434719f479c926aea347d099a4bf929f8e0889e3b0cdaf0eda380c06b37643ea

Analysis

user interaction
yes
max time kernel
298s
max time network
192s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
14/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sulian.exe
Size 79.3MB
Sample260814-dhv4hatckc
SHA256 434719f479c926aea347d099a4bf929f8e0889e3b0cdaf0eda380c06b37643ea
MD5 b234848c49ac0722877b0a4b165e61f0
SHA1 e653c25d0e79f0acf0fc8a10499a6345ba789b00
SHA512 b95fc39b15ff8cdf15b27294c7e7627a9580ad4c8d0dd63c04c9d9ad767cf05b74304ab34eacc3a9f8cefc56d728d580c0ee349ea05a758ed3e2c932ece4dc27
SSDEEP 1572864:UyRKMX05/LjA1bH9Y9n8FInLwsTz2GpTcX+YI/dYfP820ZZ5ET/XUJJ/AWUPgK:URMX+jAFH9U8FB3kTcuX/KHgGcPAfgK
TLSH
T14708333FE247283DF069423B35B6E565143B6626A9474C12E3F89488CF265B12E3F787
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 12 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4412	netsh.exe
4252	netsh.exe
3440	netsh.exe
852	netsh.exe
3140	netsh.exe
1836	netsh.exe
1456	netsh.exe
1428	netsh.exe
5052	netsh.exe
4312	netsh.exe
1640	netsh.exe
1788	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	sulian.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	SpeedLink.exe

Executes dropped EXE 2 IoCs

pid	Process
520	sulian.tmp
4436	SpeedLink.exe

Loads dropped DLL 64 IoCs

pid	Process
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\SpeedLink\System.Net.Mail.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Runtime.Loader.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Security.Cryptography.Xml.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-IZUAJOZLZQ.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\fr\is-4RROPLMEH8.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\pl\UIAutomationClientSideProviders.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\tr\Microsoft.VisualBasic.Forms.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\tr\UIAutomationTypes.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\ko\PresentationFramework.resources.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-F6BIQ04RH9.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-D2R5MEK5QG.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\fr\ServiceLib.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\hostpolicy.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\cs\System.Windows.Forms.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Threading.Tasks.Parallel.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-LWI6W5M0E6.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\resources\bin\xray\is-75BGQT0SKS.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\zh-Hant\is-RJ4JF4G9X1.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Formats.Nrbf.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\ko\System.Xaml.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\zh-Hans\UIAutomationTypes.resources.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\pl\is-UZYLF6UV8R.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\ServiceLib.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-KXBCOA3835.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\zh-Hant\is-0X3BO5VVGK.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\zh-Hans\PresentationUI.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\de\UIAutomationTypes.resources.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-SRIL290QA5.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\WindowsFormsIntegration.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-K5DK6N99AW.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\de\is-LYNOGAXQOP.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\ru\is-M4TBUJQ551.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\zh-Hant\System.Windows.Input.Manipulations.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\zh-Hant\UIAutomationProvider.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Private.Uri.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\zh-Hant\WindowsFormsIntegration.resources.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-C2SDJ41NTR.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-QG92XY2IFQ.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-JMFEFZ8TDL.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-JUWSECX18D.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\cs\is-5YLIAZ1C5N.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\pt-BR\is-152BTFLEEH.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Formats.Asn1.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Numerics.Vectors.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Security.Cryptography.Cng.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\ko\System.Windows.Controls.Ribbon.resources.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\zh-Hant\is-SH2ZAOSPYT.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\Splat.Core.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Core.dll	sulian.tmp
File created	C:\Program Files\SpeedLink\is-3UMRZZGV63.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-YNXG71OXKP.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\es\is-P84ZQHO5WG.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\pl\is-55NG0LHE7V.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-SS9607EXZW.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-X8PCQEVJSS.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\is-WZXFCZ2BCF.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\de\is-6IWLZBZ487.tmp	sulian.tmp
File created	C:\Program Files\SpeedLink\ru\is-X1G3W05S28.tmp	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\fr\PresentationCore.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\System.Net.Requests.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\ja\ReachFramework.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\de\System.Windows.Forms.Primitives.resources.dll	sulian.tmp
File opened for modification	C:\Program Files\SpeedLink\it\ReachFramework.resources.dll	sulian.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sulian.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sulian.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/3720-0-0x0000000000360000-0x0000000000448000-memory.dmp	innosetup
behavioral2/memory/3720-6-0x0000000000360000-0x0000000000448000-memory.dmp	innosetup
behavioral2/memory/3720-1188-0x0000000000360000-0x0000000000448000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
520	sulian.tmp
520	sulian.tmp
4436	SpeedLink.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	SpeedLink.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
520	sulian.tmp
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe
4436	SpeedLink.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4436	SpeedLink.exe
4436	SpeedLink.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 520	3720	sulian.exe	83
PID 520 wrote to memory of 1640	520	sulian.tmp	93
PID 520 wrote to memory of 852	520	sulian.tmp	96
PID 520 wrote to memory of 1788	520	sulian.tmp	98
PID 520 wrote to memory of 3140	520	sulian.tmp	100
PID 520 wrote to memory of 1836	520	sulian.tmp	102
PID 520 wrote to memory of 1456	520	sulian.tmp	104
PID 520 wrote to memory of 4412	520	sulian.tmp	107
PID 520 wrote to memory of 4252	520	sulian.tmp	109
PID 520 wrote to memory of 1428	520	sulian.tmp	111
PID 520 wrote to memory of 5052	520	sulian.tmp	113
PID 520 wrote to memory of 3440	520	sulian.tmp	115
PID 520 wrote to memory of 4312	520	sulian.tmp	117
PID 520 wrote to memory of 4436	520	sulian.tmp	119

