Malware Analysis Report

2025-01-22 09:08

Sample ID 240520-kwe3rsda8y
Target d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe
SHA256 d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463
Tags
redline @shehqqq6 execution infostealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463

Threat Level: Known bad

The file d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe was found to be: Known bad.

Malicious Activity Summary

redline @shehqqq6 execution infostealer spyware

RedLine

RedLine payload

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Enumerates physical storage devices

Command and Scripting Interpreter: PowerShell

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Views/modifies file attributes

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-20 08:56

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-20 08:56

Reported

2024-05-20 08:59

Platform

win7-20231129-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe

"C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"

Network

N/A

Files

memory/1684-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

memory/1684-1-0x0000000000A30000-0x0000000000AA6000-memory.dmp

\Users\Admin\AppData\Roaming\d3d9.dll

MD5 9f84c9689115005f1cb61b36a2c7c67e
SHA1 76891a7d8c2ea143cb9dab05864fb04aea8a7153
SHA256 f732dbad6982c48205dbb20d7cb644ddfddcd26ca1b35700a2e81f5002130bf8
SHA512 68b0fe1961328d9003b5918e62d0c3c9da0e79f9285771e99cc2a67f4f84739fed14c4e6343339c7f6578c3a9494e9da54a8f817cf30a6db39a87e407ee84538

memory/1684-6-0x00000000758F0000-0x00000000759B1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-20 08:56

Reported

2024-05-20 08:59

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\conhost.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4880 set thread context of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\7z.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 4880 wrote to memory of 456 N/A C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
PID 456 wrote to memory of 208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 456 wrote to memory of 208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 456 wrote to memory of 208 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Users\Admin\AppData\Local\Temp\conhost.exe
PID 208 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 208 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\conhost.exe C:\Windows\system32\cmd.exe
PID 4932 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 4932 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mode.com
PID 4932 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4932 wrote to memory of 380 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4932 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4932 wrote to memory of 2876 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4932 wrote to memory of 4968 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4932 wrote to memory of 4968 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\7z.exe
PID 4932 wrote to memory of 1120 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4932 wrote to memory of 1120 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4932 wrote to memory of 4732 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe
PID 4932 wrote to memory of 4732 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe
PID 4932 wrote to memory of 4732 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe
PID 4732 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 2092 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 4840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4732 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 4732 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe C:\Windows\SysWOW64\cmd.exe
PID 1448 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1448 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1448 wrote to memory of 1940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3760 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3760 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3760 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe

"C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

C:\Users\Admin\AppData\Local\Temp\conhost.exe

"C:\Users\Admin\AppData\Local\Temp\conhost.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\system32\mode.com

mode 65,10

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p563741341569714296105326100 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\system32\attrib.exe

attrib +H "svcshost.exe"

C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe

"svcshost.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C powershell -EncodedCommand "PAAjADAARQBmAEQAbABBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABwADEARQBXAFQAbQBZACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAbgBNAE4AVgA4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEoAdwAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -EncodedCommand "PAAjADAARQBmAEQAbABBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABwADEARQBXAFQAbQBZACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAbgBNAE4AVgA4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEoAdwAjAD4A"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3654" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"

C:\Windows\SysWOW64\schtasks.exe

SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3654" /TR "C:\ProgramData\Dllhost\dllhost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
RU 147.45.47.93:80 tcp
US 8.8.8.8:53 93.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 130.211.222.173.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 api.ip.sb udp
US 172.67.75.172:443 api.ip.sb tcp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 172.75.67.172.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
RU 147.45.47.115:80 147.45.47.115 tcp
US 8.8.8.8:53 115.47.45.147.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
RU 147.45.47.115:80 147.45.47.115 tcp
RU 147.45.47.115:80 147.45.47.115 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4880-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

memory/4880-1-0x0000000000F90000-0x0000000001006000-memory.dmp

C:\Users\Admin\AppData\Roaming\d3d9.dll

MD5 9f84c9689115005f1cb61b36a2c7c67e
SHA1 76891a7d8c2ea143cb9dab05864fb04aea8a7153
SHA256 f732dbad6982c48205dbb20d7cb644ddfddcd26ca1b35700a2e81f5002130bf8
SHA512 68b0fe1961328d9003b5918e62d0c3c9da0e79f9285771e99cc2a67f4f84739fed14c4e6343339c7f6578c3a9494e9da54a8f817cf30a6db39a87e407ee84538

memory/456-8-0x0000000000700000-0x0000000000752000-memory.dmp

memory/4880-10-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/456-11-0x0000000005190000-0x0000000005734000-memory.dmp

memory/456-12-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/456-13-0x0000000004C80000-0x0000000004D12000-memory.dmp

memory/456-14-0x0000000004C50000-0x0000000004C5A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp519A.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/456-31-0x0000000005AC0000-0x0000000005B36000-memory.dmp

memory/456-32-0x0000000006170000-0x000000000618E000-memory.dmp

memory/456-35-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/456-36-0x00000000069C0000-0x0000000006FD8000-memory.dmp

memory/456-37-0x0000000006600000-0x000000000670A000-memory.dmp

memory/456-38-0x0000000006540000-0x0000000006552000-memory.dmp

memory/456-39-0x00000000065A0000-0x00000000065DC000-memory.dmp

memory/456-40-0x00000000067B0000-0x00000000067FC000-memory.dmp

memory/456-43-0x0000000008CB0000-0x0000000008D16000-memory.dmp

memory/456-44-0x0000000008FB0000-0x0000000009000000-memory.dmp

memory/456-45-0x00000000094D0000-0x0000000009692000-memory.dmp

memory/456-46-0x0000000009BD0000-0x000000000A0FC000-memory.dmp

memory/4880-47-0x00000000751E0000-0x0000000075990000-memory.dmp

memory/456-48-0x00000000751E0000-0x0000000075990000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\conhost.exe

