Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2024 20:09

General

  • Target

    265814fa12f815634ae99f4d5819579c67e875b2c59b945979dc89ad5c85d75f.exe

  • Size

    1.8MB

  • MD5

    69f38f993bb9f5efec0dce2f949db6a9

  • SHA1

    069577e0e9154ec476b541bf0614c127481e59d3

  • SHA256

    265814fa12f815634ae99f4d5819579c67e875b2c59b945979dc89ad5c85d75f

  • SHA512

    4064492171d5c0e4dcaf578f5e4d84964476ab590bfb35689896ca467274b8440e041c8acd48cf5ec39830ceb5753ba99921a5b43f037b1807ddd635e82e4a8a

  • SSDEEP

    49152:j0B6KAY0H3afEKBB5YYdedbRwvyF9lOMJzVhIbFvQe4:j+63YQ3CEaBAdZOWzVuI7

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.137.132:1632

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

amadey

Version

4.18

C2

http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect ZGRat V1 5 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 8 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 7 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 29 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 9 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\265814fa12f815634ae99f4d5819579c67e875b2c59b945979dc89ad5c85d75f.exe
    "C:\Users\Admin\AppData\Local\Temp\265814fa12f815634ae99f4d5819579c67e875b2c59b945979dc89ad5c85d75f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:1616
  • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe
      "C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3440
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2912
    • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
      "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      PID:1748
    • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
      "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3244
        • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
          "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1528
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
          4⤵
            PID:944
            • C:\Windows\SysWOW64\choice.exe
              choice /C Y /N /D Y /T 3
              5⤵
                PID:1280
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1040
          • C:\Windows\system32\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
            3⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3408
            • C:\Windows\system32\netsh.exe
              netsh wlan show profiles
              4⤵
                PID:5108
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip' -CompressionLevel Optimal
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4512
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
            2⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            PID:4928
          • C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe
            "C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            PID:1620
          • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
            "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
            2⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4512
            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
              "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:1404
              • C:\Users\Admin\AppData\Local\Temp\1000022001\e974bf76cb.exe
                "C:\Users\Admin\AppData\Local\Temp\1000022001\e974bf76cb.exe"
                4⤵
                • Executes dropped EXE
                PID:1788
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                4⤵
                • Loads dropped DLL
                PID:3996
                • C:\Windows\system32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
                  5⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4284
                  • C:\Windows\system32\netsh.exe
                    netsh wlan show profiles
                    6⤵
                      PID:1040
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip' -CompressionLevel Optimal
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4308
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
                  4⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:2416
            • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe"
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3500
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe" /F
                3⤵
                • Creates scheduled task(s)
                PID:4300
              • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4404
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1148
                • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2920
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4600
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                      PID:2420
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        6⤵
                        • Modifies Windows Firewall
                        PID:3368
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1616
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:216
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      5⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:1668
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:588
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                        6⤵
                        • Creates scheduled task(s)
                        PID:1312
                      • C:\Windows\SYSTEM32\schtasks.exe
                        schtasks /delete /tn ScheduledUpdate /f
                        6⤵
                          PID:4444
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2528
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3436
                        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                          C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                          6⤵
                            PID:5028
                          • C:\Windows\SYSTEM32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            6⤵
                            • Creates scheduled task(s)
                            PID:4144
                          • C:\Windows\windefender.exe
                            "C:\Windows\windefender.exe"
                            6⤵
                              PID:3892
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                7⤵
                                  PID:5128
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    8⤵
                                    • Launches sc.exe
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:5144
                      • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                        "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3660
                      • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                        "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1180
                    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                      C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:2276
                    • C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                      C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
                      1⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:2472
                      • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe"
                        2⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:1464
                      • C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000100001\NewB.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:4708
                      • C:\Users\Admin\AppData\Local\Temp\1000107001\redlinepanel.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000107001\redlinepanel.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2664
                      • C:\Users\Admin\AppData\Local\Temp\1000111001\goldprimeldlldf.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000111001\goldprimeldlldf.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:4324
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:744
                      • C:\Users\Admin\AppData\Local\Temp\1000113001\32456.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000113001\32456.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1660
                      • C:\Users\Admin\AppData\Local\Temp\1000118001\alex1234.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000118001\alex1234.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:1872
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          3⤵
                            PID:3284
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            3⤵
                            • Checks computer location settings
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3056
                            • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                              "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:832
                            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                              "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:628
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                              4⤵
                                PID:5596
                                • C:\Windows\SysWOW64\choice.exe
                                  choice /C Y /N /D Y /T 3
                                  5⤵
                                    PID:5644
                            • C:\Windows\SysWOW64\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                              2⤵
                              • Loads dropped DLL
                              PID:3436
                              • C:\Windows\system32\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
                                3⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:4700
                                • C:\Windows\system32\netsh.exe
                                  netsh wlan show profiles
                                  4⤵
                                    PID:2904
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip' -CompressionLevel Optimal
                                    4⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4708
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                2⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:5752
                            • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                              C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                              1⤵
                              • Executes dropped EXE
                              PID:2680
                            • C:\Windows\windefender.exe
                              C:\Windows\windefender.exe
                              1⤵
                              • Modifies data under HKEY_USERS
                              PID:5164
                            • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:5220
                            • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                              C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                              1⤵
                              • Executes dropped EXE
                              PID:436

