Analysis

  • max time kernel
    42s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 03:40

General

  • Target
    setup_installer.exe
  • Size 2.4MB
  • Sample240319-d8cd3shc61
  • SHA256 2990a3bec6a52f106787fbdcebd73ebe67bbb6d903ef9e7bfd3fa71f51988e1f
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • smokeloader

Botnet
  • pub5

Extracted

Family
  • cryptbot

C2
  • lysuht78.top

  • morisc07.top

Attributes
  • payload_url

    http://damysa10.top/download.php?file=lv.exe

Extracted

Family
  • redline

Botnet
  • test1

C2
  • 185.215.113.15:61506

Extracted

Family
  • nullmixer

C2
  • http://watira.xyz/

Extracted

Family
  • vidar

Version
  • 40

Botnet
  • 706

C2
  • https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://aucmoney.com/upload/

  • http://thegymmum.com/upload/

  • http://atvcampingtrips.com/upload/

  • http://kuapakualaman.com/upload/

  • http://renatazarazua.com/upload/

  • http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • CryptBot payload 2 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 24 IoCs
  • Checks SCSI registry key(s) 3 TTPs 15 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 7 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3036
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun106578261967b7.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3068
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun106578261967b7.exe
          Sun106578261967b7.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2584
          • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun106578261967b7.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun106578261967b7.exe" -a
            5⤵
            • Executes dropped EXE
            PID:1688
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun10b17602b7.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1048
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10b17602b7.exe
          Sun10b17602b7.exe
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:1568
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 376
            5⤵
            • Program crash
            PID:3792
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun103e41e770cfe.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun103e41e770cfe.exe
          Sun103e41e770cfe.exe
          4⤵
          • Executes dropped EXE
          PID:756
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun10489769067d.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4272
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10489769067d.exe
          Sun10489769067d.exe
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          PID:3180
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 824
            5⤵
            • Program crash
            PID:3164
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 832
            5⤵
            • Program crash
            PID:1060
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 832
            5⤵
            • Program crash
            PID:5092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 908
            5⤵
            • Program crash
            PID:808
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1036
            5⤵
            • Program crash
            PID:2988
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1076
            5⤵
            • Program crash
            PID:2444
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1136
            5⤵
            • Program crash
            PID:4888
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1184
            5⤵
            • Program crash
            PID:2036
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1928
            5⤵
            • Program crash
            PID:3936
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1928
            5⤵
            • Program crash
            PID:4192
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1952
            5⤵
            • Program crash
            PID:3356
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun1066b26185fd.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun1066b26185fd.exe
          Sun1066b26185fd.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4696
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun10d565f4df3.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10d565f4df3.exe
          Sun10d565f4df3.exe
          4⤵
          • Executes dropped EXE
          PID:760
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun10523bfbc62f84b.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:744
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10523bfbc62f84b.exe
          Sun10523bfbc62f84b.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4180
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Sun100b66839e961cc60.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun100b66839e961cc60.exe
          Sun100b66839e961cc60.exe
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of FindShellTrayWindow
          PID:2968
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 612
            5⤵
            • Program crash
            PID:2892
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 644
            5⤵
            • Program crash
            PID:5028
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 796
            5⤵
            • Program crash
            PID:412
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 804
            5⤵
            • Program crash
            PID:5100
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 864
            5⤵
            • Program crash
            PID:2240
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 864
            5⤵
            • Program crash
            PID:1624
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1148
            5⤵
            • Program crash
            PID:3312
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1248
            5⤵
            • Program crash
            PID:2872
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 1244
            5⤵
            • Program crash
            PID:4988
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 624
            5⤵
            • Program crash
            PID:3652
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 788
            5⤵
            • Program crash
            PID:3316
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 560
        3⤵
        • Program crash
        PID:3964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4656 -ip 4656
    1⤵
      PID:3168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2968 -ip 2968
      1⤵
        PID:4292
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3180 -ip 3180
        1⤵
          PID:216
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2968 -ip 2968
          1⤵
            PID:1660
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3180 -ip 3180
            1⤵
              PID:2444
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2968 -ip 2968
              1⤵
                PID:5116
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3180 -ip 3180
                1⤵
                  PID:4368
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1568 -ip 1568
                  1⤵
                    PID:4936
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2968 -ip 2968
                    1⤵
                      PID:4356
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3180 -ip 3180
                      1⤵
                        PID:3160
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2968 -ip 2968
                        1⤵
                          PID:5048
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3180 -ip 3180
                          1⤵
                            PID:2232
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3180 -ip 3180
                            1⤵
                              PID:1072
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2968 -ip 2968
                              1⤵
                                PID:4348
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3180 -ip 3180
                                1⤵
                                  PID:3364
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2968 -ip 2968
                                  1⤵
                                    PID:3672
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2968 -ip 2968
                                    1⤵
                                      PID:3232
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2968 -ip 2968
                                      1⤵
                                        PID:1140
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 2968 -ip 2968
                                        1⤵
                                          PID:744
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2968 -ip 2968
                                          1⤵
                                            PID:4292
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3180 -ip 3180
                                            1⤵
                                              PID:920
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3180 -ip 3180
                                              1⤵
                                                PID:4796
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3180 -ip 3180
                                                1⤵
                                                  PID:4940
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3180 -ip 3180
                                                  1⤵
                                                    PID:2020
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3180 -ip 3180
                                                    1⤵
                                                      PID:1936
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3180 -ip 3180
                                                      1⤵
                                                        PID:5008
                                                      • C:\Windows\system32\dwm.exe
                                                        "dwm.exe"
                                                        1⤵
                                                        • Checks SCSI registry key(s)
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        PID:2536
                                                      • C:\Windows\system32\sihost.exe
                                                        sihost.exe
                                                        1⤵
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:3076
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3180 -ip 3180
                                                        1⤵
                                                          PID:4480
                                                        • C:\Windows\system32\dwm.exe
                                                          "dwm.exe"
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Enumerates system info in registry
                                                          PID:1548
                                                        • C:\Windows\system32\dwm.exe
                                                          "dwm.exe"
                                                          1⤵
                                                            PID:3172
                                                          • C:\Windows\system32\dwm.exe
                                                            "dwm.exe"
                                                            1⤵
                                                              PID:3256
                                                            • C:\Windows\system32\dwm.exe
                                                              "dwm.exe"
                                                              1⤵
                                                                PID:4972

