Malware Analysis Report

2025-01-02 12:20

Sample ID 240714-xgrjgavflh
Target CheatKeys__Application_66941d6bd945d.zip
SHA256 1d4b32c4ba025e745eff6d741e7baa97f1b8ef190a1e028e1d8dca45a1b97de9
Tags
stealc default discovery execution spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1d4b32c4ba025e745eff6d741e7baa97f1b8ef190a1e028e1d8dca45a1b97de9

Threat Level: Known bad

The file CheatKeys__Application_66941d6bd945d.zip was found to be: Known bad.

Malicious Activity Summary

stealc default discovery execution spyware stealer

Stealc

Downloads MZ/PE file

Loads dropped DLL

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Checks processor information in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-14 18:51

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-14 18:49

Reported

2024-07-14 18:56

Platform

win11-20240709-en

Max time kernel

172s

Max time network

187s

Command Line

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\CheatKeys__Application_66941d6bd945d.zip

Signatures

Stealc

stealer stealc

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4904 set thread context of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 set thread context of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000_Classes\Local Settings\MuiCache C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2116 wrote to memory of 696 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 696 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 696 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 128 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 128 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2116 wrote to memory of 128 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 128 wrote to memory of 4904 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe
PID 128 wrote to memory of 4904 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe
PID 128 wrote to memory of 4904 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4904 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 544 wrote to memory of 492 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 492 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 492 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 1452 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 1452 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 544 wrote to memory of 1452 N/A C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1452 wrote to memory of 4632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe
PID 1452 wrote to memory of 4632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe
PID 1452 wrote to memory of 4632 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe
PID 4632 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4632 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Windows\Explorer.exe

C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\CheatKeys__Application_66941d6bd945d.zip

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca

C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe

"C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe'"

C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe

"C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\ActivationInstaller\app\README.txt

C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe

"C:\Users\Admin\Documents\ActivationInstaller\ActivationInstaller.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe'"

C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe

"C:\Users\Admin\AppData\Roaming\UINMBQYQ.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
GB 2.18.66.67:443 tcp
GB 2.18.66.67:443 tcp
US 8.8.8.8:53 222.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
GB 184.28.176.10:443 r.bing.com tcp
US 20.189.173.5:443 browser.pipe.aria.microsoft.com tcp
US 150.171.22.254:443 ln-ring.msedge.net tcp
FR 152.199.21.118:443 static-ecst.licdn.com tcp
US 172.67.219.189:443 antymalwarecheckgood.top tcp
US 172.67.173.125:443 wondershare-filmora.top tcp
US 104.21.90.13:80 testyregerglegrjerg.top tcp
US 172.67.219.189:443 antymalwarecheckgood.top tcp
US 172.67.173.125:443 wondershare-filmora.top tcp
US 104.21.90.13:80 testyregerglegrjerg.top tcp
GB 2.18.66.67:443 tcp
US 150.171.70.254:443 mcr-ring.msedge.net tcp
US 4.150.240.254:443 arm-ring.msedge.net tcp
GB 184.28.176.10:443 r.bing.com tcp

Files

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

MD5 fa818effcde20598c3b9ec9eebc345dc
SHA1 a26401fd9c0b51b32e036e18f3b6ae3a14240227
SHA256 065e354a76c8f6f6db86558fe1376dd6bd479104bd75f95b4022b2be16fc69ec
SHA512 df9686a22117e1f1c8fdcc29526fe7301323a37afcd67dd83d3183546bf02849cade68f5af8eef59f415f00076d890b1f5055b94ea96ce395d416499644d0943

memory/2116-7-0x0000000000880000-0x000000000088A000-memory.dmp

memory/696-8-0x0000000002800000-0x0000000002836000-memory.dmp

memory/696-9-0x0000000005410000-0x0000000005A3A000-memory.dmp

memory/696-10-0x00000000051B0000-0x00000000051D2000-memory.dmp

memory/696-12-0x0000000005B20000-0x0000000005B86000-memory.dmp

memory/696-11-0x0000000005AB0000-0x0000000005B16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_krqudek4.rpt.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/696-21-0x0000000005C00000-0x0000000005F57000-memory.dmp

