amadey | bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-en-20211208
submitted
18-12-2021 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
Size

787KB
MD5

a048419bbecd8baf3e9620c51a19dcb0
SHA1

468c3e429b559aebb2046a8f3367ea4e52e4d30a
SHA256

bc568026a968ebfed5e7fc53d59e57f36925ee31670480b466bdc4f9dc38c39b
SHA512

32facaca25a760af3ecdfabf561e50f8631a079ea7411484bd7565c64ea1f0b3f87060c05ff1d8535d77b726658f62ae098d622e7318b7d76929f67cc268f7a6

Score

10^/10

amadey mimikatz redline discovery evasion infostealer persistence spyware stealer suricata themida trojan

Malware Config

Extracted

Family

amadey

Version

3.01

exxxodusdomen.hk/f83jd823S/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-56-0x0000000000970000-0x0000000000A15000-memory.dmp	family_redline
behavioral1/memory/1900-57-0x0000000000970000-0x0000000000A15000-memory.dmp	family_redline

suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
suricata
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1900-90-0x000000006D0A0000-0x000000006D0D8000-memory.dmp	mimikatz

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

am.exeet.exek.exetkools.exetkools.exeservices32.exesihost32.exek.exeet.exeservices32.exesihost32.exetkools.exe

pid	process
1708	am.exe
1728	et.exe
1752	k.exe
1772	tkools.exe
1540	tkools.exe
1896	services32.exe
1332	sihost32.exe
1028	k.exe
752	et.exe
336	services32.exe
560	sihost32.exe
1676	tkools.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

k.exeam.exetkools.exek.exetkools.exetkools.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	k.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	am.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tkools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tkools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	k.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	k.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tkools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	am.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	k.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tkools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tkools.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tkools.exe

Loads dropped DLL 13 IoCs

Processes:

21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exeam.execmd.exeservices32.exetkools.execmd.exeservices32.exe

pid	process
1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
1708	am.exe
528	cmd.exe
1896	services32.exe
1772	tkools.exe
1772	tkools.exe
1772	tkools.exe
1772	tkools.exe
1772	tkools.exe
528	cmd.exe
336	services32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 23 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\am.exe	themida
C:\Users\Admin\AppData\Local\Temp\am.exe	themida
C:\Users\Admin\AppData\Local\Temp\am.exe	themida
behavioral1/memory/1708-102-0x0000000000E70000-0x0000000001734000-memory.dmp	themida
\Users\Admin\AppData\Local\Temp\k.exe	themida
behavioral1/memory/1708-103-0x0000000000E70000-0x0000000001734000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\k.exe	themida
\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe	themida
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe	themida
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe	themida
behavioral1/memory/1752-113-0x0000000000980000-0x0000000000981000-memory.dmp	themida
behavioral1/memory/1772-116-0x00000000011A0000-0x0000000001A64000-memory.dmp	themida
behavioral1/memory/1772-117-0x00000000011A0000-0x0000000001A64000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe	themida
behavioral1/memory/1540-146-0x00000000011A0000-0x0000000001A64000-memory.dmp	themida
behavioral1/memory/1540-147-0x00000000011A0000-0x0000000001A64000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\1000002001\k.exe	themida
\Users\Admin\AppData\Local\Temp\1000002001\k.exe	themida
\Users\Admin\AppData\Local\Temp\1000002001\k.exe	themida
\Users\Admin\AppData\Local\Temp\1000002001\k.exe	themida
\Users\Admin\AppData\Local\Temp\1000002001\k.exe	themida
behavioral1/memory/1028-182-0x0000000000A90000-0x0000000000A91000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tkools.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\k.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000002001\\k.exe"	tkools.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\et.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000010001\\et.exe"	tkools.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	tkools.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

tkools.exek.exetkools.exeam.exetkools.exek.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tkools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	k.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tkools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	am.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tkools.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	k.exe

