Malware Analysis Report

2024-11-16 12:11

Sample ID 240715-s1b6nszgph
Target PO supplies 15 7 24.rar
SHA256 3a5ddc7a8667a2994e2add46c9110c6ed6678bea5af5de4d9648597c68ab0237
Tags
neshta execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a5ddc7a8667a2994e2add46c9110c6ed6678bea5af5de4d9648597c68ab0237

Threat Level: Known bad

The file PO supplies 15 7 24.rar was found to be: Known bad.

Malicious Activity Summary

neshta execution persistence spyware stealer

Neshta

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Checks computer location settings

Loads dropped DLL

Modifies system executable filetype association

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-15 15:35

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-15 15:35

Reported

2024-07-15 15:37

Platform

win7-20240704-en

Max time kernel

69s

Max time network

21s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2480 set thread context of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2480 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2480 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2480 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2480 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2480 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2480 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QBloUDNxsti.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QBloUDNxsti" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2904.tmp"

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Network

N/A

Files

memory/2480-0-0x000000007485E000-0x000000007485F000-memory.dmp

memory/2480-1-0x0000000001300000-0x00000000013BC000-memory.dmp

memory/2480-2-0x0000000074850000-0x0000000074F3E000-memory.dmp

memory/2480-3-0x0000000000950000-0x000000000096A000-memory.dmp

memory/2480-4-0x0000000000610000-0x000000000061E000-memory.dmp

memory/2480-5-0x00000000011A0000-0x000000000122E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UACIG8Q11FZVI8ZS6VA7.temp

MD5 5149fc5ad6860df25979e98fbfe1ea45
SHA1 539493c373872e9d6d117934b34aac626f288afc
SHA256 e2bfdb36b583476e24abba7f2af7a7280c168d31b24e9cc5dfc373e717041546
SHA512 23d1918dc01851b2ccc5f39730bab22adf37349f72dad5ae426f5f665de18b5904ec9f3bbea22c1924598c3446214ee48905bfb14dcd4f08f97fe38880a2a83d

C:\Users\Admin\AppData\Local\Temp\tmp2904.tmp

MD5 281b51fad97457f900af07f7d09764a6
SHA1 fe1471ce90e80e1f6bf7fbfad4178db3b68afe1c
SHA256 73e8558665bd2aa338ab4b24644de8484a819d61a2f16938c4ddc1daaea127ab
SHA512 d7a0caa3fcfbd3dae284f456950af4b795bfc011c3ac9ea6f080f58d5f7ff234c376563dcce493299f94e726b9b3c132669005881601591c4cb8c999f430e782

memory/2700-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2700-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-18-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2700-21-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2480-40-0x0000000074850000-0x0000000074F3E000-memory.dmp

C:\Windows\svchost.com

MD5 831ea2d64c8371b5fb5c293902f942dd
SHA1 41bda99a7dcda14fffc5297f77d73deccf7e52f9
SHA256 0be3fe232479bb98c0801b5b5279e6f0527d470cf93236c9cc8109dd8bf6b268
SHA512 eb195b26b63bff3102231be5fcef9e700b23af42485719c1b77e30b06efd7cfd2c170a46d756c38d8056f0a9fa12fd25564bf21a700238035f4d066afadc0b0a

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Users\Admin\AppData\Roaming\QBLOUD~1.EXE

MD5 8c4507c84e866d7a0677244d94c439f6
SHA1 b7917d2630306f79444a473903c0170ce8e58abe
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
SHA512 950b7452c9047f24baec92101973fd3d4fdfac7f81cc2208df2a20de46db43b54eb411fa48442df5cf963ba18286047490b920529906149a8e1d9a5605bf01e1

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-15 15:35

Reported

2024-07-15 15:37

Platform

win10v2004-20240709-en

Max time kernel

95s

Max time network

98s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Reads user/profile data of web browsers

spyware stealer

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2432 set thread context of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI391D~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~2.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1508 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2432 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2432 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Windows\SysWOW64\schtasks.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe
PID 2432 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QBloUDNxsti.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QBloUDNxsti" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAEBE.tmp"

C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe

"C:\Users\Admin\AppData\Local\Temp\PO supplies 15 7 24.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 34.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp

Files

memory/2432-0-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/2432-1-0x0000000000D60000-0x0000000000E1C000-memory.dmp

memory/2432-2-0x0000000005D20000-0x00000000062C4000-memory.dmp

memory/2432-3-0x0000000005810000-0x00000000058A2000-memory.dmp

memory/2432-5-0x00000000057F0000-0x00000000057FA000-memory.dmp

memory/2432-4-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/2432-6-0x00000000080A0000-0x00000000080BA000-memory.dmp

memory/2432-7-0x00000000069D0000-0x00000000069DE000-memory.dmp

memory/2432-8-0x0000000006A30000-0x0000000006ABE000-memory.dmp

memory/2432-9-0x000000000A510000-0x000000000A5AC000-memory.dmp

memory/1012-14-0x0000000002890000-0x00000000028C6000-memory.dmp

memory/1012-15-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/1012-16-0x00000000053F0000-0x0000000005A18000-memory.dmp

memory/1012-17-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/1012-18-0x0000000074C30000-0x00000000753E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpAEBE.tmp

