growtopia | c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576

Analysis

max time kernel
1800s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VespyGrabberBuilder.exe
Size

12.6MB
MD5

fab385fb154644665f94aca9424fb0ce
SHA1

8dc525108cebd97b3127129cc1633a7f31010424
SHA256

c08b63c50a78ca119a5ff4fe10592a0f66289708df38349e91e645214aae7576
SHA512

07def38b8590ebaa95d7213e77e3892f60f10a87cef797fa07c6feb033f08d4148024360c7c32b5f92441c41236b8a86e66cee59bb51d6fbde97b86923a640e3
SSDEEP

393216:NayDfg/3Y8G6jgVINcfwt+F2CZZiLe2Wq:wyDfYPwPwtO2Mie2J

Score

10^/10

growtopia zgrat evasion persistence pyinstaller rat stealer

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/1072-58-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-61-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-56-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-65-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-92-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-76-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-55-0x0000000004F70000-0x0000000004FDC000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-105-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-142-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-127-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-118-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-99-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-183-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-190-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-192-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-194-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-196-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-198-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-200-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-202-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-204-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-206-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-208-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-210-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-212-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-214-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-216-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-218-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-175-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-228-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-223-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-230-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-235-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1
behavioral2/memory/1072-241-0x0000000004F70000-0x0000000004FD5000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	VespyGrabberBuilder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

pid	Process
1072	Ilkdt.exe
4800	WinHostMgr.exe
4656	WinErrorMgr.exe
4888	Sahyui1337.exe
3184	KeyGeneratorTOP.exe
2808	KeyGeneratorTOP.exe
3516	WinErrorMgr.exe
5188	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

pid	Process
2808	KeyGeneratorTOP.exe
2808	KeyGeneratorTOP.exe
2808	KeyGeneratorTOP.exe
2808	KeyGeneratorTOP.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
105	pastebin.com
37	discord.com
38	discord.com
104	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
224	api.ipify.org
227	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe
File opened for modification	C:\Windows\system32\MRT.exe	Process not Found
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5188 set thread context of 1820	5188	bauwrdgwodhv.exe	170
PID 5188 set thread context of 5436	5188	bauwrdgwodhv.exe	179

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5352	sc.exe
5716	sc.exe
6060	sc.exe
6016	sc.exe
5148	sc.exe
5408	sc.exe
5228	sc.exe
5592	sc.exe
6068	sc.exe
6104	sc.exe
5356	sc.exe
5496	sc.exe
5940	sc.exe
5828	sc.exe

