Analysis

  • max time kernel
    62s
  • max time network
    58s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    03-08-2021 09:57

General

  • Target

    cf474d186c9d81aa7d9ba7837754cca0.exe

  • Size

    100KB

  • MD5

    cf474d186c9d81aa7d9ba7837754cca0

  • SHA1

    caa5640f4085238c0c84a191a38d85aaaa6e42fe

  • SHA256

    3cc3678682dc887a9f5e168717967fc266e266a5fd5dfe10e210d26b7246e5c4

  • SHA512

    c2e1dba69d89ca28ac5306d57922f2ac2e90cdb0b15846bc963a472b9bf87874c0fb9ec5435091ad59fe4b6d7deec6719369bea12af3267011fcd02f0948f960

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf474d186c9d81aa7d9ba7837754cca0.exe
    "C:\Users\Admin\AppData\Local\Temp\cf474d186c9d81aa7d9ba7837754cca0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\fl.exe
      "C:\Users\Admin\AppData\Local\Temp\fl.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\Windows\system32\cmd.exe
        "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:272
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1748
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:532
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1544
        • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
          C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\fl.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:596
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1484
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
              6⤵
              • Creates scheduled task(s)
              PID:1496
          • C:\Windows\system32\services32.exe
            "C:\Windows\system32\services32.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1532
            • C:\Windows\system32\cmd.exe
              "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1472
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1172
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1168
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:948
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                7⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1540
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:552
              • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Windows\system32\services32.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1692
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
                  8⤵
                    PID:1368
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
                      9⤵
                      • Creates scheduled task(s)
                      PID:1200
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                    8⤵
                      PID:1572
                      • C:\Windows\system32\choice.exe
                        choice /C Y /N /D Y /T 3
                        9⤵
                          PID:1592
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1860
                  • C:\Windows\system32\choice.exe
                    choice /C Y /N /D Y /T 3
                    6⤵
                      PID:1804

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Scheduled Task

          1
          T1053

          Persistence

          Scheduled Task

          1
          T1053

          Privilege Escalation

          Scheduled Task

          1
          T1053

          Credential Access

          Credentials in Files

          2
          T1081

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          Collection

          Data from Local System

          2
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_44c1e24a-01dd-40db-9670-44d46939da78
            MD5

            2d5cd190b5db0620cd62e3cd6ba1dcd3

            SHA1

            ff4f229f4fbacccdf11d98c04ba756bda80aac7a

            SHA256

            ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

            SHA512

            edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_550fb772-356a-41dc-a2b0-41466d2e9d84
            MD5

            a70ee38af4bb2b5ed3eeb7cbd1a12fa3

            SHA1

            81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

            SHA256

            dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

            SHA512

            8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_911b9e5c-02af-4295-8b5e-a1a7bb3c5c94
            MD5

            faa37917b36371249ac9fcf93317bf97

            SHA1

            a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

            SHA256

            b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

            SHA512

            614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9c39af7c-08dd-4ac5-8665-34078367a77f
            MD5

            7f79b990cb5ed648f9e583fe35527aa7

            SHA1

            71b177b48c8bd745ef02c2affad79ca222da7c33

            SHA256

            080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

            SHA512

            20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ad551f14-9cc0-4b28-a63c-e5a8366d54bd
            MD5

            6f0d509e28be1af95ba237d4f43adab4

            SHA1

            c665febe79e435843553bee86a6cea731ce6c5e4

            SHA256

            f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

            SHA512

            8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f5ef41b9-57e7-49a5-9914-8fd7acb12461
            MD5

            d89968acfbd0cd60b51df04860d99896

            SHA1

            b3c29916ccb81ce98f95bbf3aa8a73de16298b29

            SHA256

            1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

            SHA512

            b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd41d6f5-71c6-4402-99b7-6ddccf3f812b
            MD5

            e5b3ba61c3cf07deda462c9b27eb4166

            SHA1

            b324dad73048be6e27467315f82b7a5c1438a1f9

            SHA256

            b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

            SHA512

            a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
            MD5

            345a0284ff93ef4ba0ce2c5ee56be139

            SHA1

            0c67e60511044cd5e5312ff08257c2cf2ce3f0b3

            SHA256

            9fd726b23a808cedf351b0527196925db7dd8d981b1b3265c78e0556f6435a5b

            SHA512

            872418ebc9a015973b38273f025b717de87360181b4336d87a3acccd2da457f9a06a01d383c65b9636b26e0e3f3a093a7722fae64aa11e7c2725121b2f271cb7

