growtopia | 269c392423c81d490122c375c7883ab452c4896ec50fad4a4f19825b501847fa

Analysis

max time kernel
1799s
max time network
1801s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
27-04-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AngelHax.exe
Size

12.9MB
MD5

f2d9ce218f902d2e7878be834e0ebae3
SHA1

502b5b506cb630d5e54b0110939dad4a98d45a4c
SHA256

269c392423c81d490122c375c7883ab452c4896ec50fad4a4f19825b501847fa
SHA512

b8c159b4c65befef350bfb22c5f76fd9317303472f4f674d9528985477c3cd77524e757ee60fa213c60e4e9602432cf7d7ba62f8ba8b32cacd1f8da158300718
SSDEEP

393216:IDA3alBdcGM5Qh47Ua/SymzvV9v6soQjWz3yiQUUPesBb:qTlHxv+7UiuzvLCsFW7RQUUPeSb

Score

10^/10

growtopia xenorat zgrat evasion persistence pyinstaller rat stealer trojan

Malware Config

Extracted

Family

xenorat

jctestwindows.airdns.org

Mutex

Xeno_rat_nd8913d

Attributes

delay
5000
install_path
temp
port
45010
startup_name
WindowsErrorHandler

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral1/memory/4620-55-0x0000000005610000-0x000000000567C000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-91-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-97-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-120-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-118-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-116-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-114-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-112-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-110-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-108-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-106-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-104-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-102-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-100-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-95-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-93-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-89-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-85-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-83-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-81-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-79-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-75-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-73-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-71-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-69-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-67-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-65-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-63-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-61-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-59-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-57-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-56-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-87-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1
behavioral1/memory/4620-77-0x0000000005610000-0x0000000005675000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 10 IoCs

pid	Process
4620	Ilkdt.exe
4312	WinHostMgr.exe
1748	WinErrorMgr.exe
2632	Sahyui1337.exe
1344	KeyGeneratorI.exe
5860	KeyGeneratorI.exe
5716	WinErrorMgr.exe
3540	bauwrdgwodhv.exe
1492	KeyGeneratorI.exe
1724	KeyGeneratorI.exe

Loads dropped DLL 8 IoCs

pid	Process
5860	KeyGeneratorI.exe
5860	KeyGeneratorI.exe
5860	KeyGeneratorI.exe
5860	KeyGeneratorI.exe
1724	KeyGeneratorI.exe
1724	KeyGeneratorI.exe
1724	KeyGeneratorI.exe
1724	KeyGeneratorI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	discord.com
17	pastebin.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3540 set thread context of 2288	3540	bauwrdgwodhv.exe	157
PID 3540 set thread context of 5820	3540	bauwrdgwodhv.exe	160

