meduza | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Resubmissions

09/04/2024, 08:32

240409-kfg77aaf8510

09/04/2024, 08:32

09/04/2024, 08:32

09/04/2024, 08:32

11/03/2024, 08:03

10/03/2024, 15:15

Analysis

max time kernel
140s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
09/04/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FUCKER.exe
Size 10KB
Sample240409-kffpcsaf79
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meduza purelogstealer quasar redline risepro stealc zgrat kz1 collection discovery evasion infostealer persistence pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

77.232.132.25:4999

Mutex

8892f097-602a-41ca-8df2-0bf3fd113bd2

Attributes

encryption_key
790BD6D1C1540AE1BFB811F2DC1E0185525C5DCB
install_name
LestaClient.exe
log_directory
LestaLogs
reconnect_delay
3000
startup_key
Lesta Game Center
subdirectory
Lesta

Signatures

Detect ZGRat V1 20 IoCs

resource	yara_rule
behavioral2/memory/2352-359-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-360-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-362-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-364-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-366-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-368-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-374-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-376-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-378-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-380-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-382-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-384-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-386-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-388-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-390-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-392-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-394-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-396-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-401-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1
behavioral2/memory/2352-407-0x0000000006C50000-0x0000000006F00000-memory.dmp	family_zgrat_v1

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ac0f-281.dat	family_meduza

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe RVHOST.exe"	Wattyl.exe

PureLog Stealer
PureLog Stealer is an infostealer written in C#.
stealer purelogstealer

PureLog Stealer payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ac20-340.dat	family_purelog_stealer

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000001abfd-195.dat	family_quasar
behavioral2/memory/1500-197-0x0000000000840000-0x0000000000B64000-memory.dmp	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ac1b-310.dat	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
13	3508	powershell.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Wattyl.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3640	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	servicedrive.exe

Executes dropped EXE 18 IoCs

pid	Process
216	EchoNavigator.exe
3876	syncUpd.exe
3232	EGCBAFCFIJ.exe
4884	kb^fr_ouverture.exe
1500	control.exe
1300	random.exe
4908	Wattyl.exe
4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
688	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
4244	servicedrive.exe
4532	288c47bbc1871b439df19ff4df68f00076.exe
1048	ISetup4.exe
3960	288c47bbc1871b439df19ff4df68f076.exe
68	TeamFour.exe
4168	ModelingTextbooks.exe
2296	Nvokcuobkn.exe
2352	cmon.exe
3928	boomlumma.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Wine	random.exe

Loads dropped DLL 2 IoCs

pid	Process
3876	syncUpd.exe
3876	syncUpd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\RVHOST.exe"	Wattyl.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	Wattyl.exe
File opened (read-only)	\??\i:	Wattyl.exe
File opened (read-only)	\??\k:	Wattyl.exe
File opened (read-only)	\??\q:	Wattyl.exe
File opened (read-only)	\??\t:	Wattyl.exe
File opened (read-only)	\??\b:	Wattyl.exe
File opened (read-only)	\??\g:	Wattyl.exe
File opened (read-only)	\??\w:	Wattyl.exe
File opened (read-only)	\??\x:	Wattyl.exe
File opened (read-only)	\??\a:	Wattyl.exe
File opened (read-only)	\??\l:	Wattyl.exe
File opened (read-only)	\??\m:	Wattyl.exe
File opened (read-only)	\??\n:	Wattyl.exe
File opened (read-only)	\??\u:	Wattyl.exe
File opened (read-only)	\??\s:	Wattyl.exe
File opened (read-only)	\??\v:	Wattyl.exe
File opened (read-only)	\??\y:	Wattyl.exe
File opened (read-only)	\??\e:	Wattyl.exe
File opened (read-only)	\??\j:	Wattyl.exe
File opened (read-only)	\??\o:	Wattyl.exe
File opened (read-only)	\??\p:	Wattyl.exe
File opened (read-only)	\??\r:	Wattyl.exe
File opened (read-only)	\??\z:	Wattyl.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs

Web Service

T1102

flow	ioc
123	raw.githubusercontent.com
265	raw.githubusercontent.com
266	raw.githubusercontent.com
203	bitbucket.org
131	raw.githubusercontent.com
132	raw.githubusercontent.com
136	raw.githubusercontent.com
141	raw.githubusercontent.com
143	raw.githubusercontent.com
159	raw.githubusercontent.com
202	bitbucket.org
211	raw.githubusercontent.com
217	raw.githubusercontent.com
263	raw.githubusercontent.com
269	raw.githubusercontent.com
129	raw.githubusercontent.com
139	raw.githubusercontent.com
146	raw.githubusercontent.com
210	raw.githubusercontent.com
214	raw.githubusercontent.com
121	raw.githubusercontent.com
152	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
138	whoer.net
140	whoer.net
104	api.ipify.org
105	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\SysWOW64\RVHOST.exe	Wattyl.exe
File created	C:\Windows\SysWOW64\setting.ini	Wattyl.exe
File opened for modification	C:\Windows\SysWOW64\setting.ini	Wattyl.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1300	random.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3928 set thread context of 2552	3928	boomlumma.exe	114

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\RVHOST.exe	Wattyl.exe
File opened for modification	C:\Windows\RVHOST.exe	Wattyl.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1352	sc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000800000001ac2d-4265.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4296	4884	WerFault.exe	84
3144	2804	WerFault.exe	147
3088	4428	WerFault.exe	166
3560	3876	WerFault.exe	187