Drops file in System32 directory 11 IoCs

Processes:

powershell.exeet.exepowershell.exepowershell.exeet.exeservices32.exepowershell.exeservices32.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\services32.exe	et.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\services32.exe	et.exe
File opened for modification	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	services32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\services32.exe	et.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	services32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exeam.exetkools.exek.exetkools.exek.exetkools.exe

pid process

1900 21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
1708 am.exe
1772 tkools.exe
1752 k.exe
1540 tkools.exe
1028 k.exe
1676 tkools.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1340 schtasks.exe
1308 schtasks.exe
1248 schtasks.exe

pid	process
1340	schtasks.exe
1308	schtasks.exe
1248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exeet.exepowershell.exepowershell.exeservices32.exepowershell.exepowershell.exeet.exepowershell.exepowershell.exeservices32.exe

pid	process
1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
1728	et.exe
1196	powershell.exe
916	powershell.exe
1896	services32.exe
1896	services32.exe
1616	powershell.exe
300	powershell.exe
752	et.exe
568	powershell.exe
868	powershell.exe
336	services32.exe
336	services32.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

k.exe

pid process

1028 k.exe

pid	process
1028	k.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exeet.exepowershell.exepowershell.exeservices32.exepowershell.exepowershell.exeet.exepowershell.exepowershell.exeservices32.exe

description	pid	process
Token: SeDebugPrivilege	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
Token: SeDebugPrivilege	1728	et.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	916	powershell.exe
Token: SeDebugPrivilege	1896	services32.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	300	powershell.exe
Token: SeDebugPrivilege	752	et.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	336	services32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exeam.exetkools.execmd.exeet.execmd.execmd.exetaskeng.execmd.exeservices32.execmd.exe

