meduza | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

09-04-2024 08:32

240409-kfg77aaf85 10

09-04-2024 08:32

09-04-2024 08:32

09-04-2024 08:32

11-03-2024 08:03

10-03-2024 15:15

Analysis

max time kernel
140s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09-04-2024 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FUCKER.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

meduza purelogstealer quasar redline risepro stealc zgrat kz1 collection discovery evasion infostealer persistence pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

KZ1

77.232.132.25:4999

Mutex

8892f097-602a-41ca-8df2-0bf3fd113bd2

Attributes

encryption_key
790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB
install_name
LestaClient.exe
log_directory
LestaLogs
reconnect_delay
3000
startup_key
Lesta Game Center
subdirectory
Lesta

Signatures

Detect ZGRat V1 20 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2352-359-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-360-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-362-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-364-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-366-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-368-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-374-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-376-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-378-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-380-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-382-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-384-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-386-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-388-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-390-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-392-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-394-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-396-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-401-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-407-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe	family_meduza

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Wattyl.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe"	Wattyl.exe

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe	family_purelog_stealer

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\control.exe	family_quasar
behavioral2/memory/1500-197-0x0000000000840000-0x0000000000B64000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

random.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ random.exe
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

13 3508 powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

flow	pid	process
13	3508	powershell.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

Wattyl.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Wattyl.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

3640 netsh.exe

pid	process
3640	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

random.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

servicedrive.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	servicedrive.exe

Executes dropped EXE 18 IoCs

Processes:

EchoNavigator.exesyncUpd.exeEGCBAFCFIJ.exekb^fr_ouverture.execontrol.exerandom.exeWattyl.exe%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmpservicedrive.exe288c47bbc1871b439df19ff4df68f00076.exeISetup4.exe288c47bbc1871b439df19ff4df68f076.exeTeamFour.exeModelingTextbooks.exeNvokcuobkn.execmon.exeboomlumma.exe

pid	process
216	EchoNavigator.exe
3876	syncUpd.exe
3232	EGCBAFCFIJ.exe
4884	kb^fr_ouverture.exe
1500	control.exe
1300	random.exe
4908	Wattyl.exe
4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
688	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
4244	servicedrive.exe
4532	288c47bbc1871b439df19ff4df68f00076.exe
1048	ISetup4.exe
3960	288c47bbc1871b439df19ff4df68f076.exe
68	TeamFour.exe
4168	ModelingTextbooks.exe
2296	Nvokcuobkn.exe
2352	cmon.exe
3928	boomlumma.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

random.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Wine random.exe
Loads dropped DLL 2 IoCs

Processes:

syncUpd.exe

pid process

3876 syncUpd.exe
3876 syncUpd.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Wine	random.exe

pid	process
3876	syncUpd.exe
3876	syncUpd.exe

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

servicedrive.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Wattyl.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe"	Wattyl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Wattyl.exe

description	ioc	process
File opened (read-only)	\??\h:	Wattyl.exe
File opened (read-only)	\??\i:	Wattyl.exe
File opened (read-only)	\??\k:	Wattyl.exe
File opened (read-only)	\??\q:	Wattyl.exe
File opened (read-only)	\??\t:	Wattyl.exe
File opened (read-only)	\??\b:	Wattyl.exe
File opened (read-only)	\??\g:	Wattyl.exe
File opened (read-only)	\??\w:	Wattyl.exe
File opened (read-only)	\??\x:	Wattyl.exe
File opened (read-only)	\??\a:	Wattyl.exe
File opened (read-only)	\??\l:	Wattyl.exe
File opened (read-only)	\??\m:	Wattyl.exe
File opened (read-only)	\??\n:	Wattyl.exe
File opened (read-only)	\??\u:	Wattyl.exe
File opened (read-only)	\??\s:	Wattyl.exe
File opened (read-only)	\??\v:	Wattyl.exe
File opened (read-only)	\??\y:	Wattyl.exe
File opened (read-only)	\??\e:	Wattyl.exe
File opened (read-only)	\??\j:	Wattyl.exe
File opened (read-only)	\??\o:	Wattyl.exe
File opened (read-only)	\??\p:	Wattyl.exe
File opened (read-only)	\??\r:	Wattyl.exe
File opened (read-only)	\??\z:	Wattyl.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs

Web Service

T1102

Processes:

flow	ioc
123	raw.githubusercontent.com
265	raw.githubusercontent.com
266	raw.githubusercontent.com
203	bitbucket.org
131	raw.githubusercontent.com
132	raw.githubusercontent.com
136	raw.githubusercontent.com
141	raw.githubusercontent.com
143	raw.githubusercontent.com
159	raw.githubusercontent.com
202	bitbucket.org
211	raw.githubusercontent.com
217	raw.githubusercontent.com
263	raw.githubusercontent.com
269	raw.githubusercontent.com
129	raw.githubusercontent.com
139	raw.githubusercontent.com
146	raw.githubusercontent.com
210	raw.githubusercontent.com
214	raw.githubusercontent.com
121	raw.githubusercontent.com
152	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

138 whoer.net
140 whoer.net
104 api.ipify.org
105 api.ipify.org

flow	ioc
138	whoer.net
140	whoer.net
104	api.ipify.org
105	api.ipify.org

Drops file in System32 directory 4 IoCs

Processes:

Wattyl.exe

description	ioc	process
File created	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File created	C:\Windows\SysWOW64\setting.ini	Wattyl.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	Wattyl.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

random.exe

pid process

1300 random.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

boomlumma.exe

description pid process target process

PID 3928 set thread context of 2552 3928 boomlumma.exe RegAsm.exe
Drops file in Windows directory 2 IoCs

Processes:

Wattyl.exe

description ioc process

File created C:\Windows\RVHOST.exe Wattyl.exe
File opened for modification C:\Windows\RVHOST.exe Wattyl.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1352 sc.exe

pid	process
1300	random.exe

description	pid	process	target process
PID 3928 set thread context of 2552	3928	boomlumma.exe	RegAsm.exe

description	ioc	process
File created	C:\Windows\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\RVHOST.exe	Wattyl.exe

pid	process
1352	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4296	4884	WerFault.exe	kb^fr_ouverture.exe
3144	2804	WerFault.exe	ffffffffffbbbbb_crypted.exe
3088	4428	WerFault.exe	M5traider.exe
3560	3876	WerFault.exe	NBYS%20AH.NET.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

syncUpd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	syncUpd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	syncUpd.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4888 schtasks.exe
3940 schtasks.exe
Runs net.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

2136 PING.EXE
1316 PING.EXE

pid	process
4888	schtasks.exe
3940	schtasks.exe

pid	process
2136	PING.EXE
1316	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

Processes:

powershell.exesyncUpd.exerandom.exeWattyl.exeTeamFour.exepowershell.exeservicedrive.exe

pid	process
3508	powershell.exe
3508	powershell.exe
3876	syncUpd.exe
3876	syncUpd.exe
3508	powershell.exe
3876	syncUpd.exe
3876	syncUpd.exe
1300	random.exe
1300	random.exe
4908	Wattyl.exe
4908	Wattyl.exe
68	TeamFour.exe
68	TeamFour.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
4244	servicedrive.exe
4244	servicedrive.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

FUCKER.exepowershell.exeAUDIODG.EXEcontrol.exeTeamFour.exeNvokcuobkn.execmon.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	600	FUCKER.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: 33	4552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4552	AUDIODG.EXE
Token: SeDebugPrivilege	1500	control.exe
Token: SeDebugPrivilege	68	TeamFour.exe
Token: SeDebugPrivilege	2296	Nvokcuobkn.exe
Token: SeBackupPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeDebugPrivilege	2352	cmon.exe
Token: SeDebugPrivilege	5076	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

control.exe

pid process

1500 control.exe

pid	process
1500	control.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FUCKER.exeEchoNavigator.exesyncUpd.execmd.exeEGCBAFCFIJ.execmd.exeWattyl.execmd.execmd.exe%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe288c47bbc1871b439df19ff4df68f00076.exe