Detects Pyinstaller 4 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000600000002321e-54.dat	pyinstaller
behavioral2/files/0x000600000002321e-77.dat	pyinstaller
behavioral2/files/0x000600000002321e-47.dat	pyinstaller
behavioral2/files/0x000600000002321e-95.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1000	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3316742141-2240921845-2885234760-1000\{29ADC599-A706-46C4-AB31-A41DD88066D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4888	Sahyui1337.exe
4888	Sahyui1337.exe
5088	powershell.exe
5088	powershell.exe
3400	msedge.exe
3400	msedge.exe
2472	msedge.exe
2472	msedge.exe
2764	identity_helper.exe
2764	identity_helper.exe
4800	Process not Found
392	powershell.exe
392	powershell.exe
392	powershell.exe
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
4800	Process not Found
5188	bauwrdgwodhv.exe
2612	powershell.exe
2612	powershell.exe
2612	powershell.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5188	bauwrdgwodhv.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe
5436	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4888	Sahyui1337.exe
Token: SeDebugPrivilege	1072	Ilkdt.exe
Token: SeDebugPrivilege	5088	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeShutdownPrivilege	5684	powercfg.exe
Token: SeCreatePagefilePrivilege	5684	powercfg.exe
Token: SeShutdownPrivilege	5692	powercfg.exe
Token: SeCreatePagefilePrivilege	5692	powercfg.exe
Token: SeShutdownPrivilege	5708	powercfg.exe
Token: SeCreatePagefilePrivilege	5708	powercfg.exe
Token: SeShutdownPrivilege	5700	powercfg.exe
Token: SeCreatePagefilePrivilege	5700	powercfg.exe
Token: SeDebugPrivilege	2612	powershell.exe
Token: SeShutdownPrivilege	4884	powercfg.exe
Token: SeCreatePagefilePrivilege	4884	powercfg.exe
Token: SeShutdownPrivilege	2728	powercfg.exe
Token: SeCreatePagefilePrivilege	2728	powercfg.exe
Token: SeShutdownPrivilege	4628	powercfg.exe
Token: SeCreatePagefilePrivilege	4628	powercfg.exe
Token: SeShutdownPrivilege	1240	powercfg.exe
Token: SeCreatePagefilePrivilege	1240	powercfg.exe
Token: SeLockMemoryPrivilege	5436	explorer.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 5088	2620	VespyGrabberBuilder.exe	92
PID 2620 wrote to memory of 5088	2620	VespyGrabberBuilder.exe	92
PID 2620 wrote to memory of 5088	2620	VespyGrabberBuilder.exe	92
PID 2620 wrote to memory of 1072	2620	VespyGrabberBuilder.exe	94
PID 2620 wrote to memory of 1072	2620	VespyGrabberBuilder.exe	94
PID 2620 wrote to memory of 1072	2620	VespyGrabberBuilder.exe	94
PID 2620 wrote to memory of 4800	2620	VespyGrabberBuilder.exe	95
PID 2620 wrote to memory of 4800	2620	VespyGrabberBuilder.exe	95
PID 2620 wrote to memory of 4656	2620	VespyGrabberBuilder.exe	96
PID 2620 wrote to memory of 4656	2620	VespyGrabberBuilder.exe	96
PID 2620 wrote to memory of 4656	2620	VespyGrabberBuilder.exe	96
PID 2620 wrote to memory of 4888	2620	VespyGrabberBuilder.exe	101
PID 2620 wrote to memory of 4888	2620	VespyGrabberBuilder.exe	101
PID 2620 wrote to memory of 3184	2620	VespyGrabberBuilder.exe	100
PID 2620 wrote to memory of 3184	2620	VespyGrabberBuilder.exe	100
PID 4656 wrote to memory of 3516	4656	WinErrorMgr.exe	97
PID 4656 wrote to memory of 3516	4656	WinErrorMgr.exe	97
PID 4656 wrote to memory of 3516	4656	WinErrorMgr.exe	97
PID 3184 wrote to memory of 2808	3184	KeyGeneratorTOP.exe	98
PID 3184 wrote to memory of 2808	3184	KeyGeneratorTOP.exe	98
PID 2808 wrote to memory of 2472	2808	KeyGeneratorTOP.exe	104
PID 2808 wrote to memory of 2472	2808	KeyGeneratorTOP.exe	104
PID 2472 wrote to memory of 704	2472	msedge.exe	103
PID 2472 wrote to memory of 704	2472	msedge.exe	103
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107
PID 2472 wrote to memory of 4856	2472	msedge.exe	107

C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe
"C:\Users\Admin\AppData\Local\Temp\VespyGrabberBuilder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHIAcgB3ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAZAB5ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AdABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGkAYgBxACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5220
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5304
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5356
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5408
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:5496
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:5592
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:5716
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5708
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:5940
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:6068
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:6060
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:3516
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1000
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3184
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4888

C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:4856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:8
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:3136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6204 /prefetch:8
    3⤵
    - Modifies registry class
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6168 /prefetch:8
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:5700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:6400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
    3⤵
    PID:6508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
    3⤵
    PID:6500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14767134679723242728,2097016893908463645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5364 /prefetch:2
    3⤵
    PID:6956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffba62746f8,0x7ffba6274708,0x7ffba6274718
1⤵
PID:704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5188
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:5828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5936
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6032
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6016
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6104
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5352
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1820
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4884
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WinErrorMgr.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
a0c192ff75834d67e73a93ff1f131149

SHA1
6b1487ca4a30732152b590d42519593f3f1d11b2

SHA256
9314d883d81a49570519a62574ffed0936246f2e7f84ac57cc099fe1e00939d6

SHA512
41ebf131ea306d1682bdb12a9c55f61ae9aa103b26d9493459e63de9e9e16fbf022f2a7e0f180747a2ef3f359ac031d05856831bc31f886b564deaa7df1c992c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
811d7e0f541599b09c1c351b40f03c2c

SHA1
11b73b275d2c7e58a5a5813ae8bc80d2e7d9871f

SHA256
b126a6378290793c5e3d5c34ab7e4c0bcfe1f86ff1acedbffa654f3098d64dee

SHA512
25be65d2abc46a5e78b80525315724fbb27da90379dd55b6cf99ed3aac442c0763da31d121e30b7290525f156e27c3d71a7f5a919960f4ecd63a0bbd4a283ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
edb02ff0f62bae388363a5ad5f4e07db

