xmrig | 38caeabef38c9b02db8cfcd79c62421ea00f653c20b4e3453ece38828891887f

Analysis

max time kernel
48s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CalamityV1.5.exe
Size

60.3MB
MD5

4e7be8f8af00c2badd0aecaa9164a088
SHA1

63ce85ee62895b8b0f42b03f1fe05dca1017d8e2
SHA256

38caeabef38c9b02db8cfcd79c62421ea00f653c20b4e3453ece38828891887f
SHA512

2d9d3c8d48727da86548732ec168d1c32ea1680633493674dad6d676a60324bb1e624d31b472737378adf0a01b4dd07cb3fdfb47b81e1df81c29d3a0972aa7b3
SSDEEP

1572864:9V8Km0TjSpfZ79y2toCqztuExv57AhRFxZA:9GKnjSJDLibtuEd57UPZ

Score

10^/10

xmrig xworm evasion execution miner persistence pyinstaller rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

91.92.241.69:5555

Attributes

Install_directory
%ProgramData%
install_file
Windows Runtime.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\svchost.exe	family_xworm
behavioral1/memory/2036-163-0x0000000000550000-0x0000000000568000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1612-1010-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-1011-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-1127-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-1120-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-1181-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-1180-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-1132-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-4426-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/1612-4427-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

6120 powershell.exe
4216 powershell.exe
5496 powershell.exe
5632 powershell.exe
5744 powershell.exe
5936 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
6120	powershell.exe
4216	powershell.exe
5496	powershell.exe
5632	powershell.exe
5744	powershell.exe
5936	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CalamityV1.5.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	CalamityV1.5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 4 IoCs

Processes:

MpDefenderCoreService.exesvchost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel Graphics Processor.exe	MpDefenderCoreService.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel Graphics Processor.exe	MpDefenderCoreService.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Runtime.lnk	svchost.exe

Executes dropped EXE 8 IoCs

Processes:

jhi_service.exeMpDefenderCoreService.exeNexus Release.exesvchost.exekanilzbpgdul.exenexusloader.exeMpDefenderCoreService.exeWindows Runtime.exe

pid	process
4932	jhi_service.exe
1096	MpDefenderCoreService.exe
1964	Nexus Release.exe
2036	svchost.exe
3188	kanilzbpgdul.exe
4116	nexusloader.exe
1820	MpDefenderCoreService.exe
5488	Windows Runtime.exe

Loads dropped DLL 64 IoCs

Processes:

nexusloader.exeMpDefenderCoreService.exe

pid	process
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
4116	nexusloader.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1612-1007-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1010-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1008-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1011-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1127-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1120-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1181-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1180-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1132-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1009-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-997-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-1006-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-4426-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/1612-4427-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Runtime = "C:\\ProgramData\\Windows Runtime.exe"	svchost.exe

Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com
25 api.ipify.org
26 api.ipify.org
27 ipinfo.io
28 ipinfo.io

flow	ioc
20	ip-api.com
25	api.ipify.org
26	api.ipify.org
27	ipinfo.io
28	ipinfo.io

Drops file in System32 directory 4 IoCs

Processes:

MpDefenderCoreService.exe

description	ioc	process
File created	C:\Windows\System32\MpDefenderCoreService.exe	MpDefenderCoreService.exe
File created	C:\Windows\System32\WindowsSecuritySmartScreen.bat	MpDefenderCoreService.exe
File opened for modification	C:\Windows\System32\MpDefenderCoreService.exe	MpDefenderCoreService.exe
File opened for modification	C:\Windows\System32\WindowsSecuritySmartScreen.bat	MpDefenderCoreService.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

kanilzbpgdul.exe

description	pid	process	target process
PID 3188 set thread context of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 set thread context of 1612	3188	kanilzbpgdul.exe	svchost.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

3300 sc.exe
2728 sc.exe
5036 sc.exe
452 sc.exe

pid	process
3300	sc.exe
2728	sc.exe
5036	sc.exe
452	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\MpDefenderCoreService.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

5904 schtasks.exe
2156 schtasks.exe
5448 schtasks.exe
Kills process with taskkill 8 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