          • C:\Users\Admin\AppData\Local\Temp\fl.exe
            MD5

            1aaac4ca212b568d9aa332979c25e2fa

            SHA1

            906e80efdc5f5dbb7c6bb74ffc387d507d81991a

            SHA256

            73a353b47b07ab046af0164afa457af80c36b6899ae3c54f80052f1026538971

            SHA512

            5d15aa0215abdb73fb370c27a3e9d0ae9ed8d89ee50f5455545af991ade44a6ca6b14a86b7dc32bf88b8613c5242d2eb68bfd2656ef14ddd146142fd0fe32dd8

          • C:\Users\Admin\AppData\Local\Temp\fl.exe
            MD5

            1aaac4ca212b568d9aa332979c25e2fa

            SHA1

            906e80efdc5f5dbb7c6bb74ffc387d507d81991a

            SHA256

            73a353b47b07ab046af0164afa457af80c36b6899ae3c54f80052f1026538971

            SHA512

            5d15aa0215abdb73fb370c27a3e9d0ae9ed8d89ee50f5455545af991ade44a6ca6b14a86b7dc32bf88b8613c5242d2eb68bfd2656ef14ddd146142fd0fe32dd8

          • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
            MD5

            8dd9e89ffad7e22cd222dac53e0cd20e

            SHA1

            f9088319537f1e70a7574ce275708f84fb205916

            SHA256

            f5ccf4834701f27c83a51b9ff56605afe3619dc2aa78ae868ed1609d27eb3dca

            SHA512

            694210cfc7a4f551cef9228e8ca277e88627f65d17950675e83854f1c1588a171a6f1f59ae1666a403797ad4393c736b5e18cd71f1b90d14e34ebc49e7414fb6

          • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
            MD5

            8dd9e89ffad7e22cd222dac53e0cd20e

            SHA1

            f9088319537f1e70a7574ce275708f84fb205916

            SHA256

            f5ccf4834701f27c83a51b9ff56605afe3619dc2aa78ae868ed1609d27eb3dca

            SHA512

            694210cfc7a4f551cef9228e8ca277e88627f65d17950675e83854f1c1588a171a6f1f59ae1666a403797ad4393c736b5e18cd71f1b90d14e34ebc49e7414fb6

          • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
            MD5

            8dd9e89ffad7e22cd222dac53e0cd20e

            SHA1

            f9088319537f1e70a7574ce275708f84fb205916

            SHA256

            f5ccf4834701f27c83a51b9ff56605afe3619dc2aa78ae868ed1609d27eb3dca

            SHA512

            694210cfc7a4f551cef9228e8ca277e88627f65d17950675e83854f1c1588a171a6f1f59ae1666a403797ad4393c736b5e18cd71f1b90d14e34ebc49e7414fb6

          • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
            MD5

            8dd9e89ffad7e22cd222dac53e0cd20e

            SHA1

            f9088319537f1e70a7574ce275708f84fb205916

            SHA256

            f5ccf4834701f27c83a51b9ff56605afe3619dc2aa78ae868ed1609d27eb3dca

            SHA512

            694210cfc7a4f551cef9228e8ca277e88627f65d17950675e83854f1c1588a171a6f1f59ae1666a403797ad4393c736b5e18cd71f1b90d14e34ebc49e7414fb6

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            520fee1f14c74155d2a9d13117126d6a

            SHA1

            d811c91daca5678d952b58005571249809a4d869

            SHA256

            236c5538537ff5d53d9b72c4247d7359a07449304b11ff61a6c2dc1b880019c6

            SHA512

            7dca2cef945bb797161bfbdc876aebf0f137be0bbf8a798ae7773a01d02f802e83b113e5532e63ac5f74f7d133173dc8808e0c7f98e1f709ef239265e985e302

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            520fee1f14c74155d2a9d13117126d6a