                            Network

                            MITRE ATT&CK Matrix ATT&CK v13

                            Execution

                            Scheduled Task/Job

                            1
                            T1053

                            Persistence

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Scheduled Task/Job

                            1
                            T1053

                            Privilege Escalation

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Scheduled Task/Job

                            1
                            T1053

                            Defense Evasion

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Impair Defenses

                            1
                            T1562

                            Disable or Modify System Firewall

                            1
                            T1562.004

                            Modify Registry

                            2
                            T1112

                            Subvert Trust Controls

                            1
                            T1553

                            Install Root Certificate

                            1
                            T1553.004

                            Credential Access

                            Unsecured Credentials

                            4
                            T1552

                            Credentials In Files

                            3
                            T1552.001

                            Credentials in Registry

                            1
                            T1552.002

                            Discovery

                            Query Registry

                            6
                            T1012

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            System Information Discovery

                            4
                            T1082

                            Collection

                            Data from Local System

                            4
                            T1005

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              3KB

                              MD5

                              fe3aab3ae544a134b68e881b82b70169

                              SHA1

                              926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6

                              SHA256

                              bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b

                              SHA512

                              3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\redlinepanel.exe.log
                              Filesize

                              2KB

                              MD5

                              f57bf6e78035d7f9150292a466c1a82d

                              SHA1

                              58cce014a5e6a6c6d08f77b1de4ce48e31bc4331

                              SHA256

                              25a36c129865722052d07b37daa985a3e4b64def94120b6343fb5a96d9026415

                              SHA512

                              fa240d2d26370589457780269bae17a883538f535e6e462cc1f969306522526faacd314d29e78f71902b799046e4395c86c34007d2cfee5090e01cd72150675f

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              74cd4674166ac8f1bea0a81b6bb8eabc

                              SHA1

                              0e7e9faee65e22e86a0f47664f3489c12e710d90

                              SHA256

                              430d083ba64e6ecf668e892360b5a4a3423ff492e84f01f14aa69957de2e1e44

                              SHA512

                              ce07207402aefa1503da21c5cc29e55f777abd5a04b2b41061c6d6a37da7ec3a2df0388c7481bf0c71e4f656cb703ca19c6ecde9cbe5ae21d2948321ee7d7391

                            • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
                              Filesize

                              1.8MB

                              MD5

                              69f38f993bb9f5efec0dce2f949db6a9

                              SHA1

                              069577e0e9154ec476b541bf0614c127481e59d3

                              SHA256

                              265814fa12f815634ae99f4d5819579c67e875b2c59b945979dc89ad5c85d75f

                              SHA512

                              4064492171d5c0e4dcaf578f5e4d84964476ab590bfb35689896ca467274b8440e041c8acd48cf5ec39830ceb5753ba99921a5b43f037b1807ddd635e82e4a8a