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2836	sc.exe
1980	sc.exe
3148	sc.exe
3472	sc.exe
6116	sc.exe
1676	sc.exe
4516	sc.exe
244	sc.exe
4680	sc.exe
3476	sc.exe
2044	sc.exe
4564	sc.exe
4412	sc.exe
3692	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001900000002ab37-34.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3808	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	Sahyui1337.exe
2632	Sahyui1337.exe
4416	powershell.exe
4416	powershell.exe
5152	msedge.exe
5152	msedge.exe
5604	msedge.exe
5604	msedge.exe
4456	msedge.exe
4456	msedge.exe
4312	WinHostMgr.exe
1888	powershell.exe
1888	powershell.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
4312	WinHostMgr.exe
3540	bauwrdgwodhv.exe
3732	powershell.exe
3732	powershell.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
3540	bauwrdgwodhv.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe
5820	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5604	msedge.exe
5604	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2632	Sahyui1337.exe
Token: SeDebugPrivilege	4620	Ilkdt.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeShutdownPrivilege	2748	powercfg.exe
Token: SeCreatePagefilePrivilege	2748	powercfg.exe
Token: SeShutdownPrivilege	2328	powercfg.exe
Token: SeCreatePagefilePrivilege	2328	powercfg.exe
Token: SeShutdownPrivilege	2644	powercfg.exe
Token: SeCreatePagefilePrivilege	2644	powercfg.exe
Token: SeShutdownPrivilege	844	powercfg.exe
Token: SeCreatePagefilePrivilege	844	powercfg.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeShutdownPrivilege	2560	powercfg.exe
Token: SeCreatePagefilePrivilege	2560	powercfg.exe
Token: SeShutdownPrivilege	2788	powercfg.exe
Token: SeCreatePagefilePrivilege	2788	powercfg.exe
Token: SeLockMemoryPrivilege	5820	explorer.exe
Token: SeShutdownPrivilege	2808	powercfg.exe
Token: SeCreatePagefilePrivilege	2808	powercfg.exe
Token: SeShutdownPrivilege	2596	powercfg.exe
Token: SeCreatePagefilePrivilege	2596	powercfg.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5044	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4416	1612	AngelHax.exe	82
PID 1612 wrote to memory of 4416	1612	AngelHax.exe	82
PID 1612 wrote to memory of 4416	1612	AngelHax.exe	82
PID 1612 wrote to memory of 4620	1612	AngelHax.exe	84
PID 1612 wrote to memory of 4620	1612	AngelHax.exe	84
PID 1612 wrote to memory of 4620	1612	AngelHax.exe	84
PID 1612 wrote to memory of 4312	1612	AngelHax.exe	85
PID 1612 wrote to memory of 4312	1612	AngelHax.exe	85
PID 1612 wrote to memory of 1748	1612	AngelHax.exe	86
PID 1612 wrote to memory of 1748	1612	AngelHax.exe	86
PID 1612 wrote to memory of 1748	1612	AngelHax.exe	86
PID 1612 wrote to memory of 1344	1612	AngelHax.exe	87
PID 1612 wrote to memory of 1344	1612	AngelHax.exe	87
PID 1612 wrote to memory of 2632	1612	AngelHax.exe	88
PID 1612 wrote to memory of 2632	1612	AngelHax.exe	88
PID 1344 wrote to memory of 5860	1344	KeyGeneratorI.exe	90
PID 1344 wrote to memory of 5860	1344	KeyGeneratorI.exe	90
PID 1748 wrote to memory of 5716	1748	WinErrorMgr.exe	91
PID 1748 wrote to memory of 5716	1748	WinErrorMgr.exe	91
PID 1748 wrote to memory of 5716	1748	WinErrorMgr.exe	91
PID 5860 wrote to memory of 5604	5860	KeyGeneratorI.exe	92
PID 5860 wrote to memory of 5604	5860	KeyGeneratorI.exe	92
PID 5604 wrote to memory of 1216	5604	msedge.exe	93
PID 5604 wrote to memory of 1216	5604	msedge.exe	93
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94
PID 5604 wrote to memory of 5132	5604	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\AngelHax.exe
"C:\Users\Admin\AppData\Local\Temp\AngelHax.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAcgBhACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAbABmACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAG4AYQBoACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAYQBwACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5608
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:5936
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:244
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4680
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2836
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:3476
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1980
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:3472
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4564
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:3692
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:4412
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    PID:5716
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF03.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:3808
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
    "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba9183cb8,0x7ffba9183cc8,0x7ffba9183cd8
        5⤵
        
        PID:1216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,14766344968274701128,6116969964306921863,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
        5⤵
        
        PID:5132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,14766344968274701128,6116969964306921863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,14766344968274701128,6116969964306921863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
        5⤵
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14766344968274701128,6116969964306921863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        
        PID:1536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,14766344968274701128,6116969964306921863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
        5⤵
        
        PID:2208
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,14766344968274701128,6116969964306921863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4456
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:3540
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2828
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:6072
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6116
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1676
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:4516
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3148
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:2044
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2288
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5820

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5044

C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
"C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
1⤵
- Executes dropped EXE
PID:1492
- C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe
  "C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffba9183cb8,0x7ffba9183cc8,0x7ffba9183cd8
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4072 /prefetch:2
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,4677283261217595714,1243051971710285849,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
      4⤵
      PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bdf3e009c72d4fe1aa9a062e409d68f6