            SHA1

            d811c91daca5678d952b58005571249809a4d869

            SHA256

            236c5538537ff5d53d9b72c4247d7359a07449304b11ff61a6c2dc1b880019c6

            SHA512

            7dca2cef945bb797161bfbdc876aebf0f137be0bbf8a798ae7773a01d02f802e83b113e5532e63ac5f74f7d133173dc8808e0c7f98e1f709ef239265e985e302

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            c2c170af88b3ad9c7ddb31e4c7661485

            SHA1

            194d44b41883371d68bf0d02407c15061975fe64

            SHA256

            f17475759e84dc0e333d28fd3bbd99b5e5f2b1144bae278c4280222bbb450548

            SHA512

            0ce6ad0be92c69782a3ccd7e73b97c7891514f0112277c73abb6beffb6394ddbcd2b027bab744c083188fa7e000afdb83b11656cd2167eec71b239a884493367

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            520fee1f14c74155d2a9d13117126d6a

            SHA1

            d811c91daca5678d952b58005571249809a4d869

            SHA256

            236c5538537ff5d53d9b72c4247d7359a07449304b11ff61a6c2dc1b880019c6

            SHA512

            7dca2cef945bb797161bfbdc876aebf0f137be0bbf8a798ae7773a01d02f802e83b113e5532e63ac5f74f7d133173dc8808e0c7f98e1f709ef239265e985e302

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            520fee1f14c74155d2a9d13117126d6a

            SHA1

            d811c91daca5678d952b58005571249809a4d869

            SHA256

            236c5538537ff5d53d9b72c4247d7359a07449304b11ff61a6c2dc1b880019c6

            SHA512

            7dca2cef945bb797161bfbdc876aebf0f137be0bbf8a798ae7773a01d02f802e83b113e5532e63ac5f74f7d133173dc8808e0c7f98e1f709ef239265e985e302

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            c2c170af88b3ad9c7ddb31e4c7661485

            SHA1

            194d44b41883371d68bf0d02407c15061975fe64

            SHA256

            f17475759e84dc0e333d28fd3bbd99b5e5f2b1144bae278c4280222bbb450548

            SHA512

            0ce6ad0be92c69782a3ccd7e73b97c7891514f0112277c73abb6beffb6394ddbcd2b027bab744c083188fa7e000afdb83b11656cd2167eec71b239a884493367

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            MD5

            c2c170af88b3ad9c7ddb31e4c7661485

            SHA1

            194d44b41883371d68bf0d02407c15061975fe64

            SHA256

            f17475759e84dc0e333d28fd3bbd99b5e5f2b1144bae278c4280222bbb450548

            SHA512

            0ce6ad0be92c69782a3ccd7e73b97c7891514f0112277c73abb6beffb6394ddbcd2b027bab744c083188fa7e000afdb83b11656cd2167eec71b239a884493367

          • C:\Windows\System32\services32.exe
            MD5

            1aaac4ca212b568d9aa332979c25e2fa

            SHA1

            906e80efdc5f5dbb7c6bb74ffc387d507d81991a

            SHA256

            73a353b47b07ab046af0164afa457af80c36b6899ae3c54f80052f1026538971

            SHA512

            5d15aa0215abdb73fb370c27a3e9d0ae9ed8d89ee50f5455545af991ade44a6ca6b14a86b7dc32bf88b8613c5242d2eb68bfd2656ef14ddd146142fd0fe32dd8

          • C:\Windows\system32\services32.exe
            MD5

            1aaac4ca212b568d9aa332979c25e2fa

            SHA1

            906e80efdc5f5dbb7c6bb74ffc387d507d81991a

            SHA256

            73a353b47b07ab046af0164afa457af80c36b6899ae3c54f80052f1026538971

            SHA512

            5d15aa0215abdb73fb370c27a3e9d0ae9ed8d89ee50f5455545af991ade44a6ca6b14a86b7dc32bf88b8613c5242d2eb68bfd2656ef14ddd146142fd0fe32dd8

