Malware Analysis Report

2024-11-30 02:15

Sample ID 240326-1fyg6sda29
Target Installer (2).exe
SHA256 2e1a346d13ae17dff86d8b824ec3b78e097827f67322c0c6175670db8c41303e
Tags
risepro collection stealer rhadamanthys persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2e1a346d13ae17dff86d8b824ec3b78e097827f67322c0c6175670db8c41303e

Threat Level: Known bad

The file Installer (2).exe was found to be: Known bad.

Malicious Activity Summary

risepro collection stealer rhadamanthys persistence

Suspicious use of NtCreateUserProcessOtherParentProcess

Rhadamanthys

RisePro

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Drops file in Program Files directory

Program crash

Checks processor information in registry

outlook_office_path

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

outlook_win_path

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-26 21:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-26 21:36

Reported

2024-03-26 21:40

Platform

win7-20240215-en

Max time kernel

125s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Installer (2).exe"

Signatures

RisePro

stealer risepro

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\microsoftgame\connection1503.exe N/A
N/A N/A C:\Program Files\microsoftgame\update1503.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2584 set thread context of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\microsoftgame\connection1503.zip C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File created C:\Program Files\microsoftgame\connection1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File opened for modification C:\Program Files\microsoftgame\connection1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File created C:\Program Files\microsoftgame\update1503.zip C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File created C:\Program Files\microsoftgame\update1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File opened for modification C:\Program Files\microsoftgame\update1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 352 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\connection1503.exe
PID 352 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\connection1503.exe
PID 352 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\connection1503.exe
PID 352 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\update1503.exe
PID 352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\update1503.exe
PID 352 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\update1503.exe
PID 2584 wrote to memory of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2584 wrote to memory of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2584 wrote to memory of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2584 wrote to memory of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2584 wrote to memory of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2584 wrote to memory of 2696 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Installer (2).exe

"C:\Users\Admin\AppData\Local\Temp\Installer (2).exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Program Files\microsoftgame\connection1503.exe

"C:\Program Files\microsoftgame\connection1503.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Program Files\microsoftgame\update1503.exe

"C:\Program Files\microsoftgame\update1503.exe"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 ipwhois.pro udp
DE 195.201.57.90:80 ipwhois.pro tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 6-z.com udp
RU 79.137.192.11:443 6-z.com tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
FI 95.216.41.236:50500 tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 db-ip.com udp
US 172.67.75.166:443 db-ip.com tcp
FI 95.216.41.236:50500 tcp

Files

memory/352-5-0x0000000002BF0000-0x0000000003010000-memory.dmp

memory/352-9-0x000000000C3B0000-0x0000000011530000-memory.dmp

memory/352-14-0x0000000001CB0000-0x0000000001CE0000-memory.dmp

memory/352-17-0x000000013F9D0000-0x00000001402FC000-memory.dmp

memory/352-19-0x00000000038F0000-0x0000000003EB0000-memory.dmp

memory/352-23-0x0000000002010000-0x0000000002120000-memory.dmp

memory/352-27-0x00000000004A0000-0x00000000004B0000-memory.dmp

memory/352-31-0x0000000002570000-0x0000000002600000-memory.dmp

memory/352-35-0x0000000002120000-0x0000000002140000-memory.dmp

memory/352-39-0x0000000002140000-0x0000000002150000-memory.dmp

memory/352-47-0x0000000003060000-0x0000000003080000-memory.dmp

memory/352-43-0x0000000003010000-0x0000000003030000-memory.dmp

memory/352-51-0x00000000045C0000-0x0000000004910000-memory.dmp

memory/352-55-0x0000000003080000-0x00000000030D0000-memory.dmp

memory/352-59-0x0000000003150000-0x0000000003160000-memory.dmp

memory/352-63-0x0000000003180000-0x0000000003190000-memory.dmp

memory/352-67-0x0000000004970000-0x0000000004980000-memory.dmp

\Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\PresentationNative_cor3.dll

MD5 0c147149b444748dae0a04e2e3d3269a
SHA1 f7edbcd6d1d6b199b6c997d6b781a794d736d3ff
SHA256 e284235a4d6e5d905692351cdfe8bc42ed842df8e5a8eb42fde90d1c3e2e90fa
SHA512 ec057829c03623cabc5a42ddebec9b75107f987eaf9cb642f3f1aed4d4c64c544f60a1dc7bc4208e025bce38c72091e615ac2fd9f1bd27651d49addcb0ae8b36

\Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\wpfgfx_cor3.dll

MD5 2ca3138aeb800aefe337d433f1590213
SHA1 0bbbd04df098d88daac40f7eac8740c6b26607ee
SHA256 053eee8408b8979a6cea211a5ee11a3f22b0090f8e6988013a79523aa25439cb
SHA512 61151f56a403b327e3ac24fd34dc22baf5049cf3d97a5bca71aa0aa7d0c1f15fb0c6c4230b849ac2763a7f1a1d34c989f71c3201938833947934d46c34e801fe

\Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\D3DCompiler_47_cor3.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

memory/352-179-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

memory/352-181-0x0000000005BC0000-0x0000000005BCA000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 cf71fb61d254bfaf28c6faa47ad7ca10
SHA1 93c7f0400f264b832316cf80591a2e7cce097db4
SHA256 f546fab7b602b0d81a0a102473cfe8df95b1c29cb122528f431b4994bd07306c
SHA512 12099971b207e2909b686071c3df4aebb2493ca26ddbef47165f14e593233c1af8008faf97f25fc3faa629f81fb7c1eaeb9fb32ef4ef26cbab4ee8e6fd5a7824

memory/2416-262-0x000000001B6B0000-0x000000001B992000-memory.dmp

memory/1624-263-0x0000000002240000-0x0000000002248000-memory.dmp

memory/2416-264-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/2416-265-0x0000000002CE0000-0x0000000002D60000-memory.dmp

memory/2416-266-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/1624-267-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/2416-268-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/1624-270-0x00000000029B0000-0x0000000002A30000-memory.dmp

memory/1624-269-0x00000000029B4000-0x00000000029B7000-memory.dmp

memory/2416-271-0x0000000002CE4000-0x0000000002CE7000-memory.dmp

memory/2416-273-0x0000000002CEB000-0x0000000002D52000-memory.dmp

memory/1624-274-0x00000000029BB000-0x0000000002A22000-memory.dmp

memory/1624-272-0x000007FEF4750000-0x000007FEF50ED000-memory.dmp

memory/352-275-0x000000013F9D0000-0x00000001402FC000-memory.dmp

\Program Files\microsoftgame\connection1503.exe

MD5 b4591bf01f419304ecfe8a2fe4a41511
SHA1 236f9da6160be2b3c9989e1ffb799c8a13a8face
SHA256 e30d09eedabcd45d9f83371c8f97987ff47b85440240754e6a26415a3e4b0b35
SHA512 4b1e7ec134fb17836f439466d4115ed275219058db94b3df0efb631d983cc331b27b45cd5bb85988d9a351d57cd05a6364a9ed1db0e0f40c181e423ddc562139

C:\Program Files\microsoftgame\connection1503.exe

MD5 0d12580a46ba44883c4dbcd83700cfa0
SHA1 760e448b1a568e262c681f463bebef781e2152b2
SHA256 a32260f5dd057b844e6e96d19162809e9e774cddc6482c51692d63a4edf638a8
SHA512 8c1cb27343848ac43fc13c46aea51c935b061a4b6629d1b6e67de20768a511431e376dcf21afdd7e0e06b3cf81aed62bc1264a095c7540a61638f04a51cb762d

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2804-304-0x0000000001F70000-0x0000000001F78000-memory.dmp

memory/2920-305-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

memory/2920-306-0x0000000002CD0000-0x0000000002D50000-memory.dmp

memory/2920-303-0x000000001B710000-0x000000001B9F2000-memory.dmp

memory/2920-307-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

memory/2804-308-0x0000000002A7B000-0x0000000002AE2000-memory.dmp

memory/2804-310-0x0000000002A74000-0x0000000002A77000-memory.dmp

memory/2804-309-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

memory/2920-311-0x0000000002CD0000-0x0000000002D50000-memory.dmp

memory/2920-312-0x0000000002CD0000-0x0000000002D50000-memory.dmp

memory/2920-313-0x000007FEF46B0000-0x000007FEF504D000-memory.dmp

\Program Files\microsoftgame\update1503.exe

MD5 1c1b225141144a7f5d8471014d922df5
SHA1 85d73110c2ecbde1c06ae4adf11ab47335babc2e
SHA256 9e12431b004e595078703b10fe7e69f8d47243e3cde9bec1caa1ed384aa0ae79
SHA512 3a9d4816ffd298adec4fe786f18ec8a72301f61ebd89c4b561b6b8ef8ffb4e7efbcdcd6049c184b76596491e3248e49ce31fe95961268f911116c04f9041338c

memory/2696-333-0x0000000000210000-0x000000000034E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\heidiOd013eCyxrFc\ZsZGuVn2ZSQ3Web Data