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	syncUpd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	syncUpd.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4888	schtasks.exe
3940	schtasks.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2136	PING.EXE
1316	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3508	powershell.exe
3508	powershell.exe
3876	syncUpd.exe
3876	syncUpd.exe
3508	powershell.exe
3876	syncUpd.exe
3876	syncUpd.exe
1300	random.exe
1300	random.exe
4908	Wattyl.exe
4908	Wattyl.exe
68	TeamFour.exe
68	TeamFour.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
4244	servicedrive.exe
4244	servicedrive.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	600	FUCKER.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: 33	4552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4552	AUDIODG.EXE
Token: SeDebugPrivilege	1500	control.exe
Token: SeDebugPrivilege	68	TeamFour.exe
Token: SeDebugPrivilege	2296	Nvokcuobkn.exe
Token: SeBackupPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeSecurityPrivilege	68	TeamFour.exe
Token: SeDebugPrivilege	2352	cmon.exe
Token: SeDebugPrivilege	5076	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1500	control.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 216	600	FUCKER.exe	74
PID 600 wrote to memory of 216	600	FUCKER.exe	74
PID 600 wrote to memory of 216	600	FUCKER.exe	74
PID 216 wrote to memory of 3508	216	EchoNavigator.exe	75
PID 216 wrote to memory of 3508	216	EchoNavigator.exe	75
PID 216 wrote to memory of 3508	216	EchoNavigator.exe	75
PID 600 wrote to memory of 3876	600	FUCKER.exe	77
PID 600 wrote to memory of 3876	600	FUCKER.exe	77
PID 600 wrote to memory of 3876	600	FUCKER.exe	77
PID 3876 wrote to memory of 2532	3876	syncUpd.exe	78
PID 3876 wrote to memory of 2532	3876	syncUpd.exe	78
PID 3876 wrote to memory of 2532	3876	syncUpd.exe	78
PID 2532 wrote to memory of 3232	2532	cmd.exe	80
PID 2532 wrote to memory of 3232	2532	cmd.exe	80
PID 2532 wrote to memory of 3232	2532	cmd.exe	80
PID 3232 wrote to memory of 4260	3232	EGCBAFCFIJ.exe	81
PID 3232 wrote to memory of 4260	3232	EGCBAFCFIJ.exe	81
PID 3232 wrote to memory of 4260	3232	EGCBAFCFIJ.exe	81
PID 4260 wrote to memory of 2136	4260	cmd.exe	83
PID 4260 wrote to memory of 2136	4260	cmd.exe	83
PID 4260 wrote to memory of 2136	4260	cmd.exe	83
PID 600 wrote to memory of 4884	600	FUCKER.exe	84
PID 600 wrote to memory of 4884	600	FUCKER.exe	84
PID 600 wrote to memory of 4884	600	FUCKER.exe	84
PID 600 wrote to memory of 1500	600	FUCKER.exe	89
PID 600 wrote to memory of 1500	600	FUCKER.exe	89
PID 600 wrote to memory of 1300	600	FUCKER.exe	90
PID 600 wrote to memory of 1300	600	FUCKER.exe	90
PID 600 wrote to memory of 1300	600	FUCKER.exe	90
PID 600 wrote to memory of 4908	600	FUCKER.exe	92
PID 600 wrote to memory of 4908	600	FUCKER.exe	92
PID 600 wrote to memory of 4908	600	FUCKER.exe	92
PID 4908 wrote to memory of 2976	4908	Wattyl.exe	93
PID 4908 wrote to memory of 2976	4908	Wattyl.exe	93
PID 4908 wrote to memory of 2976	4908	Wattyl.exe	93
PID 2976 wrote to memory of 2596	2976	cmd.exe	95
PID 2976 wrote to memory of 2596	2976	cmd.exe	95
PID 2976 wrote to memory of 2596	2976	cmd.exe	95
PID 4908 wrote to memory of 3124	4908	Wattyl.exe	96
PID 4908 wrote to memory of 3124	4908	Wattyl.exe	96
PID 4908 wrote to memory of 3124	4908	Wattyl.exe	96
PID 3124 wrote to memory of 2244	3124	cmd.exe	98
PID 3124 wrote to memory of 2244	3124	cmd.exe	98
PID 3124 wrote to memory of 2244	3124	cmd.exe	98
PID 600 wrote to memory of 4124	600	FUCKER.exe	99
PID 600 wrote to memory of 4124	600	FUCKER.exe	99
PID 600 wrote to memory of 4124	600	FUCKER.exe	99
PID 4124 wrote to memory of 688	4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe	100
PID 4124 wrote to memory of 688	4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe	100
PID 4124 wrote to memory of 688	4124	%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe	100
PID 600 wrote to memory of 4244	600	FUCKER.exe	101
PID 600 wrote to memory of 4244	600	FUCKER.exe	101
PID 600 wrote to memory of 4532	600	FUCKER.exe	102
PID 600 wrote to memory of 4532	600	FUCKER.exe	102
PID 600 wrote to memory of 4532	600	FUCKER.exe	102
PID 4532 wrote to memory of 1048	4532	288c47bbc1871b439df19ff4df68f00076.exe	103
PID 4532 wrote to memory of 1048	4532	288c47bbc1871b439df19ff4df68f00076.exe	103
PID 4532 wrote to memory of 1048	4532	288c47bbc1871b439df19ff4df68f00076.exe	103
PID 4532 wrote to memory of 3960	4532	288c47bbc1871b439df19ff4df68f00076.exe	104
PID 4532 wrote to memory of 3960	4532	288c47bbc1871b439df19ff4df68f00076.exe	104
PID 4532 wrote to memory of 3960	4532	288c47bbc1871b439df19ff4df68f00076.exe	104
PID 600 wrote to memory of 68	600	FUCKER.exe	105
PID 600 wrote to memory of 68	600	FUCKER.exe	105
PID 600 wrote to memory of 4168	600	FUCKER.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	servicedrive.exe

C:\Users\Admin\AppData\Local\Temp\FUCKER.exe
"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:600
- C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -nologo -noprofile -noninteractive -executionpolicy bypass -command .\serverBrowser.ps1
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe
      "C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4260
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        6⤵
        Runs ping.exe
        
