meduza | a3c37478d879d20b7d6c392c70c0acdf0ed7ef4fba94578d9a5a9131b873831b

Analysis

max time kernel
177s
max time network
191s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
15-12-2024 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client.exe.zip
Size

9KB
MD5

781d60871b7567e08fdf43533408e09f
SHA1

ef0476c57634c04f02da0f4d762fc6f0c219119f
SHA256

a3c37478d879d20b7d6c392c70c0acdf0ed7ef4fba94578d9a5a9131b873831b
SHA512

38c640d4f9d3e64e3b088ae12bd7c75e43aaeb4448fbceec5e3d54d082254124519765f2ebf083534255f49cc0d8ce1116f509d616b114dd216de6cded977efd
SSDEEP

192:aUr8d+BYXkYvHF2UAmblJ5TcyN58iy1xknBpWQ+:aUgd8YUShAobTc+8NQp+

Score

10^/10

meduza xworm collection credential_access discovery execution pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

meduza

193.3.19.151

Attributes

anti_dbg
true
anti_vm
true
build_name
hellres
extensions
.txt; .doc; .xlsx
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Extracted

Family

xworm

Version

5.0

45.141.26.234:7000

Mutex

2XLzSYLZvUJjDK3V

Attributes

Install_directory
%ProgramData%
install_file
Java Update (32bit).exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002ac23-192.dat	family_xworm
behavioral1/memory/3172-232-0x00000000001A0000-0x00000000001B0000-memory.dmp	family_xworm

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 7 IoCs

resource	yara_rule
behavioral1/memory/2160-37-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/memory/2160-39-0x0000000140000000-0x0000000140141000-memory.dmp	family_meduza
behavioral1/files/0x001c00000002aae8-60.dat	family_meduza
behavioral1/files/0x001900000002aaef-68.dat	family_meduza
behavioral1/files/0x001900000002aaf0-77.dat	family_meduza
behavioral1/memory/452-236-0x0000000000400000-0x0000000000522000-memory.dmp	family_meduza
behavioral1/memory/452-237-0x0000000000400000-0x0000000000522000-memory.dmp	family_meduza

Meduza family
meduza
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3512	powershell.exe
4508	powershell.exe
3748	powershell.exe
452	powershell.exe

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update (32bit).lnk	x.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java Update (32bit).lnk	x.exe

Executes dropped EXE 17 IoCs

pid	Process
2304	4363463463464363463463463.exe
3996	New Text Document mod.exe
1044	frnd.exe
2160	frnd.exe
2176	hellres.exe
4808	duschno.exe
548	resp.exe
4072	AutoUpdate.exe
4428	frnd1.exe
4052	zx.exe
1096	TPB-1.exe
4724	TestExe.exe
3016	zx.exe
3172	x.exe
1600	New Text Document mod.exe
452	frnd1.exe
3704	PDFReader.exe

Loads dropped DLL 5 IoCs

pid	Process
3016	zx.exe
3016	zx.exe
3016	zx.exe
3016	zx.exe
3016	zx.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com
31	raw.githubusercontent.com
42	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
4	ip-api.com
8	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1044 set thread context of 2160	1044	frnd.exe	96
PID 4428 set thread context of 452	4428	frnd1.exe	112
PID 3704 set thread context of 3228	3704	PDFReader.exe	126