C:\Users\Admin\AppData\Local\Temp\sulian.exe
"C:\Users\Admin\AppData\Local\Temp\sulian.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Users\Admin\AppData\Local\Temp\is-1RWGR5UFZR.tmp\sulian.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1RWGR5UFZR.tmp\sulian.tmp" /SL5="$50216,81846286,890880,C:\Users\Admin\AppData\Local\Temp\sulian.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="速连 Xray 本地 TCP"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1640
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="速连 Xray 本地 UDP"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:852
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="速连应用本地 TCP 出站"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1788
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="速连应用本地 TCP 入站"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3140
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="速连 Xray 出站 TCP"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1836
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="速连 Xray 出站 UDP"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1456
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="速连 Xray 本地 TCP" dir=in action=allow program="C:\Program Files\SpeedLink\resources\bin\xray\xray.exe" protocol=TCP localip=127.0.0.1 remoteip=127.0.0.1 profile=any enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4412
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="速连 Xray 本地 UDP" dir=in action=allow program="C:\Program Files\SpeedLink\resources\bin\xray\xray.exe" protocol=UDP localip=127.0.0.1 remoteip=127.0.0.1 profile=any enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4252
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="速连应用本地 TCP 出站" dir=out action=allow program="C:\Program Files\SpeedLink\SpeedLink.exe" protocol=TCP localip=127.0.0.1 remoteip=127.0.0.1 profile=any enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1428
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="速连应用本地 TCP 入站" dir=in action=allow program="C:\Program Files\SpeedLink\SpeedLink.exe" protocol=TCP localip=127.0.0.1 remoteip=127.0.0.1 profile=any enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5052
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="速连 Xray 出站 TCP" dir=out action=allow program="C:\Program Files\SpeedLink\resources\bin\xray\xray.exe" protocol=TCP profile=any enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3440
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="速连 Xray 出站 UDP" dir=out action=allow program="C:\Program Files\SpeedLink\resources\bin\xray\xray.exe" protocol=UDP profile=any enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4312
- - C:\Program Files\SpeedLink\SpeedLink.exe
    "C:\Program Files\SpeedLink\SpeedLink.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DirectWriteForwarder.dll

Path C:\Program Files\SpeedLink\DirectWriteForwarder.dll
Size 493KB
SHA256 e585360ca511a352f0b53438a24b8f588b3ae7fac73a8f9abe1e9c18c8affc09
MD5 18fa76b8d197aeb62420585aaf937e4b
SHA1 e422b07787e67f5a561a83af1f62d9af12cbfb89
SHA512 81afc8d660e8cce77e89d7f4f64e6c653a6d11a4b5f43545e95d5d367823da716c548df82742aa11482aa4e7ca3379217a8d2feaa63735022c222d2c7d1c82ab
SSDEEP 6144:0lramPXxuPcM1rFBEqvIPOHWR4P4XWZ5rv8EDQT29mnSfvWylSownrQQ6icHUuc7:0bhuPcM1rFBZwPOW2P0HmWclicHUNvig
TLSH
T1A4B48E25F7C52762E86E92BA4243C2629531E8F65707E3C3C681C6252D3F7C2D73A6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Primitives.dll

Path C:\Program Files\SpeedLink\Microsoft.Win32.Primitives.dll
Size 15KB
SHA256 0ed8917deff4e38def167b11ad222354bb463ba8092fc14710f4e59b4f7f99da
MD5 6b15b5344df9aa78a946bda8573834a1
SHA1 63db967195e85f72157a834d8f292cd85db35b83
SHA512 426784a44842f8b8398215031d4692f089b159c3489c45e14d40848f6c2608af71e64cc524e75d311f2eee3ea822cab8a1e66d6ac5a6c5b37679f973240ebc10
SSDEEP 384:8phz23MXBszkWhPGpWCZlNZriSR9zUEZBWSP:Y5Bs+9rr9zPZ7P
TLSH
T1D8624BD2C73C8103FDEBAEB096A4DE833D3857C348059A6A059AF1191C637C1DB3163A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Registry.dll

Path C:\Program Files\SpeedLink\Microsoft.Win32.Registry.dll
Size 113KB
SHA256 a4244204f35b3f9afb9321322a4aa140b082dcf6b7744f9ceb2525c7a0dc1895
MD5 6eedeb6332ee5cd8914f2e94406113df
SHA1 e15a897829536d23d0ab3e23acb95d01da84cbab
SHA512 07b5cd4614c96c86a9a36f84bac0c3f5b5aedc5d5d70068e3d83cfa1f3cb7099c695388cffc345f47c96cfc91bf16b8c8a337b429f10cfc9a9429e2514951d9b
SSDEEP 3072:2t4wrsx6bAYMteaJSvEdy7IVihNv5aatHi+ga:aOVteaJSvEdEvRc+V
TLSH
T117B36B10BBC4410FEAAE45B89C734846E232F5961742ABDF46D5C0DD2F63BC6F232562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationCore.dll