SHA1
acfe477eb57bca7a1a34675db88b6e4da747f660

SHA256
c89afee4c675bf977993285d181be44d785f6c069c0d266b38c2ae7dfc3100cb

SHA512
20bfe754ab5bd7494f33c19a299b22b8fdfb339c0364c0132e98722f3011b009c9f74c77c89f7928a46849fee3341463c18f75d203ae1fc4f6b57969f8233faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6da20c2781313cec6e79c17ce4a7dd5c

SHA1
a9c41904d8ec0efb1fa2554be35e6440cda449ff

SHA256
48f77ceac2eb9dfeaa3c09b41ecae4afefa6df2a54365ffbe98d0418066bbb29

SHA512
5aee8c84ecc9b948e36e5b7af43ba26715a3ae9577f64f5482e858d0f22c87ad8498469465904afe66f668caa3d02aef115b9eec86a9bd814e39eb7d98ed35b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6969bc23dfe0c3b8d1a1a2be0003649

SHA1
410e6048e2437ed5fedac349676f790df9a406af

SHA256
b4092dd9475583c8e45159d88b2bd1ecc755a40cfacb01e3c60d35de1dd517c3

SHA512
0393582f0d55e448072afad86e4384be7170662924e20cef133b1b92ef68a8d30cc6fb80ca0ecc60be0575ea0cc961441c2cdaad0be29aceba27a888087c8321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
884e8dcefe8474bac3c4599f8a4c7074

SHA1
aca4a2e9dea8338bf202549d53edd2c79ff4e6e0

SHA256
3919741b3ab763fba6b6fecb36ac00f44f9bb9ed940e0af6dc6070bfc78ee87b

SHA512
109fb43dfc1d4bc266d6d04ba6105e9ae57b3b04a7cda63d97429c0a6e91652bb64c3806d74bb49e85611556784e1745c9ad4192174959232544f9eebd42e616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d4b833702d85a23f9dd3162e11b5c6ad

SHA1
a9ab3b7cdf73fcca33ada7c7641014386892df26

SHA256
d2da51ada0f204903dad386a39849d5ce8f636dd49f5853a918d3c5a11dc7a76

SHA512
eb417a91254426f92f0d35f37913f2372a89d1d4081a8052412adb62c353c5b57dc34af52f803001e65818949427de637d0512811827465f93f2f0b9da292ec1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b39e5dd9aa7bc631e4cc076703f3c6f7

SHA1
280de7aee81ef553d717d1d7b49dd3f521cf87bb

SHA256
9e226721030c3e2a25dd028a3219f8d03c8630385e5e6fd7bea3e4029632c587

SHA512
a50e94be7b0023d5f9aa4c39b0b87048b86936b8039c86a48c128b610304d8cf08651cd2c6f7df8c73e7113a99338d11d71d7d8fafa67d81935e95567a415d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8986f3206d4a5b14f18ea4a59c18c93

SHA1
1181ae27e3af044c5d750be4d805dc483ea7658a

SHA256
9c0976bc7ef5512244d930d89cceacf10db3fa3d16d42c11cd3fdf3f8e03605d

SHA512
5cda61f2b1be6b0f91efee7e5dd1f7095fecdd726aa9588a0a2a6cb37cff84d893ee856d425e78456f8f6f2cd76df0b36bfdc25804b24cd3421282added2c242

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\e88b8b2b-bf74-4aa9-97ca-c6330bbc86f2\index-dir\the-real-index

Filesize
5KB

MD5
78bde27c39f79b1170f2d6e92f1b24ac

SHA1
8af825068327ac996b34ebad28c45734d1399bc6

SHA256
aa1f3ac9fd5bf4ef37f6c77c7d5ab61c8a6943d15587a73a8a5cefeac3b1785d

SHA512
e943eaa53d56ed530d0d0d0c854c57077ba5f3dce5cc19b7a5de634777c6b9a4f3360580a5cf6a01d6043fc0b1178ff97850935442294016bc0f4cf00a5d69bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\e88b8b2b-bf74-4aa9-97ca-c6330bbc86f2\index-dir\the-real-index~RFe593fbe.TMP

