Malware Analysis Report

2024-11-16 12:13

Sample ID 240724-blhapszapp
Target 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
Tags
neshta discovery execution persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31

Threat Level: Known bad

The file 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe was found to be: Known bad.

Malicious Activity Summary

neshta discovery execution persistence spyware stealer

Neshta

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Modifies system executable filetype association

Suspicious use of SetThreadContext

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-24 01:13

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-24 01:13

Reported

2024-07-24 01:16

Platform

win7-20240708-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wabmig.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\WinMail.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI4223~1\sidebar.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~1\wab.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1952 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1952 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 1952 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 1952 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 1952 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 1952 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qwyxUYwZbCeXJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwyxUYwZbCeXJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE041.tmp"

C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

Network

N/A

Files

memory/1952-0-0x000000007427E000-0x000000007427F000-memory.dmp

memory/1952-1-0x0000000001220000-0x00000000012E4000-memory.dmp

memory/1952-2-0x0000000074270000-0x000000007495E000-memory.dmp

memory/1952-3-0x0000000000490000-0x00000000004A0000-memory.dmp

memory/1952-4-0x00000000004A0000-0x00000000004AE000-memory.dmp

memory/1952-5-0x00000000046F0000-0x000000000477E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 dcb4622622367a8543db8e20f0aca48f
SHA1 817a38dba35b6015de2bc07cca8a5a9c7809fdd1
SHA256 913e563e5824049f29fbf29c50e42fca34af32738cd210a380c4b904ffeac443
SHA512 e430a70245720095d718bd2504c2a72ddf834beee88db7f3ff01815ea86cb55b2632ec3aee592a0503542dd660ad2aea59ef29cd94ed5e8a671d7768d44ffd87

C:\Users\Admin\AppData\Local\Temp\tmpE041.tmp

MD5 74db5140e158d095d82127604f027b26
SHA1 ed3067a6df8e2a7567e2f56201676a6c50334ce3
SHA256 4c469593bd9e8665a4e9bea22a49f3a400681ec59ff9562a6b26e2b08bdfc0b6
SHA512 fb1e2dfaa1e362d1addadbbc4b21d31b599b9d44c35950c33687ef31015ef23d15bd1ff27ace76ba66f00de453c54189004a8e350fc83fa85dddd5e1da2ecdc9

memory/2612-30-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-18-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-20-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-27-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-24-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-34-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-33-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2612-29-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2612-22-0x0000000000400000-0x000000000041B000-memory.dmp

memory/1952-37-0x0000000074270000-0x000000007495E000-memory.dmp

C:\Windows\svchost.com

MD5 a84134e51db793d68b3b1a8718eb3b32
SHA1 0ff8ae348f19210799b74168610771d019e6ac26
SHA256 88a5de78b70d1164451d38d1415bbba1e374ffca345c089701e6a750212960f6
SHA512 49bb49e190f435708fb2cc8461eace217d883a202a157f812b4277afb582a47db9944abaf7313d909958bfa0b40ee57fbacb844327eeab46ba0b5b4d37b15ec8

\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

MD5 9e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1 ec66cda99f44b62470c6930e5afda061579cde35
SHA256 8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA512 2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

C:\Users\Admin\AppData\Roaming\QWYXUY~1.EXE

MD5 31c87737ea27257492b80ffe38db4a02
SHA1 202620c58aee7e3d873f344196fa43c5ad863baf
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
SHA512 f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-24 01:13

Reported

2024-07-24 01:16

Platform

win10v2004-20240709-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

Signatures

Neshta

persistence spyware neshta

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~3.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{63880~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MI9C33~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmplayer.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~3.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13187~1.41\MICROS~4.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13187~1.41\MICROS~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5068 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 3016 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5068 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Windows\SysWOW64\schtasks.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe
PID 5068 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

Processes

C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qwyxUYwZbCeXJ.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qwyxUYwZbCeXJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp"

C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

"C:\Users\Admin\AppData\Local\Temp\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
IE 52.111.236.23:443 tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/5068-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

memory/5068-1-0x0000000000ED0000-0x0000000000F94000-memory.dmp

memory/5068-2-0x0000000005F10000-0x00000000064B4000-memory.dmp

memory/5068-3-0x0000000005A00000-0x0000000005A92000-memory.dmp

memory/5068-4-0x00000000059D0000-0x00000000059DA000-memory.dmp

memory/5068-5-0x0000000074A40000-0x00000000751F0000-memory.dmp

memory/5068-6-0x0000000005C40000-0x0000000005CDC000-memory.dmp

memory/5068-7-0x0000000008650000-0x0000000008660000-memory.dmp

memory/5068-8-0x0000000006BC0000-0x0000000006BCE000-memory.dmp

memory/5068-9-0x0000000006C00000-0x0000000006C8E000-memory.dmp

memory/3016-14-0x0000000002510000-0x0000000002546000-memory.dmp

memory/3016-16-0x0000000004FE0000-0x0000000005608000-memory.dmp

memory/3016-17-0x0000000074A40000-0x00000000751F0000-memory.dmp

memory/3016-15-0x0000000074A40000-0x00000000751F0000-memory.dmp

memory/5068-18-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

memory/3016-19-0x0000000074A40000-0x00000000751F0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0j0ybage.3iw.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3016-28-0x0000000005700000-0x0000000005766000-memory.dmp

memory/3016-27-0x0000000004F00000-0x0000000004F66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD8BC.tmp