description	pid	process	target process
PID 1900 wrote to memory of 1708	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	am.exe
PID 1900 wrote to memory of 1708	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	am.exe
PID 1900 wrote to memory of 1708	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	am.exe
PID 1900 wrote to memory of 1708	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	am.exe
PID 1900 wrote to memory of 1728	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	et.exe
PID 1900 wrote to memory of 1728	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	et.exe
PID 1900 wrote to memory of 1728	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	et.exe
PID 1900 wrote to memory of 1728	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	et.exe
PID 1900 wrote to memory of 1752	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	k.exe
PID 1900 wrote to memory of 1752	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	k.exe
PID 1900 wrote to memory of 1752	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	k.exe
PID 1900 wrote to memory of 1752	1900	21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe	k.exe
PID 1708 wrote to memory of 1772	1708	am.exe	tkools.exe
PID 1708 wrote to memory of 1772	1708	am.exe	tkools.exe
PID 1708 wrote to memory of 1772	1708	am.exe	tkools.exe
PID 1708 wrote to memory of 1772	1708	am.exe	tkools.exe
PID 1772 wrote to memory of 572	1772	tkools.exe	cmd.exe
PID 1772 wrote to memory of 572	1772	tkools.exe	cmd.exe
PID 1772 wrote to memory of 572	1772	tkools.exe	cmd.exe
PID 1772 wrote to memory of 572	1772	tkools.exe	cmd.exe
PID 1772 wrote to memory of 1340	1772	tkools.exe	schtasks.exe
PID 1772 wrote to memory of 1340	1772	tkools.exe	schtasks.exe
PID 1772 wrote to memory of 1340	1772	tkools.exe	schtasks.exe
PID 1772 wrote to memory of 1340	1772	tkools.exe	schtasks.exe
PID 572 wrote to memory of 1404	572	cmd.exe	reg.exe
PID 572 wrote to memory of 1404	572	cmd.exe	reg.exe
PID 572 wrote to memory of 1404	572	cmd.exe	reg.exe
PID 572 wrote to memory of 1404	572	cmd.exe	reg.exe
PID 1728 wrote to memory of 460	1728	et.exe	cmd.exe
PID 1728 wrote to memory of 460	1728	et.exe	cmd.exe
PID 1728 wrote to memory of 460	1728	et.exe	cmd.exe
PID 460 wrote to memory of 1196	460	cmd.exe	powershell.exe
PID 460 wrote to memory of 1196	460	cmd.exe	powershell.exe
PID 460 wrote to memory of 1196	460	cmd.exe	powershell.exe
PID 1728 wrote to memory of 1564	1728	et.exe	cmd.exe
PID 1728 wrote to memory of 1564	1728	et.exe	cmd.exe
PID 1728 wrote to memory of 1564	1728	et.exe	cmd.exe
PID 1564 wrote to memory of 1308	1564	cmd.exe	schtasks.exe
PID 1564 wrote to memory of 1308	1564	cmd.exe	schtasks.exe
PID 1564 wrote to memory of 1308	1564	cmd.exe	schtasks.exe
PID 460 wrote to memory of 916	460	cmd.exe	powershell.exe
PID 460 wrote to memory of 916	460	cmd.exe	powershell.exe
PID 460 wrote to memory of 916	460	cmd.exe	powershell.exe
PID 768 wrote to memory of 1540	768	taskeng.exe	tkools.exe
PID 768 wrote to memory of 1540	768	taskeng.exe	tkools.exe
PID 768 wrote to memory of 1540	768	taskeng.exe	tkools.exe
PID 768 wrote to memory of 1540	768	taskeng.exe	tkools.exe
PID 1728 wrote to memory of 528	1728	et.exe	cmd.exe
PID 1728 wrote to memory of 528	1728	et.exe	cmd.exe
PID 1728 wrote to memory of 528	1728	et.exe	cmd.exe
PID 528 wrote to memory of 1896	528	cmd.exe	services32.exe
PID 528 wrote to memory of 1896	528	cmd.exe	services32.exe
PID 528 wrote to memory of 1896	528	cmd.exe	services32.exe
PID 1896 wrote to memory of 868	1896	services32.exe	cmd.exe
PID 1896 wrote to memory of 868	1896	services32.exe	cmd.exe
PID 1896 wrote to memory of 868	1896	services32.exe	cmd.exe
PID 868 wrote to memory of 1616	868	cmd.exe	powershell.exe
PID 868 wrote to memory of 1616	868	cmd.exe	powershell.exe
PID 868 wrote to memory of 1616	868	cmd.exe	powershell.exe
PID 1896 wrote to memory of 1332	1896	services32.exe	sihost32.exe
PID 1896 wrote to memory of 1332	1896	services32.exe	sihost32.exe
PID 1896 wrote to memory of 1332	1896	services32.exe	sihost32.exe
PID 1772 wrote to memory of 1028	1772	tkools.exe	k.exe
PID 1772 wrote to memory of 1028	1772	tkools.exe	k.exe

C:\Users\Admin\AppData\Local\Temp\tmp\21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\21b1fb08-2827-4c3a-aaf9-a118f8209a34_334.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900

C:\Users\Admin\AppData\Local\Temp\am.exe
"C:\Users\Admin\AppData\Local\Temp\am.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
"C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\91a0189a82\
4⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\91a0189a82\
5⤵
PID:1404

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe" /F
4⤵
- Creates scheduled task(s)
PID:1340

C:\Users\Admin\AppData\Local\Temp\1000002001\k.exe
"C:\Users\Admin\AppData\Local\Temp\1000002001\k.exe"
4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: SetClipboardViewer
PID:1028

C:\Users\Admin\AppData\Local\Temp\1000010001\et.exe
"C:\Users\Admin\AppData\Local\Temp\1000010001\et.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
5⤵
PID:1044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
5⤵
PID:1096

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
6⤵
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services32.exe"
5⤵
- Loads dropped DLL
PID:528

C:\Windows\system32\services32.exe
C:\Windows\system32\services32.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:336

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
7⤵
PID:1516

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
8⤵
PID:972

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
7⤵
- Executes dropped EXE
PID:560