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x001900000002aaf6-108.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TPB-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frnd1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PDFReader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TestExe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	frnd1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TPB-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TPB-1.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4352	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2160	frnd.exe
2160	frnd.exe
3512	powershell.exe
3512	powershell.exe
3512	powershell.exe
1096	TPB-1.exe
1096	TPB-1.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
3748	powershell.exe
3748	powershell.exe
3748	powershell.exe
452	powershell.exe
452	powershell.exe
452	powershell.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe
3172	x.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
5000	7zFM.exe
1556	7zFM.exe
3172	x.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeRestorePrivilege	5000	7zFM.exe
Token: 35	5000	7zFM.exe
Token: SeSecurityPrivilege	5000	7zFM.exe
Token: SeRestorePrivilege	1556	7zFM.exe
Token: 35	1556	7zFM.exe
Token: SeSecurityPrivilege	1556	7zFM.exe
Token: SeRestorePrivilege	1784	7zG.exe
Token: 35	1784	7zG.exe
Token: SeSecurityPrivilege	1784	7zG.exe
Token: SeSecurityPrivilege	1784	7zG.exe
Token: SeRestorePrivilege	4384	7zG.exe
Token: 35	4384	7zG.exe
Token: SeSecurityPrivilege	4384	7zG.exe
Token: SeSecurityPrivilege	4384	7zG.exe
Token: SeDebugPrivilege	2304	4363463463464363463463463.exe
Token: SeDebugPrivilege	3996	New Text Document mod.exe
Token: SeDebugPrivilege	2160	frnd.exe
Token: SeImpersonatePrivilege	2160	frnd.exe
Token: SeDebugPrivilege	2176	hellres.exe
Token: SeImpersonatePrivilege	2176	hellres.exe
Token: SeDebugPrivilege	4808	duschno.exe
Token: SeImpersonatePrivilege	4808	duschno.exe
Token: SeDebugPrivilege	548	resp.exe
Token: SeImpersonatePrivilege	548	resp.exe
Token: SeDebugPrivilege	4428	frnd1.exe
Token: SeDebugPrivilege	3172	x.exe
Token: SeDebugPrivilege	1600	New Text Document mod.exe
Token: SeDebugPrivilege	452	frnd1.exe
Token: SeImpersonatePrivilege	452	frnd1.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	3172	x.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
5000	7zFM.exe
5000	7zFM.exe
1556	7zFM.exe
1556	7zFM.exe
1784	7zG.exe
4384	7zG.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1984	MiniSearchHost.exe
3172	x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 1044	3996	New Text Document mod.exe	95
PID 3996 wrote to memory of 1044	3996	New Text Document mod.exe	95
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 1044 wrote to memory of 2160	1044	frnd.exe	96
PID 3996 wrote to memory of 2176	3996	New Text Document mod.exe	97
PID 3996 wrote to memory of 2176	3996	New Text Document mod.exe	97
PID 3996 wrote to memory of 4808	3996	New Text Document mod.exe	98
PID 3996 wrote to memory of 4808	3996	New Text Document mod.exe	98
PID 3996 wrote to memory of 548	3996	New Text Document mod.exe	99
PID 3996 wrote to memory of 548	3996	New Text Document mod.exe	99
PID 2304 wrote to memory of 4072	2304	4363463463464363463463463.exe	100
PID 2304 wrote to memory of 4072	2304	4363463463464363463463463.exe	100
PID 2304 wrote to memory of 4072	2304	4363463463464363463463463.exe	100
PID 3996 wrote to memory of 4428	3996	New Text Document mod.exe	101
PID 3996 wrote to memory of 4428	3996	New Text Document mod.exe	101
PID 3996 wrote to memory of 4428	3996	New Text Document mod.exe	101
PID 3996 wrote to memory of 4052	3996	New Text Document mod.exe	105
PID 3996 wrote to memory of 4052	3996	New Text Document mod.exe	105
PID 3996 wrote to memory of 1096	3996	New Text Document mod.exe	106
PID 3996 wrote to memory of 1096	3996	New Text Document mod.exe	106
PID 3996 wrote to memory of 1096	3996	New Text Document mod.exe	106
PID 3996 wrote to memory of 4724	3996	New Text Document mod.exe	107
PID 3996 wrote to memory of 4724	3996	New Text Document mod.exe	107
PID 3996 wrote to memory of 4724	3996	New Text Document mod.exe	107
PID 4052 wrote to memory of 3016	4052	zx.exe	108
PID 4052 wrote to memory of 3016	4052	zx.exe	108
PID 3996 wrote to memory of 3172	3996	New Text Document mod.exe	109
PID 3996 wrote to memory of 3172	3996	New Text Document mod.exe	109
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 4428 wrote to memory of 452	4428	frnd1.exe	112
PID 3172 wrote to memory of 3512	3172	x.exe	114
PID 3172 wrote to memory of 3512	3172	x.exe	114
PID 3172 wrote to memory of 4508	3172	x.exe	116
PID 3172 wrote to memory of 4508	3172	x.exe	116
PID 3172 wrote to memory of 3748	3172	x.exe	118
PID 3172 wrote to memory of 3748	3172	x.exe	118
PID 3172 wrote to memory of 452	3172	x.exe	120
PID 3172 wrote to memory of 452	3172	x.exe	120
PID 1096 wrote to memory of 3828	1096	TPB-1.exe	122
PID 1096 wrote to memory of 3828	1096	TPB-1.exe	122
PID 1096 wrote to memory of 3828	1096	TPB-1.exe	122
PID 3828 wrote to memory of 4352	3828	cmd.exe	124
PID 3828 wrote to memory of 4352	3828	cmd.exe	124
PID 3828 wrote to memory of 4352	3828	cmd.exe	124
PID 3996 wrote to memory of 3704	3996	New Text Document mod.exe	125
PID 3996 wrote to memory of 3704	3996	New Text Document mod.exe	125
PID 3996 wrote to memory of 3704	3996	New Text Document mod.exe	125
PID 3704 wrote to memory of 3228	3704	PDFReader.exe	126