memory/696-22-0x0000000006050000-0x000000000606E000-memory.dmp

memory/696-23-0x00000000060A0000-0x00000000060EC000-memory.dmp

memory/696-24-0x0000000006610000-0x0000000006656000-memory.dmp

memory/696-25-0x0000000007A30000-0x00000000080AA000-memory.dmp

memory/696-26-0x00000000073B0000-0x00000000073CA000-memory.dmp

memory/696-28-0x0000000070690000-0x00000000706DC000-memory.dmp

memory/696-38-0x0000000007520000-0x000000000753E000-memory.dmp

memory/696-29-0x00000000708A0000-0x0000000070BF7000-memory.dmp

memory/696-27-0x00000000074E0000-0x0000000007514000-memory.dmp

memory/696-39-0x0000000007540000-0x00000000075E4000-memory.dmp

memory/696-40-0x0000000007640000-0x000000000764A000-memory.dmp

memory/696-41-0x0000000007700000-0x0000000007796000-memory.dmp

memory/696-42-0x0000000007670000-0x0000000007681000-memory.dmp

memory/696-43-0x00000000076C0000-0x00000000076CE000-memory.dmp

memory/696-44-0x00000000076D0000-0x00000000076E5000-memory.dmp

memory/696-45-0x00000000077C0000-0x00000000077DA000-memory.dmp

memory/696-46-0x00000000077A0000-0x00000000077A8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 529711b4efccd85db64b21b08df3b0bf
SHA1 dd945e6bed9cf8a7a54827e689fd8b4abfcd5045
SHA256 c976943b77e1fb572fc8c2827afced0a9a3da93b6a14e57f7c323c5d88b8c608
SHA512 abce497499a4c610a3e55049322cc5b014d123a3d55a60badc68d1b109ed4b7b13530d49f3840f885b39b3c74cbe72b45b1e2ceab6ca64d8215ffc3009607e59

memory/128-60-0x0000000006320000-0x0000000006677000-memory.dmp

memory/128-61-0x0000000006880000-0x00000000068CC000-memory.dmp

memory/128-62-0x0000000007740000-0x0000000007762000-memory.dmp

memory/128-63-0x0000000007E30000-0x00000000083D6000-memory.dmp

C:\Users\Admin\AppData\Roaming\QCCJ27I0.exe

MD5 1c085b357c2b99300e2ee34bbcdc8984
SHA1 f30d3025b5c1671f32ce6376cfd963754a13cb28
SHA256 7643c766a6c6c0f0b08c7e0175a5c7cd39ad265db30c07ec0a0c315455b50bc9
SHA512 eaf59d3b98055441f5a535b8ed10d4bef7e0423402d890c3602aed60b7821b643f46c44ab86663de678b16f503bb13dea97b360e973912075a352ec1cb3a0152

memory/2988-67-0x0000000000400000-0x000000000063C000-memory.dmp

memory/2988-68-0x0000000000400000-0x000000000063C000-memory.dmp

memory/2988-69-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ActivationInstaller.exe.log

MD5 ef375f28c91db0202bf7db29c0cbc2ce
SHA1 5a3f5d4ec75a468b908c2eb2b9e6f4b1e76c1017
SHA256 f4d1c038db378dec10e7e2fc81ccc2e2d4b8132ef0d66905e3625a0b0cbbde5f
SHA512 f18141e352fcd253e02cb25fa0cff29ab06dec62bafd5aa80ca48c959d1dba97deae830d01bf521f851a8143b9416747eb170d0cedafa32b59155027c02f244d

memory/492-164-0x0000000006300000-0x0000000006657000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 28472f37c092e0011b2b846853deab2c
SHA1 d83894897215ba79b1a9559e055fbd0aae77f210
SHA256 f25cc6b6766a0b5a153aa984b6af9a0d50fd235c89a37ec3042f411b30818cf5
SHA512 4f781c8f0f260ec55ebaad0f5947df7f8c02ce73dc307850ef4246022b4caf835ec0c751598a262e196cdb89c20f18d940a693b6581431084f07f07f68c628bd

memory/492-166-0x0000000006D30000-0x0000000006D7C000-memory.dmp

memory/492-167-0x0000000070730000-0x000000007077C000-memory.dmp

memory/492-177-0x0000000007CE0000-0x0000000007D84000-memory.dmp

memory/492-168-0x0000000070960000-0x0000000070CB7000-memory.dmp

memory/492-178-0x0000000007E40000-0x0000000007E51000-memory.dmp

memory/492-179-0x0000000006240000-0x0000000006255000-memory.dmp

memory/1452-182-0x0000000005740000-0x0000000005A97000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 a7621e17902f7a71eee412f3b4d7e73b
SHA1 5e885f7db7a373491bc9f25ed939481bded79517
SHA256 5d726a979a8daa2be33aaa18b3c94bee2d7d57a2df56c6ab3eac0cb25954cab7
SHA512 811c50055b3c5a9e6e9cd438f73f46ac816619e8d7c4ac97eeae07cdd7892c944ce7bf25c8f82c6c99fc5bd138d49af4db403c0d7bd8d8bf8bfae9b3683609a3

memory/1452-192-0x0000000005E00000-0x0000000005E4C000-memory.dmp