C:\Users\Admin\AppData\Local\Temp\et.exe
"C:\Users\Admin\AppData\Local\Temp\et.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1564

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Windows\system32\services32.exe"
4⤵
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services32.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:528

C:\Windows\system32\services32.exe
C:\Windows\system32\services32.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
5⤵
- Executes dropped EXE
PID:1332

C:\Users\Admin\AppData\Local\Temp\k.exe
"C:\Users\Admin\AppData\Local\Temp\k.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1752

C:\Windows\system32\taskeng.exe
taskeng.exe {C4F47760-E154-4551-8EEF-D90ECD24534B} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:768

C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1540

C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000002001\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000010001\et.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000010001\et.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
C:\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
C:\Users\Admin\AppData\Local\Temp\am.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
C:\Users\Admin\AppData\Local\Temp\am.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
C:\Users\Admin\AppData\Local\Temp\et.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\et.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
df6dc8526352286be8ea6a22ee364471

SHA1
46c4d96bb7d677ded281d56681aa1bc8929cbca9

SHA256
fdccef196c6facdd3cb3a150c5b92bef79d9b6b74bf9879eb69c41524f4d5083

SHA512
f5decc338234c23fa90085902999be5b17519eb666358c5a86934c4f6e337fe6c4065d4b8d8bc3dc59bf053643d1f5ef803d4f5ca9bedd559ffded2f6478a052

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
35a82452258380df35ce0cae46072359

SHA1
a0a98b9e115b40708e7c41f6d2014828620bbdf2

SHA256
036e6208113ed5f80718688b69539550cb36c17ee62e4164cfa7a806c73411c6

SHA512
a87633692af39cc75b8605180ce14c01ef2f5587efc8216eeb1fbb635f39343618f13902bbec9444b16f9e506fb7d5c1723dd0504c093f986f548434baafcd64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
35a82452258380df35ce0cae46072359

SHA1
a0a98b9e115b40708e7c41f6d2014828620bbdf2

SHA256
036e6208113ed5f80718688b69539550cb36c17ee62e4164cfa7a806c73411c6

SHA512
a87633692af39cc75b8605180ce14c01ef2f5587efc8216eeb1fbb635f39343618f13902bbec9444b16f9e506fb7d5c1723dd0504c093f986f548434baafcd64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
df6dc8526352286be8ea6a22ee364471

SHA1
46c4d96bb7d677ded281d56681aa1bc8929cbca9

SHA256
fdccef196c6facdd3cb3a150c5b92bef79d9b6b74bf9879eb69c41524f4d5083

SHA512
f5decc338234c23fa90085902999be5b17519eb666358c5a86934c4f6e337fe6c4065d4b8d8bc3dc59bf053643d1f5ef803d4f5ca9bedd559ffded2f6478a052

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
35a82452258380df35ce0cae46072359

SHA1
a0a98b9e115b40708e7c41f6d2014828620bbdf2

SHA256
036e6208113ed5f80718688b69539550cb36c17ee62e4164cfa7a806c73411c6

SHA512
a87633692af39cc75b8605180ce14c01ef2f5587efc8216eeb1fbb635f39343618f13902bbec9444b16f9e506fb7d5c1723dd0504c093f986f548434baafcd64

Download Submit
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
ad6711a4f144a46e1e744f0186385bd2

SHA1
88e6b0201ddaf8e9254f3fd0e840cdeada159fa3

SHA256
7f4877c825f9ab42dd7f8376985f8059c4d605cc3d72ac22490211bbaedee660

SHA512
2d52a8ad918ac95a853ea62a2a1d745e1510b4104c7cabbe7ab127d64fcdd1d619fe66a6fb83600abf0504d3f5c0855e63eeaa4d7c8a31c967e6f29d61c7dfa4

Download Submit
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
ad6711a4f144a46e1e744f0186385bd2