description	pid	process	target process
PID 600 wrote to memory of 216	600	FUCKER.exe	EchoNavigator.exe
PID 600 wrote to memory of 216	600	FUCKER.exe	EchoNavigator.exe
PID 600 wrote to memory of 216	600	FUCKER.exe	EchoNavigator.exe
PID 216 wrote to memory of 3508	216	EchoNavigator.exe	powershell.exe
PID 216 wrote to memory of 3508	216	EchoNavigator.exe	powershell.exe
PID 216 wrote to memory of 3508	216	EchoNavigator.exe	powershell.exe
PID 600 wrote to memory of 3876	600	FUCKER.exe	syncUpd.exe
PID 600 wrote to memory of 3876	600	FUCKER.exe	syncUpd.exe
PID 600 wrote to memory of 3876	600	FUCKER.exe	syncUpd.exe
PID 3876 wrote to memory of 2532	3876	syncUpd.exe	cmd.exe
PID 3876 wrote to memory of 2532	3876	syncUpd.exe	cmd.exe
PID 3876 wrote to memory of 2532	3876	syncUpd.exe	cmd.exe
PID 2532 wrote to memory of 3232	2532	cmd.exe	EGCBAFCFIJ.exe
PID 2532 wrote to memory of 3232	2532	cmd.exe	EGCBAFCFIJ.exe
PID 2532 wrote to memory of 3232	2532	cmd.exe	EGCBAFCFIJ.exe
PID 3232 wrote to memory of 4260	3232	EGCBAFCFIJ.exe	cmd.exe
PID 3232 wrote to memory of 4260	3232	EGCBAFCFIJ.exe	cmd.exe
PID 3232 wrote to memory of 4260	3232	EGCBAFCFIJ.exe	cmd.exe
PID 4260 wrote to memory of 2136	4260	cmd.exe	PING.EXE
PID 4260 wrote to memory of 2136	4260	cmd.exe	PING.EXE
PID 4260 wrote to memory of 2136	4260	cmd.exe	PING.EXE
PID 600 wrote to memory of 4884	600	FUCKER.exe	kb^fr_ouverture.exe
PID 600 wrote to memory of 4884	600	FUCKER.exe	kb^fr_ouverture.exe
PID 600 wrote to memory of 4884	600	FUCKER.exe	kb^fr_ouverture.exe
PID 600 wrote to memory of 1500	600	FUCKER.exe	control.exe
PID 600 wrote to memory of 1500	600	FUCKER.exe	control.exe
PID 600 wrote to memory of 1300	600	FUCKER.exe	random.exe
PID 600 wrote to memory of 1300	600	FUCKER.exe	random.exe
PID 600 wrote to memory of 1300	600	FUCKER.exe	random.exe
PID 600 wrote to memory of 4908	600	FUCKER.exe	Wattyl.exe
PID 600 wrote to memory of 4908	600	FUCKER.exe	Wattyl.exe
PID 600 wrote to memory of 4908	600	FUCKER.exe	Wattyl.exe
PID 4908 wrote to memory of 2976	4908	Wattyl.exe	cmd.exe
PID 4908 wrote to memory of 2976	4908	Wattyl.exe	cmd.exe
PID 4908 wrote to memory of 2976	4908	Wattyl.exe	cmd.exe
PID 2976 wrote to memory of 2596	2976	cmd.exe	at.exe
PID 2976 wrote to memory of 2596	2976	cmd.exe	at.exe
PID 2976 wrote to memory of 2596	2976	cmd.exe	at.exe
PID 4908 wrote to memory of 3124	4908	Wattyl.exe	cmd.exe
PID 4908 wrote to memory of 3124	4908	Wattyl.exe	cmd.exe
PID 4908 wrote to memory of 3124	4908	Wattyl.exe	cmd.exe
PID 3124 wrote to memory of 2244	3124	cmd.exe	at.exe
PID 3124 wrote to memory of 2244	3124	cmd.exe	at.exe
PID 3124 wrote to memory of 2244	3124	cmd.exe	at.exe
PID 600 wrote to memory of 4124	600	FUCKER.exe	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
PID 600 wrote to memory of 4124	600	FUCKER.exe	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
PID 600 wrote to memory of 4124	600	FUCKER.exe	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
PID 4124 wrote to memory of 688	4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
PID 4124 wrote to memory of 688	4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
PID 4124 wrote to memory of 688	4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
PID 600 wrote to memory of 4244	600	FUCKER.exe	servicedrive.exe
PID 600 wrote to memory of 4244	600	FUCKER.exe	servicedrive.exe
PID 600 wrote to memory of 4532	600	FUCKER.exe	288c47bbc1871b439df19ff4df68f00076.exe
PID 600 wrote to memory of 4532	600	FUCKER.exe	288c47bbc1871b439df19ff4df68f00076.exe
PID 600 wrote to memory of 4532	600	FUCKER.exe	288c47bbc1871b439df19ff4df68f00076.exe
PID 4532 wrote to memory of 1048	4532	288c47bbc1871b439df19ff4df68f00076.exe	ISetup4.exe
PID 4532 wrote to memory of 1048	4532	288c47bbc1871b439df19ff4df68f00076.exe	ISetup4.exe
PID 4532 wrote to memory of 1048	4532	288c47bbc1871b439df19ff4df68f00076.exe	ISetup4.exe
PID 4532 wrote to memory of 3960	4532	288c47bbc1871b439df19ff4df68f00076.exe	288c47bbc1871b439df19ff4df68f076.exe
PID 4532 wrote to memory of 3960	4532	288c47bbc1871b439df19ff4df68f00076.exe	288c47bbc1871b439df19ff4df68f076.exe
PID 4532 wrote to memory of 3960	4532	288c47bbc1871b439df19ff4df68f00076.exe	288c47bbc1871b439df19ff4df68f076.exe
PID 600 wrote to memory of 68	600	FUCKER.exe	TeamFour.exe
PID 600 wrote to memory of 68	600	FUCKER.exe	TeamFour.exe
PID 600 wrote to memory of 4168	600	FUCKER.exe	ModelingTextbooks.exe

outlook_office_path 1 IoCs

Processes:

servicedrive.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe

outlook_win_path 1 IoCs

Processes:

servicedrive.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe

C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:600

C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe
"C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -nologo -noprofile -noninteractive -executionpolicy bypass -command .\serverBrowser.ps1
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
"C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2532

C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe
"C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:4260

C:\Windows\SysWOW64\PING.EXE
ping 2.2.2.2 -n 1 -w 3000
6⤵
- Runs ping.exe
PID:2136

C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
"C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"
2⤵
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 748
3⤵
- Program crash
PID:4296

C:\Users\Admin\AppData\Local\Temp\Files\control.exe
"C:\Users\Admin\AppData\Local\Temp\Files\control.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1500

C:\Users\Admin\AppData\Local\Temp\Files\random.exe
"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"
2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT /delete /yes
3⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\at.exe
AT /delete /yes
4⤵
PID:2596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3124

C:\Windows\SysWOW64\at.exe
AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
4⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
"C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124

C:\Users\Admin\AppData\Local\Temp\is-3H3I1.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
"C:\Users\Admin\AppData\Local\Temp\is-3H3I1.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp" /SL5="$90226,1495449,832512,C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe"
3⤵
- Executes dropped EXE
PID:688

C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe
"C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
PID:4244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe"
3⤵
PID:4396

C:\Windows\system32\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:1316

C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f00076.exe
"C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f00076.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532

C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
"C:\Users\Admin\AppData\Local\Temp\ISetup4.exe"
3⤵
- Executes dropped EXE
PID:1048

