Malware Analysis Report

2024-11-16 13:40

Sample ID 240531-qtdptaah37
Target NyroxBot.rar
SHA256 9c1cde9090de5699e135c14211f930f67bb8b052d96778e08b6d7b4fbae397af
Tags
xworm persistence pyinstaller rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9c1cde9090de5699e135c14211f930f67bb8b052d96778e08b6d7b4fbae397af

Threat Level: Known bad

The file NyroxBot.rar was found to be: Known bad.

Malicious Activity Summary

xworm persistence pyinstaller rat spyware stealer trojan

Xworm

Detect Xworm Payload

Executes dropped EXE

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Drops startup file

Adds Run key to start application

Unsigned PE

Detects Pyinstaller

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-31 13:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-31 13:32

Reported

2024-05-31 13:51

Platform

win10v2004-20240508-en

Max time kernel

1046s

Max time network

1050s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AMD Graphics Manager.lnk C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
N/A N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AMD Graphics Manager = "C:\\Users\\Admin\\AppData\\Roaming\\AMD Graphics Manager" C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\AMD Graphics Manager N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4676 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE
PID 4676 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE
PID 4676 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE
PID 1184 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE
PID 1184 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE
PID 1184 wrote to memory of 4728 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE
PID 4676 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE
PID 4676 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE
PID 2292 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE
PID 2292 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE
PID 4144 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe
PID 4144 wrote to memory of 3536 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe
PID 3536 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe
PID 3536 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe
PID 4144 wrote to memory of 7028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE
PID 4144 wrote to memory of 7028 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE
PID 7028 wrote to memory of 7068 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe
PID 7028 wrote to memory of 7068 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe
PID 7068 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe C:\Windows\System32\schtasks.exe
PID 7068 wrote to memory of 1564 N/A C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe

"C:\Users\Admin\AppData\Local\Temp\NyroxMain\NyroxV1.4.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\novus.EXE

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GFDGDF~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\XClient.exe

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "AMD Graphics Manager" /tr "C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

"C:\Users\Admin\AppData\Roaming\AMD Graphics Manager"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.113:443 www.bing.com tcp
US 8.8.8.8:53 113.61.62.23.in-addr.arpa udp
NL 23.62.61.113:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
NL 91.92.241.69:5555 tcp
US 8.8.8.8:53 69.241.92.91.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 87.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 83.121.18.2.in-addr.arpa udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp
US 138.91.171.81:80 tcp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nyrox.EXE

MD5 d9b578176058e284fa7a5026ff28349c
SHA1 584c269a881599b00864a906335bbe42c08ee114
SHA256 f9eeba32c6d22897d7d04a8a60ee99d62e576facc8d6048828783d54d430a031
SHA512 3042c279663ef29c0d0bb6fb7e56b6646dc75eb1819cfc1f3b6b73e4e68763e32c70e0cc7b507490b535478d482226407676e9803d5c8f5acc7c7354e4689d18

C:\Users\Admin\AppData\Local\Temp\_MEI11842\python311.dll

MD5 b8769a867abc02bfdd8637bea508cab2
SHA1 782f5fb799328c001bca77643e31fb7824f9d8cc
SHA256 9cf39945840ee8d769e47ffdb554044550b5843b29c68fa3849ba9376c3a7ec8
SHA512 bf01e343877a92d458373c02a9d64426118915ade324cf12d6ff200970da641358e8f362732cd9a8508845e367313c9bab2772d59a9ae8d934cd0dd7d28535b3

C:\Users\Admin\AppData\Local\Temp\_MEI11842\VCRUNTIME140.dll

MD5 1e6e97d60d411a2dee8964d3d05adb15
SHA1 0a2fe6ec6b6675c44998c282dbb1cd8787612faf
SHA256 8598940e498271b542f2c04998626aa680f2172d0ff4f8dbd4ffec1a196540f9
SHA512 3f7d79079c57786051a2f7facfb1046188049e831f12b549609a8f152664678ee35ad54d1fff4447428b6f76bea1c7ca88fa96aab395a560c6ec598344fcc7fa

C:\Users\Admin\AppData\Local\Temp\_MEI11842\base_library.zip

MD5 83d235e1f5b0ee5b0282b5ab7244f6c4
SHA1 629a1ce71314d7abbce96674a1ddf9f38c4a5e9c
SHA256 db389a9e14bfac6ee5cce17d41f9637d3ff8b702cc74102db8643e78659670a0
SHA512 77364aff24cfc75ee32e50973b7d589b4a896d634305d965ecbc31a9e0097e270499dbec93126092eb11f3f1ad97692db6ca5927d3d02f3d053336d6267d7e5f