MD5 b9af5c719db63a9decb0b1052c0a85d5
SHA1 585493959d346672fe6ab9c8306e97848913b4d9
SHA256 0e09675516bc06d1f1b8067b8d9be5d000cde881bf0fb6ff5cd2268c0ef99ba8
SHA512 65a72a4cb4193877715ec77e6d26bfe2f04318a3e2e5eada1a1f43bb3fef7d24b50df5dea8d560194f3f1d212d28f40b48acb61d22ab299ec8969ede15255ff2

memory/1508-19-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/2432-25-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/1508-24-0x0000000074C30000-0x00000000753E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p3imiw3o.iq4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2688-28-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2688-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2688-26-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1012-23-0x0000000005BB0000-0x0000000005C16000-memory.dmp

memory/1012-22-0x0000000005AD0000-0x0000000005B36000-memory.dmp

memory/1012-21-0x0000000005300000-0x0000000005322000-memory.dmp

memory/2432-52-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/2688-51-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2432-50-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/1012-49-0x0000000005C20000-0x0000000005F74000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\PO supplies 15 7 24.exe

MD5 ae303747897daf45e48698d2ae593960
SHA1 b9349e9bf97e84e1490450a6a71f364a8a18ba40
SHA256 6ad9d05e2f8ab4b9050da219cc18aef707fd79ff7ee6e108bfb5f1d262c26dbb
SHA512 6386c4b064a957481a52faf153fc93af4029f2ade078656a359a8e0398c0329df6a903062a16868dc69efb06489af61a52aeccea4958402ddf46315f0b6ff16b

C:\Windows\svchost.com

MD5 831ea2d64c8371b5fb5c293902f942dd
SHA1 41bda99a7dcda14fffc5297f77d73deccf7e52f9
SHA256 0be3fe232479bb98c0801b5b5279e6f0527d470cf93236c9cc8109dd8bf6b268
SHA512 eb195b26b63bff3102231be5fcef9e700b23af42485719c1b77e30b06efd7cfd2c170a46d756c38d8056f0a9fa12fd25564bf21a700238035f4d066afadc0b0a

memory/1012-63-0x00000000061D0000-0x00000000061EE000-memory.dmp

memory/1012-64-0x0000000006280000-0x00000000062CC000-memory.dmp

memory/1012-94-0x00000000067A0000-0x00000000067D2000-memory.dmp

memory/1012-98-0x0000000071190000-0x00000000711DC000-memory.dmp

memory/1508-101-0x0000000071190000-0x00000000711DC000-memory.dmp

memory/1508-115-0x0000000006A80000-0x0000000006A9E000-memory.dmp

memory/1012-122-0x00000000071D0000-0x0000000007273000-memory.dmp

memory/1508-146-0x0000000007DC0000-0x000000000843A000-memory.dmp

memory/1508-147-0x0000000007780000-0x000000000779A000-memory.dmp

memory/1508-150-0x00000000077F0000-0x00000000077FA000-memory.dmp

memory/1508-160-0x0000000007A00000-0x0000000007A96000-memory.dmp

memory/1508-165-0x0000000007980000-0x0000000007991000-memory.dmp

C:\Users\Admin\AppData\Roaming\QBLOUD~1.EXE

MD5 8c4507c84e866d7a0677244d94c439f6
SHA1 b7917d2630306f79444a473903c0170ce8e58abe
SHA256 08666ef4278f5e77d441949a6069b712fd4908fc75df489ed9289daa5ff3cf5e
SHA512 950b7452c9047f24baec92101973fd3d4fdfac7f81cc2208df2a20de46db43b54eb411fa48442df5cf963ba18286047490b920529906149a8e1d9a5605bf01e1

memory/1508-178-0x00000000079B0000-0x00000000079BE000-memory.dmp

memory/1012-179-0x0000000007740000-0x0000000007754000-memory.dmp

memory/1012-180-0x0000000007840000-0x000000000785A000-memory.dmp

memory/1012-181-0x0000000007820000-0x0000000007828000-memory.dmp

memory/1012-184-0x0000000074C30000-0x00000000753E0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 40057cb5e57d99add72c535d625f0b94
SHA1 4d78d3e3bad5aaff2297181ea47ad893f76a69cc
SHA256 f08fed7fed43318a4315e8a4f8402db999c25bbe4ffdbfc8f8186b33412204f7
SHA512 e156285513e4c19395659b81a2a5e1a3cff72fc4933edb57d9da5b3aabc7898872b56834a096837537cf0422e2556826e8a96b38324fc209628dc0ab5b653d57

memory/1508-188-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/2688-190-0x0000000000400000-0x000000000041B000-memory.dmp