Malware Analysis Report

2024-09-11 09:43

Sample ID 240616-dwbl1sxend
Target 14de93c0296fd8e1225cfd59f2730678.exe
SHA256 7f40bfb86707faf0ec8978614840ab858320d1978bc351546833272b7b70c854
Tags
redline sectoprat cheat discovery execution infostealer rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7f40bfb86707faf0ec8978614840ab858320d1978bc351546833272b7b70c854

Threat Level: Known bad

The file 14de93c0296fd8e1225cfd59f2730678.exe was found to be: Known bad.

Malicious Activity Summary

redline sectoprat cheat discovery execution infostealer rat spyware stealer trojan

RedLine payload

SectopRAT

SectopRAT payload

RedLine

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Checks computer location settings

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-16 03:21

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 03:21

Reported

2024-06-16 03:23

Platform

win7-20231129-en

Max time kernel

122s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3040 set thread context of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2252 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3040 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 3040 wrote to memory of 2520 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

Processes

C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dVLgxTxutL.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dVLgxTxutL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp57B1.tmp"

C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

Network

Country Destination Domain Proto
NL 185.222.58.77:55615 185.222.58.77 tcp
US 8.8.8.8:53 api.ip.sb udp
US 104.26.12.31:443 api.ip.sb tcp
US 8.8.8.8:53 apps.identrust.com udp
BE 2.17.107.226:80 apps.identrust.com tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

memory/3040-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

memory/3040-1-0x0000000000A50000-0x0000000000AE8000-memory.dmp

memory/3040-2-0x0000000074BF0000-0x00000000752DE000-memory.dmp

memory/3040-3-0x0000000000550000-0x000000000056A000-memory.dmp

memory/3040-4-0x0000000000390000-0x00000000003A0000-memory.dmp

memory/3040-5-0x0000000005240000-0x00000000052A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 44c5e4aceb1c40dc118091d8043bf4a9
SHA1 647ae0ece9a73cc1e264857e71199dccb863a93d
SHA256 076fea0d1b9c8adc2f5e246076012106724c810f27a3b33bf5100897180d3936
SHA512 45db8a97bfd6b9d3c1d876afa455d640f866dfd907737e5695d68afcce83bd1f700b530186e134524897542f6973612e03ebe074ef4928a106c47247157754ee

C:\Users\Admin\AppData\Local\Temp\tmp57B1.tmp

MD5 81e799b3ce26f777611db0d091ed53d9
SHA1 d96d8fd245e73d8f4cd00cd823d3a71c366bde38
SHA256 63f0e00f884c427d98b1b006193924725ab4d769094e921cf014e109ee8038e1
SHA512 cd518918ed488f96eed4136b40e806b5196d63ab93ce2becbe794881688c2921365c7280293c6a489ef18d3b96f1255ab909ee280e5714b7c567a0a150fb8876

memory/2520-18-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2520-27-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2520-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2520-25-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2520-22-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2520-20-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2520-28-0x0000000000400000-0x000000000041E000-memory.dmp

memory/2520-30-0x0000000000400000-0x000000000041E000-memory.dmp

memory/3040-31-0x0000000074BF0000-0x00000000752DE000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7F33.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 6b6d7ad3dd545e2ffad97b2a627ff0af
SHA1 109344e6db29f2f33a38070da57cb415a4f0551e
SHA256 f5c14fa0da90abb0fd7521fecad326693a500c2d86bd8b4b074cc769361ae302
SHA512 336539d8cf351a97b8f8426a615dbaf0891c95c37771e038102eca6061f3d955e9016b97ce505044ead35a73309e260bd178739193588205b4939917f74c6519

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6199acb64e55e81da41bc3b6fa5ee93b
SHA1 2449d13fa7541f02090ea6744accedf33940c7cd
SHA256 f3af7fb700fd090af427b28657732f563850a5264547913c1b70ad4fd9ddbd29
SHA512 ec5177f10876d208ba0d73207c7ae6160048e1530ee1571b930c2d46ae424d1517afda50a5f6a7e2558dc4fc928d1616f22e977e5e34c9e22a3d4e5a4325a35a

C:\Users\Admin\AppData\Local\Temp\tmp81B7.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Temp\tmp81BD.tmp

MD5 69b4e9248982ac94fa6ee1ea6528305f
SHA1 6fb0e765699dd0597b7a7c35af4b85eead942e5b
SHA256 53c5e056da67d60a3b2872f8d4bda857f687be398ed05ed17c102f4c4b942883
SHA512 5cb260ab12c8cf0f134c34ae9533ac06227a0c3bdb9ad30d925d3d7b96e6fae0825c63e7db3c78852dc2a053767bbcfdd16898531509ffadade2dd7149f6241d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 03:21

Reported

2024-06-16 03:23

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A

SectopRAT

trojan rat sectoprat

SectopRAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4040 set thread context of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4040 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 4040 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 4040 wrote to memory of 3456 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Windows\SysWOW64\schtasks.exe
PID 4040 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe
PID 4040 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