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_ssl.pyd

MD5 77da1e6ad0cbb474cb2714c6b09f661a
SHA1 da3946b0d6e56e7f416b96fce4c5b9f870747149
SHA256 fd6879eaadbc75a2a989568a1e6781cca9bb08508aed796b7fdea3f80aeae26a
SHA512 8fc31fd23fc42cb7e53faad8adfe3314ced71af4aae5bc2dcce91939365957f1052ebe054d0d02f4adb504e456e88465d4a79cf7acd7d0aab7617d652a06b749

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_queue.pyd

MD5 48f98bbd96f2b179f9b62a634f2353ba
SHA1 24a374e9aebdefb6f02c4fad06502f9d13d000dd
SHA256 dee6f87c1cb0ee904e4a2189e04a2931d33e36db9e09312c96bc34f317a30bfd
SHA512 3980ef687c9050bef2ce08f6f2a497bd29bf51a7be45e275bf9f77987e1fbe1319888fc0c163d91ab9b805d42c8457bad792eea6ca62a8fd1503e8d2cdf58503

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_socket.pyd

MD5 b55ce33c6ba6d7af221f3d8b1a30a6f7
SHA1 b8696ed5b7a52c9bfda5c1ea4bd43a9ecc17fed0
SHA256 ec5817b46539f9a5cbf1525cf7c714bc0e9f5a918fc4b963dec9c301b86c7d1f
SHA512 4d15d90dd2bacc8c9537533b1267455fbc030e38546c1f6f4eb7dabe690c744471bd45c079f0c711b9eca330f1a413ea37fc6b08810854d5f51b69b19e991462

C:\Users\Admin\AppData\Local\Temp\_MEI11842\select.pyd

MD5 aae48cf580702fec3a79524d1721305c
SHA1 33f68231ff3e82adc90c3c9589d5cc918ad9c936
SHA256 93b2b54c80d03ff7ade5fe4cd03baed8c5b5a8e1edcd695a53bae2e369006265
SHA512 1c826364015684bb3fb36ce1fcb608da88f4c74b0eec6b53f4ca07b5ea99fee8b4e318c1570ce358cefd6b7bdf21b046b1375c3d687f6d0d08bf7b955568a1c6

C:\Users\Admin\AppData\Local\Temp\_MEI11842\libssl-1_1.dll

MD5 0eb0295658ac5ce82b2d96d330d2866e
SHA1 68894ff86e0b443502e3ba9ce06bfb1660d19204
SHA256 52224881670ced6419a3e68731e5e3d0b1d224d5816619dccf6161f91ec78021
SHA512 347b7b5d7b9b1c88ea642f92257f955c0202ae16d6764f82d9923c96c151f1e944abf968f1e5728bde0dae382026b5279e4bcbe24c347134a1fbe1cb0b2e090f

C:\Users\Admin\AppData\Local\Temp\_MEI11842\libcrypto-1_1.dll

MD5 90311ea0cc27e27d2998969c57eba038
SHA1 4653f1261fb7b16bc64c72833cfb93f0662d6f6d
SHA256 239d518dd67d8c2bbf6aeaded86ed464865e914db6bf3b115973d525ebd7d367
SHA512 6e2f839fb8d7aaab0b51778670da104c36355e22991eae930d2eaecabab45b40fda5e2317f1c928a803146855ac5553e4e464a65213696311c206bec926775d8

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_lzma.pyd

MD5 b4251ed45538a2a7d79737db8fb139db
SHA1 cded1a4637e7e18684d89cd34c73cfae424183e6
SHA256 caad390c4c3c6b1e50a33754a0af7d2c3f4b1245c8ead79ff7f7be0e5654e210
SHA512 d40f7de85c8dbb3e16135e1f8d8ce829cb681eaab49c6f4c40792fa8f733743df70cfa7c6224e06bff68214069f90cd960970ac47d0348e9827a2136789c43c1

C:\Users\Admin\AppData\Local\Temp\_MEI11842\charset_normalizer\md.cp311-win32.pyd