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
3⤵
- Executes dropped EXE
PID:3960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
4⤵
PID:4752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:368

C:\Windows\System32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
PID:3960

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:3640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:4588

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
PID:2388

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
PID:4648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:2936

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:4888

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
6⤵
PID:4156

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:3308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
6⤵
PID:2132

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
6⤵
PID:4160

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
6⤵
- Creates scheduled task(s)
PID:3940

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
6⤵
PID:2100

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
7⤵
PID:4996

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
- Launches sc.exe
PID:1352

C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe
"C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:68

C:\Users\Admin\AppData\Local\Temp\Files\ModelingTextbooks.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ModelingTextbooks.exe"
2⤵
- Executes dropped EXE
PID:4168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Elder Elder.bat & Elder.bat & exit
3⤵
PID:4404

C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe
"C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2552

C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"
2⤵
PID:1460

C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
"C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"
3⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\Files\current.exe
"C:\Users\Admin\AppData\Local\Temp\Files\current.exe"
2⤵
PID:32

C:\Users\Admin\AppData\Local\Temp\Files\ffffffffffbbbbb_crypted.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ffffffffffbbbbb_crypted.exe"
2⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 752
3⤵
- Program crash
PID:3144

C:\Users\Admin\AppData\Local\Temp\Files\dais.exe
"C:\Users\Admin\AppData\Local\Temp\Files\dais.exe"
2⤵
PID:4744

C:\Users\Admin\AppData\Local\Temp\Files\thost.exe
"C:\Users\Admin\AppData\Local\Temp\Files\thost.exe"
2⤵
PID:3112

C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe
"C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe"
2⤵
PID:236

C:\Users\Admin\AppData\Local\Temp\Files\Ljauypuypg.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Ljauypuypg.exe"
2⤵
PID:3308

C:\Users\Admin\AppData\Local\Temp\Files\net.exe
"C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
2⤵
PID:1280

C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe
"C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe"
2⤵
PID:4428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
3⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1260
3⤵
- Program crash
PID:3088

C:\Users\Admin\AppData\Local\Temp\Files\2-3-1_2023-12-14_13-35.exe
"C:\Users\Admin\AppData\Local\Temp\Files\2-3-1_2023-12-14_13-35.exe"
2⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe
"C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe"
2⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\Files\cry.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cry.exe"
2⤵
PID:3232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\Files\Crypto.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Crypto.exe"
2⤵
PID:2000

C:\Users\Admin\AppData\Local\Temp\Files\native.exe
"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
2⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
2⤵
PID:1872

C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"
2⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe
"C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe"
2⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"
2⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
2⤵
PID:1180

C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe
"C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe"
2⤵
PID:2956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe'
3⤵
PID:5944

C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"
2⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe
"C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe"
2⤵
PID:2684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\Files\Props.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Props.exe"
2⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe"
2⤵
PID:3876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1116
3⤵
- Program crash
PID:3560

C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe
"C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"
2⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\Files\DemagogicAlewife.exe
"C:\Users\Admin\AppData\Local\Temp\Files\DemagogicAlewife.exe"
2⤵
PID:2876

C:\Users\Admin\AppData\Local\Temp\Files\Nzewxakqtk.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Nzewxakqtk.exe"
2⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\Files\swizzyyyy.exe
"C:\Users\Admin\AppData\Local\Temp\Files\swizzyyyy.exe"
2⤵
PID:4408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:5832

C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
"C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
2⤵
PID:5280

C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
2⤵
PID:5596

C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
"C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
2⤵
PID:5640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
f9c40426d3ae3c029d3decd2a245b5ff

SHA1
dbb9d2958775b077a719c8226fb4befc73e66d1e

SHA256
87538301f3ec0d132aeb234a2f9690f711b740fb7648258dfd60db5a9868f6e5

SHA512
7be9ec0f8aba70be99ec826ee907afe955c63fb0348f5ef15655ea72d147cb1964df2a602429d0ddf32c561d1d049c115c3f0879bb37edab517414be52bf5460

Download Submit
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Filesize
4.2MB

MD5
43b4b9050e5b237de2d1412de8781f36

SHA1
125cd51af3ca81d4c3e517b8405b9afae92b86f2

SHA256
97bb5c78c753aa5e39ffc3d4c1058f584d0241e9b19aff20a248f1f159fdca6d

SHA512
24e90d5a5d4a06e0d62ff2b5bc91e686f5cdb2e77fb4c31ef3b6a59f62afae9fc6642bb57576c334e46e234d10300a2814cca747cc315b52ea63b0226a6695d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe
Filesize
106KB

MD5
fe380780b5c35bd6d54541791151c2be

SHA1
7fe3a583cf91474c733f85cebf3c857682e269e1

SHA256
b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53

SHA512
ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Echo Navigator\serverBrowser.ps1
Filesize
125KB

MD5
581ef78d54af26c5f1e7321929ddf10e

SHA1
c368969b4aa6d7124e61229408d6362a4e84168b

SHA256
52adeb5afa0f4e92914cb7f65ba44e0283ec44dbac9dc88920850e84f5a5f1fe

SHA512
9d42f077853e97f40cdb45d99ecf7b79e6378983e22ffab65463288a0266a6807a78d6bd2af4be9136268b5eed9afbccb1b0d329f91252dcced4778d26684da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Elder
Filesize
19KB