SHA1
88e6b0201ddaf8e9254f3fd0e840cdeada159fa3

SHA256
7f4877c825f9ab42dd7f8376985f8059c4d605cc3d72ac22490211bbaedee660

SHA512
2d52a8ad918ac95a853ea62a2a1d745e1510b4104c7cabbe7ab127d64fcdd1d619fe66a6fb83600abf0504d3f5c0855e63eeaa4d7c8a31c967e6f29d61c7dfa4

Download Submit
C:\Windows\System32\services32.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Windows\System32\services32.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
MD5
ad6711a4f144a46e1e744f0186385bd2

SHA1
88e6b0201ddaf8e9254f3fd0e840cdeada159fa3

SHA256
7f4877c825f9ab42dd7f8376985f8059c4d605cc3d72ac22490211bbaedee660

SHA512
2d52a8ad918ac95a853ea62a2a1d745e1510b4104c7cabbe7ab127d64fcdd1d619fe66a6fb83600abf0504d3f5c0855e63eeaa4d7c8a31c967e6f29d61c7dfa4

Download Submit
C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
MD5
ad6711a4f144a46e1e744f0186385bd2

SHA1
88e6b0201ddaf8e9254f3fd0e840cdeada159fa3

SHA256
7f4877c825f9ab42dd7f8376985f8059c4d605cc3d72ac22490211bbaedee660

SHA512
2d52a8ad918ac95a853ea62a2a1d745e1510b4104c7cabbe7ab127d64fcdd1d619fe66a6fb83600abf0504d3f5c0855e63eeaa4d7c8a31c967e6f29d61c7dfa4

Download Submit
C:\Windows\system32\services32.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
C:\Windows\system32\services32.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\1000002001\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
\Users\Admin\AppData\Local\Temp\1000002001\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
\Users\Admin\AppData\Local\Temp\1000002001\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
\Users\Admin\AppData\Local\Temp\1000002001\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
\Users\Admin\AppData\Local\Temp\1000010001\et.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
\Users\Admin\AppData\Local\Temp\91a0189a82\tkools.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
\Users\Admin\AppData\Local\Temp\am.exe
MD5
fe10a4f29bdb19294e5d23e946f2b41c

SHA1
a20942b2f605342a95a23849195c8974b70ae273

SHA256
01e1569c9614d44f66b8f493e36ce90a45da47c0007f6f2d9a36eadf79cc0851

SHA512
32da7bd6d0dedd540f67818a19efe709fe508ccf282be1c65263589c64162ec9ebb9fdfd9026c24ec1e81e9b48ab533a4d2cf249eb07452ea624427e0fbc4add

Download Submit
\Users\Admin\AppData\Local\Temp\et.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
\Users\Admin\AppData\Local\Temp\k.exe
MD5
fd73f81aa14d9ac2bed06703ddb406fc

SHA1
71201a58ed4a950b3b5fb1f01c2a4826f9e98180

SHA256
f84d2af6ba8cf7bacc684fac666335b963632ce17775fa0bd7d25de9282cde01

SHA512
b0474899f93aa9d46090fb02c6ef1a8ce283a19be29f13eec70b32059752c50fed05aa507da83c20a9a580f941d9987bb9c93518fac8210c3bd6a0cf815bf407

Download Submit
\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
ad6711a4f144a46e1e744f0186385bd2

SHA1
88e6b0201ddaf8e9254f3fd0e840cdeada159fa3

SHA256
7f4877c825f9ab42dd7f8376985f8059c4d605cc3d72ac22490211bbaedee660

SHA512
2d52a8ad918ac95a853ea62a2a1d745e1510b4104c7cabbe7ab127d64fcdd1d619fe66a6fb83600abf0504d3f5c0855e63eeaa4d7c8a31c967e6f29d61c7dfa4

Download Submit
\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
ad6711a4f144a46e1e744f0186385bd2