MD5 be320b59ef29060678bcb78d6c8fa059
SHA1 eb76091dc908c5bcf1ddd24900f53b6d9119bf53
SHA256 9fdadcad0d51590fd9b604d464cdac18c9b34d43b4194c7d54110b299a841145
SHA512 8015324abb929d2ff22c1ba96bf79fe2393a16ad9daa93caef756ab41122b9e582fca68aaf8b625934aad3140223db6928a105633bb5ca209a2a3980383383fc

memory/456-67-0x00000000751E0000-0x0000000075990000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 1005b0d4f17c3e5c9a8c0e89f3943c63
SHA1 5d5e9a7ad0c21cb256f7381cb1fd414aff83d102
SHA256 db61ff7a98d6279ae8db81c9713407f42f673da134d2b12d31d0bae0a3eb00e7
SHA512 845c09bded690af0563c6f94357d591425604b4d34404c46caba5295c192dd7eb66b620d2656b4de6a26f90657e08f591b9b46bb3d821d5344329727f37d5540

C:\Users\Admin\AppData\Local\Temp\main\file.bin

MD5 6f4dc951bbb91da352f1b1736b9551dc
SHA1 c94c3fbb3a830f8a3f98963eef485ecbf7f8487b
SHA256 ffeeaa61d3e4e3aeedbd1303757049b46e30bad6445e6d78f02efce265071404
SHA512 da41d47ce5f4599bb7acbf71cfd22980f2f0f2cd74aecf1dc9664f349815a44389f13c0c2c70a89812ab665fb4b932f64f0a48664d63206e22db655f223406ea

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Local\Temp\main\7z.dll

MD5 72491c7b87a7c2dd350b727444f13bb4
SHA1 1e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA256 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

MD5 1dea9b52d271181663e8490fb0cfb259
SHA1 ecb5431dd5f2195fa006f6b122fbada1ee7814fa
SHA256 4d06d0ef87f79d86c05b505d6bb1726e76e032514de129b1421d660fd31b7934
SHA512 fff4c592f7947f29fc3c1209f13d9c2b19a052e88cab59e1f18f0d30eb53b734601d8292dbfb2004d6ab13b72f36d3ef600808c83625aa32f5a152af6acc1812

C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

MD5 ed96024f86a8d005a58c85056c939b57
SHA1 304349dddbc2be0b786188aeb9f3e774b3eee000
SHA256 191472c620709b27aaf22d77531ad320de820f4470911d12ca947835b11985a3
SHA512 d8b40cd1a478daeb50aaf641b5dca98f483b7164f06a0c7bc9ff73f3ae75197542518b1fa867622600f3b589756e493bba6baa88c98a284751f2a4abd710e07d

C:\Users\Admin\AppData\Local\Temp\main\extracted\svcshost.exe

MD5 3157f43bcc6254d4dd2b18ed3748cc0e
SHA1 e9268a22049763ada485c7ab61538767f1e5693e
SHA256 8abd4b8b64f0594bd1295a458d5f157fe6d3af3000318025273645c753ec18aa
SHA512 0ea5d6a6e12bc7fea0f1129aed97eb15801d9003033d96758810598bee9d8dc1a49626e655527cb7c758856e2c471e4801460abffdaeb2d8c4b7faebdb91d74e

C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

MD5 7fc02b51dd8ee71d01cf01ec2faa8cc6
SHA1 52d16d36ea5719177ac56d1420281587b84268e5
SHA256 87920f35f5b119fa851cc3e1be8d26669a86636d25fb5a1fc71d8e49c20426b1
SHA512 f7c98a71882f8517b9c942222de7f5ef8b75a3b5699530f194ff1c670c1e4c4ab1622d2dbf5e9145df28d67491a96fd5c2e6b2ebf8aa9fa07415e4e7466bde5c

memory/4732-99-0x0000000000100000-0x000000000010C000-memory.dmp

memory/4840-100-0x0000000002380000-0x00000000023B6000-memory.dmp

memory/4840-101-0x0000000004DA0000-0x00000000053C8000-memory.dmp

memory/4840-102-0x0000000005500000-0x0000000005522000-memory.dmp

memory/4840-103-0x00000000055A0000-0x0000000005606000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2hs4p5b.1pn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4840-113-0x0000000005820000-0x0000000005B74000-memory.dmp

memory/4840-114-0x0000000005C90000-0x0000000005CAE000-memory.dmp

memory/4840-115-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

memory/4840-116-0x0000000006270000-0x00000000062A2000-memory.dmp

memory/4840-117-0x0000000071B50000-0x0000000071B9C000-memory.dmp

memory/4840-127-0x0000000006E60000-0x0000000006E7E000-memory.dmp

memory/4840-128-0x0000000006E90000-0x0000000006F33000-memory.dmp

memory/4840-129-0x0000000007610000-0x0000000007C8A000-memory.dmp

memory/4840-130-0x0000000006FC0000-0x0000000006FDA000-memory.dmp

memory/4840-131-0x0000000007040000-0x000000000704A000-memory.dmp

memory/4840-132-0x0000000007240000-0x00000000072D6000-memory.dmp

memory/4840-133-0x00000000071C0000-0x00000000071D1000-memory.dmp

memory/4840-137-0x0000000007200000-0x000000000720E000-memory.dmp

memory/4840-138-0x0000000007210000-0x0000000007224000-memory.dmp

memory/4840-143-0x0000000007300000-0x000000000731A000-memory.dmp

memory/4840-144-0x00000000072E0000-0x00000000072E8000-memory.dmp