Path C:\Program Files\SpeedLink\PresentationCore.dll
Size 7.9MB
SHA256 96a329ae739f41626263b52e9d4179f55a49c5be1ab0f0285c7b95ff119eb07d
MD5 008470c5e8fa78bd0c48de1b199b913b
SHA1 ec07efdf955ee9091d5c6f3208d9d8a49e0090b5
SHA512 4cd8d89ef9c2c7c5d263a9be0366669da4173a21366bfd30104eca99f0fe2c0937cb207715339684c1f081524e40efb52a71d00a1b18e6c21b61c0e4e2eeff4a
SSDEEP 196608:7tzLeQNqk+GyW5QZzKFCr1axAtGYOShfPKR:pzLeUQQbyhiR
TLSH
T188868D08E3C91E25D27F95BDA2A36102F7B4A033971192CB3D9DDB192F937C19A77212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFramework.dll

Path C:\Program Files\SpeedLink\PresentationFramework.dll
Size 15.1MB
SHA256 95323c3fb3370d53a2a8ff288327ee5186b006b18c595d54a0f8495340d066c3
MD5 dc0af395ba0ce912de298dbcb7b630e6
SHA1 ece1ff3a15901c6435f3f8475d538edccd5b0491
SHA512 92fdc49e887abb4525b79593b4e98d0578f36c0025e71fb11f153a19fea6af1ce1e5ce9fa56c437952c39f91d46161c3e2c7564b7fbb4ed56fcbee638a26f50f
SSDEEP 196608:u6k3buHljBxsAJted72Zlzcgb/erKHvAtkcfgMbgDr:wEljBxsSed72ZZHPAtkT
TLSH
T1E4F67D19E3D84A05D37EC1BF82632102E5F5F8B6937285DF0527DA492F83FC1A676262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Program Files\SpeedLink\PresentationNative_cor3.dll
Size 1.2MB
SHA256 7fec1277620afb3100c1025e018e9f6dbd4eb495c2b1370b2ad9c6020066faa9
MD5 361caeac55ab228e14ef04733262f94c
SHA1 ffb3985b55586afa37e20b6cb034c267a9396019
SHA512 71ff529e6eece05da224a3507e4f607461f5e4ed5cd2dd93a008c4edd97ff9edbdf4b043f3ee1b92d32ff0b1659cf1c52ced38c61657e06f5b6303d6c188eda8
SSDEEP 24576:ngaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPvFG:qnR+g8lYP00OM8zT3GbNUdvoxWZBlIul
TLSH
T179453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpeedLink.deps.json

Path C:\Program Files\SpeedLink\SpeedLink.deps.json
Size 60KB
SHA256 44a5ee52dff38e6eeaa6d7df35bf064cbe4048900925815130c6bac2a5a8db96
MD5 53538f0dda356a13876fa3d217f0ed11
SHA1 d882c4517a23f96021a1270100f277a55e40b4af
SHA512 4963ae8f4db968b1503e56fe57f79d758a2346f8b6b4be112d2a2554330528ddf6ad92ff914048eb51b7dc6df0ce3e0df0ff481bcedcb7ed08b32f49ad5a2ba1
SSDEEP 384:XzSXaUa+sjgqndDagkByfHnfn14XnFAuwmKTlks7vzv7I8RHg1U7zlo5cjWAgvHZ:X5EwXlxLvB7O5nX7vYK
TLSH
T164530226D9604DBB0A3597F2383946A0F36A032F7044088EB5BC682DDF77EAB1155F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpeedLink.dll

Path C:\Program Files\SpeedLink\SpeedLink.dll
Size 5.4MB
SHA256 315865d86fe50e2489f637ca0132240b1099a88233e657eb2f7eb81ad01f9fbe
MD5 3fe6d52b1d65a0500680fd3d761759cd
SHA1 c738475e74e5cf2791c5c7cccfb9702647d08d05
SHA512 0696230ea78dce484d686f220b2623953e5c196a7c434bf5dc659b2574a4483f24a7bd4eb858f769bb02dae7c42b3e7638bab8c4cdbafb64dbcf6fc84838ab4d
SSDEEP 98304:G6udYsYyCOESas4yrXHD22yu5wmVsxlTv3+0IjjHRUIfeLZPvvVEWdYGCU:hPdyCOmsjpVePv3jQRLeLZP+H
TLSH
T1F44612476266CD20C6BE0E70886AC5D0E739FE87C4D048E177DABC8FBC7AD61751246A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpeedLink.exe