SHA1
7c7cc29a19adb5aa0a44782bb644575340914474

SHA256
8728752ef08d5b17d7eb77ed69cfdd1fc73b9d6e27200844b0953aeece7a7fdc

SHA512
75b85a025733914163d90846af462124db41a40f1ce97e1e0736a05e4f09fe9e78d72316753317dabea28d50906631f634431a39384a332d66fa87352ff497f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c16971be0e6f1e01725260be0e299cd

SHA1
e7dc1882a0fc68087a2d146b3a639ee7392ac5ed

SHA256
b1fa098c668cdf8092aa096c83328b93e4014df102614aaaf6ab8dc12844bdc0

SHA512
dc76816e756d27eedc2fe7035101f35d90d54ec7d7c724ad6a330b5dd2b1e6d108f3ae44cedb14a02110157be8ddac7d454efae1becebf0efc9931fdc06e953c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d118c3081b30e727be1bee5df66cfa1d

SHA1
4a2ce5d551ca70a9a221dc511daef8049b85aef1

SHA256
7cb980001394b5b755363d866b5a1341422cb8b345f24dc2ecabb64892ec7290

SHA512
d484c4523dc48c5f08f6c68fe0fdf063e67e42ee73600927ea4311c71f6b9f6312d9c7fc28a56d5a22000986702175ba5e25f3238ed19601ba7e31526cd6407d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bd85627025942bc6e1008c95caca164

SHA1
a10d6f677928b7b1cc212f4590c2f97c5e6c654e

SHA256
8eb549e062779d46971693faa9eeee03211920473f02400bebc69177001a8a29

SHA512
e8908c48438cb66ca049fce945410847e1df2e5b619cd20ed2bb316d9e1c3dad4505486c28dd30a035ed5759e47c5feac0d41f81f7dcf5327473764553d6d955

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ba0a98e8ad4afd1acec5718b6a520fa

SHA1
8c61cecc08859fa8dbeb1b77c75898adf103eab5

SHA256
6d74cd2b075c8c70bd07a10cbfc683d9a4a1e36920201c580963f32058fb651a

SHA512
b30dcdadb246f3691671b44d6ea3787bbb1800013602fb822bd9ac35fdc306c4729d952f1875d99838f9c4c1cd55c95c62713d7e3cb05afc882fbc573a762a14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
742974263721617213e99aa032306552

SHA1
d7c7b2186216f59cebfc133a365ffd60a7f06629

SHA256
c5c884440d1ccd1656dfeb7440c414d58a4cdb2b7b23cb0e329e9dc4db6427b0

SHA512
7c85fce3d4be37dd550e59557aaf1396642a75bdd0970454b15a8bc6f125ad515358b9a6d25724ac018187a49696a9c0b810f4aca7ba233d0bf054de135d7111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
0c21852f0062660ad6effc41fbb0bce1

SHA1
e77c81e44069d533159847774418e8d5e2229466

SHA256
8918fd472b2ccfa08f2ea18de550f8cc73f0cbce81c139681c386ce28431e4ed

SHA512
76553e960ecb02184b106ad4727b24524bb6d6cd7e7d70f493cabc1b87d0145aa8475b2de41eae65ef6fe30069af00ea571922f9549e5a031835c0623eb83711

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
d0ab68ac0b89fa609e83abbed8b37923

SHA1
43a050a9d4c28eafa204a7d061d229f6d7da5bad

SHA256
637c5ae1b9dea72fb51b2b011a6962105524bbc74ead625f97cd2c21de675f50

SHA512
4c4a562a82380f0f6b11ea41a91fbb1f287bb7ca2cd9d17134e5198b5f6bd5f5cd53900820091a2a28815caa5e054b7ce868d99dd45eb0baea22ee3a7504c753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
46dad089234e41e215f1f5dad1b2b83f

SHA1
f15ac54f53943a3694154db0603b007e7edba565

SHA256
73aba57e48cb5eda2b903988763f835d03395a037f95cdea9b9c2573a8d1f3bc

SHA512
64f1ee42be5d1d1a52f1607e3cade988fbe1f969954b9eee02f062f585dd76f24b48a326e644012f2ee9bb47d7f6b55b2253c38a8fdd1ffb30fc9aef562374f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9c9a4774bef57f86948b9b4aaed77ee8