Filesize
48B

MD5
f2b440be519ebe7c98f2c00cb63874bb

SHA1
80d24390f1d0f12a7a597b68a739d555bafec1c1

SHA256
9d012545f451166574a2589573aa8526f990da2f9fb021a2318b47ead711967d

SHA512
9fc719d9e9922c1ffa7eb46cd6fb1d0c3a089fd8965ee0e74e898b784eb29721eb69c6c043c45bb1fabe850850425038339181ed6108f635bcd7e03d41aa00be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
93B

MD5
c9cdc40afd4924f894d8012c83ee14ef

SHA1
873e99d1f22878195f8069bb0c3308a7d031d945

SHA256
685152e858ca27e46da40e7918e1a02cfed1bb5ddd9bc8913a6a2797f5c2c2ec

SHA512
41aa4363794b1bc3312b1afafebeb722c18dc192bfb37c2e883cccc436d721ed06ea3c82643a7e00f461cc8bd37704c4df0f4bba6e503d871ff4c9e7312f53b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c1eb0cde2406b6af565f825dcd492589d40ab644\index.txt

Filesize
89B

MD5
3005959ed7d4405d48cddafc34d510d6

SHA1
eb1904dab2ab36647bd809c169b2f5cd5f5e817a

SHA256
89765c24b738e23f93bc820da77423d17dedca79d426a41600df4398f19c1398

SHA512
81ccffeaa11670220091ab5882c9a852f91148b31d5c028e7a6d8f495fcbefccdab81b265a9f65e9dc27223e2475d281935774999aa94264832a50c7869edac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c3a7a49e70bb3e073036e71ef058d672

SHA1
ab0945abdf0c7ee562c5058781a765f0c33975d7

SHA256
aeede0176dcba0dca9e93886e08df5aa24d11ccbb8a26ebec6722a05b34185ed

SHA512
1fb9314d898d19b0333f6a97c1f2e1738ec13964b98c91bc6771eda353aa029868a3292aa2abcb5494de28d0c9ce81fd4052c68bf6b1294de7e541fc2453d05f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d4cf.TMP

Filesize
48B

MD5
8d1f254604d669f68c2b2373ba92da2f

SHA1
8e9f1b17d24ffd5f977d303368e896d8d4f45e05

SHA256
463eadc8c06425168977757d4997b4d6379a344bc315c82cf12c878eefa01361

SHA512
54b1435e5008b4917573f4cb9d3b0c95b98bf9424cee981a08a3f32a6516b7f601240f77f4ca7dd66e6fdab8064856a5aecf270c9b4d9efbc58b0e1ddd40aed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
19beccb1f5ced65346dcbbecbaa61bbb

SHA1
30b7740e0fa87bbdc90ffcb81af52e5c8ccf0518

SHA256
54352ef486e42033b5f7a845824b1780b593f4eabf72d6f837ab2387ffe7f93a

SHA512
49e95242e8389c660bba2cd6378bffda1d958b79313d9f7509035ff7b8d56a1265fcfc9b7cedbd2ab2e7949b7d969cccc28a8efc441f5883e16bf139a2a4da4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
019df4cf52f9e01909528cebfe7cec46

SHA1
ee5ff4af2be634ff6f0aac3cf045502a91df3ad8

SHA256
7fa240a414490dc05182554b80ca7f3ada24696d236e71d1e9b3e1b1ef34f112

SHA512
45ea5ecf9f215cff164b92c02af682a8f55d9220e8a5c5b9dc5decf608a626ec6a1d65704c3185c5a2eed17453efebb2ca9da1303e29986846ff44f63994eb50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5895b3.TMP

Filesize
204B

MD5
d171f1bbcc554f251ced333c1c35b436

SHA1
bf9833ca80f3ec286feeee1f7906fda3f54b67e9

SHA256
08c47e9846434cbb0e48e384e46b1265e71f3fc8b4211df94330182856ebef9d

SHA512
59b94cd8180637ed7416682046a331dc39c8aec39dcb9d5f6607545bab015f2f6820cf7c47369cb79a327e406d6395de3df47a1a3e47839848fba250a41e9ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7c02257c97dbdb928caa332418d6e3d8