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3973800497-2716210218-310192997-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	frnd.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\client.exe.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5000

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\client.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1556

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4432

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Downloaders\" -ad -an -ai#7zMap11347:80:7zEvent9598
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1784

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Downloaders\*\" -ad -an -ai#7zMap14298:264:7zEvent4083
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4384

C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\4363463463464363463463463.exe
"C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\4363463463464363463463463.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\Files\AutoUpdate.exe
  "C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\Files\AutoUpdate.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4072

C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe
"C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd.exe
    "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2160
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\hellres.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\hellres.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\duschno.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\duschno.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\resp.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\resp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd1.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd1.exe
    "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd1.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\zx.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\zx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\zx.exe
    "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\zx.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3016
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TPB-1.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TPB-1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TPB-1.exe" & rd /s /q "C:\ProgramData\DBAI5X4OZU3E" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4352
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TestExe.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TestExe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4724
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\x.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\x.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\x.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'x.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Java Update (32bit).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Java Update (32bit).exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:452
- C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\PDFReader.exe
  "C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\PDFReader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1984

C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe
"C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
50B

MD5
0974c3368779398cd8fa96f5b7ccd8e2

SHA1
956e5a349777c14ab12c9448d2cb5ec7a720d879

SHA256
05b8751d5178cc15ca6b5d9f0b328687e86d2e2d1479bc3b984bb82fcd21f9fa

SHA512
78d80eb5cb5b4ebd4c3281fc98a7b9d785cf453a651effa8a5603ef2881ffd8272df19fd46c1bc6a41aa74f2cd1ebc224287186ade2bc054d1e9c09712950055

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\VCRUNTIME140.dll

Filesize
87KB

MD5
0e675d4a7a5b7ccd69013386793f68eb

SHA1
6e5821ddd8fea6681bda4448816f39984a33596b

SHA256
bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1

SHA512
cae69a90f92936febde67dacd6ce77647cb3b3ed82bb66463cd9047e90723f633aa2fc365489de09fecdc510be15808c183b12e6236b0893af19633f6a670e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\_ctypes.pyd

Filesize
120KB

MD5
f1e33a8f6f91c2ed93dc5049dd50d7b8

SHA1
23c583dc98aa3f6b8b108db5d90e65d3dd72e9b4

SHA256
9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4

SHA512
229896da389d78cbdf2168753ed7fcc72d8e0e62c6607a3766d6d47842c0abd519ac4f5d46607b15e7ba785280f9d27b482954e931645337a152b8a54467c6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-console-l1-1-0.dll

Filesize
19KB

MD5
b56d69079d2001c1b2af272774b53a64

SHA1
67ede1c5a71412b11847f79f5a684eabaf00de01

SHA256
f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143

SHA512
7eb8fe111dd2e1f7e308b622461eb311c2b9fc4ef44c76e1def6c524eb7281d5522af12211f1f91f651f2b678592d2997fe4cd15724f700deaff314a1737b3a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-datetime-l1-1-0.dll

Filesize
19KB

MD5
5af784f599437629deea9fe4e8eb4799

SHA1
3c891b920fd2703edd6881117ea035ced5a619f6

SHA256
7e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c

SHA512
4df58513cf52511c0d2037cdc674115d8ed5a0ed4360eb6383cc6a798a7037f3f7f2d587797223ed7797ccd476f1c503b3c16e095843f43e6b87d55ad4822d70

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-debug-l1-1-0.dll

Filesize
19KB

MD5
e1ca15cf0597c6743b3876af23a96960

SHA1
301231f7250431bd122b12ed34a8d4e8bb379457

SHA256
990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d

SHA512
7c9dacd882a0650bf2f553e9bc5647e6320a66021ac4c1adc802070fd53de4c6672a7bacfd397c51009a23b6762e85c8017895e9347a94d489d42c50fa0a1c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
19KB