                            • C:\Users\Admin\AppData\Local\Temp\1000022001\e974bf76cb.exe
                              Filesize

                              823KB

                              MD5

                              d1c67770f3ff21687709ef0f9ec6c5aa

                              SHA1

                              f12c887eb6ccb6955e15d9d22484e1d7db632d87

                              SHA256

                              a418e06af747884788a7797b82f523306c450f4082f078ac52dfb245e27dfe74

                              SHA512

                              e9a9c350cfc6b30f0606f4c3a85bc599397d9dde58254e690a00484603771ab32821a76157de339c00827fa4fdcec8d4277f7b28e3aa19e85f5ebcf675fe7370

                            • C:\Users\Admin\AppData\Local\Temp\1000022001\e974bf76cb.exe
                              Filesize

                              192KB

                              MD5

                              953afd687bfc09cc77406642d1ab5b4d

                              SHA1

                              81ed04533bc472f8b2c811ce725a1fe55ffee766

                              SHA256

                              92429250a4a88e478ace1d0a83701cec1e925483d4559e2c4cfd63920ce7436b

                              SHA512

                              6d53ce43c99c06741479291ba72a720e38db65408e87044ebe4c8a6569d4dafc374ce64503359aea7b124e63d4978b1d97acaa061d5c611f9c7705d496a48316

                            • C:\Users\Admin\AppData\Local\Temp\1000087001\amadka.exe
                              Filesize

                              1024KB

                              MD5

                              9a20296fd8eeb375278c9f8978b1df0b

                              SHA1

                              e84943243b82819498e2a6cf34f3e37ba6a4bfb2

                              SHA256

                              5ba22b4a70a8bd59393dc91a28e5c1438b85b3b0cdd076c9954ee6f4662001e4

                              SHA512

                              f74570f46cbff89fb8ab0dcaac63bb6f338f1e35d06160b8c5586b28ffba57a50c755512b84ab364c3a9d078316c7b1e57cff23d503d1fa1bb79d010cd3513a3

                            • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                              Filesize

                              4.1MB

                              MD5

                              6d5a96bb6e77a5a8f369697f8ccf447b

                              SHA1

                              0a4111fa4771ab17009095b048f16248c872f05b

                              SHA256

                              49b675c9649ea00947e11b2b612c102719eff428fdecbf8d50ad9b640238104d

                              SHA512

                              c601ebfbd0a5cbfc8aa732fee263e98e762c014c64055e724f9b454f9ab7742890669645b314e7a120d6d6b7ea16d7da6b39b573a9146144201774214c206e1e

                            • C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe
                              Filesize

                              1.8MB

                              MD5

                              8548efb7c92f7067845487d357432e4e

                              SHA1

                              b26e38928d24572be4e99284c93fc7643d9e9a30

                              SHA256

                              781a78b50aac3b36ae2ef1e6f517174d7881a604fb2003ce8838185ed9e05965

                              SHA512

                              c17041814893d7de57cc6728c8f51ff240f71781e21e6b10b4be41f94fe260675a499d976bae5106727a1d22a77ff702a347dfaf92d572024b87cd7256a156b5

                            • C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe
                              Filesize

                              162B

                              MD5

                              1b7c22a214949975556626d7217e9a39

                              SHA1

                              d01c97e2944166ed23e47e4a62ff471ab8fa031f

                              SHA256

                              340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                              SHA512

                              ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                            • C:\Users\Admin\AppData\Local\Temp\1000837001\goldprimeldlldf.exe
                              Filesize

                              464KB

                              MD5

                              c084d6f6ba40534fbfc5a64b21ef99ab

                              SHA1

                              0b4a17da83c0a8abbc8fab321931d5447b32b720

                              SHA256

                              afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

                              SHA512

                              a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

                            • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
                              Filesize