                                                              Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    Sun100b66839e961cc60.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun100b66839e961cc60.exe
                                                                    • Size 533KB
                                                                    • SHA256 6f37d97e388e1a4ecbe541dc1f0f17b1fe7171c8138f6c7a0bb8daa66432e211
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun103e41e770cfe.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun103e41e770cfe.exe
                                                                    • Size 241KB
                                                                    • SHA256 9e1a149370efe9814bf2cbd87acfcfa410d1769efd86a9722da4373d6716d22e
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun10489769067d.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10489769067d.exe
                                                                    • Size 527KB
                                                                    • SHA256 ffc2ec2b0becb31a28f5f0916c67a17bbcd6d347951e098bcb80b2e330c2ff5c
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun10523bfbc62f84b.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10523bfbc62f84b.exe
                                                                    • Size 177KB
                                                                    • SHA256 ea127b5ee9172e36b62106b044b8060032fd1dd68d411f3cfe64d4677f2b23f3
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun106578261967b7.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun106578261967b7.exe
                                                                    • Size 56KB
                                                                    • SHA256 78958d664b1c140f2b45e56c4706108eeb5f14756977e2efd3409f8a788d3c98
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun1066b26185fd.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun1066b26185fd.exe
                                                                    • Size 286KB
                                                                    • SHA256 a949a824d86498f795871cbfc332df4b8c39fac1efcb01d93659c11d4bd7e829
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun10b17602b7.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10b17602b7.exe
                                                                    • Size 159KB
                                                                    • SHA256 bdc70ea0bc30ad4735ddbfb2316843e7e93d7f183955594af6f1aaaf615a00be
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    Sun10d565f4df3.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\Sun10d565f4df3.exe
                                                                    • Size 631KB
                                                                    • SHA256 d05cb3a734aaa9d090be20fbaeddf8069a829fa78c44dd8378a2350c1510e1fc
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    libcurl.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\libcurl.dll
                                                                    • Size 218KB
                                                                    • SHA256 0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    libcurlpp.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\libcurlpp.dll
                                                                    • Size 54KB
                                                                    • SHA256 43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    libgcc_s_dw2-1.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\libgcc_s_dw2-1.dll
                                                                    • Size 113KB
                                                                    • SHA256 59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    libstdc++-6.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\libstdc++-6.dll
                                                                    • Size 647KB
                                                                    • SHA256 97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    libwinpthread-1.dll