4932 taskkill.exe
3220 taskkill.exe
1776 taskkill.exe
1628 taskkill.exe
3324 taskkill.exe
4528 taskkill.exe
4072 taskkill.exe
4908 taskkill.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

svchost.exe

pid process

2036 svchost.exe

pid	process
5904	schtasks.exe
2156	schtasks.exe
5448	schtasks.exe

pid	process
4932	taskkill.exe
3220	taskkill.exe
1776	taskkill.exe
1628	taskkill.exe
3324	taskkill.exe
4528	taskkill.exe
4072	taskkill.exe
4908	taskkill.exe

pid	process
2036	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

jhi_service.exekanilzbpgdul.exesvchost.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeMpDefenderCoreService.exe

pid	process
4932	jhi_service.exe
4932	jhi_service.exe
4932	jhi_service.exe
4932	jhi_service.exe
4932	jhi_service.exe
4932	jhi_service.exe
4932	jhi_service.exe
4932	jhi_service.exe
3188	kanilzbpgdul.exe
3188	kanilzbpgdul.exe
3188	kanilzbpgdul.exe
3188	kanilzbpgdul.exe
3188	kanilzbpgdul.exe
3188	kanilzbpgdul.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
4216	powershell.exe
4216	powershell.exe
5496	powershell.exe
5496	powershell.exe
1612	svchost.exe
1612	svchost.exe
5632	powershell.exe
5744	powershell.exe
5632	powershell.exe
5744	powershell.exe
5936	powershell.exe
5936	powershell.exe
1612	svchost.exe
1612	svchost.exe
6120	powershell.exe
6120	powershell.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1820	MpDefenderCoreService.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe
1612	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exeMpDefenderCoreService.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2036	svchost.exe
Token: SeShutdownPrivilege	2304	powercfg.exe
Token: SeCreatePagefilePrivilege	2304	powercfg.exe
Token: SeShutdownPrivilege	2256	powercfg.exe
Token: SeCreatePagefilePrivilege	2256	powercfg.exe
Token: SeShutdownPrivilege	2412	powercfg.exe
Token: SeCreatePagefilePrivilege	2412	powercfg.exe
Token: SeShutdownPrivilege	1372	powercfg.exe
Token: SeCreatePagefilePrivilege	1372	powercfg.exe
Token: SeShutdownPrivilege	5044	powercfg.exe
Token: SeCreatePagefilePrivilege	5044	powercfg.exe
Token: SeShutdownPrivilege	4816	powercfg.exe
Token: SeCreatePagefilePrivilege	4816	powercfg.exe
Token: SeShutdownPrivilege	4164	powercfg.exe
Token: SeCreatePagefilePrivilege	4164	powercfg.exe
Token: SeShutdownPrivilege	2636	powercfg.exe
Token: SeCreatePagefilePrivilege	2636	powercfg.exe
Token: SeLockMemoryPrivilege	1612	svchost.exe
Token: SeDebugPrivilege	1820	MpDefenderCoreService.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeDebugPrivilege	5632	powershell.exe
Token: SeDebugPrivilege	5744	powershell.exe
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	6120	powershell.exe
Token: SeDebugPrivilege	1776	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	3324	taskkill.exe
Token: SeDebugPrivilege	4528	taskkill.exe
Token: SeDebugPrivilege	4072	taskkill.exe
Token: SeDebugPrivilege	4908	taskkill.exe
Token: SeDebugPrivilege	4932	taskkill.exe
Token: SeDebugPrivilege	3220	taskkill.exe
Token: SeDebugPrivilege	2036	svchost.exe
Token: SeIncreaseQuotaPrivilege	1088	WMIC.exe
Token: SeSecurityPrivilege	1088	WMIC.exe
Token: SeTakeOwnershipPrivilege	1088	WMIC.exe
Token: SeLoadDriverPrivilege	1088	WMIC.exe
Token: SeSystemProfilePrivilege	1088	WMIC.exe
Token: SeSystemtimePrivilege	1088	WMIC.exe
Token: SeProfSingleProcessPrivilege	1088	WMIC.exe
Token: SeIncBasePriorityPrivilege	1088	WMIC.exe
Token: SeCreatePagefilePrivilege	1088	WMIC.exe
Token: SeBackupPrivilege	1088	WMIC.exe
Token: SeRestorePrivilege	1088	WMIC.exe
Token: SeShutdownPrivilege	1088	WMIC.exe
Token: SeDebugPrivilege	1088	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1088	WMIC.exe
Token: SeRemoteShutdownPrivilege	1088	WMIC.exe
Token: SeUndockPrivilege	1088	WMIC.exe
Token: SeManageVolumePrivilege	1088	WMIC.exe
Token: 33	1088	WMIC.exe
Token: 34	1088	WMIC.exe
Token: 35	1088	WMIC.exe
Token: 36	1088	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1088	WMIC.exe
Token: SeSecurityPrivilege	1088	WMIC.exe
Token: SeTakeOwnershipPrivilege	1088	WMIC.exe
Token: SeLoadDriverPrivilege	1088	WMIC.exe
Token: SeSystemProfilePrivilege	1088	WMIC.exe
Token: SeSystemtimePrivilege	1088	WMIC.exe
Token: SeProfSingleProcessPrivilege	1088	WMIC.exe
Token: SeIncBasePriorityPrivilege	1088	WMIC.exe
Token: SeCreatePagefilePrivilege	1088	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