                              3.0MB

                              MD5

                              1259cf47cff5a1b9d01c31b49addd53f

                              SHA1

                              bbd12cfc45b85cc83869b79c13168d9464a5a4fd

                              SHA256

                              125026da84806a8ea58f15ab87929f6b644ea5a6c7ec4587dfee1ed71d1a1792

                              SHA512

                              7c2d89161a24c979697599efdfe222b01b02591623c8e2394bc57a9b4420c7d6779b16c9e701c668acf4130d8facad5ce1904d2e511c168a7cb20fba2f2a8ac6

                            • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                              Filesize

                              1.7MB

                              MD5

                              85a15f080b09acace350ab30460c8996

                              SHA1

                              3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

                              SHA256

                              3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

                              SHA512

                              ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

                            • C:\Users\Admin\AppData\Local\Temp\1001022001\chckik.exe
                              Filesize

                              413KB

                              MD5

                              d467222c3bd563cb72fa49302f80b079

                              SHA1

                              9335e2a36abb8309d8a2075faf78d66b968b2a91

                              SHA256

                              fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e

                              SHA512

                              484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7

                            • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                              Filesize

                              1.9MB

                              MD5

                              a3783c56ec85a68ad5ac12797df4eac8

                              SHA1

                              8b44c5479c06c0835fd29ce1c5d3638ec67ffe7e

                              SHA256

                              21c97b7886d56372292bf660056ce0ab83a6229afb23eb166caeb09f1927d5a3

                              SHA512

                              89017cc01b725ca4e579043be0d9e79733a6a07e36aabb83e015685335060724e3183e8dfb56325f577d1083e84064124d02f46f2093fbcb9772aef789d1d4c0

                            • C:\Users\Admin\AppData\Local\Temp\1001036001\NewB.exe
                              Filesize

                              418KB

                              MD5

                              0099a99f5ffb3c3ae78af0084136fab3

                              SHA1

                              0205a065728a9ec1133e8a372b1e3864df776e8c

                              SHA256

                              919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                              SHA512

                              5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                            • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                              Filesize

                              301KB

                              MD5

                              832eb4dc3ed8ceb9a1735bd0c7acaf1b

                              SHA1

                              b622a406927fbb8f6cd5081bd4455fb831948fca

                              SHA256

                              2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

                              SHA512

                              3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

                            • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                              Filesize

                              499KB

                              MD5

                              83d0b41c7a3a0d29a268b49a313c5de5

                              SHA1

                              46f3251c771b67b40b1f3268caef8046174909a5

                              SHA256

                              09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

                              SHA512

                              705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

                            • C:\Users\Admin\AppData\Local\Temp\660967641992_Desktop.zip
                              Filesize

                              22B

                              MD5

                              76cdb2bad9582d23c1f6f4d868218d6c

                              SHA1

                              b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

                              SHA256

                              8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

                              SHA512

                              5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

                            • C:\Users\Admin\AppData\Local\Temp\TmpC803.tmp
                              Filesize

                              2KB

                              MD5

                              1420d30f964eac2c85b2ccfe968eebce

                              SHA1

                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                              SHA256

                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                              SHA512

                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5rcjwsrg.dra.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                              Filesize

                              109KB

                              MD5

                              2afdbe3b99a4736083066a13e4b5d11a

                              SHA1

                              4d4856cf02b3123ac16e63d4a448cdbcb1633546

                              SHA256

                              8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

                              SHA512

                              d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

                            • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                              Filesize

                              1.2MB

                              MD5

                              92fbdfccf6a63acef2743631d16652a7

                              SHA1

                              971968b1378dd89d59d7f84bf92f16fc68664506

                              SHA256

                              b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

                              SHA512

                              b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

                            • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                              Filesize

                              109KB

                              MD5

                              726cd06231883a159ec1ce28dd538699

                              SHA1

                              404897e6a133d255ad5a9c26ac6414d7134285a2

                              SHA256

                              12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

                              SHA512

                              9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

                            • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                              Filesize