MD5 d5ee43d2a25c2370159327c951da3f57
SHA1 11b76c32e3a08381101d597187e3c96788659025
SHA256 c66200d56aced972e2dd7d63f73c12d0e7f575827ea54f83ac66a37f832234ed
SHA512 8108a4bcde1fed31b7ae863510e4705ad74c934a53e42dbd51cad8701c4a272af939e38076904dc7941dcbfd57aa60152798250af34696c196171a465fb5a1dd

memory/2696-397-0x0000000000210000-0x000000000034E000-memory.dmp

memory/2696-417-0x00000000008C0000-0x00000000008C1000-memory.dmp

memory/2696-419-0x0000000002870000-0x00000000028E8000-memory.dmp

memory/2696-421-0x0000000002870000-0x00000000028E8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-26 21:36

Reported

2024-03-26 21:40

Platform

win10v2004-20240226-en

Max time kernel

144s

Max time network

150s

Command Line

sihost.exe

Signatures

Rhadamanthys

stealer rhadamanthys

RisePro

stealer risepro

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4596 created 2596 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\system32\sihost.exe

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\microsoftgame\connection1503.exe N/A
N/A N/A C:\Program Files\microsoftgame\update1503.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\(1c1b225141144a7f5d8471014d922df5)update1503.exe = "C:\\Users\\Public\\AccountPictures\\(1c1b225141144a7f5d8471014d922df5)update1503.exe" C:\Program Files\microsoftgame\update1503.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ipinfo.io N/A N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ipinfo.io N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\microsoftgame\update1503.zip C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File created C:\Program Files\microsoftgame\update1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File opened for modification C:\Program Files\microsoftgame\update1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File created C:\Program Files\microsoftgame\connection1503.zip C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File created C:\Program Files\microsoftgame\connection1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
File opened for modification C:\Program Files\microsoftgame\connection1503.exe C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\microsoftgame\connection1503.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4252 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\connection1503.exe
PID 4252 wrote to memory of 4992 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\connection1503.exe
PID 4252 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4252 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\update1503.exe
PID 4252 wrote to memory of 2348 N/A C:\Users\Admin\AppData\Local\Temp\Installer (2).exe C:\Program Files\microsoftgame\update1503.exe
PID 4992 wrote to memory of 4596 N/A C:\Program Files\microsoftgame\connection1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 4992 wrote to memory of 4596 N/A C:\Program Files\microsoftgame\connection1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 4992 wrote to memory of 4596 N/A C:\Program Files\microsoftgame\connection1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 4992 wrote to memory of 4596 N/A C:\Program Files\microsoftgame\connection1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 4992 wrote to memory of 4596 N/A C:\Program Files\microsoftgame\connection1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 4596 wrote to memory of 3488 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\SysWOW64\dialer.exe
PID 4596 wrote to memory of 3488 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\SysWOW64\dialer.exe
PID 4596 wrote to memory of 3488 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\SysWOW64\dialer.exe
PID 4596 wrote to memory of 3488 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\SysWOW64\dialer.exe
PID 4596 wrote to memory of 3488 N/A C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe C:\Windows\SysWOW64\dialer.exe
PID 2348 wrote to memory of 652 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2348 wrote to memory of 652 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2348 wrote to memory of 652 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2348 wrote to memory of 652 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
PID 2348 wrote to memory of 652 N/A C:\Program Files\microsoftgame\update1503.exe C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe N/A

Processes

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\Installer (2).exe

"C:\Users\Admin\AppData\Local\Temp\Installer (2).exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Program Files\microsoftgame\connection1503.exe

"C:\Program Files\microsoftgame\connection1503.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Add-MpPreference -ExclusionPath 'C:/Program Files/microsoftgame'

C:\Program Files\microsoftgame\update1503.exe

"C:\Program Files\microsoftgame\update1503.exe"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\SysWOW64\dialer.exe

"C:\Windows\system32\dialer.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4596 -ip 4596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4596 -ip 4596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 424