CalamityV1.5.exekanilzbpgdul.exeNexus Release.exeMpDefenderCoreService.exeMpDefenderCoreService.execmd.exesvchost.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2488 wrote to memory of 4932	2488	CalamityV1.5.exe	taskkill.exe
PID 2488 wrote to memory of 4932	2488	CalamityV1.5.exe	taskkill.exe
PID 2488 wrote to memory of 1096	2488	CalamityV1.5.exe	MpDefenderCoreService.exe
PID 2488 wrote to memory of 1096	2488	CalamityV1.5.exe	MpDefenderCoreService.exe
PID 2488 wrote to memory of 1964	2488	CalamityV1.5.exe	Nexus Release.exe
PID 2488 wrote to memory of 1964	2488	CalamityV1.5.exe	Nexus Release.exe
PID 2488 wrote to memory of 2036	2488	CalamityV1.5.exe	svchost.exe
PID 2488 wrote to memory of 2036	2488	CalamityV1.5.exe	svchost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1520	3188	kanilzbpgdul.exe	conhost.exe
PID 3188 wrote to memory of 1612	3188	kanilzbpgdul.exe	svchost.exe
PID 3188 wrote to memory of 1612	3188	kanilzbpgdul.exe	svchost.exe
PID 3188 wrote to memory of 1612	3188	kanilzbpgdul.exe	svchost.exe
PID 3188 wrote to memory of 1612	3188	kanilzbpgdul.exe	svchost.exe
PID 3188 wrote to memory of 1612	3188	kanilzbpgdul.exe	svchost.exe
PID 1964 wrote to memory of 4116	1964	Nexus Release.exe	nexusloader.exe
PID 1964 wrote to memory of 4116	1964	Nexus Release.exe	nexusloader.exe
PID 1096 wrote to memory of 1820	1096	MpDefenderCoreService.exe	MpDefenderCoreService.exe
PID 1096 wrote to memory of 1820	1096	MpDefenderCoreService.exe	MpDefenderCoreService.exe
PID 1820 wrote to memory of 5160	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 5160	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 4608	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 4608	1820	MpDefenderCoreService.exe	cmd.exe
PID 4608 wrote to memory of 4216	4608	cmd.exe	powershell.exe
PID 4608 wrote to memory of 4216	4608	cmd.exe	powershell.exe
PID 2036 wrote to memory of 5496	2036	svchost.exe	powershell.exe
PID 2036 wrote to memory of 5496	2036	svchost.exe	powershell.exe
PID 1820 wrote to memory of 5448	1820	MpDefenderCoreService.exe	schtasks.exe
PID 1820 wrote to memory of 5448	1820	MpDefenderCoreService.exe	schtasks.exe
PID 2036 wrote to memory of 5632	2036	svchost.exe	powershell.exe
PID 2036 wrote to memory of 5632	2036	svchost.exe	powershell.exe
PID 1820 wrote to memory of 1828	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 1828	1820	MpDefenderCoreService.exe	cmd.exe
PID 1828 wrote to memory of 5744	1828	cmd.exe	powershell.exe
PID 1828 wrote to memory of 5744	1828	cmd.exe	powershell.exe
PID 1820 wrote to memory of 5904	1820	MpDefenderCoreService.exe	schtasks.exe
PID 1820 wrote to memory of 5904	1820	MpDefenderCoreService.exe	schtasks.exe
PID 2036 wrote to memory of 5936	2036	svchost.exe	powershell.exe
PID 2036 wrote to memory of 5936	2036	svchost.exe	powershell.exe
PID 2036 wrote to memory of 6120	2036	svchost.exe	powershell.exe
PID 2036 wrote to memory of 6120	2036	svchost.exe	powershell.exe
PID 1820 wrote to memory of 4560	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 4560	1820	MpDefenderCoreService.exe	cmd.exe
PID 4560 wrote to memory of 1776	4560	cmd.exe	taskkill.exe
PID 4560 wrote to memory of 1776	4560	cmd.exe	taskkill.exe
PID 1820 wrote to memory of 4640	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 4640	1820	MpDefenderCoreService.exe	cmd.exe
PID 4640 wrote to memory of 1628	4640	cmd.exe	taskkill.exe
PID 4640 wrote to memory of 1628	4640	cmd.exe	taskkill.exe
PID 1820 wrote to memory of 444	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 444	1820	MpDefenderCoreService.exe	cmd.exe
PID 444 wrote to memory of 3324	444	cmd.exe	taskkill.exe
PID 444 wrote to memory of 3324	444	cmd.exe	taskkill.exe
PID 1820 wrote to memory of 4468	1820	MpDefenderCoreService.exe	cmd.exe
PID 1820 wrote to memory of 4468	1820	MpDefenderCoreService.exe	cmd.exe
PID 4468 wrote to memory of 4528	4468	cmd.exe	taskkill.exe
PID 4468 wrote to memory of 4528	4468	cmd.exe	taskkill.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CalamityV1.5.exe
"C:\Users\Admin\AppData\Local\Temp\CalamityV1.5.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2488