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\libwinpthread-1.dll
                                                                    • Size 69KB
                                                                    • SHA256 509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    setup_install.exe

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\7zSC06F5917\setup_install.exe
                                                                    • Size 2.1MB
                                                                    • SHA256 d8a8ad0a417f86f1511b81ede6dd98e6fe8bd4c848cdf92f464759aaac25c325
                                                                    • MD5 SHA1 SHA512 SSDEEP

                                                                    __PSScriptPolicyTest_fizt3uet.a0t.ps1

                                                                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fizt3uet.a0t.ps1
                                                                    • Size 60B
                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                    • MD5 SHA1 SHA512

                                                                    memory/1568-106-0x0000000000400000-0x0000000002CB7000-memory.dmp

                                                                    memory/1568-91-0x0000000004780000-0x0000000004789000-memory.dmp

                                                                    memory/1568-162-0x0000000000400000-0x0000000002CB7000-memory.dmp

                                                                    memory/1568-134-0x0000000002CC0000-0x0000000002DC0000-memory.dmp

                                                                    memory/2968-136-0x0000000000400000-0x0000000002D13000-memory.dmp

                                                                    memory/2968-135-0x0000000002E80000-0x0000000002F80000-memory.dmp

                                                                    memory/2968-108-0x0000000004980000-0x0000000004A20000-memory.dmp

                                                                    memory/3036-110-0x0000000005E90000-0x00000000061E4000-memory.dmp

                                                                    memory/3036-164-0x0000000007840000-0x000000000784E000-memory.dmp

                                                                    memory/3036-129-0x0000000005DF0000-0x0000000005E0E000-memory.dmp

                                                                    memory/3036-170-0x0000000072A60000-0x0000000073210000-memory.dmp

                                                                    memory/3036-167-0x0000000007930000-0x0000000007938000-memory.dmp

                                                                    memory/3036-139-0x000000007F840000-0x000000007F850000-memory.dmp

                                                                    memory/3036-82-0x0000000004D00000-0x0000000004D36000-memory.dmp

                                                                    memory/3036-138-0x0000000007260000-0x0000000007292000-memory.dmp

                                                                    memory/3036-84-0x0000000072A60000-0x0000000073210000-memory.dmp

                                                                    memory/3036-87-0x00000000054E0000-0x0000000005B08000-memory.dmp

                                                                    memory/3036-88-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

                                                                    memory/3036-140-0x000000006EF20000-0x000000006EF6C000-memory.dmp

                                                                    memory/3036-150-0x0000000007240000-0x000000000725E000-memory.dmp

                                                                    memory/3036-151-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

                                                                    memory/3036-152-0x00000000072A0000-0x0000000007343000-memory.dmp

                                                                    memory/3036-166-0x0000000007940000-0x000000000795A000-memory.dmp

                                                                    memory/3036-156-0x0000000007610000-0x000000000762A000-memory.dmp

                                                                    memory/3036-165-0x0000000007850000-0x0000000007864000-memory.dmp

                                                                    memory/3036-99-0x0000000005B60000-0x0000000005B82000-memory.dmp

                                                                    memory/3036-132-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

                                                                    memory/3036-163-0x0000000007810000-0x0000000007821000-memory.dmp

                                                                    memory/3036-105-0x0000000005D80000-0x0000000005DE6000-memory.dmp

                                                                    memory/3036-107-0x0000000005E20000-0x0000000005E86000-memory.dmp

                                                                    memory/3036-161-0x0000000007880000-0x0000000007916000-memory.dmp

                                                                    memory/3036-160-0x0000000007690000-0x000000000769A000-memory.dmp