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 40.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 152.74.67.172.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 ipwhois.pro udp
DE 195.201.57.90:80 ipwhois.pro tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 90.57.201.195.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 6-z.com udp
RU 79.137.192.11:443 6-z.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 11.192.137.79.in-addr.arpa udp
DE 195.201.57.90:80 ipwhois.pro tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 49.118.77.104.in-addr.arpa udp
FI 95.216.41.236:50500 tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 236.41.216.95.in-addr.arpa udp
US 8.8.8.8:53 db-ip.com udp
US 104.26.4.15:443 db-ip.com tcp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 15.4.26.104.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
FI 95.216.41.236:50500 tcp
US 8.8.8.8:53 85.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\PresentationNative_cor3.dll

MD5 0c147149b444748dae0a04e2e3d3269a
SHA1 f7edbcd6d1d6b199b6c997d6b781a794d736d3ff
SHA256 e284235a4d6e5d905692351cdfe8bc42ed842df8e5a8eb42fde90d1c3e2e90fa
SHA512 ec057829c03623cabc5a42ddebec9b75107f987eaf9cb642f3f1aed4d4c64c544f60a1dc7bc4208e025bce38c72091e615ac2fd9f1bd27651d49addcb0ae8b36

C:\Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\wpfgfx_cor3.dll

MD5 2ca3138aeb800aefe337d433f1590213
SHA1 0bbbd04df098d88daac40f7eac8740c6b26607ee
SHA256 053eee8408b8979a6cea211a5ee11a3f22b0090f8e6988013a79523aa25439cb
SHA512 61151f56a403b327e3ac24fd34dc22baf5049cf3d97a5bca71aa0aa7d0c1f15fb0c6c4230b849ac2763a7f1a1d34c989f71c3201938833947934d46c34e801fe

C:\Users\Admin\AppData\Local\Temp\.net\Installer (2)\a8aMwpSmSRiydchTZFml8SDbGi80c5Y=\D3DCompiler_47_cor3.dll

MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

memory/2752-13-0x0000021A47080000-0x0000021A470A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzsbfn4f.gqu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2752-23-0x00007FFEAFBA0000-0x00007FFEB0661000-memory.dmp

memory/2752-24-0x0000021A47070000-0x0000021A47080000-memory.dmp

memory/2752-25-0x0000021A47070000-0x0000021A47080000-memory.dmp

memory/4548-26-0x0000019ED03E0000-0x0000019ED03F0000-memory.dmp

memory/4548-36-0x00007FFEAFBA0000-0x00007FFEB0661000-memory.dmp

memory/2752-37-0x0000021A47070000-0x0000021A47080000-memory.dmp

memory/2752-40-0x00007FFEAFBA0000-0x00007FFEB0661000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

memory/4548-44-0x00007FFEAFBA0000-0x00007FFEB0661000-memory.dmp

C:\Program Files\microsoftgame\connection1503.exe

MD5 e805962996160817b81d5851ac0efe64
SHA1 d9cfca926d93576360f2bec2e0a1ae4bd05f3e69
SHA256 2b45d2908e1e194d8fbd037b8f1bd4235ac1146eb1d7927e94631e1da8038684
SHA512 c27dfad849a081b7e6b11d93ade474890d5ea38220e92dc090e082675470458cc62cb23dce59f5bde6148856c320aabb743cb59cf950a75e0e4a0ace90e2470f

C:\Program Files\microsoftgame\connection1503.exe

MD5 0d12580a46ba44883c4dbcd83700cfa0
SHA1 760e448b1a568e262c681f463bebef781e2152b2
SHA256 a32260f5dd057b844e6e96d19162809e9e774cddc6482c51692d63a4edf638a8
SHA512 8c1cb27343848ac43fc13c46aea51c935b061a4b6629d1b6e67de20768a511431e376dcf21afdd7e0e06b3cf81aed62bc1264a095c7540a61638f04a51cb762d