SHA1
00091d40f5dd827cb66ae58bb058db91d704f1c0

SHA256
063f8d1f4e19a747f090b20a0794740af9ea70ca72e95cee9b9f7927fb615214

SHA512
a13e8866f1fd825a4459dad7f9bbe7ace0741b1c19eeba1663592ddc5f81abf983a59d4eea2425a177c13dfceb06c5e390b9b8724eb43a0430af451600398f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
11b6128ce875d66bbbcecbeaee8f85fe

SHA1
4d5e7127d971f2f5a9378a1b8b9da0fe4ec6e088

SHA256
461009b0aad06337a9b8e0834178fdfa2103923838da69f655aee1ad15ffce57

SHA512
81f3107cf3b46d141399586b153b25793b2c432575b73eeb5257281e5b88053fe602c737d8111476b371af55e20aaabc5dd4fe3df2b3a96c6d723f1567b0cac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
e56444bec789de0de3edc8ff0e383e45

SHA1
c6e214a9003d1be078fd0d77dc11bb19248381c4

SHA256
d554996a56c55729b62df383098939f7d791d3f050073939618e975f35894794

SHA512
922e0ea0fd5faa42c9484f8d7b6361f6bbaa9092e2fd2fd39e40606ccceb37e8b072a85db2bd5ae1a120113347973ca90d4fc740f6cc9e21fac9474bbe174e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
bc80d4cc1aa3b06f3fa79944195597fc

SHA1
9c1a86abc36af302da402ca245474a5ffbbc7b87

SHA256
2a9f46d3ce9a1c0e3888c5a516adffef366abcd1b9a8ba06a4fc66fb279a51c6

SHA512
7ff32217f7409afec43c32b65a87da3c905c23796beeaeb6d42e3aaec5ae8e8c2808ea119dc9060bd318c3c3bdfdaedd4bdf53ea3b0cdc269931a29eec51e88d

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
709ea4f194033ad11003db4cb2ba4f2f

SHA1
dcabb3b0fde498d8ce59476fdd284ce1320f6e21

SHA256
162e7656185aaa1fcf8f8f672568627d5e0662f1c761a4be69bdd64dde3a1199

SHA512
ff097d22d949af91887d66b077966d1af5940e6948ca27dc1583d5252c1d7554c55552b4362d0ae76782a9b30ea885d7fd79c8bbbd8e386daabf5b628059761c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\_bz2.pyd

Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\_decimal.pyd

Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\_hashlib.pyd

Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\_lzma.pyd

Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\_socket.pyd

Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\base_library.zip

Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\libcrypto-3.dll

Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\python312.dll

Filesize
6.7MB

MD5
48ebfefa21b480a9b0dbfc3364e1d066

SHA1
b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

SHA256
0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

SHA512
4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\select.pyd

Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13442\unicodedata.pyd

Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fe3xflx3.3th.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEF03.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
C:\Users\Admin\AppData\Roaming\KeyGeneratorI.exe

Filesize
6.9MB

MD5
d1ebfb3ff83375dc6897e50a95e8b2a5

SHA1
fd1cb7ac0181ee647419761871dd78ad0a09d44a

SHA256
ec709b3a8a2d6df0c990303226ef5d8fea4d4270add2d06e69b0db8b913fcd06

SHA512
f210610472f34ff991a93bf290deb7d76e38b11d534b21ac689f53432e018e12792d801d38afbfd722fdaea21f4cad47ca5a09b2f7c983d73cec57e01a9d5d63

Download Submit
memory/1748-36-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/1888-1777-0x00000190FBC40000-0x00000190FBC62000-memory.dmp