        PID:2136
- C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"
  2⤵
  - Executes dropped EXE
  PID:4884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 748
    3⤵
    - Program crash
    PID:4296
- C:\Users\Admin\AppData\Local\Temp\Files\control.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\control.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1500
- C:\Users\Admin\AppData\Local\Temp\Files\random.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
      4⤵
      PID:2244
- C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Users\Admin\AppData\Local\Temp\is-3H3I1.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-3H3I1.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp" /SL5="$90226,1495449,832512,C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe"
    3⤵
    - Executes dropped EXE
    PID:688
- C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - outlook_office_path
  - outlook_win_path
  PID:4244
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe"
    3⤵
    PID:4396
  - - C:\Windows\system32\PING.EXE
      ping 1.1.1.1 -n 1 -w 3000
      4⤵
      Runs ping.exe
      PID:1316
- C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f00076.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f00076.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
    "C:\Users\Admin\AppData\Local\Temp\ISetup4.exe"
    3⤵
    - Executes dropped EXE
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
    "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
    3⤵
    - Executes dropped EXE
    PID:3960
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
      "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
      4⤵
      PID:4752
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:368
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3960
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4588
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2388
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        
        PID:4648
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2936
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4888
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4156
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:3308
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        
        PID:4160
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3940
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:1352
- C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:68
- C:\Users\Admin\AppData\Local\Temp\Files\ModelingTextbooks.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ModelingTextbooks.exe"
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Elder Elder.bat & Elder.bat & exit
    3⤵
    PID:4404
- C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2552
- C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"
  2⤵
  PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe"
    3⤵
    PID:2920
- C:\Users\Admin\AppData\Local\Temp\Files\current.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\current.exe"
  2⤵
  PID:32
- C:\Users\Admin\AppData\Local\Temp\Files\ffffffffffbbbbb_crypted.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ffffffffffbbbbb_crypted.exe"
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 752
    3⤵
    - Program crash
    PID:3144
- C:\Users\Admin\AppData\Local\Temp\Files\dais.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\dais.exe"
  2⤵
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\Files\thost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\thost.exe"
  2⤵
  PID:3112
- C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe"
  2⤵
  PID:236
- C:\Users\Admin\AppData\Local\Temp\Files\Ljauypuypg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Ljauypuypg.exe"
  2⤵
  PID:3308
- C:\Users\Admin\AppData\Local\Temp\Files\net.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\net.exe"
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe"
  2⤵
  PID:4428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4428 -s 1260
    3⤵
    - Program crash
    PID:3088
- C:\Users\Admin\AppData\Local\Temp\Files\2-3-1_2023-12-14_13-35.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\2-3-1_2023-12-14_13-35.exe"
  2⤵
  PID:4100
- C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\abtc8mhlbehqil.exe"
  2⤵
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\Files\cry.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cry.exe"
  2⤵
  PID:3232
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1316
- C:\Users\Admin\AppData\Local\Temp\Files\Crypto.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Crypto.exe"
  2⤵
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\Files\native.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\native.exe"
  2⤵
  PID:4700
- C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"
  2⤵
  PID:2496
- C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alex12341.exe"
  2⤵
  PID:1940
- C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
  2⤵
  PID:1180
- C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe"
  2⤵
  PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\BrawlB0t.exe'
    3⤵
    PID:5944
- C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Yellow%20Pages%20Scraper.exe"
  2⤵
  PID:568
- C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\appdata.exe"
  2⤵
  PID:2684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3544
- C:\Users\Admin\AppData\Local\Temp\Files\Props.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Props.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20AH.NET.exe"
  2⤵
  PID:3876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3876 -s 1116
    3⤵
    - Program crash
    PID:3560
- C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\VLTKBacdau.exe"
  2⤵
  PID:3348
- C:\Users\Admin\AppData\Local\Temp\Files\DemagogicAlewife.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\DemagogicAlewife.exe"
  2⤵
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\Files\Nzewxakqtk.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Nzewxakqtk.exe"
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\Files\swizzyyyy.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\swizzyyyy.exe"
  2⤵
  PID:4408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5832
- C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
  2⤵
  PID:5280
- C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\cayV0Deo9jSt417.exe"
  2⤵
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
  2⤵
  PID:5640

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 87538301f3ec0d132aeb234a2f9690f711b740fb7648258dfd60db5a9868f6e5
MD5 f9c40426d3ae3c029d3decd2a245b5ff
SHA1 dbb9d2958775b077a719c8226fb4befc73e66d1e
SHA512 7be9ec0f8aba70be99ec826ee907afe955c63fb0348f5ef15655ea72d147cb1964df2a602429d0ddf32c561d1d049c115c3f0879bb37edab517414be52bf5460
MD5 SHA1 SHA512

Submit Download

288c47bbc1871b439df19ff4df68f076.exe

Path C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
Size 4.2MB
SHA256 97bb5c78c753aa5e39ffc3d4c1058f584d0241e9b19aff20a248f1f159fdca6d
MD5 43b4b9050e5b237de2d1412de8781f36
SHA1 125cd51af3ca81d4c3e517b8405b9afae92b86f2
SHA512 24e90d5a5d4a06e0d62ff2b5bc91e686f5cdb2e77fb4c31ef3b6a59f62afae9fc6642bb57576c334e46e234d10300a2814cca747cc315b52ea63b0226a6695d3
SSDEEP 98304:2Gx9Si0ntl4MS3uZTh+Cvcz2i4+MQY1LbiqI1f/5ZAaROwr:px9Si0ntC3uX+CWxMQY1XQXLes
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGCBAFCFIJ.exe