C:\Users\Admin\AppData\Roaming\jhi_service.exe
"C:\Users\Admin\AppData\Roaming\jhi_service.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4932

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2256

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "HDNFMUHS"
3⤵
- Launches sc.exe
PID:3300

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"
3⤵
- Launches sc.exe
PID:2728

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:452

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "HDNFMUHS"
3⤵
- Launches sc.exe
PID:5036

C:\Users\Admin\MpDefenderCoreService.exe
"C:\Users\Admin\MpDefenderCoreService.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\MpDefenderCoreService.exe
"C:\Users\Admin\MpDefenderCoreService.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
4⤵
PID:5160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell.exe -Command Add-MpPreference -ExclusionPath "C:\"
4⤵
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command Add-MpPreference -ExclusionPath "C:\"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /xml task.xml /tn "Process Lasso Management Console (GUI)"
4⤵
- Creates scheduled task(s)
PID:5448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell.exe -Command Add-MpPreference -ExclusionPath "C:\"
4⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -Command Add-MpPreference -ExclusionPath "C:\"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /xml task.xml /tn "Process Lasso Management Console (GUI)"
4⤵
- Creates scheduled task(s)
PID:5904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\system32\taskkill.exe
taskkill /F /IM chrome.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM msedge.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\system32\taskkill.exe
taskkill /F /IM msedge.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM firefox.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:444

C:\Windows\system32\taskkill.exe
taskkill /F /IM firefox.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM opera.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:4468

C:\Windows\system32\taskkill.exe
taskkill /F /IM opera.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM iexplore.exe
4⤵
PID:4696

C:\Windows\system32\taskkill.exe
taskkill /F /IM iexplore.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM brave.exe
4⤵
PID:4288

C:\Windows\system32\taskkill.exe
taskkill /F /IM brave.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM vivaldi.exe
4⤵
PID:1856

C:\Windows\system32\taskkill.exe
taskkill /F /IM vivaldi.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /F /IM Telegram.exe
4⤵
PID:3028