SHA1
88e6b0201ddaf8e9254f3fd0e840cdeada159fa3

SHA256
7f4877c825f9ab42dd7f8376985f8059c4d605cc3d72ac22490211bbaedee660

SHA512
2d52a8ad918ac95a853ea62a2a1d745e1510b4104c7cabbe7ab127d64fcdd1d619fe66a6fb83600abf0504d3f5c0855e63eeaa4d7c8a31c967e6f29d61c7dfa4

Download Submit
\Windows\System32\services32.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
\Windows\System32\services32.exe
MD5
cd06b2114626a7ac7829f440a08f6995

SHA1
80c87ec2f3b6dda5dc7bad8a97f021a751befb18

SHA256
4a291c7b3e0aef77dc7c17163536722d9df1bc025744fde659fd7c14c9e6ece2

SHA512
19aa3b9877a12cdaf3b94007e9cf115553768e816b309533ef437eea1b44b1332520e11be414fced3a4d95556dc842c5ef62fbd9d1bafb1f7e77ced9c245f4d7

Download Submit
memory/300-187-0x0000000002560000-0x0000000002562000-memory.dmp

Filesize
8KB

Download
memory/300-191-0x000000000256B000-0x000000000258A000-memory.dmp

Filesize
124KB

Download
memory/300-179-0x0000000000000000-mapping.dmp

Download
memory/300-185-0x000007FEEC6A0000-0x000007FEED1FD000-memory.dmp

Filesize
11.4MB

Download
memory/300-188-0x0000000002562000-0x0000000002564000-memory.dmp

Filesize
8KB

Download
memory/300-189-0x0000000002564000-0x0000000002567000-memory.dmp

Filesize
12KB

Download
memory/336-237-0x000000001BC10000-0x000000001BC12000-memory.dmp

Filesize
8KB

Download
memory/336-223-0x0000000000000000-mapping.dmp

Download
memory/460-124-0x0000000000000000-mapping.dmp

Download
memory/528-221-0x0000000000000000-mapping.dmp

Download
memory/528-148-0x0000000000000000-mapping.dmp

Download
memory/560-238-0x0000000002400000-0x0000000002402000-memory.dmp

Filesize
8KB

Download
memory/560-232-0x0000000000000000-mapping.dmp

Download
memory/568-216-0x00000000029BB000-0x00000000029DA000-memory.dmp

Filesize
124KB

Download
memory/568-207-0x00000000029B2000-0x00000000029B4000-memory.dmp

Filesize
8KB

Download
memory/568-208-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/568-206-0x00000000029B0000-0x00000000029B2000-memory.dmp

Filesize
8KB

Download
memory/568-199-0x0000000000000000-mapping.dmp

Download
memory/572-120-0x0000000000000000-mapping.dmp

Download
memory/752-205-0x000000001BC60000-0x000000001BC62000-memory.dmp

Filesize
8KB

Download
memory/752-193-0x0000000000000000-mapping.dmp

Download
memory/868-218-0x0000000002542000-0x0000000002544000-memory.dmp

Filesize
8KB

Download
memory/868-220-0x000000000254B000-0x000000000256A000-memory.dmp

Filesize
124KB

Download
memory/868-155-0x0000000000000000-mapping.dmp

Download
memory/868-210-0x0000000000000000-mapping.dmp

Download
memory/868-217-0x0000000002540000-0x0000000002542000-memory.dmp

Filesize
8KB

Download
memory/868-219-0x0000000002544000-0x0000000002547000-memory.dmp

Filesize
12KB

Download
memory/916-139-0x00000000026C2000-0x00000000026C4000-memory.dmp

Filesize
8KB

Download
memory/916-134-0x0000000000000000-mapping.dmp

Download
memory/916-137-0x000007FEEF2D0000-0x000007FEEFE2D000-memory.dmp

Filesize
11.4MB

Download
memory/916-138-0x00000000026C0000-0x00000000026C2000-memory.dmp

Filesize
8KB

Download
memory/916-140-0x00000000026C4000-0x00000000026C7000-memory.dmp

Filesize
12KB

Download
memory/916-141-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/916-142-0x00000000026CB000-0x00000000026EA000-memory.dmp