                              1.2MB

                              MD5

                              15a42d3e4579da615a384c717ab2109b

                              SHA1

                              22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

                              SHA256

                              3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

                              SHA512

                              1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

                            • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                              Filesize

                              109KB

                              MD5

                              154c3f1334dd435f562672f2664fea6b

                              SHA1

                              51dd25e2ba98b8546de163b8f26e2972a90c2c79

                              SHA256

                              5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

                              SHA512

                              1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

                            • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
                              Filesize

                              1.2MB

                              MD5

                              f35b671fda2603ec30ace10946f11a90

                              SHA1

                              059ad6b06559d4db581b1879e709f32f80850872

                              SHA256

                              83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

                              SHA512

                              b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

                            • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                              Filesize

                              541KB

                              MD5

                              1fc4b9014855e9238a361046cfbf6d66

                              SHA1

                              c17f18c8246026c9979ab595392a14fe65cc5e9f

                              SHA256

                              f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

                              SHA512

                              2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

                            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                              Filesize

                              304KB

                              MD5

                              cc90e3326d7b20a33f8037b9aab238e4

                              SHA1

                              236d173a6ac462d85de4e866439634db3b9eeba3

                              SHA256

                              bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

                              SHA512

                              b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

                            • C:\Users\Public\Desktop\Google Chrome.lnk
                              Filesize

                              2KB

                              MD5

                              ca599ab7ae7f8ae92d3c62a4107304c0

                              SHA1

                              11ea6b1bcad9308bfcf1cdf190961e5af8e4731f

                              SHA256

                              e0ac7b60c603df6b2cb26e497aba8e4aadac3af23a2e17bdba6e97ab6c29bf82

                              SHA512

                              e948b7dbf8690f866bf255cf4d605227919fbafb40474b35aa6c64d63626c53717d1bdcf2509bbda489a3e506279b372ca4e0f5bd8289ef0daba19f72813e104

                            • C:\Users\Public\Desktop\Microsoft Edge.lnk
                              Filesize

                              2KB

                              MD5

                              c75ff6972ad7aee1c2a12838f83a9b17

                              SHA1

                              61e1012e239c13efb82ede15f07657fec59563f9

                              SHA256

                              29b9b7b848aaea113183e1dbd9e06cf0542cea61c93260a4979fc62bfe27fa1e

                              SHA512

                              da88addcd943cf47a78f6edd970517380664eccda9a117a0d9d37e658d554770fab2482ad83bc620b92a51b80a2cc5637082e1a13e3435742db636d76b29bb38

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              3d086a433708053f9bf9523e1d87a4e8

                              SHA1

                              b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                              SHA256

                              6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                              SHA512

                              931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                              Filesize

                              19KB

                              MD5

                              ecda61528e697f6d363c2a35e9cb338f

                              SHA1

                              bb5deb8ef6cbcf1df32347d54f9ac87d04904719

                              SHA256

                              23f100341ce7b43693e1d3bbbd49735a592b3872387d46406590fe49abe649f6

                              SHA512

                              86f6c40945aec71e246e783d941227eea23a3740b9c297def5591519e486695d1c85837cc0d221acee852b68ef19f4cbe9bea12ccb16a47c59d5bacfb05d4e74

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                              Filesize

                              19KB

                              MD5

                              b07ee007ce40370863e779a37e7fe3ff

                              SHA1

                              4479da45a390256b48c8ac83adac7c9bbaf2e29c

                              SHA256

                              e926f575a3de728c43013c94e1b73a42238bd3b96c6c8a06525cd8f2a484fc52

                              SHA512

                              08a82f2a15fef56ac5738cd57b8ab40b276bdc68e69a69f5dd8e2451d888152e50e9a5c9980db96ed70515752ffe7b84a4211d61a3a0778d876e82a013e420b1

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                              Filesize