Path C:\Users\Admin\AppData\Local\Temp\EGCBAFCFIJ.exe
Size 106KB
SHA256 b64a84d1f88e4e78464a1901c1cb5bbd5f00bb73203d719e64e072157a087b53
MD5 fe380780b5c35bd6d54541791151c2be
SHA1 7fe3a583cf91474c733f85cebf3c857682e269e1
SHA512 ba05ba8aa13c4bc1cf98fbf6c08b021e8b19354098e0397fc8e1e5d3dcce367c1063203f24e50d0973193f6535681d0a43486e5dade5d112853b7a2fe8739b6c
SSDEEP 1536:lIpbrxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+UPpe5xKOcuS11Phbiyn2TCf:KpbrsISnRGPJkGt74GsISnRF
MD5 SHA1 SHA512 SSDEEP

Submit Download

serverBrowser.ps1

Path C:\Users\Admin\AppData\Local\Temp\Echo Navigator\serverBrowser.ps1
Size 125KB
SHA256 52adeb5afa0f4e92914cb7f65ba44e0283ec44dbac9dc88920850e84f5a5f1fe
MD5 581ef78d54af26c5f1e7321929ddf10e
SHA1 c368969b4aa6d7124e61229408d6362a4e84168b
SHA512 9d42f077853e97f40cdb45d99ecf7b79e6378983e22ffab65463288a0266a6807a78d6bd2af4be9136268b5eed9afbccb1b0d329f91252dcced4778d26684da4
SSDEEP 3072:Ou9LdrdhBu7y6cg4Php1UmAbAN1tJtLtEtnZnzABr:V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Elder

Path C:\Users\Admin\AppData\Local\Temp\Elder
Size 19KB
SHA256 2d14b4668f2d8baf5d7f06fe402f3b68b40bb99fffa660b2b0be289af9dfd8e4
MD5 b5d2f4e32195be913bf7bb05050616db
SHA1 aee9fcd2db09c875f7137c9b1ddd9a8de4ee1daf
SHA512 3af474495f0db89a285ab6bdd0710f9555b020160b76fa6512c81b5e08724e9e7720f56980fa6f1552c4f85e835f05eb3a0adb0f19a11cb83fad0e070f84b2b1
SSDEEP 384:WBRczTEt5lyfCOAvq75JPumuRzWeSwMDw6D8MWVC1dQDb71xKkv1cquteDG6IB/7:WBR4QvyBACfPs49C48N9xKTvB/1Tt
MD5 SHA1 SHA512 SSDEEP

Submit Download

%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.exe
Size 2.2MB
SHA256 3a6cc772d828a3581880b772e9ec2bdce35ee7204d5bbaaf8a08e278676d96dd
MD5 825d33a659673c01085a56e787a26660
SHA1 76ff37ab68882bb538ed82ead5a8cfbb209da1ef
SHA512 21050f35fb210e7fa95aea1cf3081549a512276aa1b47c2abdcbf7bbe8102376be60831a2d2abb1e2386312704decf2ce371e33f4398520ddbe7c0af5eb0caef
SSDEEP 24576:t7FUDowAyrTVE3U5Fm+bOu8qy4YLAyfb5lf1F9J9yx45uX5ZVP2OnolJDHLe5x7z:tBuZrEU/y4YHLNRUCc2q55DdN7POGjp
MD5 SHA1 SHA512 SSDEEP

Submit Download

288c47bbc1871b439df19ff4df68f00076.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\288c47bbc1871b439df19ff4df68f00076.exe
Size 4.7MB
SHA256 e70dcf3f915087251224a7db3850669c000a6da68ef2b55e3e2eda196cb01fc3
MD5 ba354d029f0e09cb6b02a4c196524da4
SHA1 d8a3c4115cc46bc9a7b5216232c87d1a6471f09d
SHA512 d27e3f6045f2915ed692d36f4152fc4dd7d1e6029e254d8e4fe4ce1d9dc5db8c6cb98cd7fab4c5762d6d2ad4c61dc5179486e70ebca5ce29ac5fc895daba4aed
SSDEEP 98304:GkYNNP4ya1yMLo/NDRhzEdPPi2HuzH/zVhRpfR7pIy/unY5p8riqnzQ2ye:GkYN6yacM8/bhzEZDYHhhz57Gy/sQi02
MD5 SHA1 SHA512 SSDEEP

Submit Download

EchoNavigator.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\EchoNavigator.exe
Size 9.3MB
SHA256 be569b1dc8758a791c81d7a4d9d653018e02f1206bc6e18d246a9d4dade25d39
MD5 5df01f9e45f5e3c30a3534a4be701aed
SHA1 2260bda07a9f49da7cf8fd79a8c9f3ed1e823cff
SHA512 e20fd9ce0deecb9f0e3c98b590dc0d10f720dcd541c97360cac807efcdea50ee9fec0e40ab3660ca90e0492664d2c12ab9f7ccf56eaedad7f19e253fb3bc1d9b
SSDEEP 196608:wFmQkGPZk0udm3FgqNXfBEtJvinmABYLp02ajL:Vhm3FgqNCLGm4YLp02
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModelingTextbooks.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ModelingTextbooks.exe
Size 797KB
SHA256 1e71bcb4133949eaa1bead27b4e01f03f7802c6b92f61acbb6b8d7c8faf419d7
MD5 bd15134c5a5187705599dc5958855753
SHA1 9782f2d27bc52bc0210c26106a78ded7fa98f5e1
SHA512 cc5fe526fecfc87cd04110f72c8e26bae786494e0ee7a29a7d241d83f6eb3ee189a85ec05b436c1a2f927ebff185c52737745b9cf04c22afec67a7d24ab386a9
SSDEEP 24576:4bXDnGdlsOnEcSDuGm2shUlWRJ68DU3fkW+NebDEQ3rqzoB13n2u:yzGlsOEvDuGmHIWrDU3f9MWJmzo/2u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nvokcuobkn.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Nvokcuobkn.exe
Size 51KB
SHA256 6570e239d47518afaf8baeed1da31b475ec07ee1256e85bd0318d397f40d4e5c
MD5 8647ffb0d889ea1933f7a4e7771094c0
SHA1 5c20b6cf56287c18566e50b0249e6cd9285f3ca3
SHA512 26c47cf2ceb3a6e7d3d3b7f7d8934d6d769d31d9d279479a141df6ae2057e8b2644e12a225f56e5306529133e1a793b9500e5633732ef586464ea2c8fd43957c
SSDEEP 768:ibNdv/q2bAXYN+/sHyIoY1Dufiy1SSP4+acdU9/nKPUTV4A5Ynn8w/Ayfmxx:i+7+1DZy1LfaF/nEUitnn8gAyfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