C:\Windows\system32\taskkill.exe
taskkill /F /IM Telegram.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
4⤵
PID:2680

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe
"C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964

C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\nexusloader.exe
"C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4116

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svchost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Windows Runtime.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Runtime.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Runtime" /tr "C:\ProgramData\Windows Runtime.exe"
3⤵
- Creates scheduled task(s)
PID:2156

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3188

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4816

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:1520

C:\Windows\system32\svchost.exe
svchost.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\ProgramData\Windows Runtime.exe
"C:\ProgramData\Windows Runtime.exe"
1⤵
- Executes dropped EXE
PID:5488

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Nexus Release.exe
Filesize
18.3MB

MD5
967adda3e5738fc034a1179482e09581

SHA1
eb96afbee081846bd8af1e173cd2ccc371cb3e9a

SHA256
14329ef35eb26ab12b38f7da97707125f5f257b3173342f9dc90b20dfc760ea2

SHA512
fba760d43c51f8bdc979edbd68ca0716f432217ef4cfe5cc345287adc4f25e491604e65b3a339f15b7c0754cc56a7976b2b3deba66e4312aa08f87f2770aa732

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
Filesize
285KB

MD5
d3e74c9d33719c8ab162baa4ae743b27

SHA1
ee32f2ccd4bc56ca68441a02bf33e32dc6205c2b

SHA256
7a347ca8fef6e29f82b6e4785355a6635c17fa755e0940f65f15aa8fc7bd7f92

SHA512
e0fb35d6901a6debbf48a0655e2aa1040700eb5166e732ae2617e89ef5e6869e8ddd5c7875fa83f31d447d4abc3db14bffd29600c9af725d9b03f03363469b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
Filesize
117KB

MD5
494f5b9adc1cfb7fdb919c9b1af346e1

SHA1
4a5fddd47812d19948585390f76d5435c4220e6b

SHA256
ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051

SHA512
2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

Download Submit
C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
Filesize
512KB

MD5
4652c4087b148d08adefedf55719308b

SHA1
30e06026fea94e5777c529b479470809025ffbe2

SHA256
003f439c27a532d6f3443706ccefac6be4152bebc1aa8bdf1c4adfc095d33795

SHA512
d4972c51ffbce63d2888ddfead2f616166b6f21a0c186ccf97a41c447c1fac6e848f464e4acde05bea5b24c73c5a03b834731f8807a54ee46ca8619b1d0c465d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ov3ns0w.1he.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\PIL\_imaging.pyd
Filesize
2.2MB

MD5
1d4aaaf3c2e8dbf96a39ddb901cdda82

SHA1
cf316bf88bfa0c6b207293533f1d2cecbd95e2d4

SHA256
88718894be067dd54e7e07d4dffa8dfc39bed02de65ff92dc5922b2ad2407995

SHA512
e88c1f6507faa883f543d47e892f6a20b6547b29883982550d6772a742510b7570fe47f912da3630ec870669e07773ec4a3d1c38962cebf63bce23b9ac55efbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_bz2.pyd
Filesize
78KB

MD5
b45e82a398713163216984f2feba88f6

SHA1
eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839

SHA256
4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8

SHA512
b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_hashlib.pyd
Filesize
57KB

MD5
cfb9e0a73a6c9d6d35c2594e52e15234

SHA1
b86042c96f2ce6d8a239b7d426f298a23df8b3b9

SHA256
50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6

SHA512
22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_lzma.pyd
Filesize
149KB

MD5
5a77a1e70e054431236adb9e46f40582

SHA1
be4a8d1618d3ad11cfdb6a366625b37c27f4611a

SHA256
f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e

SHA512
3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_queue.pyd
Filesize
26KB

MD5
c9ee37e9f3bffd296ade10a27c7e5b50

SHA1
b7eee121b2918b6c0997d4889cff13025af4f676

SHA256
9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a

SHA512
c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_socket.pyd
Filesize
72KB

MD5
5dd51579fa9b6a06336854889562bec0

SHA1
99c0ed0a15ed450279b01d95b75c162628c9be1d

SHA256
3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c

SHA512
7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_ssl.pyd
Filesize
152KB