                              19KB

                              MD5

                              fd4e94668bcd78a4b8eb1e9f9b0bc80f

                              SHA1

                              bc576984c8f851c159d5f2a28be1a10a1a9740b2

                              SHA256

                              74b8f6fd73edf2ef3c00a090fef2d16042a308d13656ea54c5ad29500c4b5c1f

                              SHA512

                              f6d1bba60b3024e565f248f6de85736729da2e7fe257a9b4acc41a7a7dc14b8822ced2efe2bb0de2c5840619a7cb5db8a1303c24dafa36bcbb1cf3bafa2c2d8e

                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                              Filesize

                              19KB

                              MD5

                              e8f2ebd6ab38469f0b8f0130acf756aa

                              SHA1

                              b852c072af8257f261f778470689ba242f3b0ac8

                              SHA256

                              c0d7c0d657cad3a31a2821f026a9cc1f469241e8738576ff797750c243446961

                              SHA512

                              f8814f7f744e0af0c057c40f4c22ec7e791047f27d5421f1e85fb466816157a94fe650ac95ef9eb4ce6f04f264d5b241026c51671b89efa7e8a1497e7835b453

                            • memory/552-25-0x0000000004F50000-0x0000000004F51000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-28-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-223-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-21-0x0000000004F60000-0x0000000004F61000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-937-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-1104-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-549-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-23-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-96-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-29-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-98-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-27-0x0000000004F90000-0x0000000004F91000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-26-0x0000000004F40000-0x0000000004F41000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-22-0x0000000004F70000-0x0000000004F71000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-24-0x0000000004F30000-0x0000000004F31000-memory.dmp
                              Filesize

                              4KB

                            • memory/552-673-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-270-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-1085-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-1080-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-407-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-20-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-19-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-1023-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/552-1060-0x0000000000D90000-0x000000000123E000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/1404-1034-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-1064-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-503-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-1083-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-881-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-1102-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-956-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1404-598-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1464-780-0x0000000000190000-0x0000000000665000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/1528-194-0x000000001B620000-0x000000001B630000-memory.dmp
                              Filesize

                              64KB

                            • memory/1528-193-0x00007FFF16E90000-0x00007FFF17951000-memory.dmp
                              Filesize

                              10.8MB

                            • memory/1528-192-0x00000000008E0000-0x000000000096C000-memory.dmp
                              Filesize

                              560KB

                            • memory/1568-141-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/1568-124-0x0000000000400000-0x0000000000592000-memory.dmp
                              Filesize

                              1.6MB

                            • memory/1568-140-0x00000000010E0000-0x00000000010F0000-memory.dmp
                              Filesize

                              64KB

                            • memory/1616-10-0x0000000005100000-0x0000000005101000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-6-0x00000000050E0000-0x00000000050E1000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-1-0x0000000077EC4000-0x0000000077EC6000-memory.dmp
                              Filesize

                              8KB

                            • memory/1616-2-0x0000000000520000-0x00000000009CE000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/1616-7-0x0000000005070000-0x0000000005071000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-8-0x0000000005080000-0x0000000005081000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-16-0x0000000000520000-0x00000000009CE000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/1616-3-0x00000000050A0000-0x00000000050A1000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-9-0x00000000050D0000-0x00000000050D1000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-4-0x00000000050B0000-0x00000000050B1000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-11-0x00000000050F0000-0x00000000050F1000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-5-0x0000000005090000-0x0000000005091000-memory.dmp
                              Filesize

                              4KB

                            • memory/1616-0-0x0000000000520000-0x00000000009CE000-memory.dmp
                              Filesize

                              4.7MB

                            • memory/1668-1045-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/1668-1066-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/1668-1001-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/1668-1087-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/1668-941-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/1748-271-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-409-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-195-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-1024-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-1061-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-99-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-535-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-1081-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-97-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-674-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-1086-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-224-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/1748-938-0x0000000000550000-0x00000000008ED000-memory.dmp
                              Filesize

                              3.6MB

                            • memory/2276-720-0x0000000000670000-0x0000000000B45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/2516-130-0x0000000002660000-0x0000000004660000-memory.dmp
                              Filesize