SHA1
552d0de9314e6132bf011dc704d9a401c71eaa05

SHA256
b71cc99c14cc92560d0e6d13536ea92a1b02ffe0e777fa06b29c1eaff05488ff

SHA512
9ef848735d0fe4416e573dc258289fc97120077b72a855e9c6e50c8ea383601a9a53f220881f3e210e85d7195adb9127f722cd0e97a6eed91c2117fdcec77a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b87880503b929f0492e873b2931ac332

SHA1
1b3a0344a44b21b30bdeb7d9054d02c506f2e2b8

SHA256
cbc28aa7a096d424807fec4998789e922c68c957c87f65fcfffdd42d905c8a6f

SHA512
f385a66072757663d6baac5bfbbf3807d67f962a184e0937b38e2ae4492dca69ea6917c17440b48f931af77e74afa45a409baf9e83446ae995942f567a1976aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.4MB

MD5
e696469c99af3c613d1b42a6ebbb1463

SHA1
efb9aec80ca1069abac4f9dca8f315cf75472d06

SHA256
6162721aaf0d9da2f0bc52958862cffe29f8506de8800b2c368e41d20e8b798c

SHA512
e643895824e17ad84039d80809435c55ff97beb69d7a48204351c979f0c24823020a9a730bd23a192ac8727f391363aa69de62efaea668ef7cb770d80e934795

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
1.8MB

MD5
6d22d2ac8d8df0fbcb102c399234931a

SHA1
f24f4db7c277db84635c4d4bc76f39967a5739ab

SHA256
7998faf031f4a930d91228ce479b87fc0459f69021d495929b8a2bff525355d4

SHA512
fc297decd51e57649e5f0c14a6854aba9fa3346a0fadc9c1275ef807676005e185c39177c817a2d8fee58b60b1a568a0934cc6d675ad466c457123486def8ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
512KB

MD5
ae6bd9089e0ac4272d650941b352e176

SHA1
bddd00e08690f1588f57a4c08f68c83643dc2a48

SHA256
743151cf89944fbe79eee96abe66c4f214ea954146f7645b4872763d2cfeace7

SHA512
e269110a140feffec07ba26c797ffc23f8b3b7332ebe299b64eaf831167d4ca03814560f9a3c8fbcf16a09134f8e1c1d4ace2f03c130e441aac5dcf2e95c9b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
384KB

MD5
8f65f181b0d0ad36244209ba25415712

SHA1
a416aff9bb402c07e0550f839826b695a35cdbd1

SHA256
9b6857b2f7d6af2a9df50c166a891f861ea091a37a4e23f057a8c695eaa8326b

SHA512
182bad151d241d104b81f9d5f265552d062e7dd731f9e47d2756c37d8f145853c86885a5e525fc11b8b23f0cf15dab711b117e32e48085a000d2a1b2a33a0180

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.2MB

MD5
6a55c259dd13a058b8b57034a8515803

SHA1
34d5628bd3deca9ca0c7a45daf638127f11433f6

SHA256
a0c5ff326c74584e6cb2b9fb9fe4f03a1d7255b17653f42444ee3185209c505d

SHA512
3cb60047b2f09e589310bfc743b583019667bdea3c5d7667f2af8f3e789c3adf5faa9128d399178cb0060562c27ed278207acd4a40a41425a1d8ec0d9a7f3d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.2MB

MD5
b29ec7c5a1c5d5d4c7907e868ebb18c0

SHA1
9012305a6cdaec6a486859238e5f990db540f5ba

SHA256
1ad1818ababd28afd6b84c260773387082ca9da5a397f1b3e8b8b8b02b5b7e39

SHA512
1b905d5bd8bcf6d49c3ba3617cbe121d0f1957a2a58d0ec83fdd03e83452fa8ef3608d36015206bb8d39711247a6b2f8b9bd16c5a37f73d83a6caa2fa9ba324f

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
2.1MB

MD5
6682a28ce9f24bf0b0c1c9aecf4a78d9

SHA1
bf9d640a8d987a0b98011077aa1e385ebc39c652

SHA256
9ac2939f2c8aaf5fcdc9746c1ecc0ad5cb0505c56989c82654a0b2b603c5e2c8

SHA512
a93a671e2eb98252f69e695c741ee96c5131270967b45649d2cf184a1fbc5ff51e99543213ff9a7360f957359e91b9a50408fe3e77350faa4c450df344924a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\VCRUNTIME140.dll