TeamFour.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\TeamFour.exe
Size 541KB
SHA256 f63bdc068c453e7e22740681a0c280d02745807b1695ce86e5067069beca533e
MD5 3b069f3dd741e4360f26cb27cb10320a
SHA1 6a9503aaf1e297f2696482ddf1bd4605a8710101
SHA512 bda58c074f7bd5171d7e3188a48cbdc457607ff06045e64a9e8e33fcb6f66f941d75a7bf57eb0ef262491622b4a9936342384237fa61c1add3365d5006c6d0d9
SSDEEP 12288:q5aw1dGYJeEVZjYGcN3CNIb88WsNMP5F1k:qLVRYGW3CNIb88WsNMhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

User%20OOBE%20Broker.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\User%20OOBE%20Broker.exe
Size 16.5MB
SHA256 8487b7cbcc6331ce5da7a3f19229813c10801285ed30a8d82e81bf19b1ec385a
MD5 21f57e534a0adc7765d6eeb22ec5bd74
SHA1 43baaefa89366a2ab42e1ad30fdffcebeb81d00a
SHA512 18bc9254f1d15dee4863be12ae862cd46c5c341ef72601500eab1d99d4ed38a34cff33587940f58885f327f8408644c5deb5c86dd274ffec3e0dcf69d1b8a83a
SSDEEP 393216:+Y2ayszf490yDfD608r6a0S6MpfaMPANgA5esmAl5VNR:+Y2dszfm0ybG08r6I6uf9PAPNmArR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Wattyl.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
Size 477KB
SHA256 2919b157d8d2161bf56a17af0efc171d8e2c3c233284cf116e8c968dd9704572
MD5 34e03669773d47d0d8f01be78ae484e4
SHA1 4b0a7e2af2c28ae191737ba07632ed354d35c978
SHA512 8d93fab3c2544d015af2d84f07d3ebbf8acead8bb0185ffb045302b2be19ac12cd2ac59288313bd75bc230768c90e68139c124ea89df943776b1cfaac4876a7f
SSDEEP 6144:ZvZ2iKiZ/QAKVfiROzkViZwc0W/1vNuMqTp/CelAaWjSZ/nnnKCXP7:J7wVfiRuqPW/dgMqIHdjSFnnKCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

boomlumma.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\boomlumma.exe
Size 351KB
SHA256 9550addd57ac80afc9a177a5e7c9e961892d96593296bac79ec7a6ea65cc12d9
MD5 059e591f9dda7d3ee0de23f64d791cb1
SHA1 55e1be730e1426d00354e994f3596764d40634a6
SHA512 c67663ee4b68cdee2d834b9ef8e29af6e39926c547efbe02568adb7eb5e37c6a933205592888b0716936635a9e6e60673f12599778a5196e5fdafcfb262af629
SSDEEP 6144:m2MvkA3qTWHeffgUEmNkJykFilk8pU4uMChoZH8lqtfUiNn7Lp15:3MvlaThgUEmWJz8VuM8yH8IsiNnHn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmon.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\cmon.exe
Size 2.7MB
SHA256 9df4aaa956d54f55f1bb038f3e8f086169983e094ef8432cd71df928a888a2d0
MD5 2bae8753475af921d7258f9b1e9fccd4
SHA1 0da0ad8fbea157d468e4ccbf66575808103246f7
SHA512 0a346f1dc1771f4e049d04eda7bfc021120cf3797011f89b3a6e2b5ad2fb6bb88d6218d8c6383d8a98bc9eaef2797a01632e7a2526005b04a5000c2889cdd12d
SSDEEP 49152:o4nuoTrSxDgQN5Ba42jktyxfc5X8f5XzFNQGIewQFsliT+KE6D:o3oT+t5Ba4HtyxUl8f5XzF51OqW6D
MD5 SHA1 SHA512 SSDEEP

Submit Download

control.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\control.exe
Size 3.1MB
SHA256 50684cb3400e3cd4959c2ccd2dd900a157ef3163179adcf8da15ed5b7b41694b
MD5 7b9d9f41d274ddd8fac0544e188ade4a
SHA1 20050de536fbf27cdbfbdd0671af913e04106363
SHA512 c102873fa15ffd776ab17b16cd39d6ac95c8412dc8c4a0c8c28e1579dd0d03f9fa4f4985d419a76cd4853c5769ea4e95a24c4c1a9c61c98b7508d97c13b345af
SSDEEP 49152:zv2I22SsaNYfdPBldt698dBcjHXaRJ6qbR3LoGd1THHB72eh2NT:zvb22SsaNYfdPBldt6+dBcjHXaRJ6E
MD5 SHA1 SHA512 SSDEEP

Submit Download

kb^fr_ouverture.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
Size 11KB
SHA256 693fbe27170b14efde45d627cf3e0af36143762d2ef70a52a8402f121f6d6ae4
MD5 2a872ae7aa325dab4fd6f4d2a0a4fa21
SHA1 f55588b089b75606b03415c9d887e1bdbb55a0a0
SHA512 fa88a7540f6fea6d487ebc29a8a83cb8e1e2e1d94b5343b0b9aba45741bd3ab5f66b86dbe549eceafaa922a70c360b0ade8d72b22a9fc6bd31a94b8d416ec5e7
SSDEEP 192:02n48OF4EuQgIsH7nG9FTqdlO85kbiACYT3xZrk2yVQm3Z+UBzoLKbJP:0jacgXH7nGP0U2toDxZo2QQ0Z+UBz0KR
MD5 SHA1 SHA512 SSDEEP