MD5
8d6599d7c4897dcd0217070cca074574

SHA1
25eacaaa4c6f89945e97388796a8c85ba6fb01fb

SHA256
a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928

SHA512
e8e2e7c5bff41ccaa0f77c3cfee48dac43c11e75688f03b719cc1d716db047597a7a2ce25b561171ef259957bdcd9dd4345a0e0125db2b36f31698ba178e2248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-file-l1-1-0.dll

Filesize
22KB

MD5
642b29701907e98e2aa7d36eba7d78b8

SHA1
16f46b0e057816f3592f9c0a6671111ea2f35114

SHA256
5d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c

SHA512
1beab2b368cc595beb39b2f5a2f52d334bc42bf674b8039d334c6d399c966aff0b15876105f0a4a54fa08e021cb44907ed47d31a0af9e789eb4102b82025cf57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-file-l1-2-0.dll

Filesize
19KB

MD5
f0c73f7454a5ce6fb8e3d795fdb0235d

SHA1
acdd6c5a359421d268b28ddf19d3bcb71f36c010

SHA256
2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b

SHA512
bd6cf4e37c3e7a1a3b36f42858af1b476f69caa4ba1fd836a7e32220e5eff7ccc811c903019560844af988a7c77cc41dc6216c0c949d8e04516a537da5821a3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-file-l2-1-0.dll

Filesize
19KB

MD5
7d4d4593b478b4357446c106b64e61f8

SHA1
8a4969c9e59d7a7485c8cc5723c037b20dea5c9d

SHA256
0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801

SHA512
7bc9c473705ec98ba0c1da31c295937d97710cedefc660f6a5cb0512bae36ad23bebb2f6f14df7ce7f90ec3f817b02f577317fdd514560aab22cb0434d8e4e0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-handle-l1-1-0.dll

Filesize
19KB

MD5
7bc1b8712e266db746914db48b27ef9c

SHA1
c76eb162c23865b3f1bd7978f7979d6ba09ccb60

SHA256
f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9

SHA512
db6983f5f9c18908266dbf01ef95ebae49f88edc04a0515699ef12201ac9a50f09939b8784c75ae513105ada5b155e5330bd42d70f8c8c48fe6005513aefad2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-heap-l1-1-0.dll

Filesize
19KB

MD5
b071e761cea670d89d7ae80e016ce7e6

SHA1
c675be753dbef1624100f16674c2221a20cf07dd

SHA256
63fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e

SHA512
f2ecbdaba3516d92bd29dcce618185f1755451d95c7dbbe23f8215318f6f300a9964c93ec3ed65c5535d87be82b668e1d3025a7e325af71a05f14e15d530d35f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
19KB

MD5
1dccf27f2967601ce6666c8611317f03

SHA1
d8246df2ed9ec4a8a719fd4b1db4fd8a71ef679b

SHA256
6a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387

SHA512
70b96d69d609211f8b9e05fa510ea7d574ae8da3a6498f5c982aee71635b8a749162247055b7ba21a884bfa06c1415b68912c463f0f1b6ffb9049f3532386877

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
19KB

MD5
569a7ac3f6824a04282ff708c629a6d2

SHA1
fc0d78de1075dfd4c1024a72074d09576d4d4181

SHA256
84c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2

SHA512
e9cbff82e32540f9230cead9063acb1aceb7ccc9f3338c0b7ad10b0ac70ff5b47c15944d0dce33ea8405554aa9b75de30b26ae2ca55db159d45b6e64bc02a180

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
1d75e7b9f68c23a195d408cf02248119

SHA1
62179fc9a949d238bb221d7c2f71ba7c1680184c

SHA256
67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b

SHA512
c2ee84a9aeac34f7b51426d12f87bb35d8c3238bb26a6e14f412ea485e5bd3b8fb5b1231323d4b089cf69d8180a38ddd7fd593cc52cbdf250125ad02d66eea9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-memory-l1-1-0.dll

Filesize
19KB

MD5
623283471b12f1bdb83e25dbafaf9c16

SHA1
ecbba66f4dca89a3faa3e242e30aefac8de02153

SHA256
9ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7

SHA512
54b69ffa2c263be4ddadca62fa2867fea6148949d64c2634745db3dcbc1ba0ecf7167f02fa53efd69eaaee81d617d914f370f26ca16ee5850853f70c69e9a61f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
19KB