Path C:\Program Files\SpeedLink\SpeedLink.exe
Size 210KB
SHA256 ac24b0fa226ed29d450609683828d657c22372e17c68b4b225b3269df85afb4c
MD5 d5f4f3279c1e92c3d5eb731856090c2f
SHA1 31de005dfd182d3ce6fdcf32b026f033def8c0d8
SHA512 f477325acf3b35309c75dfd7ebbfb1f3bfed29fc77115e6ef151defb1855a335936eda907dc08675fe5b6f7b1ef4eb8de9ba9102114f1d8df9c99522046e0018
SSDEEP 3072:ZlDJk88wN1QA7sxrYL1peQ3lOg9SkHNwG3JzaAT5IcCUbi03vj0OQ5qGtX:HAAwxrI14Q38gB/o3HUi03bMqGt
TLSH
T1EB247E13A6A811FEE1B3D679C9924901FB7278594B71A7CF07504EBA0F67BD09E39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpeedLink.runtimeconfig.json

Path C:\Program Files\SpeedLink\SpeedLink.runtimeconfig.json
Size 882B
SHA256 9905ab014781839e4253d730618601adf6ad24004e830a6d8ab497e6c2b38b65
MD5 bf24273d07857ffab604f6e103f94c8c
SHA1 6b2fac01b5d5eb810072b0e582e7c1819304c08b
SHA512 ba496a09a96d17442dd4dbd7677d96a9a7d63afbfd8288ce481d7867049cf029d1dc0762d8ebabe160ea7b5746ef70189d3d091b5369003c468caa0bd33f9dd2
TLSH
T1F0116636CB14ACBA1879727AE615D482D634273720003C56B4FD080CBF775E51233F96
MD5 SHA1 SHA512 TLSH

Submit Download

System.Collections.NonGeneric.dll

Path C:\Program Files\SpeedLink\System.Collections.NonGeneric.dll
Size 101KB
SHA256 6570a4691cafd9b56c24042ad8ba0ed60304ef2aad4a4ee680b105f57abcde8d
MD5 c49b5d20fda4e11d50ede05e49615094
SHA1 dd8d6407d421b5f3234ad110d4c07b3732977776
SHA512 f3db550c09b029854900ff4fd431152aced2c503c43c111156c3f4d12219abd0e93aabaf13b1dea55db5f043f6b757a3283a0a826253d1cf55e5a87087f6337c
SSDEEP 1536:i2tKtoofN5YHiRJ3+IOj4mwsxmDagF79Jj51RlLHLFSbcDyR+zV:ijtoofyCJ3+Hwskm0LRljLFSee+Z
TLSH
T13DA33729B39C0722C6AAA2BCD1578446E2B0F5E36712D6DF1408948E1FA7BC5C7F3167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.Specialized.dll

Path C:\Program Files\SpeedLink\System.Collections.Specialized.dll
Size 101KB
SHA256 fcb36f4fa19d63c7304e033b27268722b478d1c1687dc28fd3036c9dd913abc4
MD5 90445b74a11f77fa2c4cb1be978d6b35
SHA1 e18f4738f45f7eef76926d474a15a97ee15d32e8
SHA512 3a40ee22c2798bab2a552883ca342d97354b4db723e52eea3a75ef191c55fdd35156a79caf06e1aa4889aa2331b5d18e675f0df6b6b311f3fadfec838bb3976d
SSDEEP 1536:AtwiptR0Eo1u7oNfE3A0Jivc9EywNSeNYZDorLXzSw8oz+:AdptRKggMtTeNYZDorLXWoq
TLSH
T1BCA32928B3888B25CB7E92FCC5A38A42E770F1D21352E6CF194AD4495E977C0867716F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Program Files\SpeedLink\System.Collections.dll
Size 289KB
SHA256 22f81315a6dbe69080c917faffc9d99f8ebd0d20dffad432e26d11f9c14aaf2c
MD5 317e2b48eac94ba8ecc945d75a8c3e87
SHA1 b22044acd9d03da4bed82d63719e8864c27d2619
SHA512 436c9351c47ee0034e76bde2b33ed519cc4a8df21ef9a60e9bcd9056093ff11cae65a6a3e1c6866a16737166e254d06f7d668130e500960cad3daf118a45d90c
SSDEEP 6144:YdtH4FsjvCSCDLEFCL8ph2wqXh0PsHkbtXa:0OUvCS8qCL9wqx/HkbtK
TLSH
T12054392873CC2711FDBE41BAE693C042E3799052835082EB46BDF6519F9BFC16AB7425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\Program Files\SpeedLink\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 3324d2a3e9f7f285f1d325061bd595b1f3a784515830d2fab5cebba9c42e856c
MD5 0d5f4cdc8035694c326e85e5ca3e5c9f
SHA1 dee631782dc5c1b02754e663b8fcd52b440cd0aa
SHA512 08a6f5f0a6fbc132868bc4019e022d2c3c13b0135a189738b034b10e61351d2f1bb7cd043539b865116e77aebeaa6b5ce80008091dff628e69ad59269531b315
SSDEEP 1536:4ze9l7W7h4qjUzMJVLvrYu2nCLW5tz+zk:4Ml7W7h4BIrLvr52CLWv+Q
TLSH
T10E733A1913E8431AEBAD567C95B399109570F5971323D9CF85E0D90E3F8FBC2A231A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Configuration.ConfigurationManager.dll

