fc81cea667
MD5 371a40b5983e426329437e53f64ddcc8
SHA1 dbc87afb2be5ad9e37f3acd899119a2a4b900962
SHA512 ef52ea95a6d16203ca0f8eb5501a5bb189457e403ebb1117613ed81ad79f54ae0f19191ab90b005562862225f10fd1d4e5f80489a63de3f0631a7e2d7ee791e4
SSDEEP 24576:zQwNF/WMAB78v6lbi5QCIzfXd1IjVE8Fiq9Nq3:zQDTl8ylGbIzfd1I1Fhq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1228-84-0x00007FF930E30000-0x00007FF9318F1000-memory.dmp

Download

memory/1228-144-0x00007FF930E30000-0x00007FF9318F1000-memory.dmp

Download

memory/1228-86-0x0000023C1EA80000-0x0000023C1EA90000-memory.dmp

Download

memory/1228-53-0x0000023C044A0000-0x0000023C044F4000-memory.dmp

Download

memory/1720-1840-0x0000011FCA460000-0x0000011FCA470000-memory.dmp

Download

memory/1720-1841-0x0000011FCA460000-0x0000011FCA470000-memory.dmp

Download

memory/1720-1846-0x00007FF92EB00000-0x00007FF92F5C1000-memory.dmp

Download

memory/1720-1839-0x00007FF92EB00000-0x00007FF92F5C1000-memory.dmp

Download

memory/1720-1834-0x0000011FCA3A0000-0x0000011FCA3C2000-memory.dmp

Download

memory/2016-1871-0x0000014B68A80000-0x0000014B68A9C000-memory.dmp

Download

memory/2016-1878-0x0000014B68CF0000-0x0000014B68CF6000-memory.dmp

Download

memory/2016-1859-0x00007FF92EC40000-0x00007FF92F701000-memory.dmp

Download

memory/2016-1888-0x00007FF92EC40000-0x00007FF92F701000-memory.dmp

Download

memory/2016-1861-0x0000014B68650000-0x0000014B68660000-memory.dmp

Download

memory/2016-1880-0x0000014B68650000-0x0000014B68660000-memory.dmp

Download

memory/2016-1879-0x0000014B68D00000-0x0000014B68D0A000-memory.dmp

Download

memory/2016-1872-0x0000014B68AA0000-0x0000014B68B55000-memory.dmp

Download

memory/2016-1873-0x0000014B68B60000-0x0000014B68B6A000-memory.dmp

Download

memory/2016-1874-0x0000014B68CD0000-0x0000014B68CEC000-memory.dmp

Download

memory/2016-1875-0x0000014B68CB0000-0x0000014B68CBA000-memory.dmp

Download

memory/2016-1877-0x0000014B68CC0000-0x0000014B68CC8000-memory.dmp

Download

memory/2016-1876-0x0000014B68D10000-0x0000014B68D2A000-memory.dmp

Download

memory/2016-1860-0x0000014B68650000-0x0000014B68660000-memory.dmp

Download

memory/2508-1843-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/2508-106-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/2508-110-0x00000000056A0000-0x00000000056B0000-memory.dmp

Download

memory/3196-112-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/3196-266-0x0000000007470000-0x0000000007481000-memory.dmp

Download

memory/3196-37-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/3196-57-0x00000000029D0000-0x00000000029E0000-memory.dmp

Download

memory/3196-59-0x00000000029D0000-0x00000000029E0000-memory.dmp

Download

memory/3196-34-0x0000000002960000-0x0000000002996000-memory.dmp

Download

memory/3196-56-0x0000000005140000-0x0000000005768000-memory.dmp

Download

memory/3196-121-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Download

memory/3196-125-0x0000000005AE0000-0x0000000005E34000-memory.dmp

Download

memory/3196-142-0x0000000005F40000-0x0000000005F5E000-memory.dmp

Download

memory/3196-146-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Download

memory/3196-181-0x0000000073BF0000-0x0000000073C3C000-memory.dmp

Download

memory/3196-98-0x00000000057C0000-0x00000000057E2000-memory.dmp

Download

memory/3196-180-0x0000000006EC0000-0x0000000006EF2000-memory.dmp

Download

memory/3196-192-0x0000000006EA0000-0x0000000006EBE000-memory.dmp

Download

memory/3196-197-0x0000000007110000-0x00000000071B3000-memory.dmp

Download

memory/3196-194-0x00000000029D0000-0x00000000029E0000-memory.dmp

Download

memory/3196-345-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/3196-325-0x0000000007590000-0x0000000007598000-memory.dmp

Download

memory/3196-318-0x00000000075B0000-0x00000000075CA000-memory.dmp

Download

memory/3196-311-0x00000000074C0000-0x00000000074D4000-memory.dmp

Download

memory/3196-179-0x000000007F800000-0x000000007F810000-memory.dmp

Download

memory/3196-211-0x00000000078B0000-0x0000000007F2A000-memory.dmp

Download

memory/3196-213-0x0000000007270000-0x000000000728A000-memory.dmp

Download

memory/3196-219-0x00000000072F0000-0x00000000072FA000-memory.dmp

Download

memory/3196-239-0x00000000074F0000-0x0000000007586000-memory.dmp

Download

memory/3196-304-0x00000000074B0000-0x00000000074BE000-memory.dmp

Download

memory/3980-157-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-171-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-161-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-83-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-196-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-201-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-199-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-182-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-165-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-1797-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/3980-155-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-153-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-143-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-151-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-149-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-177-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-147-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-175-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-129-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-127-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-173-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-159-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-124-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-122-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-108-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-104-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-38-0x0000000000CB0000-0x0000000000CE6000-memory.dmp

Download

memory/3980-90-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-169-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-54-0x0000000002EE0000-0x0000000002F4C000-memory.dmp

Download

memory/3980-66-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-65-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/3980-163-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-63-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-62-0x0000000001440000-0x0000000001450000-memory.dmp

Download

memory/3980-60-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-167-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/3980-58-0x0000000002EE0000-0x0000000002F45000-memory.dmp

Download

memory/4400-55-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/4400-30-0x0000000000A70000-0x0000000000A80000-memory.dmp

Download

memory/4400-105-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/4704-1912-0x0000000001A30000-0x0000000001A50000-memory.dmp

Download

memory/4704-1942-0x0000000001B50000-0x0000000001B70000-memory.dmp

Download

memory/4704-1970-0x0000000001B50000-0x0000000001B70000-memory.dmp

Download