Filesize
136KB

Download
memory/2632-51-0x00000252F1490000-0x00000252F14E4000-memory.dmp

Filesize
336KB

Download
memory/3732-1852-0x0000022AF3140000-0x0000022AF315C000-memory.dmp

Filesize
112KB

Download
memory/3732-1855-0x0000022AF3120000-0x0000022AF312A000-memory.dmp

Filesize
40KB

Download
memory/3732-1857-0x0000022AF3130000-0x0000022AF3138000-memory.dmp

Filesize
32KB

Download
memory/3732-1858-0x0000022AF3160000-0x0000022AF3166000-memory.dmp

Filesize
24KB

Download
memory/3732-1859-0x0000022AF3170000-0x0000022AF317A000-memory.dmp

Filesize
40KB

Download
memory/3732-1850-0x0000022AF3010000-0x0000022AF301A000-memory.dmp

Filesize
40KB

Download
memory/3732-1840-0x0000022AF2F50000-0x0000022AF3003000-memory.dmp

Filesize
716KB

Download
memory/3732-1802-0x0000022AF2F30000-0x0000022AF2F4C000-memory.dmp

Filesize
112KB

Download
memory/3732-1856-0x0000022AF3180000-0x0000022AF319A000-memory.dmp

Filesize
104KB

Download
memory/4416-1745-0x0000000007840000-0x000000000785A000-memory.dmp

Filesize
104KB

Download
memory/4416-1736-0x0000000007160000-0x000000000717E000-memory.dmp

Filesize
120KB

Download
memory/4416-1679-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Filesize
408KB

Download
memory/4416-1689-0x0000000005CD0000-0x0000000006027000-memory.dmp

Filesize
3.3MB

Download
memory/4416-1678-0x0000000005B50000-0x0000000005B72000-memory.dmp

Filesize
136KB

Download
memory/4416-37-0x0000000073610000-0x0000000073DC1000-memory.dmp

Filesize
7.7MB

Download
memory/4416-50-0x0000000004D10000-0x0000000004D46000-memory.dmp

Filesize
216KB

Download
memory/4416-99-0x00000000054F0000-0x0000000005B1A000-memory.dmp

Filesize
6.2MB

Download
memory/4416-1703-0x0000000006720000-0x000000000676C000-memory.dmp

Filesize
304KB

Download
memory/4416-1702-0x0000000006180000-0x000000000619E000-memory.dmp

Filesize
120KB

Download
memory/4416-1751-0x0000000073610000-0x0000000073DC1000-memory.dmp

Filesize
7.7MB

Download
memory/4416-1746-0x0000000007830000-0x0000000007838000-memory.dmp

Filesize
32KB

Download
memory/4416-1744-0x0000000007750000-0x0000000007765000-memory.dmp

Filesize
84KB

Download
memory/4416-1743-0x0000000007740000-0x000000000774E000-memory.dmp

Filesize
56KB

Download
memory/4416-1742-0x0000000007700000-0x0000000007711000-memory.dmp

Filesize
68KB

Download
memory/4416-1680-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/4416-1741-0x0000000007780000-0x0000000007816000-memory.dmp

Filesize
600KB

Download
memory/4416-1740-0x0000000007580000-0x000000000758A000-memory.dmp

Filesize
40KB

Download
memory/4416-1739-0x00000000074F0000-0x000000000750A000-memory.dmp

Filesize
104KB

Download
memory/4416-1738-0x0000000007B30000-0x00000000081AA000-memory.dmp

Filesize
6.5MB

Download
memory/4416-1737-0x00000000071E0000-0x0000000007284000-memory.dmp

Filesize
656KB

Download
memory/4416-1726-0x00000000071A0000-0x00000000071D4000-memory.dmp

Filesize
208KB

Download
memory/4416-1727-0x0000000074930000-0x000000007497C000-memory.dmp

Filesize
304KB

Download
memory/4620-65-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-100-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-73-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-71-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-69-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-67-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-1691-0x0000000073610000-0x0000000073DC1000-memory.dmp

Filesize
7.7MB

Download
memory/4620-63-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-61-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-79-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-59-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-81-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-57-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-83-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-85-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-89-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-93-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-95-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-56-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-75-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-102-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-104-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-106-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-108-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-110-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-112-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-114-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-116-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-118-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-120-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-97-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-91-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-55-0x0000000005610000-0x000000000567C000-memory.dmp

Filesize
432KB

Download
memory/4620-54-0x0000000073610000-0x0000000073DC1000-memory.dmp

Filesize
7.7MB

Download
memory/4620-29-0x0000000000D30000-0x0000000000D66000-memory.dmp

Filesize
216KB

Download
memory/4620-87-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download
memory/4620-77-0x0000000005610000-0x0000000005675000-memory.dmp

Filesize
404KB

Download