MD5
11c5008e0ba2caa8adf7452f0aaafd1e

SHA1
764b33b749e3da9e716b8a853b63b2f7711fcc7c

SHA256
bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14

SHA512
fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\_tkinter.pyd
Filesize
60KB

MD5
0f1aa5b9a82b75b607b4ead6bb6b8be6

SHA1
5d58fd899018a106d55433ea4fcb22faf96b4b3d

SHA256
336bd5bffdc0229da4eaddbb0cfc42a9e55459a40e1322b38f7e563bda8dd190

SHA512
b32ea7d3ed9ae3079728c7f92e043dd0614a4da1dbf40ae3651043d35058252187c3c0ad458f4ca79b8b006575fac17246fb33329f7b908138f5de3c4e9b4e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\charset_normalizer\md.pyd
Filesize
10KB

MD5
f33ca57d413e6b5313272fa54dbc8baa

SHA1
4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44

SHA256
9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664

SHA512
f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\libcrypto-1_1.dll
Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\libssl-1_1.dll
Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\nexusloader.exe
Filesize
22.7MB

MD5
5e61211e577a7fb75fab8b0c38ac11ea

SHA1
b00d7db41af8de8d8122e65ae77eb3ef28b3f633

SHA256
2ea85a21886caa6ad7ac3c840a903031af872df01bb42b597b5b599e2884b8a1

SHA512
7a2114cf3f2a372e1b699a8a91bac793a80bcb4dc6886e1d137be7e3f50015e976987b034d4b9e46cbfe43f9a7acb299c1963289b95f80ed1ea6396881203fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\python310.dll
Filesize
4.2MB

MD5
384349987b60775d6fc3a6d202c3e1bd

SHA1
701cb80c55f859ad4a31c53aa744a00d61e467e5

SHA256
f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

SHA512
6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\select.pyd
Filesize
25KB

MD5
78d421a4e6b06b5561c45b9a5c6f86b1

SHA1
c70747d3f2d26a92a0fe0b353f1d1d01693929ac

SHA256
f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823

SHA512
83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl86t.dll
Filesize
1.8MB

MD5
ad03d1e9f0121330694415f901af8f49

SHA1
ad8d3eee5274fef8bb300e2d1f4a11e27d3940df

SHA256
224476bedbcf121c69137f1df4dd025ae81769b2f7651bd3788a870a842cfbf9

SHA512
19b85c010c98fa75eacfd0b86f9c90a2dbf6f07a2b3ff5b4120108f3c26711512edf2b875a782497bdb3d28359325ad95c17951621c4b9c1fd692fde26b77c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl8\8.5\msgcat-1.6.1.tm
Filesize
33KB

MD5
db52847c625ea3290f81238595a915cd

SHA1
45a4ed9b74965e399430290bcdcd64aca5d29159

SHA256
4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55

SHA512
5a8fb4ada7b2efbf1cadd10dbe4dc7ea7acd101cb8fd0b80dad42be3ed8804fc8695c53e6aeec088c2d4c3ee01af97d148b836289da6e4f9ee14432b923c7e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\auto.tcl
Filesize
20KB

MD5
5e9b3e874f8fbeaadef3a004a1b291b5

SHA1
b356286005efb4a3a46a1fdd53e4fcdc406569d0

SHA256
f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840

SHA512
482c555a0da2e635fa6838a40377eef547746b2907f53d77e9ffce8063c1a24322d8faa3421fc8d12fdcaff831b517a65dafb1cea6f5ea010bdc18a441b38790

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\encoding\cp1252.enc
Filesize
1KB

MD5
5900f51fd8b5ff75e65594eb7dd50533

SHA1
2e21300e0bc8a847d0423671b08d3c65761ee172

SHA256
14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

SHA512
ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\http1.0\pkgIndex.tcl
Filesize
735B

MD5
10ec7cd64ca949099c818646b6fae31c

SHA1
6001a58a0701dff225e2510a4aaee6489a537657

SHA256
420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c

SHA512
34a0acb689e430ed2903d8a903d531a3d734cb37733ef13c5d243cb9f59c020a3856aad98726e10ad7f4d67619a3af1018f6c3e53a6e073e39bd31d088efd4af