Processes

C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dVLgxTxutL.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dVLgxTxutL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8637.tmp"

C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe

"C:\Users\Admin\AppData\Local\Temp\14de93c0296fd8e1225cfd59f2730678.exe"

Network

Country Destination Domain Proto
NL 185.222.58.77:55615 tcp
NL 185.222.58.77:55615 tcp
NL 185.222.58.77:55615 tcp
NL 185.222.58.77:55615 tcp
NL 185.222.58.77:55615 tcp
NL 185.222.58.77:55615 tcp

Files

memory/4040-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

memory/4040-1-0x0000000000310000-0x00000000003A8000-memory.dmp

memory/4040-2-0x0000000005620000-0x0000000005BC4000-memory.dmp

memory/4040-3-0x0000000005150000-0x00000000051E2000-memory.dmp

memory/4040-4-0x0000000005210000-0x000000000521A000-memory.dmp

memory/4040-5-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/4040-6-0x00000000069D0000-0x00000000069EA000-memory.dmp

memory/4040-7-0x00000000062D0000-0x00000000062E0000-memory.dmp

memory/4040-8-0x0000000006530000-0x0000000006590000-memory.dmp

memory/4040-9-0x0000000008F40000-0x0000000008FDC000-memory.dmp

memory/3268-14-0x00000000029A0000-0x00000000029D6000-memory.dmp

memory/3268-15-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/3268-16-0x00000000056D0000-0x0000000005CF8000-memory.dmp

memory/3268-17-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/5116-18-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/3268-19-0x0000000005500000-0x0000000005522000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8637.tmp

MD5 31a5fac844c2c3d62bef8ea50b9ab7e4
SHA1 e8cc94969cf20a918c82a842c79238777e7913a0
SHA256 4f5ea29425af6b67680d9a7a705d86414bbf91c91740973b56c1a0102578ec5f
SHA512 5397d6bbf2a588f5b315da71610ee5ae068f98dead531b6de0df4afeb5e05e022d0515aa86babfd87fa62c95dd0221151eac097aaef6c10f234b1b9207445253

memory/3268-27-0x0000000005640000-0x00000000056A6000-memory.dmp

memory/5116-28-0x0000000074EA0000-0x0000000075650000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dguzgnwt.p2d.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3268-21-0x00000000055D0000-0x0000000005636000-memory.dmp

memory/5116-44-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/1836-45-0x0000000000400000-0x000000000041E000-memory.dmp

memory/4040-47-0x0000000074EA0000-0x0000000075650000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\14de93c0296fd8e1225cfd59f2730678.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/5116-43-0x0000000005F40000-0x0000000006294000-memory.dmp

memory/4040-39-0x0000000074EAE000-0x0000000074EAF000-memory.dmp

memory/1836-50-0x0000000002C30000-0x0000000002C42000-memory.dmp

memory/1836-49-0x00000000055C0000-0x0000000005BD8000-memory.dmp

memory/1836-51-0x0000000005020000-0x000000000505C000-memory.dmp

memory/3268-52-0x00000000062E0000-0x00000000062FE000-memory.dmp

memory/3268-53-0x0000000006870000-0x00000000068BC000-memory.dmp

memory/1836-54-0x00000000052B0000-0x00000000053BA000-memory.dmp

memory/3268-67-0x00000000074D0000-0x0000000007573000-memory.dmp

memory/3268-66-0x0000000006900000-0x000000000691E000-memory.dmp

memory/3268-56-0x0000000075730000-0x000000007577C000-memory.dmp

memory/3268-55-0x00000000068C0000-0x00000000068F2000-memory.dmp

memory/5116-68-0x0000000075730000-0x000000007577C000-memory.dmp

memory/3268-79-0x0000000007600000-0x000000000761A000-memory.dmp

memory/3268-78-0x0000000007C40000-0x00000000082BA000-memory.dmp

memory/3268-80-0x0000000007670000-0x000000000767A000-memory.dmp

memory/5116-81-0x00000000079B0000-0x0000000007A46000-memory.dmp

memory/5116-82-0x0000000007930000-0x0000000007941000-memory.dmp

memory/3268-83-0x0000000007830000-0x000000000783E000-memory.dmp

memory/5116-84-0x0000000007970000-0x0000000007984000-memory.dmp

memory/5116-85-0x0000000007A70000-0x0000000007A8A000-memory.dmp

memory/5116-86-0x0000000007A50000-0x0000000007A58000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a6753735ea27eab81a6b579ae3363b32
SHA1 7b7b2c4e2abc6c4692fff57cde46e74fdae6a21b
SHA256 5355b9b44fb655bd9f047644169a02dcb20b48c1bced3b07c6194b7e36294ef2
SHA512 e4bd46f3ec8c01f5140578ece62e14270df70c8d5ab6e69e053f98752a6cd3d1d660584bce3f2003a5563bff23ee27b133e131915db90b0f01be5119ce28ff61

memory/3268-93-0x0000000074EA0000-0x0000000075650000-memory.dmp

memory/5116-92-0x0000000074EA0000-0x0000000075650000-memory.dmp