Filesize
124KB

Download
memory/972-229-0x0000000000000000-mapping.dmp

Download
memory/1028-186-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/1028-182-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/1028-176-0x0000000000000000-mapping.dmp

Download
memory/1044-198-0x0000000000000000-mapping.dmp

Download
memory/1096-201-0x0000000000000000-mapping.dmp

Download
memory/1196-132-0x0000000002734000-0x0000000002737000-memory.dmp

Filesize
12KB

Download
memory/1196-133-0x000000000273B000-0x000000000275A000-memory.dmp

Filesize
124KB

Download
memory/1196-125-0x0000000000000000-mapping.dmp

Download
memory/1196-126-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1196-127-0x000007FEED580000-0x000007FEEE0DD000-memory.dmp

Filesize
11.4MB

Download
memory/1196-130-0x0000000002730000-0x0000000002732000-memory.dmp

Filesize
8KB

Download
memory/1196-131-0x0000000002732000-0x0000000002734000-memory.dmp

Filesize
8KB

Download
memory/1248-203-0x0000000000000000-mapping.dmp

Download
memory/1308-129-0x0000000000000000-mapping.dmp

Download
memory/1332-169-0x000000013F470000-0x000000013F471000-memory.dmp

Filesize
4KB

Download
memory/1332-163-0x0000000000000000-mapping.dmp

Download
memory/1332-180-0x000000001BDE0000-0x000000001BDE2000-memory.dmp

Filesize
8KB

Download
memory/1340-121-0x0000000000000000-mapping.dmp

Download
memory/1404-122-0x0000000000000000-mapping.dmp

Download
memory/1516-228-0x0000000000000000-mapping.dmp

Download
memory/1540-146-0x00000000011A0000-0x0000000001A64000-memory.dmp

Filesize
8.8MB

Download
memory/1540-143-0x0000000000000000-mapping.dmp

Download
memory/1540-147-0x00000000011A0000-0x0000000001A64000-memory.dmp

Filesize
8.8MB

Download
memory/1564-128-0x0000000000000000-mapping.dmp

Download
memory/1616-159-0x000007FEED580000-0x000007FEEE0DD000-memory.dmp

Filesize
11.4MB

Download
memory/1616-171-0x000000000266B000-0x000000000268A000-memory.dmp

Filesize
124KB

Download
memory/1616-165-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/1616-164-0x0000000002662000-0x0000000002664000-memory.dmp

Filesize
8KB

Download
memory/1616-166-0x0000000002664000-0x0000000002667000-memory.dmp

Filesize
12KB

Download
memory/1616-156-0x0000000000000000-mapping.dmp

Download
memory/1616-161-0x0000000002660000-0x0000000002662000-memory.dmp

Filesize
8KB

Download
memory/1676-239-0x0000000000000000-mapping.dmp

Download
memory/1708-102-0x0000000000E70000-0x0000000001734000-memory.dmp

Filesize
8.8MB

Download
memory/1708-94-0x0000000000000000-mapping.dmp

Download
memory/1708-103-0x0000000000E70000-0x0000000001734000-memory.dmp

Filesize
8.8MB

Download
memory/1728-123-0x000000001B610000-0x000000001B612000-memory.dmp

Filesize
8KB

Download
memory/1728-118-0x000000013F820000-0x000000013F821000-memory.dmp

Filesize
4KB

Download
memory/1728-98-0x0000000000000000-mapping.dmp

Download
memory/1752-115-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/1752-113-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1752-105-0x0000000000000000-mapping.dmp