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\init.tcl
Filesize
23KB

MD5
e10e428598b2d5f2054cfae4a7029709

SHA1
f8e7490e977c3c675e76297638238e08c1a5e72e

SHA256
61c55633fa048deb120422daed84224f2bb12c7c94958ca6f679b219cf2fa939

SHA512
88ef7628af5b784229dda6772c6ddd77905238a1648d4290b496eafeec013107437218e4834b7198aeb098bc854dcb9f18083c76dd5bf3ce9cedf3d5c9e4faae

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\opt0.4\pkgIndex.tcl
Filesize
607B

MD5
92ff1e42cfc5fecce95068fc38d995b3

SHA1
b2e71842f14d5422a9093115d52f19bcca1bf881

SHA256
eb9925a8f0fcc7c2a1113968ab0537180e10c9187b139c8371adf821c7b56718

SHA512
608d436395d055c5449a53208f3869b8793df267b8476ad31bcdd9659a222797814832720c495d938e34bf7d253ffc3f01a73cc0399c0dfb9c85d2789c7f11c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\package.tcl
Filesize
22KB

MD5
55e2db5dcf8d49f8cd5b7d64fea640c7

SHA1
8fdc28822b0cc08fa3569a14a8c96edca03bfbbd

SHA256
47b6af117199b1511f6103ec966a58e2fd41f0aba775c44692b2069f6ed10bad

SHA512
824c210106de7eae57a480e3f6e3a5c8fb8ac4bbf0a0a386d576d3eb2a3ac849bdfe638428184056da9e81767e2b63eff8e18068a1cf5149c9f8a018f817d3e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\tclIndex
Filesize
5KB

MD5
996f74f323ea95c03670734814b7887f

SHA1
49f4b9be5ab77e6ccab8091f315d424d7ac183f3

SHA256
962c60eb7e050061462ff72cec9741a7f18307af4aaa68d7665174f904842d13

SHA512
c4694260c733dc534dc1a70791fa29b725efd078a6846434883362f06f7bf080ca07478208b1909630e1b55fbdccf14484b78b0a5b8c6dad90f190c8c9d88a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tcl\tm.tcl
Filesize
11KB

MD5
52db1cd97ceab81675e86fa0264ea539

SHA1
b31693b5408a847f97ee8004fed48e5891df6e65

SHA256
6c02298d56e3c4c6b197afc79ec3ce1fc37ae176dc35f5d7ac48246f05f91669

SHA512
5032b0a79d0cd5a342af2f9edf8b88b7214e9aa61ba524a42c5be2286741e18fa380ad2d40dda9a0257afceed2ef6e48624013e854f37b5e41cb88a831ad04c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tk86t.dll
Filesize
1.5MB

MD5
e3c7ed5f9d601970921523be5e6fce2c

SHA1
a7ee921e126c3c1ae8d0e274a896a33552a4bd40

SHA256
bd4443b8ecc3b1f0c6fb13b264769253c80a4597af7181884bda20442038ec77

SHA512
bfa76b6d754259eabc39d701d359dd96f7a4491e63b17826a05a14f8fdf87656e8fc541a40e477e4fef8d0601320dd163199520e66d9ee8b5d6bb5cd9a275901

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tk\button.tcl
Filesize
20KB

MD5
cf6e5b2eb7681567c119040939dd6e2c

SHA1
3e0b905428c293f21074145fe43281f22e699eb4

SHA256
2f013b643d62f08ddaaa1dea39ff80d6607569c9e1acc19406377b64d75ccf53

SHA512
be03edea59be01d2b8de72b6ebe9dceb13d16c522bb5c042cdae83c84eafc6ac7b3650bf924f5f84f4f126634f9d17d74d087316d289f237129921a89aa4e0c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tk\entry.tcl
Filesize
17KB

MD5
1d9ff9bb7fedb472910776361510c610

SHA1
c190dd07bcc55741b9bdfc210f82df7b7c2fac81

SHA256
dd351da6288cf7e9f367fd97c97cb476193ff7461b25e31667e85fe720edea04

SHA512
85d25622f4e0c9517d8caa454ec4e81c8cbbec25e418f5a2d885d5561999cfb3c3026aac8bf1ca6f9b40993802fda86d60ff8fd2e30a77d56f1c1914af695f03