MD5 1ccf6ee093d7156b589314139bd9e87a
SHA1 6baabb904264e1e1fe8b096b2133b4b97645892a
SHA256 d11f094ec510083ac5f1de11862aeabfbef788a9f5ee2959c50145c8a0e6ec5a
SHA512 611e05d056e3cdb61bbfd7a703d0d9a8dd849a06d8bc6dcccbb438f0346d3e6656ab6d7a91df89a1cda82eedf1a02c12527c3a0d0ae2882725ffe2b570f60e23

memory/3500-21-0x0000000074A40000-0x00000000751F0000-memory.dmp

memory/3016-20-0x0000000004E60000-0x0000000004E82000-memory.dmp

memory/3016-34-0x0000000005970000-0x0000000005CC4000-memory.dmp

memory/5068-35-0x0000000074A40000-0x00000000751F0000-memory.dmp

memory/3500-36-0x0000000074A40000-0x00000000751F0000-memory.dmp

memory/2056-47-0x0000000000400000-0x000000000041B000-memory.dmp

memory/2056-46-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3582-490\16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31.exe

MD5 eab1cbc9e7da6d32d557dfc901918f72
SHA1 c8c710ccda27bbf5f82b36aa387c1c8a9f14b5d2
SHA256 9343e70417d6d5d6db49c9fa263337c953183ec07f3ee524a43e6d3976cf5dd3
SHA512 aca29afd5a5fb66aa9d4facd5d4bd6fe5b20ae2ac6987fc998ae28407cb6f2983071a1ba0d831baaa72c5a0df0a319065bd08f6c71e3baa993f183f5edd9ceb2

memory/5068-56-0x0000000074A40000-0x00000000751F0000-memory.dmp

C:\Windows\svchost.com

MD5 a84134e51db793d68b3b1a8718eb3b32
SHA1 0ff8ae348f19210799b74168610771d019e6ac26
SHA256 88a5de78b70d1164451d38d1415bbba1e374ffca345c089701e6a750212960f6
SHA512 49bb49e190f435708fb2cc8461eace217d883a202a157f812b4277afb582a47db9944abaf7313d909958bfa0b40ee57fbacb844327eeab46ba0b5b4d37b15ec8

memory/3016-59-0x0000000005E10000-0x0000000005E2E000-memory.dmp

memory/3016-62-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

memory/3016-63-0x0000000006400000-0x0000000006432000-memory.dmp

memory/3016-74-0x00000000063E0000-0x00000000063FE000-memory.dmp

memory/3016-64-0x00000000752F0000-0x000000007533C000-memory.dmp

memory/3016-75-0x0000000006FF0000-0x0000000007093000-memory.dmp

memory/3016-90-0x0000000007790000-0x0000000007E0A000-memory.dmp

memory/3016-91-0x0000000007150000-0x000000000716A000-memory.dmp

memory/3500-92-0x00000000752F0000-0x000000007533C000-memory.dmp

memory/3016-102-0x00000000071C0000-0x00000000071CA000-memory.dmp

memory/3016-103-0x00000000073D0000-0x0000000007466000-memory.dmp

memory/3016-106-0x0000000007350000-0x0000000007361000-memory.dmp

memory/3016-151-0x0000000007380000-0x000000000738E000-memory.dmp

memory/3016-152-0x0000000007390000-0x00000000073A4000-memory.dmp

memory/3016-155-0x0000000007490000-0x00000000074AA000-memory.dmp

memory/3016-162-0x0000000007470000-0x0000000007478000-memory.dmp

C:\Users\Admin\AppData\Roaming\QWYXUY~1.EXE

MD5 31c87737ea27257492b80ffe38db4a02
SHA1 202620c58aee7e3d873f344196fa43c5ad863baf
SHA256 16ecf712d513d305e40994ad4cdc51cc5b9be0f5f7067c543f00875973bc0a31
SHA512 f50ee3c56f7f498fb54c501201bda1640bb7b9e7476dc896b2c19a7706b0f132bae808b4a312c0c401a1b8e58058b7255cc2ed9026b19a7a561f3168d85dbec9

memory/3016-182-0x0000000074A40000-0x00000000751F0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 c4965c22c155790548b3be9584260a48
SHA1 cb414ac051b5ab540e6e04ea4f65cfa9e40bf491
SHA256 2d7e7ab04a8d4005c922fa7d496fc00d7c8f743e427c63cee35d64c0c01bed0d
SHA512 b2d38d61b1af634812406a892b68435b882e50c19bce1e94995fa75baceb4237cdebc0223ce86fc3dddf087649f5bdc8736ea1b48430f87cb1e7b0e6e3110dfd

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/3500-186-0x0000000074A40000-0x00000000751F0000-memory.dmp