Submit Download

native.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\native.exe
Size 5.3MB
SHA256 432747c04ab478a654328867d7ca806b52fedf1572c74712fa8b7c0edb71df67
MD5 de08b70c1b36bce2c90a34b9e5e61f09
SHA1 1628635f073c61ad744d406a16d46dfac871c9c2
SHA512 18a30e480ce7d122cfad5a99570042e3bef9e1f9feda1f7be32b273a7248274285c65ac997c90d3d6a950a37b4ea62e6b928bfefc924187c90e32ea571bfd1f5
SSDEEP 98304:/+p+LLypykV4RJGIfsv7RynHr/x1leOzcv0nbzKIKFStIJ:/+pMLCYJ/svlUr/x1vzcvib+Ir
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\random.exe
Size 2.2MB
SHA256 e696fceb57c0eb026917377129e99e53cb1a7be745eb7dd51a3fa58ca5b3fb2f
MD5 c4c25694f502a6ebeee98c85731126d4
SHA1 3596c6d1b06114a9fb29206499af878307446cc5
SHA512 81877d8132d953cb0d247f4b5e917d84d4791bec3b4c68d25934be3feff8f2f8cc645bf139f9303776b5b6236439ffe72d72840216fe68cdbe40c0a0e2671ac2
SSDEEP 49152:is9NRR5MmyC8+CAXAj8d1ccouZ1pKComn0F8raItS0mDGvlX:iQNRG3WAjyAuZ1kCYFTmqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

servicedrive.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\servicedrive.exe
Size 1.5MB
SHA256 2ab767ed95da57611db4f66990f750d981fdabce02b606e6910e2690a2b5acef
MD5 0842c1a1d5fe5c7cc934fc5021b0885b
SHA1 057cc72a78d78b126fe0fc5f05498ceb9b7da2c6
SHA512 d0d5eae46c621e752b4ffc59aff24b70d6229ddf30239def128ce62a7f77c0e223591dc4a4a8abb84630c7905851dfdcc7b644e45c06991674d287ec98ebae4d
SSDEEP 24576:Gjsuba3nkq2xRgjzn9ZrpN9lzCUDmsXUwl2QQGTZMpf1aHC8Pu2:Fuba3nkq2xq3n9ZrrzvmsXbsRNSu2
MD5 SHA1 SHA512 SSDEEP

Submit Download

syncUpd.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
Size 272KB
SHA256 cf995f855bb296ca2744bf6fbf0e9d01009dcf580c98324a2424893394447e4e
MD5 f46eb7b82a0ee6ffbd0a48dd120f0802
SHA1 3241e2cb73acf8c80c12af2864d59ad0a24acc3d
SHA512 c2135243ed4b6d516891c81ac7b29914aa42bdd3a34e7902c3c6c072352063a2012c151dcc9a134b344a9c311c3d6857e03bd566d7b79f7baa280ce83c725e02
SSDEEP 3072:heJgTqtrMvFe0Ck+iqBk77vettSKzGYmgSdHvnUZzLCr9q3kywzYbg4pSNK0gc6Y:45cQjipgOHvuzLu9Qk8cG0aJ9zwzYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISetup4.exe