MD5
61f70f2d1e3f22e976053df5f3d8ecb7

SHA1
7d224b7f404cde960e6b7a1c449b41050c8e9c58

SHA256
2695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020

SHA512
1ddc568590e9954db198f102be99eabb4133b49e9f3b464f2fc7f31cc77d06d5a7132152f4b331332c42f241562ee6c7bf1c2d68e546db3f59ab47eaf83a22cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
20KB

MD5
1322690996cf4b2b7275a7950bad9856

SHA1
502e05ed81e3629ea3ed26ee84a4e7c07f663735

SHA256
5660030ee4c18b1610fb9f46e66f44d3fc1cf714ecce235525f08f627b3738d7

SHA512
7edc06bfa9e633351291b449b283659e5dd9e706dd57ade354bce3af55df4842491af27c7721b2acc6948078bdfc8e9736fec46e0641af368d419c7ed6aebd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
95612a8a419c61480b670d6767e72d09

SHA1
3b94d1745aff6aafeff87fed7f23e45473f9afc9

SHA256
6781071119d66757efa996317167904697216ad72d7c031af4337138a61258d4

SHA512
570f15c2c5aa599332dd4cfb3c90da0dd565ca9053ecf1c2c05316a7f623615dd153497e93b38df94971c8abf2e25bc1aaaf3311f1cda432f2670b32c767012a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
19KB

MD5
d6ad0f2652460f428c0e8fc40b6f6115

SHA1
1a5152871abc5cf3d4868a218de665105563775e

SHA256
4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a

SHA512
ceafeee932919bc002b111d6d67b7c249c85d30da35dfbcebd1f37db51e506ac161e4ee047ff8f7bf0d08da6a7f8b97e802224920bd058f8e790e6fa0ee48b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-profile-l1-1-0.dll

Filesize
18KB

MD5
654d95515ab099639f2739685cb35977

SHA1
9951854a5cf407051ce6cd44767bfd9bd5c4b0cc

SHA256
c4868e4cebdf86126377a45bd829d88449b4aa031c9b1c05edc47d6d395949d4

SHA512
9c9dd64a3ad1136ba62cca14fc27574faaebc3de1e371a86b83599260424a966dfd813991a5ef0b2342e0401cb99ce83cd82c19fcae73c7decdb92bac1fb58a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
19KB

MD5
e6b7681ccc718ddb69c48abe8709fdd6

SHA1
a518b705746b2c6276f56a2f1c996360b837d548

SHA256
4b532729988224fe5d98056cd94fc3e8b4ba496519f461ef5d9d0ff9d9402d4b

SHA512
89b20affaa23e674543f0f2e9b0a8b3ecd9a8a095e19d50e11c52cb205dafdbf2672892fd35b1c45f16e78ae9b61525de67dbe7673f8ca450aa8c42feeac0895

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-string-l1-1-0.dll

Filesize
19KB

MD5
bcb412464f01467f1066e94085957f42

SHA1
716c11b5d759d59dbfec116874e382d69f9a25b6

SHA256
f040b6e07935b67599ea7e32859a3e93db37ff4195b28b4451ad0d274db6330e

SHA512
79ec0c5ee21680843c8b7f22da3155b7607d5be269f8a51056cc5f060ad3a48ced3b6829117262aba1a90e692374b59ddfe92105d14179f631efc0c863bfdecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
b98598657162de8fbc1536568f1e5a4f

SHA1
f7c020220025101638fd690d86c53d895a03e53c

SHA256
f596c72be43db3a722b7c7a0fd3a4d5aea68267003986fbfd278702af88efa74

SHA512
ad5f46a3f4f6e64a5dcb85c328f1b8daefa94fc33f59922328fdcfedc04a8759f16a1a839027f74b7d7016406c20ac47569277620d6b909e09999021b669a0d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-synch-l1-2-0.dll

Filesize
19KB

MD5
b751571148923d943f828a1deb459e24

SHA1
d4160404c2aa6aeaf3492738f5a6ce476a0584a6

SHA256
b394b1142d060322048fb6a8ac6281e4576c0e37be8da772bc970f352dd22a20

SHA512
26e252ff0c01e1e398ebddcc5683a58cdd139161f2b63b65bde6c3e943e85c0820b24486859c2c597af6189de38ca7fe6fa700975be0650cb53c791cd2481c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
20KB