Filesize
14KB

MD5
025997057ab9a7c463fd3e82d15a4d43

SHA1
b7eeca10232ac56e438e6c05b9a574f5c28e3db8

SHA256
cdbe7488ec1eca0014d37dc5cd8c26b274eb3520c361dc82ad071523dd47e516

SHA512
9f71897b23bfa4ab2da70d16b5ada92feb3152d955525789c0625dff46a4b39d049036feb273f94aba9011caa593164351da68449742992a8157f314a77c32f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\libcrypto-3.dll

Filesize
1.2MB

MD5
70c935d152ab8af9b6a995d360ae89f7

SHA1
e708ed82f2ee15034285d126e0c90be5f25a8743

SHA256
979b5dcf2b7e473363c5afcd7289b799a2f616ca880b65597174ca3ad022f85c

SHA512
117ea7b9710392d4e469df5bdedce9d4a988a6fce4b8301e42436be9032b257f4bb5e43d5f9886022c3945ae26a72f0298697c84d82b1118c1b48eff0f07a513

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\python312.dll

Filesize
128KB

MD5
7dd0b85f37b137947a86c06cc0df7911

SHA1
112aecad658ab5fec54b6cae2de45b91d921cfeb

SHA256
8e4d4e57d43450380830f115875564c042bf862e2265989bfdd63531fbacedd1

SHA512
f182f8d7ff2e40cc4acac9dcd6a226117ccf800f0e8bf39a575be5c8d54f98ae1991848f911b2872fc369cc2989299ab5482eb424da74dd7e01b6d8ace20dad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\python312.dll

Filesize
3.1MB

MD5
d7cfd9cfce47fb307693b5132cb6b802

SHA1
0c1ac24943089f39f2225ffccfe8dfbb0d4e3f93

SHA256
3d9d862e25fa364b6f003d2ce8cf5d79a12ab7ce4da46b125de19b5e53a3c52d

SHA512
d39c1baf22d37c439c81c03704b42c62268628c9420c156ceb3458fd309aaa471cd91f7d660c367607dccb70f8846c4d97088d55e240856c669ae69b94313b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI31842\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lhvmx1lh.e4i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
memory/392-1417-0x000001D3F9A30000-0x000001D3F9A52000-memory.dmp

Filesize
136KB

Download
memory/392-1405-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

Filesize
10.8MB

Download
memory/392-1462-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

Filesize
10.8MB

Download
memory/392-1409-0x000001D3FA040000-0x000001D3FA050000-memory.dmp

Filesize
64KB

Download
memory/392-1407-0x000001D3FA040000-0x000001D3FA050000-memory.dmp

Filesize
64KB

Download
memory/1072-190-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-235-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-118-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-57-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/1072-58-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-61-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-56-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-65-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-92-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-76-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-99-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-75-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1072-55-0x0000000004F70000-0x0000000004FDC000-memory.dmp

Filesize
432KB

Download
memory/1072-1648-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1072-183-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-1646-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/1072-45-0x0000000000770000-0x00000000007A6000-memory.dmp

Filesize
216KB

Download
memory/1072-105-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-192-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-194-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-196-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-198-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-200-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-202-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-204-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-206-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-208-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-210-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-127-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-212-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-214-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-216-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-218-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-241-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-175-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-142-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-228-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-223-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/1072-230-0x0000000004F70000-0x0000000004FD5000-memory.dmp