MD5
b5d2f4e32195be913bf7bb05050616db

SHA1
aee9fcd2db09c875f7137c9b1ddd9a8de4ee1daf

SHA256
2d14b4668f2d8baf5d7f06fe402f3b68b40bb99fffa660b2b0be289af9dfd8e4

SHA512
3af474495f0db89a285ab6bdd0710f9555b020160b76fa6512c81b5e08724e9e7720f56980fa6f1552c4f85e835f05eb3a0adb0f19a11cb83fad0e070f84b2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
Filesize
2.2MB

MD5
825d33a659673c01085a56e787a26660

SHA1
76ff37ab68882bb538ed82ead5a8cfbb209da1ef

SHA256
3a6cc772d828a3581880b772e9ec2bdce35ee7204d5bbaaf8a08e278676d96dd

SHA512
21050f35fb210e7fa95aea1cf3081549a512276aa1b47c2abdcbf7bbe8102376be60831a2d2abb1e2386312704decf2ce371e33f4398520ddbe7c0af5eb0caef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f00076.exe
Filesize
4.7MB

MD5
ba354d029f0e09cb6b02a4c196524da4

SHA1
d8a3c4115cc46bc9a7b5216232c87d1a6471f09d

SHA256
e70dcf3f915087251224a7db3850669c000a6da68ef2b55e3e2eda196cb01fc3

SHA512
d27e3f6045f2915ed692d36f4152fc4dd7d1e6029e254d8e4fe4ce1d9dc5db8c6cb98cd7fab4c5762d6d2ad4c61dc5179486e70ebca5ce29ac5fc895daba4aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe
Filesize
9.3MB

MD5
5df01f9e45f5e3c30a3534a4be701aed

SHA1
2260bda07a9f49da7cf8fd79a8c9f3ed1e823cff

SHA256
be569b1dc8758a791c81d7a4d9d653018e02f1206bc6e18d246a9d4dade25d39

SHA512
e20fd9ce0deecb9f0e3c98b590dc0d10f720dcd541c97360cac807efcdea50ee9fec0e40ab3660ca90e0492664d2c12ab9f7ccf56eaedad7f19e253fb3bc1d9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ModelingTextbooks.exe
Filesize
797KB

MD5
bd15134c5a5187705599dc5958855753

SHA1
9782f2d27bc52bc0210c26106a78ded7fa98f5e1

SHA256
1e71bcb4133949eaa1bead27b4e01f03f7802c6b92f61acbb6b8d7c8faf419d7

SHA512
cc5fe526fecfc87cd04110f72c8e26bae786494e0ee7a29a7d241d83f6eb3ee189a85ec05b436c1a2f927ebff185c52737745b9cf04c22afec67a7d24ab386a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe
Filesize
51KB

MD5
8647ffb0d889ea1933f7a4e7771094c0

SHA1
5c20b6cf56287c18566e50b0249e6cd9285f3ca3

SHA256
6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c

SHA512
26c47cf2ceb3a6e7d3d3b7f7d8934d6d769d31d9d279479a141df6ae2057e8b2644e12a225f56e5306529133e1a793b9500e5633732ef586464ea2c8fd43957c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe
Filesize
541KB

MD5
3b069f3dd741e4360f26cb27cb10320a

SHA1
6a9503aaf1e297f2696482ddf1bd4605a8710101

SHA256
f63bdc068c453e7e22740681a0c280d02745807b1695ce86e5067069beca533e

SHA512
bda58c074f7bd5171d7e3188a48cbdc457607ff06045e64a9e8e33fcb6f66f941d75a7bf57eb0ef262491622b4a9936342384237fa61c1add3365d5006c6d0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
Filesize
16.5MB

MD5
21f57e534a0adc7765d6eeb22ec5bd74

SHA1
43baaefa89366a2ab42e1ad30fdffcebeb81d00a

SHA256
8487b7cbcc6331ce5da7a3f19229813c10801285ed30a8d82e81bf19b1ec385a

SHA512
18bc9254f1d15dee4863be12ae862cd46c5c341ef72601500eab1d99d4ed38a34cff33587940f58885f327f8408644c5deb5c86dd274ffec3e0dcf69d1b8a83a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
Filesize
477KB

MD5
34e03669773d47d0d8f01be78ae484e4

SHA1
4b0a7e2af2c28ae191737ba07632ed354d35c978

SHA256
2919b157d8d2161bf56a17af0efc171d8e2c3c233284cf116e8c968dd9704572

SHA512
8d93fab3c2544d015af2d84f07d3ebbf8acead8bb0185ffb045302b2be19ac12cd2ac59288313bd75bc230768c90e68139c124ea89df943776b1cfaac4876a7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe
Filesize
351KB

MD5
059e591f9dda7d3ee0de23f64d791cb1

SHA1
55e1be730e1426d00354e994f3596764d40634a6

SHA256
9550addd57ac80afc9a177a5e7c9e961892d96593296bac79ec7a6ea65cc12d9

SHA512
c67663ee4b68cdee2d834b9ef8e29af6e39926c547efbe02568adb7eb5e37c6a933205592888b0716936635a9e6e60673f12599778a5196e5fdafcfb262af629