Path C:\Program Files\SpeedLink\System.Configuration.ConfigurationManager.dll
Size 1021KB
SHA256 0ff9221244b3f0a620400ca2a1a7d962aa713907a304bea1cd0dbe8bad0f750f
MD5 55e4c287fa07ddc9dea5209184f89615
SHA1 f3c3517de147fce182222f30d7432d9500f13b01
SHA512 91c6b0ddd3bd7613f69e57a29a0f9993f882ac26a276c611c198c303db10b61ad6051f1511310224c00ab933828d017e5c46d984063dcd2ecfea4beb83b602a1
SSDEEP 12288:JIFTDBQp0Dv+3Mu6fOsdV0Z8oApKK1sPTdokGH5OTNWLOdNUsX0UNHyhvW6lfM/v:ETXvCUmDm+6lqg7oU8QMn3R
TLSH
T10A254A2553D84B19F3BA1778D12A0A01DAF9AD570321C6CFD447B84E2F93BC296F2267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Debug.dll

Path C:\Program Files\SpeedLink\System.Diagnostics.Debug.dll
Size 15KB
SHA256 5b7d49214fe831d4f54c30937d223bf1a72c180f66ace8fab153f39e9f726bf3
MD5 9903a418ec9fadf39148f0a891b93ab4
SHA1 7ccc5709579ed8da9071c74ef4d99af9ca871c4d
SHA512 1bceccc9f63dd0ea48c00c58cee429717afc9ff7686bfc41eaca75712ba3b296f58b2b74f1d4928ccc38c2431dfeba63f7d43b5a63ff0f8f221b2f92c0fbeaff
SSDEEP 192:QGWgxRieW2/mWUWF+GBTBWsea8W9QcNpcspKLX01k9z3Apo6m341Z:jxweW2/mWplNEscmeR9zIo6m3O
TLSH
T1AB625CA5D7BC8203FEDB6EB097A4C9833C38A7C65D519A5A01D5F1061C53784EB3172D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Packaging.dll

Path C:\Program Files\SpeedLink\System.IO.Packaging.dll
Size 313KB
SHA256 92b115060814437134fe3c667b2fd0f5b49e389db66e5fe02b4c01a48f645b03
MD5 a4d92758dd8105e60cf01aff53e14778
SHA1 e3de4fcdccdded9ab80898c9726bc652cbc637ab
SHA512 2c9aa76b4c59a4c44d354edbf62e4bc6942c770ca5260a131da25a6b364b3f9e06a9d9cd34f615b0487e22d2ed179a9c90b0ed7ffcc17f276b7fcc2d3b1bf7dd
SSDEEP 6144:I026TCxuA6WnSCLSF5y+//2WbEUy9vafnlKUV6P:I02bxuAFSCeF//2WdwasUMP
TLSH
T19F64F72633E80506FBBB5BFC91F3A051E27AB45227A1C6CF0521D59D1B93BC18EB1762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Program Files\SpeedLink\System.Memory.dll
Size 157KB
SHA256 1078a6c41bb1ce7ac34143318dea476b85ff174f9e69af8e43979bdf8f88a8c4
MD5 875be7a95a1efd5cbefbaae5bc638593
SHA1 61af3e42601670b0bbe9ad14a147d84b686f7d46
SHA512 fc9ea499df81b5d152d221ecbd6174df509a7c8b02b46517d331e72950ee2b7c48f462d6d8bbae95311c2d0d2241c059fc4e17c3bc48e435211f14aa8424bd39
SSDEEP 3072:iubfv1/38noVRXZ1isc8JyyKhpwaGrpXki4T/hhxgMR:Ld38Aby3vwaGraiw5h/
TLSH
T1A0F34A1BD3980257DA2FE6BA8796C202EF336101D711A1CB48D4DA44AF53BE1BF76835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\Program Files\SpeedLink\System.Private.CoreLib.dll
Size 15.3MB
SHA256 5b6700e2802afdb2cc4863b096760a66442e89fd6ee5edb718c697ae5cf33ddc
MD5 f2f1e377eb7bae97cbf2edceb2befe8a
SHA1 c9f020d0a116c3b51d3dd18be3ea52133a667229
SHA512 3e685edc37756e80a2aff502323e715745f4fd0967df97ff5b962ebfdeba61581300a9e21e706a342fd089d6468a9ee4cc05910595d0ea49720f492c97ed38c9
SSDEEP 196608:Azw2LnkvY9BnpsZdI9fkuOH0Ar+6x5LKd6kIn+9ZNIbe0p:2w2LnkvY9BnAdI9dOH0Ar+6vKd6k52v
TLSH
T1A3F6AE10E3D89F4AE53EC2788057C616DA70F882532B86CB0195EA493F73BD5673B762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Uri.dll

Path C:\Program Files\SpeedLink\System.Private.Uri.dll
Size 249KB
SHA256 5541bb33861941addd700eacdf9a206c49da1a0382bb6725d50eda964b656c36
MD5 d19d3b2ce89fb2c93ebfc5e0ab594f9e
SHA1 cfd17d8baf0e9859f194b5051cf41cea7d3322cd
SHA512 b1a92d43a7197c5cda58e0fce23ad7d7069a98c4ae36748ffbcf79e51f86f83b60e9d3143c9cabfc6a25623af1327dcdf5d38d56f8b1f3307790e3055cee270d
SSDEEP 6144:8gE0Now00kgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMW:cIhtCmC2+HtGw
TLSH
T163447D1BB3D40E6AFB2EC3FD8693C592D272B1965305E7DB07B490812E133C16A79993
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.Xml.dll