                                                                    memory/3036-155-0x0000000007C50000-0x00000000082CA000-memory.dmp

                                                                    memory/3180-85-0x0000000002E20000-0x0000000002F20000-memory.dmp

                                                                    memory/3180-86-0x0000000004960000-0x00000000049FD000-memory.dmp

                                                                    memory/3180-133-0x0000000000400000-0x0000000002D13000-memory.dmp

                                                                    memory/3180-177-0x0000000002E20000-0x0000000002F20000-memory.dmp

                                                                    memory/3296-157-0x00000000021E0000-0x00000000021F6000-memory.dmp

                                                                    memory/4180-154-0x00007FFD2BAD0000-0x00007FFD2C591000-memory.dmp

                                                                    memory/4180-111-0x00000000028C0000-0x00000000028D0000-memory.dmp

                                                                    memory/4180-92-0x0000000001090000-0x0000000001096000-memory.dmp

                                                                    memory/4180-90-0x0000000001070000-0x0000000001094000-memory.dmp

                                                                    memory/4180-83-0x0000000001060000-0x0000000001066000-memory.dmp

                                                                    memory/4180-78-0x00007FFD2BAD0000-0x00007FFD2C591000-memory.dmp

                                                                    memory/4180-77-0x0000000000870000-0x00000000008A2000-memory.dmp

                                                                    memory/4656-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    memory/4656-118-0x0000000000400000-0x000000000051B000-memory.dmp

                                                                    memory/4656-126-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    memory/4656-59-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    memory/4656-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    memory/4656-50-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    memory/4656-123-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    memory/4656-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    memory/4656-55-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    memory/4656-125-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                                                    memory/4656-60-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    memory/4656-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    memory/4656-51-0x0000000000720000-0x00000000007AF000-memory.dmp

                                                                    memory/4656-49-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    memory/4656-47-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    memory/4656-122-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    memory/4656-121-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    memory/4656-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    memory/4656-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    memory/4696-115-0x0000000007950000-0x0000000007F68000-memory.dmp

                                                                    memory/4696-116-0x0000000007330000-0x0000000007342000-memory.dmp

                                                                    memory/4696-109-0x00000000073A0000-0x0000000007944000-memory.dmp

                                                                    memory/4696-112-0x0000000004C90000-0x0000000004CB0000-memory.dmp

                                                                    memory/4696-114-0x0000000002D60000-0x0000000002D8F000-memory.dmp

                                                                    memory/4696-113-0x0000000002E00000-0x0000000002F00000-memory.dmp

                                                                    memory/4696-117-0x0000000007350000-0x000000000738C000-memory.dmp

                                                                    memory/4696-124-0x0000000072A60000-0x0000000073210000-memory.dmp

                                                                    memory/4696-137-0x0000000007390000-0x00000000073A0000-memory.dmp

                                                                    memory/4696-120-0x0000000000400000-0x0000000002CD5000-memory.dmp

                                                                    memory/4696-104-0x0000000004B90000-0x0000000004BB2000-memory.dmp

                                                                    memory/4696-119-0x0000000007F90000-0x0000000007FDC000-memory.dmp

                                                                    memory/4696-130-0x0000000007390000-0x00000000073A0000-memory.dmp

                                                                    memory/4696-131-0x0000000008120000-0x000000000822A000-memory.dmp

                                                                    memory/4696-128-0x0000000007390000-0x00000000073A0000-memory.dmp

                                                                    memory/4696-127-0x0000000007390000-0x00000000073A0000-memory.dmp