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe
Filesize
2.7MB

MD5
2bae8753475af921d7258f9b1e9fccd4

SHA1
0da0ad8fbea157d468e4ccbf66575808103246f7

SHA256
9df4aaa956d54f55f1bb038f3e8f086169983e094ef8432cd71df928a888a2d0

SHA512
0a346f1dc1771f4e049d04eda7bfc021120cf3797011f89b3a6e2b5ad2fb6bb88d6218d8c6383d8a98bc9eaef2797a01632e7a2526005b04a5000c2889cdd12d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\control.exe
Filesize
3.1MB

MD5
7b9d9f41d274ddd8fac0544e188ade4a

SHA1
20050de536fbf27cdbfbdd0671af913e04106363

SHA256
50684cb3400e3cd4959c2ccd2dd900a157ef3163179adcf8da15ed5b7b41694b

SHA512
c102873fa15ffd776ab17b16cd39d6ac95c8412dc8c4a0c8c28e1579dd0d03f9fa4f4985d419a76cd4853c5769ea4e95a24c4c1a9c61c98b7508d97c13b345af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
Filesize
11KB

MD5
2a872ae7aa325dab4fd6f4d2a0a4fa21

SHA1
f55588b089b75606b03415c9d887e1bdbb55a0a0

SHA256
693fbe27170b14efde45d627cf3e0af36143762d2ef70a52a8402f121f6d6ae4

SHA512
fa88a7540f6fea6d487ebc29a8a83cb8e1e2e1d94b5343b0b9aba45741bd3ab5f66b86dbe549eceafaa922a70c360b0ade8d72b22a9fc6bd31a94b8d416ec5e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\native.exe
Filesize
5.3MB

MD5
de08b70c1b36bce2c90a34b9e5e61f09

SHA1
1628635f073c61ad744d406a16d46dfac871c9c2

SHA256
432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67

SHA512
18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\random.exe
Filesize
2.2MB

MD5
c4c25694f502a6ebeee98c85731126d4

SHA1
3596c6d1b06114a9fb29206499af878307446cc5

SHA256
e696fceb57c0eb026917377129e99e53cb1a7be745eb7dd51a3fa58ca5b3fb2f

SHA512
81877d8132d953cb0d247f4b5e917d84d4791bec3b4c68d25934be3feff8f2f8cc645bf139f9303776b5b6236439ffe72d72840216fe68cdbe40c0a0e2671ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe
Filesize
1.5MB

MD5
0842c1a1d5fe5c7cc934fc5021b0885b

SHA1
057cc72a78d78b126fe0fc5f05498ceb9b7da2c6

SHA256
2ab767ed95da57611db4f66990f750d981fdabce02b606e6910e2690a2b5acef

SHA512
d0d5eae46c621e752b4ffc59aff24b70d6229ddf30239def128ce62a7f77c0e223591dc4a4a8abb84630c7905851dfdcc7b644e45c06991674d287ec98ebae4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
Filesize
272KB

MD5
f46eb7b82a0ee6ffbd0a48dd120f0802

SHA1
3241e2cb73acf8c80c12af2864d59ad0a24acc3d

SHA256
cf995f855bb296ca2744bf6fbf0e9d01009dcf580c98324a2424893394447e4e

SHA512
c2135243ed4b6d516891c81ac7b29914aa42bdd3a34e7902c3c6c072352063a2012c151dcc9a134b344a9c311c3d6857e03bd566d7b79f7baa280ce83c725e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
Filesize
464KB

MD5
44f814be76122897ef325f8938f8e4cf

SHA1
5f338e940d1ee1fa89523d13a0b289912e396d23

SHA256
2899d533753918409ab910b70ba92f8740f76c8e8ac74f4c890e53b258e3bff6

SHA512
daeb1a81dd4fe1578502d0c681c7e723273d06297c2fad7aeb74b1a06cd05f72a418af9571c82188525af329b3fef9785d588f1416d6ccf45ab58b589d8f0d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14602\base_library.zip
Filesize
1.7MB

MD5
c02b1b28775aa757d008b2b0e52a4943

SHA1
f5c12fa0eddb3a4127bd0866714bdcf10a7abead

SHA256
eb71c75ad9fa6aba6e8b793948a96029a190b612bb289c780621757d90c08577

SHA512
58ae35c802ef81da05e9aeef0f16e9b27d6391e9dffb8aa77ea8406497201766d9fd7834d40a167485f452f57b51066988afc344c733129d1e4fad78b8dcf1c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14602\python3.DLL
Filesize
65KB

MD5
7442c154565f1956d409092ede9cc310

SHA1
c72f9c99ea56c8fb269b4d6b3507b67e80269c2d

SHA256
95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b

SHA512
2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aeakwjsk.mqd.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3H3I1.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
Filesize
3.0MB

MD5
25a216e64ef305c97444182fb2440316

SHA1
5b2d808def3398b73d0085b6a4a7ceccf960b014

SHA256
033382ec20598a624f624aa427168b1415786fe1d4e6848ed579e5728e7f67be

SHA512
713218496b28ff397ec6ea908a99318040672fcfcd10637918dfc3ca85ef6fd591e67599aa24095a23278fde795dbcee022fa27f73a58ee192d615be65541f42