Path C:\Program Files\SpeedLink\System.Private.Xml.dll
Size 7.4MB
SHA256 99098e70118247ebcc8c466e737c326a1fa837cb23d1e3429d9d1f0d395cafdb
MD5 1241436bf9203262bcf249b42274a1e0
SHA1 48284c41dc8a056667822a236ace4ca8e3eafdfc
SHA512 1f2abc8979227853013c0461ac9aef6d4ca5455cbcc9144bd37d383b1fd5faeca48605671b2d9d8956779e454b3f37f7984aa1519380406f67c894f54f333e23
SSDEEP 98304:+mZ4nygnZe+85ykjHD0x5TSJqjfAF3TDMsrUR:3ZEFoyGHeTSAE3PM8g
TLSH
T162767C14B3C40A19D32FC27D92238611E6F9B8933356EAEF0458DAC51F937C18A7766B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.VisualC.dll

Path C:\Program Files\SpeedLink\System.Runtime.CompilerServices.VisualC.dll
Size 29KB
SHA256 bf3e787aef846dc36c7f4f4bc678e27cc3b39daba14ab1a223f179823d27ed29
MD5 3a81b1481a2ffee202a0459f2734fab7
SHA1 6d626b81c66387b2612fc38ac8b9a5a6e18a8dea
SHA512 7efdf27e54d7f800c3a5994ce47b0cb37f4fb1472ca53d0040644a0c137edde05d51bf1339b9b9dab0898818bfbf29bdb40d5dd0e2c9a1047634c2d2b6d5a2ea
SSDEEP 192:hWsQLWWNhIt/3yyxl5XCxH1lzWVij/WCWKie1BzBWsea4WhMrbuK/X01k9z3ApEC:hWsQLWoilpvIVZZlNnMriSR9zUE6Bpjd
TLSH
T103D24BB19B6CC223EE9B0D749AF5DA832D39F3C65B4696D7009DF10A5C667C08B30635
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.Extensions.dll

Path C:\Program Files\SpeedLink\System.Runtime.Extensions.dll
Size 17KB
SHA256 242fe2a65b3ea3fd42ff29106d54a8b7c5efafcd971e5b9b13f2f0c4f7d3567c
MD5 29b403f45f6e754ac5584c137ebc9e91
SHA1 9ac2e386dc1c063f8aafafeb5a6528fd0f6f35ab
SHA512 8505e1d9f1fb6d090c78374b13425cf78638f71454cd9f260f33257ef1b7a6e9de164f66d612d74a5fdaf7a6d76b9ff3ffdd06011a48d0b68dd05acb509071fa
SSDEEP 384:6u/E9x+Du3FW8yNWbBzZlNYAUyR9zVCaRo:6pmu0Y6AU+9zVC3
TLSH
T145823B92CF5C8313DD9B5FB0AEB6D9822DB8B7C29D71D96A0689E0081C537C4D731728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\Program Files\SpeedLink\System.Runtime.InteropServices.dll
Size 109KB
SHA256 b6231cd2114de5d310fa8665715b39a08c0f045da62c66648dc948ae757b5b4d
MD5 c1d55ed3d2ee97003c445d4c99802608
SHA1 23ddd2ebf157c9b3e2116d430aa6d5aab4d96c41
SHA512 5cf64c78b98df3e752d6f7b09821fd270ffe3ea3b13a91588cabf04feaeb3a64befe7b00889fb7f0398e2f92a10e4593f5cf4e1c25d15edf9a67319493c4cd5d
SSDEEP 1536:4eBz2QtNQMALNBKTerzicKDq5t4udNY/w2yVvObug894RHPeF20gArkzwKE:4egiNQMA7KTVC2udNY42ypCu2mcArk8N
TLSH
T173B34A107B98863ACAAA87389C335D448DB3FEC69312E2CF9584C49D0FD77C066757A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files\SpeedLink\System.Runtime.dll
Size 43KB
SHA256 7f87ad22ac2ec701604a68646bcf4aa1f5c43ad6744c6d01bfaa9e9667e5595e
MD5 7ebfd3ee5132c9fdb50282ab4f7b536a
SHA1 7e864f9753bd8ac2098389c9229f9ca2e9fcf4e0
SHA512 353a5a2f1d04860250d9b62f6ab65cfce866ff359ce1f5275fbad2775c63dadcfbd145d851223105859d7fb9a737ca6a1d6e7b4edbc0876f2d88c4045f503861
SSDEEP 768:LAShN9Yzl50v4boRiPYVbugVJL8ibhAU+9zVCgVaM:LAmN9Yzl50v4boRS0L8ij6zIE
TLSH
T1E813C4A1EE28C233CCCA93B29CB3A4801EF673C240764D75556FD73524AAB89523637D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\Program Files\SpeedLink\System.Threading.Thread.dll
Size 15KB
SHA256 bd46c23f6a765530df2a9971c6f93993587652f8bcc2c15b4673f8d16b4300b8
MD5 abbdb90d3a2e09bf10e1f0b0e1ce2312
SHA1 ecae1a1a08df5d5af84bc21eb6dcd2d8ba833682
SHA512 e4c559001becd73cee4fb7019f90b9f55f546b121204d83ccf3db3b4e724e16bb822353ab583ee4d3de48045f0d4722f9ba0e06d30f72d9fe692cd6297b6514e
SSDEEP 192:x+cTz4dEpYxUoKoyWcw7WVWCWKie1BzBWseawW0gzMUNn9X01k9z3A1J9m:bTz2EcUoKoyWcw7WtZlNSSMW9R9zGJs
TLSH
T125625BD2CB688143FDAB2EB155B4DAC33C7A77D69851C65A54A6F1181C533C4EF30A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\Program Files\SpeedLink\System.Threading.dll
Size 81KB
SHA256 73e42dc61faa190b99da8e13234ecf5276468ba43da277b957e595c696329598
MD5 c02121b7a7865de8e00bf802e556c29e
SHA1 b01ac9f9db6858515f764a17e63d9af62b7f2466
SHA512 4c45ae807d7e27ee8a53d00dc103d04d823a5512ab90fda366280fcc18df8b16014d4b05c736614cacbce102e4e5c560c40f1a6b778e78ca529b60cc3e248fd0
SSDEEP 1536:ulJlwVFH8OyQwXeisjb9Rnd5bbF9o6ziondZze60:uXluH8OxwXdsf9RnHPF9o6Gonr6
TLSH
T1F8835B11A3E8090EF67B17B9DAB35905C171FEE62B01D6CF4069D10C2FA77C096B226B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xaml.dll