memory/796-52-0x00007FFEAF0D0000-0x00007FFEAFB91000-memory.dmp

memory/3408-72-0x00007FFEAF0D0000-0x00007FFEAFB91000-memory.dmp

memory/3408-73-0x000001C0FA3B0000-0x000001C0FA3C0000-memory.dmp

memory/796-74-0x000002CEB6EC0000-0x000002CEB6ED0000-memory.dmp

memory/3408-75-0x000001C0FA3B0000-0x000001C0FA3C0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 1099dc40baabde4be41cc1faf6353f7d
SHA1 345705c6b9adc64389b6d142e7484d0cdd4f2bd0
SHA256 6cec99d44ed65e73240a96691f299a41e944a9c8f59c543df3ecd73d95c8bf40
SHA512 6315f1089cc8139531acc422741290c84a60841a65a8cc9844cd907c96694d33d164120c36f460a0bef03e67e2a60c33f9c968ac41edf3dd82cab015e00e74a1

memory/3408-81-0x00007FFEAF0D0000-0x00007FFEAFB91000-memory.dmp

memory/796-82-0x00007FFEAF0D0000-0x00007FFEAFB91000-memory.dmp

C:\Program Files\microsoftgame\update1503.exe

MD5 1c1b225141144a7f5d8471014d922df5
SHA1 85d73110c2ecbde1c06ae4adf11ab47335babc2e
SHA256 9e12431b004e595078703b10fe7e69f8d47243e3cde9bec1caa1ed384aa0ae79
SHA512 3a9d4816ffd298adec4fe786f18ec8a72301f61ebd89c4b561b6b8ef8ffb4e7efbcdcd6049c184b76596491e3248e49ce31fe95961268f911116c04f9041338c

memory/4992-93-0x00007FF6ADE00000-0x00007FF6AF5E9000-memory.dmp

memory/4596-96-0x0000000000D90000-0x0000000000DFD000-memory.dmp

memory/4992-97-0x00007FF6ADE00000-0x00007FF6AF5E9000-memory.dmp

memory/4596-99-0x0000000000D90000-0x0000000000DFD000-memory.dmp

memory/4596-100-0x0000000000D90000-0x0000000000DFD000-memory.dmp

memory/4596-101-0x0000000003FE0000-0x00000000043E0000-memory.dmp

memory/4596-102-0x0000000003FE0000-0x00000000043E0000-memory.dmp

memory/4596-103-0x0000000003FE0000-0x00000000043E0000-memory.dmp

memory/4596-104-0x00007FFECFBB0000-0x00007FFECFDA5000-memory.dmp

memory/4596-106-0x0000000003FE0000-0x00000000043E0000-memory.dmp

memory/4596-107-0x0000000075570000-0x0000000075785000-memory.dmp

memory/3488-108-0x00000000004A0000-0x00000000004A9000-memory.dmp

memory/3488-111-0x0000000002370000-0x0000000002770000-memory.dmp

memory/2348-110-0x00007FF65E7E0000-0x00007FF65F4A9000-memory.dmp

memory/3488-112-0x00007FFECFBB0000-0x00007FFECFDA5000-memory.dmp

memory/3488-114-0x0000000002370000-0x0000000002770000-memory.dmp

memory/3488-115-0x0000000075570000-0x0000000075785000-memory.dmp

memory/3488-116-0x0000000002370000-0x0000000002770000-memory.dmp

memory/4596-117-0x0000000003FE0000-0x00000000043E0000-memory.dmp

memory/652-120-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/2348-121-0x00007FF65E7E0000-0x00007FF65F4A9000-memory.dmp

memory/652-122-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-123-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-124-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-125-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-126-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-137-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-138-0x0000000000A60000-0x0000000000B9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\heidiJfz1IJm_pyOU\6xZUKNQxCZepWeb Data

MD5 d8258cfea30050e289acf9aa882159f2
SHA1 26acf382025e2880308c3cb82ee11b935f52d6fa
SHA256 97f3a97af8aad5da47509b3b5639b85c82f5b67fb34193ef409c9bb84c2e334b
SHA512 caa184c63653b9b8be5b76833be8caf40d8a6804cc26b329d955e5b59e5cf75c0e9e654f5e4fef9fdb76536f43fe3d9a4017a3446f0610d6df61f3737f44a74a

C:\Users\Admin\AppData\Local\Temp\heidiJfz1IJm_pyOU\2xaxn_WzOTetWeb Data

MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

memory/652-184-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-185-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-195-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-197-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-202-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-209-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-210-0x0000000003260000-0x0000000003261000-memory.dmp

memory/652-211-0x0000000003280000-0x00000000032F8000-memory.dmp

memory/652-214-0x0000000000A60000-0x0000000000B9E000-memory.dmp

memory/652-215-0x0000000003280000-0x00000000032F8000-memory.dmp