Path C:\Users\Admin\AppData\Local\Temp\ISetup4.exe
Size 464KB
SHA256 2899d533753918409ab910b70ba92f8740f76c8e8ac74f4c890e53b258e3bff6
MD5 44f814be76122897ef325f8938f8e4cf
SHA1 5f338e940d1ee1fa89523d13a0b289912e396d23
SHA512 daeb1a81dd4fe1578502d0c681c7e723273d06297c2fad7aeb74b1a06cd05f72a418af9571c82188525af329b3fef9785d588f1416d6ccf45ab58b589d8f0d79
SSDEEP 6144:v4GSq0VRginLsGLz5yrjKaXHdabTqXkcappfbOEOd8hp:AGS7/gubeJXHIPq0cepzOOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI14602\base_library.zip
Size 1.7MB
SHA256 eb71c75ad9fa6aba6e8b793948a96029a190b612bb289c780621757d90c08577
MD5 c02b1b28775aa757d008b2b0e52a4943
SHA1 f5c12fa0eddb3a4127bd0866714bdcf10a7abead
SHA512 58ae35c802ef81da05e9aeef0f16e9b27d6391e9dffb8aa77ea8406497201766d9fd7834d40a167485f452f57b51066988afc344c733129d1e4fad78b8dcf1c5
SSDEEP 24576:mQR5pATtFRm4lUKdcubgAnyfbJs0iwhrMSdYfdPXs83Ty7dma0uHHP:mQR5p+Rm1GL+7gan
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI14602\python3.DLL
Size 65KB
SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
MD5 7442c154565f1956d409092ede9cc310
SHA1 c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA512 2bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844
SSDEEP 768:pw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJSA:W/5k8cnzeJSNImL0P7SyiPx6
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_aeakwjsk.mqd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aeakwjsk.mqd.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3H3I1.tmp\%E5%88%9D%E5%A6%86%E5%8A%A9%E6%89%8B.tmp
Size 3.0MB
SHA256 033382ec20598a624f624aa427168b1415786fe1d4e6848ed579e5728e7f67be
MD5 25a216e64ef305c97444182fb2440316
SHA1 5b2d808def3398b73d0085b6a4a7ceccf960b014
SHA512 713218496b28ff397ec6ea908a99318040672fcfcd10637918dfc3ca85ef6fd591e67599aa24095a23278fde795dbcee022fa27f73a58ee192d615be65541f42
SSDEEP 49152:6dx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TY:LHDYsqiPRhINnq95FoHVBT333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
MD5 db01a2c1c7e70b2b038edf8ad5ad9826
SHA1 540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA512 c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 41KB
SHA256 03f4d293b34e18f429d34282179a04a705d448f3b88b88982486997f6cd51f39
MD5 0f38a17bbaa7b6f75f51c671be981097
SHA1 ee95e5225cfb623b6ddd58902bf72504993e2030
SHA512 429100ae213ea857fa3fefea7b512bb616219f76cf2a55a4735776650806d42582ff886cd4779a1406d2bc9d0f514c93e40c3d12d9e764ffa8b880067bd704a2
SSDEEP 768:u+/3hFJ+z302oV3IpNBQkj2Fh4iUx/aVgfrRJv5FSvV4c3EyO0LyOdBJzztAHk4y:Rh+z302oV3CNBQkj2Fh4iUx/aVgflJnU
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 fc636b5481df443931ce2b815ad291b673081834c98660e7ac836bf87edcf154
MD5 6990a376736feafb4de6bcaf112d2b80
SHA1 324a2f51351beb01b6157e57f5dcfe75a49bc134
SHA512 744e85aedec1b86e2da44e41f3ec89744710101f5f2f1cf9db511d12e5af2cb7f917f6bb4a055d54346c22e06f95ea487abfe80cfad1009169da392fd3ee40d7
SSDEEP 384:gAbla7LefegYkeIAQf+UGH6P44o01zx7SHcftlodBPJgSO+w8KRcYL0D8:/Ufef5Y9PHTa/7SH4HoLJT/jKRFY4
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 18KB
SHA256 bd43410c1abb46d9528e258746fc37bd2b37bcb05d4026253a51674b1d60772c
MD5 15980c8fba2997a8d6c3551f92217600
SHA1 a4374969850e1089a1cc6f264a92fbf6b36a9c3f
SHA512 7e7e5f97e6773c1e4a91f5f4b1c951ac940dcf70d2112e61adb36ff2b1de2a6f452f5ad422cd523e3091b5827dc599b40ab2f7b0c50905f4d66e157802d4db07
SSDEEP 384:YAbxPWw3agoteNzAasfiuAhVKASR4MBiIGUNJodB0CVMB2GQ4n7L4GeSJya:fNH9/NEa62BlMB3Vbow2urt
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 17KB
SHA256 6a8a464af76e40fb8ff67eafc7849ba67dc0e9099524a6ed7d3264b7aa1602cb
MD5 ba6b6d39b4bab98af8cf84b6a3ffb075
SHA1 0e570b8acf4446f146e47050f96bd1ba3dbe1d5e
SHA512 69d39b9980bd73a3caab579b700ac3c2464c5480135a335948025982b72f3da83983f3411ff568fc43c7e2f5f2f15f291371cdfe3b60d6d182f7457a21042688
SSDEEP 384:f2bTxha7hrX3ySilESSilAN2MHegKAiVRUMgIOUNJZhB0CKudr0Wf:ePSdrXi333lyeIRMZdbZIe4i
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 17KB
SHA256 9d4f81b99cc58e3982506016c0bec57e6a52accf73ee94abe1813d5a74642f50
MD5 95a4eda49d88cf21d18e73361666fb8e
SHA1 c53178d492c1670098773e59b2cdc256ce5c0cf0
SHA512 7113d095a846315873fbfd9b6cb4758d08be03656c4942f79148de3a834213de8f66996412aa603342f4d032351260c27e666546a2dbcd618ac38be9a67ff281
SSDEEP 384:VATx/a7zZXvuwfTdAf4TEVVKASR4MgIGUNJodBLBuGOGFuGvSzya:2UPF24Gf4+BlMZVboW/
MD5 SHA1 SHA512 SSDEEP

Submit Download

setting.ini

Path C:\Windows\SysWOW64\setting.ini
Size 141KB
SHA256 11e415ef1484c25ac6fea93c8f13d1429a0061a8ca692d0697afe01211f2ab35
MD5 e7cfc403f37bbe1ef81cef47bc01036d
SHA1 672a8711a1d6dc6ab38b48d88f3f2a671c3f378a
SHA512 7a06890aedd7a4cb7df4f8b411ac0eeb03cceb8faea2084575a265c76cf7377ba6f17af494fe9035c97a211528ddb2fa02ed28f6d277d59928ab571893a2da9b
SSDEEP 3072:gaS0lefmsoe9hKyPpRRnxKZ9f7G/4ZdqxwR/wHHVc2/:gaS0leff9hKyPp7nxS9f7G/4ZdqxwR/K
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path \Users\Admin\AppData\Local\Temp\_MEI14602\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path \Users\Admin\AppData\Local\Temp\_MEI14602\_ctypes.pyd
Size 120KB
SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
MD5 9b344f8d7ce5b57e397a475847cc5f66
SHA1 aff1ccc2608da022ecc8d0aba65d304fe74cdf71
SHA512 2b0d9e1b550bf108fa842324ab26555f2a224aefff517fdb16df85693e05adaf0d77ebe49382848f1ec68dc9b5ae75027a62c33721e42a1566274d1a2b1baa41
SSDEEP 3072:+7u5LnIx1If3yJdXfLIOAYX5BO8NImLPcPZx:+wxfijXfLIO9BO8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path \Users\Admin\AppData\Local\Temp\_MEI14602\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path \Users\Admin\AppData\Local\Temp\_MEI14602\python311.dll
Size 5.5MB
SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
MD5 e2bd5ae53427f193b42d64b8e9bf1943
SHA1 7c317aad8e2b24c08d3b8b3fba16dd537411727f
SHA512 ae23a6707e539c619fd5c5b4fc6e4734edc91f89ebe024d25ff2a70168da6105ac0bd47cf6bf3715af6411963caf0acbb4632464e1619ca6361abf53adfe7036
SSDEEP 98304:AtcGVQE2EKmLX3N1fn/q+VHzMzDPFE+syIqPzlJ0:AtcGVQE2XmLX3ffGzJENyIqH0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/216-11-0x0000000001DF0000-0x0000000001DFA000-memory.dmp