Path C:\Program Files\SpeedLink\System.Xaml.dll
Size 1.3MB
SHA256 0c47b6d98365094016d92fd4831119afd3069ce8a1497190a78183b4531bfc1a
MD5 341fdc27adab5cd1bff2894a3d224b86
SHA1 86861028ef10355616658d7f4d3f9429a35dbf3e
SHA512 52ebec6dd8d0dae63ae344571e3816f132740e7994505932ff1f3c2a3ee9b92fc8d820a96f95b59db46d6f56c4286897971827b4e928910760f9df47d445ca39
SSDEEP 24576:3/kc7vpWcVYFzBzhJsHf0xOL0nsfr1ALiDvQrTcvjS+HaftF:P7CFzBzhJsGsfrhvQrTc18
TLSH
T1D1556B2463E88615D7BB82BFD1938122D6F590531362C6CF8405EE6D2FD77C3AB72262
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Xml.ReaderWriter.dll

Path C:\Program Files\SpeedLink\System.Xml.ReaderWriter.dll
Size 21KB
SHA256 dd4fc7436ca8f6076b977d82c2b36a890d0c6357893ef87a3882e4a1f7945328
MD5 2ad3e0aa0c003cd1beb81571766e27fb
SHA1 c05b4da7fe166bf2ee6aab0b0ba2922d6a1c1748
SHA512 23c2fbd40acaf736bcbd3909c119d731555e3a0dac2e7fd9cbcd97cacad9975948bb66e53c1723d52cfd4a1ca5e3c26e3bbfd2d5995fc9210365fb6937803f5f
SSDEEP 384:G125qkxK67ex4FCyhVW15AWJlNDPR9zad0B3:cKLBh+XJ9za25
TLSH
T11AA217A0C9A8DE13EDAA7B71C69FD4C33BF4A29164719735E582D10F8863784A733319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WindowsBase.dll

Path C:\Program Files\SpeedLink\WindowsBase.dll
Size 2.1MB
SHA256 09e57985154139bc0c3b50b9de5a57078864199874479bbef87929bec5e82401
MD5 20076ad88bb34179e6ca88c23716ff25
SHA1 ce410c8b226a7eeb3f8d8549de8257fa551deb5b
SHA512 d3f51c437542151ae752d92985706ae188dfae1dba4ff8a9799ff59731e8c07ec4f3921509a01d886b02e00b39d1e5a5b236e94b3a046c6e7a77193a73019680
SSDEEP 24576:hSfXf1vpCb8ZvoX9OPIA9wxc/rYd1/Yph4R+uyhapRSvM9:h8fvCAeOPIowxMWmh1uyAci
TLSH
T113A55A2473D84726CD7A82B9A6739112E677F457031ACBCF1809C62D2F97BC087762B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\Program Files\SpeedLink\clrjit.dll
Size 2.0MB
SHA256 18fe968846117d13edf3262bcb305ca28f678742a3281f8b4228a44047966f79
MD5 20523aaef93c259bf3929d187db592a1
SHA1 167a37a4b84df90364db6646f8fa0563df572d05
SHA512 7edeb6446b7c207191f5bf1a19ff3d647de911cefff98e37845107b8341d0da92a38a1175aa6d8f997ccd09eb71fa6c4ec8fd3d556cb5e9dbfe60ef72046f3ab
SSDEEP 49152:k1NyfVyKIaKUnctJfilvld1oZgpdZTctkQLFbD/Mq+Nyupy1wmp/Ky7f5hwbq:kx2nctJfGvld1oZGdZQtkQLdD0q9upyZ
TLSH
T17CA5AE47A2B900FCD46F9274C6274A07EBB2B80527719FDF03F04A556F23BA2296E715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\Program Files\SpeedLink\coreclr.dll
Size 4.4MB
SHA256 85135fcf132fae2c3e03d3480dfbb51f910e78e8a6c35ffa367ea33b243216d7
MD5 9db0fbaf52c9fdceb59b2b1be0dfd76e
SHA1 d972628c8db3a131de08bd3b076a02765895f614
SHA512 67d10ea09298ca34978312dfb83f12bb1bed74e8affe35d6f5e29a321c6415f5c757f4aa4335a65cf7dc894c22fd7eaf832d2277d65eee1923c93288891c55ee
SSDEEP 49152:sOyyR7TkLEH6ut8PjdCRxKe2b7b7b7b7br7b7b7b7b7/IqnAXYIxmRL3zeE24QIF:tyyJRvcO0qQzX0T1Ur
TLSH
T156268E25F6AD01DCC4BAD178C6E74A1BFBB238591338DBEB026146651F237E16A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