          • \Users\Admin\AppData\Local\Temp\fl.exe
            MD5

            1aaac4ca212b568d9aa332979c25e2fa

            SHA1

            906e80efdc5f5dbb7c6bb74ffc387d507d81991a

            SHA256

            73a353b47b07ab046af0164afa457af80c36b6899ae3c54f80052f1026538971

            SHA512

            5d15aa0215abdb73fb370c27a3e9d0ae9ed8d89ee50f5455545af991ade44a6ca6b14a86b7dc32bf88b8613c5242d2eb68bfd2656ef14ddd146142fd0fe32dd8

          • \Users\Admin\AppData\Local\Temp\svchost32.exe
            MD5

            8dd9e89ffad7e22cd222dac53e0cd20e

            SHA1

            f9088319537f1e70a7574ce275708f84fb205916

            SHA256

            f5ccf4834701f27c83a51b9ff56605afe3619dc2aa78ae868ed1609d27eb3dca

            SHA512

            694210cfc7a4f551cef9228e8ca277e88627f65d17950675e83854f1c1588a171a6f1f59ae1666a403797ad4393c736b5e18cd71f1b90d14e34ebc49e7414fb6

          • \Users\Admin\AppData\Local\Temp\svchost32.exe
            MD5

            8dd9e89ffad7e22cd222dac53e0cd20e

            SHA1

            f9088319537f1e70a7574ce275708f84fb205916

            SHA256

            f5ccf4834701f27c83a51b9ff56605afe3619dc2aa78ae868ed1609d27eb3dca

            SHA512

            694210cfc7a4f551cef9228e8ca277e88627f65d17950675e83854f1c1588a171a6f1f59ae1666a403797ad4393c736b5e18cd71f1b90d14e34ebc49e7414fb6

          • \Windows\System32\services32.exe
            MD5

            1aaac4ca212b568d9aa332979c25e2fa

            SHA1

            906e80efdc5f5dbb7c6bb74ffc387d507d81991a

            SHA256

            73a353b47b07ab046af0164afa457af80c36b6899ae3c54f80052f1026538971

            SHA512

            5d15aa0215abdb73fb370c27a3e9d0ae9ed8d89ee50f5455545af991ade44a6ca6b14a86b7dc32bf88b8613c5242d2eb68bfd2656ef14ddd146142fd0fe32dd8

          • memory/272-76-0x000000001AD04000-0x000000001AD06000-memory.dmp
            Filesize

            8KB

          • memory/272-75-0x000000001AD00000-0x000000001AD02000-memory.dmp
            Filesize

            8KB

          • memory/272-70-0x0000000000000000-mapping.dmp
          • memory/272-71-0x000007FEFB561000-0x000007FEFB563000-memory.dmp
            Filesize

            8KB

          • memory/272-72-0x0000000001DC0000-0x0000000001DC1000-memory.dmp
            Filesize

            4KB

          • memory/272-73-0x000000001AD80000-0x000000001AD81000-memory.dmp
            Filesize

            4KB

          • memory/272-95-0x00000000025A0000-0x00000000025A1000-memory.dmp
            Filesize

            4KB

          • memory/272-94-0x0000000002590000-0x0000000002591000-memory.dmp
            Filesize

            4KB

          • memory/272-82-0x00000000026D0000-0x00000000026D1000-memory.dmp
            Filesize

            4KB

          • memory/272-79-0x0000000002560000-0x0000000002561000-memory.dmp
            Filesize

            4KB

          • memory/272-78-0x0000000002480000-0x0000000002481000-memory.dmp
            Filesize

            4KB

          • memory/272-77-0x00000000023C0000-0x00000000023C1000-memory.dmp
            Filesize

            4KB

          • memory/532-129-0x000000001AB04000-0x000000001AB06000-memory.dmp
            Filesize

            8KB

          • memory/532-128-0x000000001AB00000-0x000000001AB02000-memory.dmp
            Filesize

            8KB

          • memory/532-122-0x0000000000000000-mapping.dmp
          • memory/552-187-0x0000000000000000-mapping.dmp
          • memory/596-136-0x000000013FA30000-0x000000013FA31000-memory.dmp
            Filesize

            4KB

          • memory/596-133-0x0000000000000000-mapping.dmp
          • memory/596-139-0x000000001BE20000-0x000000001BE22000-memory.dmp
            Filesize