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
db01a2c1c7e70b2b038edf8ad5ad9826

SHA1
540217c647a73bad8d8a79e3a0f3998b5abd199b

SHA256
413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

SHA512
c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
41KB

MD5
0f38a17bbaa7b6f75f51c671be981097

SHA1
ee95e5225cfb623b6ddd58902bf72504993e2030

SHA256
03f4d293b34e18f429d34282179a04a705d448f3b88b88982486997f6cd51f39

SHA512
429100ae213ea857fa3fefea7b512bb616219f76cf2a55a4735776650806d42582ff886cd4779a1406d2bc9d0f514c93e40c3d12d9e764ffa8b880067bd704a2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
6990a376736feafb4de6bcaf112d2b80

SHA1
324a2f51351beb01b6157e57f5dcfe75a49bc134

SHA256
fc636b5481df443931ce2b815ad291b673081834c98660e7ac836bf87edcf154

SHA512
744e85aedec1b86e2da44e41f3ec89744710101f5f2f1cf9db511d12e5af2cb7f917f6bb4a055d54346c22e06f95ea487abfe80cfad1009169da392fd3ee40d7

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
18KB

MD5
15980c8fba2997a8d6c3551f92217600

SHA1
a4374969850e1089a1cc6f264a92fbf6b36a9c3f

SHA256
bd43410c1abb46d9528e258746fc37bd2b37bcb05d4026253a51674b1d60772c

SHA512
7e7e5f97e6773c1e4a91f5f4b1c951ac940dcf70d2112e61adb36ff2b1de2a6f452f5ad422cd523e3091b5827dc599b40ab2f7b0c50905f4d66e157802d4db07

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
17KB

MD5
ba6b6d39b4bab98af8cf84b6a3ffb075

SHA1
0e570b8acf4446f146e47050f96bd1ba3dbe1d5e

SHA256
6a8a464af76e40fb8ff67eafc7849ba67dc0e9099524a6ed7d3264b7aa1602cb

SHA512
69d39b9980bd73a3caab579b700ac3c2464c5480135a335948025982b72f3da83983f3411ff568fc43c7e2f5f2f15f291371cdfe3b60d6d182f7457a21042688

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
17KB

MD5
95a4eda49d88cf21d18e73361666fb8e

SHA1
c53178d492c1670098773e59b2cdc256ce5c0cf0

SHA256
9d4f81b99cc58e3982506016c0bec57e6a52accf73ee94abe1813d5a74642f50

SHA512
7113d095a846315873fbfd9b6cb4758d08be03656c4942f79148de3a834213de8f66996412aa603342f4d032351260c27e666546a2dbcd618ac38be9a67ff281

Download Submit
C:\Windows\SysWOW64\setting.ini
Filesize
141KB

MD5
e7cfc403f37bbe1ef81cef47bc01036d

SHA1
672a8711a1d6dc6ab38b48d88f3f2a671c3f378a

SHA256
11e415ef1484c25ac6fea93c8f13d1429a0061a8ca692d0697afe01211f2ab35

SHA512
7a06890aedd7a4cb7df4f8b411ac0eeb03cceb8faea2084575a265c76cf7377ba6f17af494fe9035c97a211528ddb2fa02ed28f6d277d59928ab571893a2da9b

Download Submit
\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14602\VCRUNTIME140.dll
Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14602\_ctypes.pyd
Filesize
120KB

MD5
9b344f8d7ce5b57e397a475847cc5f66

SHA1
aff1ccc2608da022ecc8d0aba65d304fe74cdf71

SHA256
b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf

SHA512
2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14602\libffi-8.dll
Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI14602\python311.dll
Filesize
5.5MB

MD5
e2bd5ae53427f193b42d64b8e9bf1943

SHA1
7c317aad8e2b24c08d3b8b3fba16dd537411727f

SHA256
c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400

SHA512
ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036

Download Submit
memory/216-11-0x0000000001DF0000-0x0000000001DFA000-memory.dmp

Filesize
40KB

Download
memory/216-20-0x0000000005E40000-0x0000000005E50000-memory.dmp

Filesize
64KB

Download
memory/216-9-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/216-10-0x0000000000BD0000-0x0000000001518000-memory.dmp

Filesize
9.3MB

Download
memory/216-13-0x0000000005CA0000-0x0000000005CB2000-memory.dmp

Filesize
72KB

Download
memory/216-139-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/600-1-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/600-0-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Filesize
32KB

Download
memory/600-116-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/600-141-0x0000000003100000-0x0000000003110000-memory.dmp

Filesize
64KB

Download
memory/600-3-0x0000000003100000-0x0000000003110000-memory.dmp

Filesize
64KB

Download
memory/600-2-0x0000000005880000-0x000000000591C000-memory.dmp

Filesize
624KB

Download
memory/688-405-0x0000000000400000-0x000000000071B000-memory.dmp

Filesize
3.1MB

Download
memory/1048-321-0x0000000000400000-0x0000000002D72000-memory.dmp

Filesize
41.4MB

Download
memory/1300-211-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/1300-216-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1300-222-0x0000000004FD0000-0x0000000004FD2000-memory.dmp

Filesize
8KB

Download
memory/1300-221-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/1300-220-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/1300-218-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/1300-219-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/1300-217-0x0000000004F60000-0x0000000004F61000-memory.dmp