MD5
8aea681e0e2b9abbf73a924003247dbb

SHA1
5bafc2e0a3906723f9b12834b054e6f44d7ff49f

SHA256
286068a999fe179ee91b289360dd76e89365900b130a50e8651a9b7ece80b36d

SHA512
08c83a729036c94148d9a5cbc03647fa2adea4fba1bbb514c06f85ca804eefbf36c909cb6edc1171da8d4d5e4389e15e52571baa6987d1f1353377f509e269ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\base_library.zip

Filesize
821KB

MD5
f4981249047e4b7709801a388e2965af

SHA1
42847b581e714a407a0b73e5dab019b104ec9af2

SHA256
b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233

SHA512
e8ef3fb3c9d5ef8ae9065838b124ba4920a3a1ba2d4174269cad05c1f318bc9ff80b1c6a6c0f3493e998f0587ef59be0305bc92e009e67b82836755470bc1b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\libffi-7.dll

Filesize
32KB

MD5
4424baf6ed5340df85482fa82b857b03

SHA1
181b641bf21c810a486f855864cd4b8967c24c44

SHA256
8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79

SHA512
8adb94893ada555de2e82f006ab4d571fad8a1b16ac19ca4d2efc1065677f25d2de5c981473fabd0398f6328c1be1ebd4d36668ea67f8a5d25060f1980ee7e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\python38.dll

Filesize
4.0MB

MD5
d2a8a5e7380d5f4716016777818a32c5

SHA1
fb12f31d1d0758fe3e056875461186056121ed0c

SHA256
59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9

SHA512
ad1269d1367f587809e3fbe44af703c464a88fa3b2ae0bf2ad6544b8ed938e4265aab7e308d999e6c8297c0c85c608e3160796325286db3188a3edf040a02ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI40522\ucrtbase.dll

Filesize
1021KB

MD5
4e326feeb3ebf1e3eb21eeb224345727

SHA1
f156a272dbc6695cc170b6091ef8cd41db7ba040

SHA256
3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9

SHA512
be9420a85c82eeee685e18913a7ff152fcead72a90ddcc2bcc8ab53a4a1743ae98f49354023c0a32b3a1d919bda64b5d455f6c3a49d4842bbba4aa37c1d05d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_saeqe4yf.tse.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463.zip

Filesize
4KB

MD5
202786d1d9b71c375e6f940e6dd4828a

SHA1
7cad95faa33e92aceee3bcc809cd687bda650d74

SHA256
45930e1ff487557dd242214c1e7d07294dbedfa7bc2cf712fae46d8d6b61de76

SHA512
de81012a38c1933a82cb39f1ac5261e7af8df80c8478ed540111fe84a6f150f0595889b0e087889894187559f61e1142d7e4971d05bceb737ed06f13726e7eae

Download Submit
C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\4363463463464363463463463.exe

Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\Files\AutoUpdate.exe

Filesize
2.0MB

MD5
a46fbc93be901a82afe29942b96067dd

SHA1
89fa610d6cec3205c2662e9997c55113fbe211ae

SHA256
2d3e29c33e0de171b8f4a1c31217df92a2adb6540860ca9ae1365170f9f80aee

SHA512
228d6beaf5d1e1d60d53cd7628f9dee27e1045f7bf1aeddd464ca43e257860f94b5c66013abe13e0b55d812cd4e4c6ee080563057c14ab355ff279e2093776d3

Download Submit
C:\Users\Admin\Desktop\Downloaders\4363463463464363463463463\Files\formule1.exe

Filesize
4.9MB

MD5
3dfc0f3771ba09e7a6319984dd4cda63

SHA1
f50dbce1821a19b6bcf6b60d058588e446cfcd35

SHA256
7503ba19c10e06da4c5c75b4e306774804865225f5d49bc226fef0d6f2cb9606

SHA512
29df52f5a0b36e75f5cd986f30a81fcbb4279818d20c5e54cc7c3814cd39968e1a7eecbf9f38446e0974e45257155cb78bfff249612f579f899413f9568969a4

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse.zip

Filesize
7KB

MD5
a7b1b22096cf2b8b9a0156216871768a

SHA1
48acafe87df586a0434459b068d9323d20f904cb

SHA256
82fbb67bf03714661b75a49245c8fe42141e7b68dda3f97f765eb1f2e00a89a9

SHA512
35b3c89b18135e3aca482b376f5013557db636a332a18c4b43d34d3983e5d070a926c95e40966fafea1d54569b9e3c4ab483eaca81b015724d42db24b5f3805f