Download

memory/216-20-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/216-9-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/216-10-0x0000000000BD0000-0x0000000001518000-memory.dmp

Download

memory/216-13-0x0000000005CA0000-0x0000000005CB2000-memory.dmp

Download

memory/216-139-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/600-1-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/600-0-0x0000000000ED0000-0x0000000000ED8000-memory.dmp

Download

memory/600-116-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/600-141-0x0000000003100000-0x0000000003110000-memory.dmp

Download

memory/600-3-0x0000000003100000-0x0000000003110000-memory.dmp

Download

memory/600-2-0x0000000005880000-0x000000000591C000-memory.dmp

Download

memory/688-405-0x0000000000400000-0x000000000071B000-memory.dmp

Download

memory/1048-321-0x0000000000400000-0x0000000002D72000-memory.dmp

Download

memory/1300-211-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/1300-216-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/1300-222-0x0000000004FD0000-0x0000000004FD2000-memory.dmp

Download

memory/1300-221-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/1300-220-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Download

memory/1300-218-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download

memory/1300-219-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/1300-217-0x0000000004F60000-0x0000000004F61000-memory.dmp

Download

memory/1300-209-0x0000000000800000-0x0000000000D9A000-memory.dmp

Download

memory/1300-210-0x0000000077A44000-0x0000000077A45000-memory.dmp

Download

memory/1300-212-0x0000000004F20000-0x0000000004F21000-memory.dmp

Download

memory/1300-342-0x0000000000800000-0x0000000000D9A000-memory.dmp

Download

memory/1300-214-0x0000000004F80000-0x0000000004F81000-memory.dmp

Download

memory/1300-213-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/1300-215-0x0000000004F10000-0x0000000004F11000-memory.dmp

Download

memory/1500-197-0x0000000000840000-0x0000000000B64000-memory.dmp

Download

memory/1500-198-0x00007FFFF2EF0000-0x00007FFFF38DC000-memory.dmp

Download

memory/1500-203-0x000000001BC80000-0x000000001BCBE000-memory.dmp

Download

memory/1500-202-0x000000001BC20000-0x000000001BC32000-memory.dmp

Download

memory/1500-201-0x000000001BCC0000-0x000000001BD72000-memory.dmp

Download

memory/1500-200-0x000000001BBB0000-0x000000001BC00000-memory.dmp

Download

memory/1500-199-0x000000001B850000-0x000000001B860000-memory.dmp

Download

memory/2352-368-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-380-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-376-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-407-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-401-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-366-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-364-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-362-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-396-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-394-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-392-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-390-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-388-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-386-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-384-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-382-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-374-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-378-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-359-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/2352-360-0x0000000006C50000-0x0000000006F00000-memory.dmp

Download

memory/3232-175-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/3232-176-0x0000000000C20000-0x0000000000C40000-memory.dmp

Download

memory/3232-177-0x0000000005520000-0x0000000005530000-memory.dmp

Download

memory/3232-180-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/3508-100-0x000000000A570000-0x000000000A732000-memory.dmp

Download

memory/3508-37-0x00000000080B0000-0x0000000008400000-memory.dmp

Download

memory/3508-68-0x000000000A8E0000-0x000000000AF58000-memory.dmp

Download

memory/3508-69-0x00000000098F0000-0x000000000990A000-memory.dmp

Download

memory/3508-71-0x0000000007340000-0x0000000007350000-memory.dmp

Download

memory/3508-30-0x0000000007340000-0x0000000007350000-memory.dmp

Download

memory/3508-29-0x0000000005050000-0x0000000005086000-memory.dmp

Download

memory/3508-101-0x000000000B490000-0x000000000B9BC000-memory.dmp

Download

memory/3508-106-0x000000000A470000-0x000000000A504000-memory.dmp

Download

memory/3508-107-0x000000000A400000-0x000000000A422000-memory.dmp

Download

memory/3508-135-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/3508-24-0x0000000073C10000-0x00000000742FE000-memory.dmp

Download

memory/3508-31-0x0000000007980000-0x0000000007FA8000-memory.dmp

Download

memory/3508-32-0x0000000007340000-0x0000000007350000-memory.dmp

Download

memory/3508-34-0x00000000078A0000-0x00000000078C2000-memory.dmp

Download

memory/3508-35-0x0000000007830000-0x0000000007896000-memory.dmp

Download

memory/3508-62-0x0000000009B60000-0x000000000A05E000-memory.dmp

Download

memory/3508-42-0x0000000008890000-0x0000000008906000-memory.dmp

Download

memory/3508-41-0x0000000008550000-0x000000000859B000-memory.dmp

Download

memory/3508-40-0x0000000008500000-0x000000000851C000-memory.dmp

Download

memory/3508-36-0x00000000078D0000-0x0000000007936000-memory.dmp

Download

memory/3508-63-0x0000000009790000-0x0000000009822000-memory.dmp

Download

memory/3876-38-0x0000000000400000-0x0000000002D21000-memory.dmp

Download

memory/3876-39-0x0000000002E20000-0x0000000002F20000-memory.dmp

Download

memory/3876-33-0x0000000002DC0000-0x0000000002DE7000-memory.dmp

Download

memory/3876-171-0x0000000000400000-0x0000000002D21000-memory.dmp

Download

memory/3876-140-0x0000000000400000-0x0000000002D21000-memory.dmp

Download

memory/3876-70-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4124-246-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4124-402-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4124-249-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/4908-227-0x0000000000400000-0x000000000048D000-memory.dmp

Download