            8KB

          • memory/948-176-0x000000001ADF4000-0x000000001ADF6000-memory.dmp
            Filesize

            8KB

          • memory/948-175-0x000000001ADF0000-0x000000001ADF2000-memory.dmp
            Filesize

            8KB

          • memory/948-169-0x0000000000000000-mapping.dmp
          • memory/1096-69-0x0000000000000000-mapping.dmp
          • memory/1168-168-0x000000001AB14000-0x000000001AB16000-memory.dmp
            Filesize

            8KB

          • memory/1168-160-0x0000000000000000-mapping.dmp
          • memory/1168-167-0x000000001AB10000-0x000000001AB12000-memory.dmp
            Filesize

            8KB

          • memory/1172-156-0x000000001AC50000-0x000000001AC52000-memory.dmp
            Filesize

            8KB

          • memory/1172-150-0x0000000000000000-mapping.dmp
          • memory/1172-157-0x000000001AC54000-0x000000001AC56000-memory.dmp
            Filesize

            8KB

          • memory/1200-195-0x0000000000000000-mapping.dmp
          • memory/1368-194-0x0000000000000000-mapping.dmp
          • memory/1376-103-0x000000001A9A4000-0x000000001A9A6000-memory.dmp
            Filesize

            8KB

          • memory/1376-104-0x000000001A8C0000-0x000000001A8C1000-memory.dmp
            Filesize

            4KB

          • memory/1376-99-0x00000000022F0000-0x00000000022F1000-memory.dmp
            Filesize

            4KB

          • memory/1376-100-0x000000001ABD0000-0x000000001ABD1000-memory.dmp
            Filesize

            4KB

          • memory/1376-96-0x0000000000000000-mapping.dmp
          • memory/1376-101-0x00000000025A0000-0x00000000025A1000-memory.dmp
            Filesize

            4KB

          • memory/1376-102-0x000000001A9A0000-0x000000001A9A2000-memory.dmp
            Filesize

            8KB

          • memory/1472-148-0x0000000000000000-mapping.dmp
          • memory/1484-138-0x0000000000000000-mapping.dmp
          • memory/1496-140-0x0000000000000000-mapping.dmp
          • memory/1532-142-0x0000000000000000-mapping.dmp
          • memory/1532-155-0x000000001BCD0000-0x000000001BCD2000-memory.dmp
            Filesize

            8KB

          • memory/1532-146-0x000000013F2A0000-0x000000013F2A1000-memory.dmp
            Filesize

            4KB

          • memory/1540-185-0x000000001AD44000-0x000000001AD46000-memory.dmp
            Filesize

            8KB

          • memory/1540-184-0x000000001AD40000-0x000000001AD42000-memory.dmp
            Filesize

            8KB

          • memory/1540-178-0x0000000000000000-mapping.dmp
          • memory/1544-131-0x0000000000000000-mapping.dmp
          • memory/1572-196-0x0000000000000000-mapping.dmp
          • memory/1584-67-0x000000013F020000-0x000000013F021000-memory.dmp
            Filesize

            4KB

          • memory/1584-74-0x000000001B510000-0x000000001B512000-memory.dmp
            Filesize

            8KB

          • memory/1584-64-0x0000000000000000-mapping.dmp
          • memory/1592-197-0x0000000000000000-mapping.dmp
          • memory/1636-62-0x00000000005D0000-0x00000000005D1000-memory.dmp
            Filesize

            4KB

          • memory/1636-60-0x0000000000890000-0x0000000000891000-memory.dmp
            Filesize

            4KB

          • memory/1692-189-0x0000000000000000-mapping.dmp
          • memory/1692-198-0x000000001ACB0000-0x000000001ACB2000-memory.dmp
            Filesize

            8KB

          • memory/1748-113-0x0000000000000000-mapping.dmp
          • memory/1748-119-0x0000000002460000-0x0000000002462000-memory.dmp
            Filesize

            8KB

          • memory/1748-120-0x0000000002464000-0x0000000002466000-memory.dmp
            Filesize

            8KB

          • memory/1804-149-0x0000000000000000-mapping.dmp
          • memory/1860-145-0x0000000000000000-mapping.dmp