MD5 5242622c9818ff5572c08d3f9f96ea07
SHA1 f4c53ef8930a2975335182ad9b6c6a2ab3851362
SHA256 85f6e0b522d54459e7d24746054d26ba35ea4cc8505a3dd74a2bf5590f9f40fc
SHA512 c2ef2a5632eb42b00756bee9ffb00e382cbc1b0c6578243f3f1fe48eff18a1033187a5d7bf8bda4d9cf8d6cb4131ca37c47d8238ff264e1b1c496b16740b79a7

C:\Users\Admin\AppData\Local\Temp\_MEI11842\charset_normalizer\md__mypyc.cp311-win32.pyd

MD5 ca6309d94f4136c058a244044c890d89
SHA1 49424c3eba17a4675a469326b6a5f10f6c14ba88
SHA256 b65e4644d0cdc01f5076fe9b7548ffd047ae143087b8ab3cbe0a1dc24fdbf00d
SHA512 ec2329db2378350ec27d742ed649df3fb81b1b2dfb24ed4cd8c274852742809c571f28a960f8907f04ec515c1960c2111880fbeecacfd04dea439a4d116f225b

C:\Users\Admin\AppData\Local\Temp\_MEI11842\unicodedata.pyd

MD5 b98d5dd9980b29ce394675dc757509b8
SHA1 7a3ad4947458baa61de998bc8fde1ef736a3a26c
SHA256 1498105d00434a5ebbaa6bee2e5f5677c34a948b2073d789f4d4b5968a4c8aaf
SHA512 ba7e52deaf88aab062646d6a70f9e15016fcbdcf55a4f16d8c73ea6a63ad591eb3b623514a9fecc03188b1d1eb55a6b168da55bb035dc7d605cae53def2b65f2

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_bz2.pyd

MD5 f73ea2b834471fb01d491a65caa1eea3
SHA1 00e888645e0a1638c639a2c21df04a3baa4c640a
SHA256 8633e8ad7172b095ed7ba40fa1039a64b04b20e6f42ac428e103d0c793831bda
SHA512 b8329b33d78458c2ac7979a5c5a19bd37ea9a473682d23faf54e77cfc5edadc0426490add9864e99a719ac5b4a57c5326ed82496adf80afd1876577caa608418

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_hashlib.pyd

MD5 303a1d7d21ca6e625950a966d17f86be
SHA1 660aaad68207dc0a4d757307ad57e86b120f2d91
SHA256 53180306bad339e76cc427009db15f124f49d4c879676258264365a7e2ed703f
SHA512 99036d59cad6f286e8f901acadcc7db192bb385699228b1b34907ea49fb5ff07b636550c04f0d4b70f161a26ea2e58794d9080d69d053ada08d2ad9bd3f861df

C:\Users\Admin\AppData\Local\Temp\_MEI11842\_decimal.pyd

MD5 bcdbf3a04a8bfd8c8a9624996735fc1a
SHA1 08d35c136fe5c779b67f56ae7165b394d5c8d8ef
SHA256 1f6db9be716626f6803cefd646fbbc478878c6acce597d9f6c5776dc7b69d3c7
SHA512 d22195c0a0535f7986d0a6d0bb820d36c8824a0b15378cb5d5ab0f334064896e0d64ed880d706f80e0b96d022631fc6b4fcc47371ca1d5cdd2c37dd75c62274b

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\num2323.EXE

MD5 8fe088b0cdaf621e2b8e6c07a35a4e74
SHA1 ab9491d5af239ecd8e766adfc66abb6366113e85
SHA256 a46d6b814964edfedaebcfd8ab5e5204a2844f072efe4b30c1de2a6f01c22c06
SHA512 6b72e6fc152c4f6a2841143d2ad7b2e79bc1ceff1ad5a7dbde1f81db904408bf2ed538e306198d113311cd6598e280d452bac5745ec73c62a2a57dad1f27ed5f

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lunar.exe

MD5 aa3e2574434459d9bff25e77da57993e
SHA1 0543816e6ac109d579b6272b686a9e8a2324017b
SHA256 76dcf34ee87efbd57cc1cb9e9527b27b3cc871f34a776fb0e7be7e119d370b7b
SHA512 5964e1b5c4b961d30b5b82165bb5af6de2da8634d3d150e8f7264d30c16f4140c16758d834d962df58a2422df89e9124bc555bc640503375434010cac619ce42