speedlink.json.tmp

Path C:\Program Files\SpeedLink\guiConfigs\speedlink.json.tmp
Size 42KB
SHA256 32344455fb5fcc02a65ceed96fea677c95b4d92335c61a69960d68caf0c95c7a
MD5 4bb474a7efd3abdb9bb8e6332515ec5e
SHA1 291d256bae47fe5d5c86487ada1ff205ca131a02
SHA512 afe7c1c9c0d55eb136dd366cd55b2581f17cbff1224bdc4b1ef0aea6437dd496b19d0a738112bec08198ac14d39786b112da065b1cf677a008779bcf8b3304b1
SSDEEP 768:zMWLunNPwkbIWimKjzBfT1D2qP/zMtCUapwChs:zMWLunNPwkbIWim8b2qxwR
TLSH
T19B13B9AF434252F72DA414C88C753E7E68C14E8901669EEFD2FA99C5EB044E84F6127F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\Program Files\SpeedLink\hostfxr.dll
Size 370KB
SHA256 dec56b41cf09cfcae002a3bb752b0b381c68b6217ed9e4b41b1ac2b645b5fdc5
MD5 15210d3243249fe60b443ff678225af9
SHA1 26c75d046727c1d2d32e1e56c9f56d16b8adc0ae
SHA512 c2c043c1b872699a4f96ddca5548e6d1fad6f80b67d84112424fbdd37966398e0c6e76d797e33a47a6da9c1a00e10bc83988a83cb7d68ca9bb91e22ea00c39be
SSDEEP 6144:falRvjNggqbRqhaUzIS64W+zz3Z0UCVvfpJEl0FsGxilKmkVAwBA8/UMs2CUHFhr:f5q0iOnpq2TDdl9BqAR
TLSH
T162840816D3E8057CF0B79678DAB29942EB727C494BB0E5DF139088651E73BD08A39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\Program Files\SpeedLink\hostpolicy.dll
Size 369KB
SHA256 385c3c4cddab07e1763a1fb1f978c57e31bb0f478b30b4c535ca1a3db50d28db
MD5 15cf6a2c9195970e025dae32555327de
SHA1 3ada2fa09f6255f0f36f406f6559827b2000a944
SHA512 09ccad0029485307864c0b5b8b1a5d4c570d2eba6edb586892808a718c4165c1555fe1513fa510248243e5bceb668bdb2e934f6d66a1be322a09b70e3585b82c
SSDEEP 6144:fsQpbUUvKO93ss3JDpMBqyiNlCCxO7ptsuBNV3h3BjcZjKr9HLhLuxJb/JDtkwKB:fHFvK+H5Kcyi8JHpa2wKdMFwEs
TLSH
T11C842916D6EC007CF0B7E679CAB28901EB727C4947B196DF139099A61E73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sulian.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1RWGR5UFZR.tmp\sulian.tmp
Size 4.2MB
SHA256 7aee841fc072ba60c1b7e2fbfba069fe66b4d389080b02c0d00c6ab7d53302f4
MD5 995e11e48a8f93baddc334e9f5dd98cd
SHA1 4635b7340e6372dfd1430b6a448c6f9a98246f60
SHA512 5a883b25591ebbc73618a0da91acf1b27e1961e07aba6e87b853980610f68ddfb638f79121be6a4dcc931eef2037be26beb13a01d9f0107835ed4e9671335932
SSDEEP 98304:I9SZUvl30aj90ZFcvdQ0hdgvminQLMj+JC333aG:/ItJj90Z6RgKwv
TLSH
T130168E03B388753EE4B71A3A883FA654583F7A213A26CD4B6BF40D5C4F396416D2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/520-13-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/520-1111-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/520-956-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/520-20-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/520-1187-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/520-7-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/520-8-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/520-5-0x0000000003670000-0x0000000003671000-memory.dmp

Download

memory/520-1147-0x0000000000020000-0x0000000000463000-memory.dmp

Download

memory/3720-6-0x0000000000360000-0x0000000000448000-memory.dmp

Download

memory/3720-0-0x0000000000360000-0x0000000000448000-memory.dmp

Download

memory/3720-1188-0x0000000000360000-0x0000000000448000-memory.dmp

Download