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\New Text Document mod.exe

Filesize
8KB

MD5
69994ff2f00eeca9335ccd502198e05b

SHA1
b13a15a5bea65b711b835ce8eccd2a699a99cead

SHA256
2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

SHA512
ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\PDFReader.exe

Filesize
2.5MB

MD5
ddce3b9704d1e4236548b1a458317dd0

SHA1
a48a65dbcba5a65d89688e1b4eac0deef65928c8

SHA256
972f3d714d2a17e1e4d524c97cf8a283728dc8cf8ea4f2c39bf005cfcd3e71ce

SHA512
5e99897810377570cc29f0a066d4f31e05790b10d8a479dd8e358477cc7317bccd4d67c5936edfdca5f6385bd0587ba43b626bfc919cb12330facf3fa8893e86

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TPB-1.exe

Filesize
203KB

MD5
8ba8994283713a778391d7607a039989

SHA1
86e2cc10ae3a8a7040bc5958c45e680fbdbd1c19

SHA256
5746d38d3f64fd37ad4aa158d119eec1378e6298bd105323d5ffc791b9f5e88a

SHA512
5b74b96cec6ce7424604c9903656dd8b26178b09ce76cf68cdbba2d39b28010c001c6818ac3fea9418ffa6c3a57a952c2b6afa5c53af5ca52157a940a734dee3

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\TestExe.exe

Filesize
38KB

MD5
51aa89efb23c098b10293527e469c042

SHA1
dc81102e0c1bced6e1da055dab620316959d8e2a

SHA256
780f11f112fcf055a2f9d6b12ce3750aed7720b85528a7adaf114067446f4292

SHA512
93230b7881a9141453c1c84e8f74085a150ce62ecd0acd80367cb16048cb9de67a7f99d1345602ad3ecd71fc2e159a4f17269f172dc7b60272f65d50e1b608fa

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\duschno.exe

Filesize
1.2MB

MD5
c6813da66eba357d0deaa48c2f7032b8

SHA1
6812e46c51f823ff0b0ee17bfce0af72f857af66

SHA256
1420f60f053c3ea5605239ee431e5f487245108b1c01be75d16b5246156fa178

SHA512
19391c6b12ba8f34a5faf326f8986ef8de4729d614d72bf438c6efa569b3505159ca55f580fe2a02642e5e7a0f1b38a7a9db9f0d66d67ba548d84c230183159e

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd.exe

Filesize
4.1MB

MD5
298f1cd4f1804f025564bdb392538183

SHA1
cc6cac6c7e6be5f6b00a3714c856c1155b6d7e17

SHA256
8d5fd6e273be8cea765bc75fd9af3db49e58578305cb9d08fa357709f0b7ce35

SHA512
6eead00ed3d0c5c9b829191d025095c1468697169c388dac0a1325d955737311ab7db21ddbf1dae723f13801b78d63f98ba9725ab3affffe1011cee4e71c4535

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\frnd1.exe

Filesize
4.7MB

MD5
8ceaf0f122909e63199c9f21f45e5098

SHA1
5ff6ef7983db06cd0ecf4e622db3b7a541c2a6a6

SHA256
36fbd1bed8e9cbccb8a2d0cb4530a0669faa97fac45efb44c9635e8ba1552d5e

SHA512
f56eecda400f58e9d632bac9d73fb510670c28aa6ba6ba2c422045bba567b9d33450e7dcc883a7f5ae2aa971d1751b1b31ff217d9736c3a5ca6f0a3edbf98870

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\hellres.exe

Filesize
1.2MB

MD5
2511d20918fe5495f4cec12ed8e010df

SHA1
1a1d3f5c67f93021868e9fa4682f576f482ba86e

SHA256
0ab815e72b9490ff95cc216c08aa6503d1610e052793d433732a3b28c25c5d71

SHA512
849994cd3e0aa394041f0f23908fdc2440366685c3a3035c224cf1048f7eb73f6c30ac670de72b9a276fe080e965fba3b500d0c49dab91892683377b9db90402

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\resp.exe

Filesize
1.2MB

MD5
bee040fc0caf73ee0cb2e55d4c703f22

SHA1
6bf7f1fa9dcf930190cabfba9abde2e7faab486f

SHA256
940d413dd95bc28d5c724d814f2cd1ecca005d2cb58ed28788d9c07d962d829b

SHA512
ec45afc4a8626dc813462a3c65b57a75f96233e9e66a0d9d60953fa2e29ec1a1c48c9ccf00f8f0e0ad3ff37e8c98c673c5b2309ff77475896ec57897d73551b2