                              32.0MB

                            • memory/2516-129-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/2516-121-0x0000000002610000-0x0000000002620000-memory.dmp
                              Filesize

                              64KB

                            • memory/2516-120-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/2516-119-0x0000000000100000-0x00000000002BC000-memory.dmp
                              Filesize

                              1.7MB

                            • memory/2912-185-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/2912-191-0x00000000058F0000-0x0000000005900000-memory.dmp
                              Filesize

                              64KB

                            • memory/2912-67-0x0000000005660000-0x00000000056F2000-memory.dmp
                              Filesize

                              584KB

                            • memory/2912-69-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/2912-66-0x0000000005B30000-0x00000000060D4000-memory.dmp
                              Filesize

                              5.6MB

                            • memory/2912-70-0x0000000005640000-0x000000000564A000-memory.dmp
                              Filesize

                              40KB

                            • memory/2912-62-0x0000000000400000-0x0000000000450000-memory.dmp
                              Filesize

                              320KB

                            • memory/2912-71-0x00000000058F0000-0x0000000005900000-memory.dmp
                              Filesize

                              64KB

                            • memory/2912-145-0x00000000066A0000-0x0000000006706000-memory.dmp
                              Filesize

                              408KB

                            • memory/2912-73-0x00000000084D0000-0x00000000085DA000-memory.dmp
                              Filesize

                              1.0MB

                            • memory/2912-74-0x0000000006B20000-0x0000000006B32000-memory.dmp
                              Filesize

                              72KB

                            • memory/2912-72-0x0000000006C50000-0x0000000007268000-memory.dmp
                              Filesize

                              6.1MB

                            • memory/2912-75-0x0000000006B80000-0x0000000006BBC000-memory.dmp
                              Filesize

                              240KB

                            • memory/2912-76-0x0000000006BD0000-0x0000000006C1C000-memory.dmp
                              Filesize

                              304KB

                            • memory/2920-642-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/2920-599-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/3244-165-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/3244-166-0x0000000000B20000-0x0000000000B72000-memory.dmp
                              Filesize

                              328KB

                            • memory/3244-183-0x00000000060A0000-0x0000000006116000-memory.dmp
                              Filesize

                              472KB

                            • memory/3244-187-0x00000000056F0000-0x0000000005700000-memory.dmp
                              Filesize

                              64KB

                            • memory/3244-186-0x0000000006870000-0x000000000688E000-memory.dmp
                              Filesize

                              120KB

                            • memory/3440-65-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/3440-57-0x0000000000420000-0x000000000049A000-memory.dmp
                              Filesize

                              488KB

                            • memory/3440-184-0x0000000002860000-0x0000000004860000-memory.dmp
                              Filesize

                              32.0MB

                            • memory/3440-58-0x0000000073AD0000-0x0000000074280000-memory.dmp
                              Filesize

                              7.7MB

                            • memory/3440-59-0x0000000004E10000-0x0000000004E20000-memory.dmp
                              Filesize

                              64KB

                            • memory/3440-68-0x0000000002860000-0x0000000004860000-memory.dmp
                              Filesize

                              32.0MB

                            • memory/3892-1002-0x0000000000400000-0x00000000008DF000-memory.dmp
                              Filesize

                              4.9MB

                            • memory/4404-533-0x0000000000400000-0x0000000000D1C000-memory.dmp
                              Filesize

                              9.1MB

                            • memory/4512-198-0x0000028E71AA0000-0x0000028E71AB0000-memory.dmp
                              Filesize

                              64KB

                            • memory/4512-196-0x00007FFF16E90000-0x00007FFF17951000-memory.dmp
                              Filesize

                              10.8MB

                            • memory/4512-327-0x0000000000970000-0x0000000000E45000-memory.dmp
                              Filesize

                              4.8MB

                            • memory/4512-197-0x0000028E71AA0000-0x0000028E71AB0000-memory.dmp
                              Filesize

                              64KB

                            • memory/5164-1100-0x0000000000400000-0x00000000008DF000-memory.dmp
                              Filesize

                              4.9MB