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tk\icons.tcl
Filesize
10KB

MD5
2652aad862e8fe06a4eedfb521e42b75

SHA1
ed22459ad3d192ab05a01a25af07247b89dc6440

SHA256
a78388d68600331d06bb14a4289bc1a46295f48cec31ceff5ae783846ea4d161

SHA512
6ecfbb8d136444a5c0dbbce2d8a4206f1558bdd95f111d3587b095904769ac10782a9ea125d85033ad6532edf3190e86e255ac0c0c81dc314e02d95cca86b596

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tk\pkgIndex.tcl
Filesize
372B

MD5
d942ff6f65bba8eb6d264db7d876a488

SHA1
74d6ca77e6092d79f37e7a1dcd7cced2e89d89cb

SHA256
e0bac49b9a3f0e50be89f692273cea7b7462bfc3e054f323261ef99b708c70a3

SHA512
3ac7d992300252109606074aefb693a31cd5cceffb6d7b851a2c8895a0d5e165a139b7038657306128af39c44785b7b4da35b8e1aeb4c30f3f7e7cfcfb789c4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\tk\tk.tcl
Filesize
23KB

MD5
25094462d2ea6b43133275bf4db31a60

SHA1
6bb76294e8fdf4d40027c9d1b994f1ab0014b81b

SHA256
3e998b41ab23677db31902e1e876e644b279b2e6d8896443f6c434352801cdd1

SHA512
8bdae921f367b864ea7f36c9a549ee870d4e4e3c6e942d70722a84ae6b23ff00a33638d8ca8f3b9b8fe084875ba7c8976975849f4dc47cdb5671df47af68cfab

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\unicodedata.pyd
Filesize
1.1MB

MD5
a40ff441b1b612b3b9f30f28fa3c680d

SHA1
42a309992bdbb68004e2b6b60b450e964276a8fc

SHA256
9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08

SHA512
5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\onefile_1964_133623592999300729\vcruntime140.dll
Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
Filesize
74KB

MD5
cc7686bf7c7d81f59196d5cc3cab3348

SHA1
ac39079f223f87d404c421c48239f913b12f00a8

SHA256
49c175257966f191a2abce16d8533d359fc27ecf6512da870a9c59937914d5f7

SHA512
940cfb37c1f5e5dbd86cc14d5a0a85dfaf889754051d4fc0d0afbe7bedceaec91b5f36b873b5e24cd081432db1b7d61df72a198681b9ab8e3a9b57197cfb58ae

Download Submit
C:\Users\Admin\AppData\Roaming\jhi_service.exe
Filesize
2.5MB

MD5
1994ad04639f3d12c7bbfa37feb3434f

SHA1
4979247e5a9771286a91827851527e5dbfb80c8e

SHA256
c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c

SHA512
adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

Download Submit
C:\Users\Admin\MpDefenderCoreService.exe
Filesize
39.4MB

MD5
76018548c6048b1544ff749c6ec7b543

SHA1
a5378eaabeada778810436d255ea5e6ce3cc2119

SHA256
a6c5102b273ced4b82b2ad08da0ef53850324a798aa1bed0d2687854728f95f5

SHA512
6510ec296d4d62d645694691a00d1f35ba1ded4793dcf41884cde9163618bd9ee9f154e6b5090f77d24fd757839974af48ccb9cd860c6f3fa3bb74732ae65175

Download Submit
memory/1520-954-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/1520-989-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/1520-952-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/1520-953-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/1520-950-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/1520-951-0x0000000140000000-0x000000014000D000-memory.dmp

Filesize
52KB

Download
memory/1612-1127-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1181-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1012-0x00000299C6A60000-0x00000299C6A80000-memory.dmp

Filesize
128KB

Download
memory/1612-1008-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1010-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1007-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1120-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1009-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-997-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1011-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1006-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-4427-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1180-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-4426-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/1612-1132-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2036-163-0x0000000000550000-0x0000000000568000-memory.dmp

Filesize
96KB

Download
memory/4216-2769-0x0000021EDBFA0000-0x0000021EDBFC2000-memory.dmp

Filesize
136KB

Download