Filesize
404KB

Download
memory/2612-1717-0x000001D62E2C0000-0x000001D62E2CA000-memory.dmp

Filesize
40KB

Download
memory/2612-1653-0x000001D646850000-0x000001D646860000-memory.dmp

Filesize
64KB

Download
memory/2612-1651-0x00007FF4A7CF0000-0x00007FF4A7D00000-memory.dmp

Filesize
64KB

Download
memory/2612-1644-0x000001D62E2A0000-0x000001D62E2BC000-memory.dmp

Filesize
112KB

Download
memory/2612-1761-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

Filesize
10.8MB

Download
memory/2612-1743-0x000001D646850000-0x000001D646860000-memory.dmp

Filesize
64KB

Download
memory/2612-1581-0x000001D646850000-0x000001D646860000-memory.dmp

Filesize
64KB

Download
memory/2612-1738-0x000001D646820000-0x000001D64682A000-memory.dmp

Filesize
40KB

Download
memory/2612-1734-0x000001D62E300000-0x000001D62E306000-memory.dmp

Filesize
24KB

Download
memory/2612-1731-0x000001D62E2D0000-0x000001D62E2D8000-memory.dmp

Filesize
32KB

Download
memory/2612-1579-0x000001D646850000-0x000001D646860000-memory.dmp

Filesize
64KB

Download
memory/2612-1727-0x000001D646BA0000-0x000001D646BBA000-memory.dmp

Filesize
104KB

Download
memory/2612-1576-0x00007FFBA2380000-0x00007FFBA2E41000-memory.dmp

Filesize
10.8MB

Download
memory/2612-1679-0x000001D62E2E0000-0x000001D62E2FC000-memory.dmp

Filesize
112KB

Download
memory/2612-1649-0x000001D646760000-0x000001D646815000-memory.dmp

Filesize
724KB

Download
memory/2612-1659-0x000001D62E110000-0x000001D62E11A000-memory.dmp

Filesize
40KB

Download
memory/3516-121-0x0000000004AF0000-0x0000000004B00000-memory.dmp

Filesize
64KB

Download
memory/3516-1742-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/3516-106-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/4656-32-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/4656-104-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/4656-85-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/4888-49-0x0000020E04960000-0x0000020E049B4000-memory.dmp

Filesize
336KB

Download
memory/4888-62-0x00007FFBA48D0000-0x00007FFBA5391000-memory.dmp

Filesize
10.8MB

Download
memory/4888-73-0x0000020E04E30000-0x0000020E04E40000-memory.dmp

Filesize
64KB

Download
memory/4888-128-0x00007FFBA48D0000-0x00007FFBA5391000-memory.dmp

Filesize
10.8MB

Download
memory/5088-94-0x0000000004B00000-0x0000000004B22000-memory.dmp

Filesize
136KB

Download
memory/5088-53-0x0000000004B60000-0x0000000005188000-memory.dmp

Filesize
6.2MB

Download
memory/5088-166-0x0000000007060000-0x00000000070F6000-memory.dmp

Filesize
600KB

Download
memory/5088-145-0x0000000074750000-0x000000007479C000-memory.dmp

Filesize
304KB

Download
memory/5088-155-0x0000000006070000-0x000000000608E000-memory.dmp

Filesize
120KB

Download
memory/5088-139-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

Filesize
120KB

Download
memory/5088-140-0x0000000005AD0000-0x0000000005B1C000-memory.dmp

Filesize
304KB

Download
memory/5088-246-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/5088-178-0x000000007F410000-0x000000007F420000-memory.dmp

Filesize
64KB

Download
memory/5088-240-0x0000000007050000-0x0000000007058000-memory.dmp

Filesize
32KB

Download
memory/5088-156-0x0000000006AC0000-0x0000000006B63000-memory.dmp

Filesize
652KB

Download
memory/5088-103-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/5088-100-0x0000000005400000-0x0000000005466000-memory.dmp

Filesize
408KB

Download
memory/5088-232-0x0000000007020000-0x0000000007034000-memory.dmp

Filesize
80KB

Download
memory/5088-179-0x0000000006FD0000-0x0000000006FE1000-memory.dmp

Filesize
68KB

Download
memory/5088-238-0x0000000007100000-0x000000000711A000-memory.dmp

Filesize
104KB

Download
memory/5088-222-0x0000000007010000-0x000000000701E000-memory.dmp

Filesize
56KB

Download
memory/5088-182-0x0000000004520000-0x0000000004530000-memory.dmp

Filesize
64KB

Download
memory/5088-64-0x0000000004520000-0x0000000004530000-memory.dmp

Filesize
64KB

Download
memory/5088-158-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/5088-157-0x0000000007420000-0x0000000007A9A000-memory.dmp

Filesize
6.5MB

Download
memory/5088-59-0x0000000004520000-0x0000000004530000-memory.dmp

Filesize
64KB

Download
memory/5088-160-0x0000000006E40000-0x0000000006E4A000-memory.dmp

Filesize
40KB

Download
memory/5088-119-0x00000000054E0000-0x0000000005834000-memory.dmp

Filesize
3.3MB

Download
memory/5088-144-0x0000000006A80000-0x0000000006AB2000-memory.dmp

Filesize
200KB

Download
memory/5088-50-0x0000000073390000-0x0000000073B40000-memory.dmp

Filesize
7.7MB

Download
memory/5088-40-0x00000000044D0000-0x0000000004506000-memory.dmp

Filesize
216KB

Download