C:\Users\Admin\AppData\Local\Temp\_MEI35362\ucrtbase.dll

MD5 0e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA1 4189f4459c54e69c6d3155a82524bda7549a75a6
SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512 a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

C:\Users\Admin\AppData\Local\Temp\_MEI35362\python312.dll

MD5 3c388ce47c0d9117d2a50b3fa5ac981d
SHA1 038484ff7460d03d1d36c23f0de4874cbaea2c48
SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
SHA512 e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

C:\Users\Admin\AppData\Local\Temp\_MEI35362\VCRUNTIME140.dll

MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

C:\Users\Admin\AppData\Local\Temp\_MEI35362\base_library.zip

MD5 8dad91add129dca41dd17a332a64d593
SHA1 70a4ec5a17ed63caf2407bd76dc116aca7765c0d
SHA256 8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783
SHA512 2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

C:\Users\Admin\AppData\Local\Temp\_MEI35362\python3.dll

MD5 79b02450d6ca4852165036c8d4eaed1f
SHA1 ce9ff1b302426d4c94a2d3ea81531d3cb9e583e4
SHA256 d2e348e615a5d3b08b0bac29b91f79b32f0c1d0be48976450042462466b51123
SHA512 47044d18db3a4dd58a93b43034f4fafa66821d157dcfefb85fca2122795f4591dc69a82eb2e0ebd9183075184368850e4caf9c9fea0cfe6f766c73a60ffdf416

C:\Users\Admin\AppData\Local\Temp\_MEI35362\libffi-8.dll

MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

C:\Users\Admin\AppData\Local\Temp\_MEI35362\_lzma.pyd

MD5 05e8b2c429aff98b3ae6adc842fb56a3
SHA1 834ddbced68db4fe17c283ab63b2faa2e4163824
SHA256 a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
SHA512 badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-file-l2-1-0.dll

MD5 bfffa7117fd9b1622c66d949bac3f1d7
SHA1 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512 b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-file-l1-2-0.dll

MD5 1c58526d681efe507deb8f1935c75487
SHA1 0e6d328faf3563f2aae029bc5f2272fb7a742672
SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
SHA512 8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-file-l1-1-0.dll

MD5 efad0ee0136532e8e8402770a64c71f9
SHA1 cda3774fe9781400792d8605869f4e6b08153e55
SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
SHA512 69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-errorhandling-l1-1-0.dll

MD5 eb0978a9213e7f6fdd63b2967f02d999
SHA1 9833f4134f7ac4766991c918aece900acfbf969f
SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
SHA512 6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-debug-l1-1-0.dll

MD5 33bbece432f8da57f17bf2e396ebaa58
SHA1 890df2dddfdf3eeccc698312d32407f3e2ec7eb1
SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
SHA512 619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-datetime-l1-1-0.dll

MD5 cfe0c1dfde224ea5fed9bd5ff778a6e0
SHA1 5150e7edd1293e29d2e4d6bb68067374b8a07ce6
SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
SHA512 b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

C:\Users\Admin\AppData\Local\Temp\_MEI35362\api-ms-win-core-console-l1-1-0.dll

MD5 e8b9d74bfd1f6d1cc1d99b24f44da796
SHA1 a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452
SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
SHA512 b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

C:\Users\Admin\AppData\Local\Temp\_MEI35362\_bz2.pyd

MD5 223fd6748cae86e8c2d5618085c768ac
SHA1 dcb589f2265728fe97156814cbe6ff3303cd05d3
SHA256 f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
SHA512 9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

C:\Users\Admin\AppData\Local\Temp\_MEI35362\_ctypes.pyd

MD5 bbd5533fc875a4a075097a7c6aba865e
SHA1 ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00
SHA256 be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
SHA512 23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

memory/7068-2094-0x0000000000720000-0x0000000000736000-memory.dmp

C:\Users\Admin\AppData\Roaming\AMD Graphics Manager

MD5 0f803689398c092ad9ae274d5c7507d6
SHA1 693161863fa62cb65e7f3102d55087a9bf816889
SHA256 0c336bb9258f45ded239bfd2a721a779c3a467cfd177d9ab75841d6eb61d2a8a
SHA512 1fed05b278b8243c1e45c34a1eca78492fb24d18296feac978bd54528359d2c07a783bff434921a26a96ba122a8dc9da6d00b9cdda09c6c8569910d0472080f8

memory/7068-2098-0x000000001C8D0000-0x000000001CC20000-memory.dmp