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\x.exe

Filesize
40KB

MD5
f9a6811d7a9d5e06d73a68fc729ce66c

SHA1
c882143d5fde4b2e7edb5a9accb534ba17d754ef

SHA256
c583d0a367ecffa74b82b78116bbb04b7c92bed0300ed1c3adc4ef3250fbb9cc

SHA512
4dec52f0d1927306deda677fea46d103b052aaa5f7d7f49abe59a3618110ee542c2db385158a393970751fcc9687efe44a860d6330ed474c0c849369c0da56df

Download Submit
C:\Users\Admin\Desktop\Downloaders\New Text Document mod.exse\a\zx.exe

Filesize
5.6MB

MD5
bb0be25bdd2121fa0bddf6ac59d4fa8d

SHA1
c24f80b6344ecc9d6daacf5f838f0a279b146c13

SHA256
50f3af8a4b14a6e63cdc7817ecb482d7045458b43d786d580b51e8f12d762106

SHA512
6c7b69845cc483a06c68b319b87345240a2288c6183adfdbaaedcb3489af6e80247456bb31529b3981c86a05bb13ea958b1e90b012071fcc7b9267c8b54f0dab

Download Submit
C:\Users\Admin\Desktop\client.exe.bin

Filesize
8KB

MD5
fd2b2fce6727aa7532a91e73f02b163c

SHA1
dbf95b40a6f4775ef57962a23892c2d0fbb217d6

SHA256
aca87d0c29cb173fe6fcdd992ba78cc42d57f634bdba63a75dce0b2fe863570e

SHA512
4678ed262b43caf418332ec49383babcac84a1b36fafb712b373322cb0891a09048207c8d76c0fe8702c419cfadad9631317e4390aaaf5d7845dbfaadad352c8

Download Submit
memory/452-286-0x000001C22AC80000-0x000001C22ADCF000-memory.dmp

Filesize
1.3MB

Download
memory/452-236-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/452-237-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1044-33-0x00007FF725DD0000-0x00007FF725DD1000-memory.dmp

Filesize
4KB

Download
memory/1096-167-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/1096-289-0x0000000000400000-0x000000000064B000-memory.dmp

Filesize
2.3MB

Download
memory/2160-39-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2160-37-0x0000000140000000-0x0000000140141000-memory.dmp

Filesize
1.3MB

Download
memory/2304-20-0x0000000000180000-0x0000000000188000-memory.dmp

Filesize
32KB

Download
memory/2304-21-0x0000000004C50000-0x0000000004CEC000-memory.dmp

Filesize
624KB

Download
memory/3172-232-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/3228-477-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-461-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-421-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-429-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-432-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-438-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-443-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-449-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-453-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-455-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-460-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-463-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-389-0x0000000000810000-0x00000000008AA000-memory.dmp

Filesize
616KB

Download
memory/3228-407-0x0000000002E40000-0x0000000002F06000-memory.dmp

Filesize
792KB

Download
memory/3228-419-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-427-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-425-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-437-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-440-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-451-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-457-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-467-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-465-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-481-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-479-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-475-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-473-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-471-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3228-469-0x0000000002E40000-0x0000000002F00000-memory.dmp

Filesize
768KB

Download
memory/3512-256-0x00000273D7280000-0x00000273D73CF000-memory.dmp

Filesize
1.3MB

Download
memory/3512-245-0x00000273BEC90000-0x00000273BECB2000-memory.dmp

Filesize
136KB

Download
memory/3748-276-0x000001ABF1450000-0x000001ABF159F000-memory.dmp

Filesize
1.3MB

Download
memory/3996-24-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/4428-235-0x0000000001580000-0x00000000015A2000-memory.dmp

Filesize
136KB

Download
memory/4428-103-0x0000000000790000-0x0000000000C46000-memory.dmp

Filesize
4.7MB

Download
memory/4428-234-0x0000000005CF0000-0x0000000005F2A000-memory.dmp

Filesize
2.2MB

Download
memory/4508-266-0x000001FFC0580000-0x000001FFC06CF000-memory.dmp

Filesize
1.3MB

Download
memory/4724-204-0x0000000004D50000-0x0000000004DE2000-memory.dmp

Filesize
584KB

Download
memory/4724-199-0x0000000005300000-0x00000000058A6000-memory.dmp

Filesize
5.6MB

Download
memory/4724-184-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/4724-233-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

Filesize
40KB

Download