Filesize
4KB

Download
memory/1300-209-0x0000000000800000-0x0000000000D9A000-memory.dmp

Filesize
5.6MB

Download
memory/1300-210-0x0000000077A44000-0x0000000077A45000-memory.dmp

Filesize
4KB

Download
memory/1300-212-0x0000000004F20000-0x0000000004F21000-memory.dmp

Filesize
4KB

Download
memory/1300-342-0x0000000000800000-0x0000000000D9A000-memory.dmp

Filesize
5.6MB

Download
memory/1300-214-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/1300-213-0x0000000004F50000-0x0000000004F51000-memory.dmp

Filesize
4KB

Download
memory/1300-215-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/1500-197-0x0000000000840000-0x0000000000B64000-memory.dmp

Filesize
3.1MB

Download
memory/1500-198-0x00007FFFF2EF0000-0x00007FFFF38DC000-memory.dmp

Filesize
9.9MB

Download
memory/1500-203-0x000000001BC80000-0x000000001BCBE000-memory.dmp

Filesize
248KB

Download
memory/1500-202-0x000000001BC20000-0x000000001BC32000-memory.dmp

Filesize
72KB

Download
memory/1500-201-0x000000001BCC0000-0x000000001BD72000-memory.dmp

Filesize
712KB

Download
memory/1500-200-0x000000001BBB0000-0x000000001BC00000-memory.dmp

Filesize
320KB

Download
memory/1500-199-0x000000001B850000-0x000000001B860000-memory.dmp

Filesize
64KB

Download
memory/2352-368-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-380-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-376-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-407-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-401-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-366-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-364-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-362-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-396-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-394-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-392-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-390-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-388-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-386-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-384-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-382-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-374-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-378-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-359-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/2352-360-0x0000000006C50000-0x0000000006F00000-memory.dmp

Filesize
2.7MB

Download
memory/3232-175-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/3232-176-0x0000000000C20000-0x0000000000C40000-memory.dmp

Filesize
128KB

Download
memory/3232-177-0x0000000005520000-0x0000000005530000-memory.dmp

Filesize
64KB

Download
memory/3232-180-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/3508-100-0x000000000A570000-0x000000000A732000-memory.dmp

Filesize
1.8MB

Download
memory/3508-37-0x00000000080B0000-0x0000000008400000-memory.dmp

Filesize
3.3MB

Download
memory/3508-68-0x000000000A8E0000-0x000000000AF58000-memory.dmp

Filesize
6.5MB

Download
memory/3508-69-0x00000000098F0000-0x000000000990A000-memory.dmp

Filesize
104KB

Download
memory/3508-71-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3508-30-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3508-29-0x0000000005050000-0x0000000005086000-memory.dmp

Filesize
216KB

Download
memory/3508-101-0x000000000B490000-0x000000000B9BC000-memory.dmp

Filesize
5.2MB

Download
memory/3508-106-0x000000000A470000-0x000000000A504000-memory.dmp

Filesize
592KB

Download
memory/3508-107-0x000000000A400000-0x000000000A422000-memory.dmp

Filesize
136KB

Download
memory/3508-135-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/3508-24-0x0000000073C10000-0x00000000742FE000-memory.dmp

Filesize
6.9MB

Download
memory/3508-31-0x0000000007980000-0x0000000007FA8000-memory.dmp

Filesize
6.2MB

Download
memory/3508-32-0x0000000007340000-0x0000000007350000-memory.dmp

Filesize
64KB

Download
memory/3508-34-0x00000000078A0000-0x00000000078C2000-memory.dmp

Filesize
136KB

Download
memory/3508-35-0x0000000007830000-0x0000000007896000-memory.dmp

Filesize
408KB

Download
memory/3508-62-0x0000000009B60000-0x000000000A05E000-memory.dmp

Filesize
5.0MB

Download
memory/3508-42-0x0000000008890000-0x0000000008906000-memory.dmp

Filesize
472KB

Download
memory/3508-41-0x0000000008550000-0x000000000859B000-memory.dmp

Filesize
300KB

Download
memory/3508-40-0x0000000008500000-0x000000000851C000-memory.dmp

Filesize
112KB

Download
memory/3508-36-0x00000000078D0000-0x0000000007936000-memory.dmp

Filesize
408KB

Download
memory/3508-63-0x0000000009790000-0x0000000009822000-memory.dmp

Filesize
584KB

Download
memory/3876-38-0x0000000000400000-0x0000000002D21000-memory.dmp

Filesize
41.1MB

Download
memory/3876-39-0x0000000002E20000-0x0000000002F20000-memory.dmp

Filesize
1024KB

Download
memory/3876-33-0x0000000002DC0000-0x0000000002DE7000-memory.dmp

Filesize
156KB

Download
memory/3876-171-0x0000000000400000-0x0000000002D21000-memory.dmp

Filesize
41.1MB

Download
memory/3876-140-0x0000000000400000-0x0000000002D21000-memory.dmp

Filesize
41.1MB

Download
memory/3876-70-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4124-246-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4124-402-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4124-249-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/4908-227-0x0000000000400000-0x000000000048D000-memory.dmp

Filesize
564KB

Download