Download
memory/1772-117-0x00000000011A0000-0x0000000001A64000-memory.dmp

Filesize
8.8MB

Download
memory/1772-116-0x00000000011A0000-0x0000000001A64000-memory.dmp

Filesize
8.8MB

Download
memory/1772-109-0x0000000000000000-mapping.dmp

Download
memory/1896-153-0x000000013F090000-0x000000013F091000-memory.dmp

Filesize
4KB

Download
memory/1896-150-0x0000000000000000-mapping.dmp

Download
memory/1896-160-0x000000001C060000-0x000000001C062000-memory.dmp

Filesize
8KB

Download
memory/1900-78-0x000000006D330000-0x000000006D33D000-memory.dmp

Filesize
52KB

Download
memory/1900-90-0x000000006D0A0000-0x000000006D0D8000-memory.dmp

Filesize
224KB

Download
memory/1900-86-0x000000006D1C0000-0x000000006D204000-memory.dmp

Filesize
272KB

Download
memory/1900-70-0x00000000760F0000-0x0000000076D3A000-memory.dmp

Filesize
12.3MB

Download
memory/1900-84-0x000000006D250000-0x000000006D26C000-memory.dmp

Filesize
112KB

Download
memory/1900-65-0x0000000077380000-0x00000000774DC000-memory.dmp

Filesize
1.4MB

Download
memory/1900-54-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/1900-82-0x00000000752F0000-0x00000000752FC000-memory.dmp

Filesize
48KB

Download
memory/1900-72-0x0000000073F90000-0x0000000073FA7000-memory.dmp

Filesize
92KB

Download
memory/1900-73-0x0000000075A30000-0x0000000075A65000-memory.dmp

Filesize
212KB

Download
memory/1900-74-0x000000006E780000-0x000000006E910000-memory.dmp

Filesize
1.6MB

Download
memory/1900-85-0x0000000077350000-0x0000000077377000-memory.dmp

Filesize
156KB

Download
memory/1900-66-0x0000000000970000-0x0000000000971000-memory.dmp

Filesize
4KB

Download
memory/1900-63-0x0000000077060000-0x00000000770B7000-memory.dmp

Filesize
348KB

Download
memory/1900-76-0x000000006D340000-0x000000006D355000-memory.dmp

Filesize
84KB

Download
memory/1900-88-0x00000000757E0000-0x00000000757EC000-memory.dmp

Filesize
48KB

Download
memory/1900-89-0x0000000075600000-0x000000007571D000-memory.dmp

Filesize
1.1MB

Download
memory/1900-75-0x000000006D3E0000-0x000000006D3F7000-memory.dmp

Filesize
92KB

Download
memory/1900-87-0x000000006D060000-0x000000006D09D000-memory.dmp

Filesize
244KB

Download
memory/1900-91-0x0000000073FB0000-0x0000000073FC6000-memory.dmp

Filesize
88KB

Download
memory/1900-77-0x000000006D360000-0x000000006D3B2000-memory.dmp

Filesize
328KB

Download
memory/1900-62-0x0000000076000000-0x0000000076047000-memory.dmp

Filesize
284KB

Download
memory/1900-61-0x0000000075720000-0x00000000757CC000-memory.dmp

Filesize
688KB

Download
memory/1900-58-0x00000000002E0000-0x0000000000325000-memory.dmp

Filesize
276KB

Download
memory/1900-68-0x0000000075C20000-0x0000000075CAF000-memory.dmp

Filesize
572KB

Download
memory/1900-79-0x0000000075A10000-0x0000000075A29000-memory.dmp

Filesize
100KB

Download
memory/1900-59-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1900-92-0x000000006CF40000-0x000000006D035000-memory.dmp

Filesize
980KB

Download
memory/1900-57-0x0000000000970000-0x0000000000A15000-memory.dmp

Filesize
660KB

Download
memory/1900-80-0x000000006D280000-0x000000006D2CF000-memory.dmp

Filesize
316KB

Download
memory/1900-71-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1900-56-0x0000000000970000-0x0000000000A15000-memory.dmp

Filesize
660KB

Download
memory/1900-81-0x000000006D2D0000-0x000000006D328000-memory.dmp

Filesize
352KB

Download
memory/1900-55-0x0000000075140000-0x000000007518A000-memory.dmp

Filesize
296KB

Download