Malware Analysis Report

2024-10-19 02:39

Sample ID 240908-m4jr2asdlm
Target ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978
SHA256 ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978
Tags
amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion execution infostealer persistence spyware stealer trojan defense_evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978

Threat Level: Known bad

The file ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978 was found to be: Known bad.

Malicious Activity Summary

amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion execution infostealer persistence spyware stealer trojan defense_evasion

Suspicious use of NtCreateUserProcessOtherParentProcess

RedLine

RedLine payload

Stealc

Amadey

CryptBot

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Credentials from Password Stores: Credentials from Web Browsers

Downloads MZ/PE file

Unsecured Credentials: Credentials In Files

Reads user/profile data of web browsers

Checks computer location settings

Checks BIOS information in registry

Executes dropped EXE

Reads data files stored by FTP clients

Identifies Wine through registry keys

Loads dropped DLL

Accesses cryptocurrency files/wallets, possible credential harvesting

Indicator Removal: File Deletion

Command and Scripting Interpreter: PowerShell

Checks installed software on the system

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Scheduled Task/Job: Scheduled Task

Modifies system certificate store

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-08 11:01

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-08 11:01

Reported

2024-09-08 11:03

Platform

win11-20240802-en

Max time kernel

145s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe"

Signatures

Amadey

trojan amadey

CryptBot

spyware stealer cryptbot

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\service123.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\km111 = "C:\\Users\\Admin\\AppData\\Roaming\\km111.exe" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks installed software on the system

discovery

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
File created C:\Windows\Tasks\Hkbsse.job C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost015.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\service123.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\famaMzsduL.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\km111.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 660 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 660 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 660 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1152 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1152 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1152 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1620 wrote to memory of 3852 N/A C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1152 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1152 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 1152 wrote to memory of 656 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 656 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5020 wrote to memory of 3228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe
PID 5020 wrote to memory of 3228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe
PID 5020 wrote to memory of 3228 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe
PID 5020 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\famaMzsduL.exe
PID 5020 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\famaMzsduL.exe
PID 5020 wrote to memory of 1680 N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe C:\Users\Admin\AppData\Roaming\famaMzsduL.exe
PID 1152 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 1152 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 1152 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
PID 5092 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 5092 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 5092 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
PID 1152 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1152 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1152 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
PID 1336 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe
PID 1336 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe
PID 1336 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe
PID 1152 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 1152 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 1152 wrote to memory of 1080 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
PID 1152 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 1152 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 1152 wrote to memory of 3724 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
PID 1152 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 1152 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 1152 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1080 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe C:\Users\Admin\AppData\Local\Temp\svchost015.exe
PID 1152 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe
PID 1152 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe

"C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

"C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe

"C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe"

C:\Users\Admin\AppData\Roaming\famaMzsduL.exe

"C:\Users\Admin\AppData\Roaming\famaMzsduL.exe"

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

"C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

"C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

"C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe

"C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe"

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

"C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

"C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

"C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

"C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe"

C:\Users\Admin\AppData\Local\Temp\km111.exe

"C:\Users\Admin\AppData\Local\Temp\km111.exe"

C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

"C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe"

C:\Users\Admin\AppData\Local\Temp\km111.exe

"C:\Users\Admin\AppData\Local\Temp\km111.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'km111';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'km111' -Value '"C:\Users\Admin\AppData\Roaming\km111.exe"' -PropertyType 'String'

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"

C:\Users\Admin\AppData\Local\Temp\service123.exe

"C:\Users\Admin\AppData\Local\Temp\service123.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f

C:\Windows\SysWOW64\Explorer.exe

"C:\Windows\SysWOW64\Explorer.exe"

C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe

"C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe"

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

"C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe"

Network

Country Destination Domain Proto
RU 185.215.113.16:80 185.215.113.16 tcp
RU 185.215.113.117:80 185.215.113.117 tcp
US 8.8.8.8:53 117.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
US 8.8.8.8:53 26.113.215.185.in-addr.arpa udp
FI 65.21.18.51:45580 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
US 154.216.17.216:80 154.216.17.216 tcp
US 8.8.8.8:53 51.18.21.65.in-addr.arpa udp
US 8.8.8.8:53 216.17.216.154.in-addr.arpa udp
RU 185.215.113.17:80 185.215.113.17 tcp
FI 95.216.107.53:12311 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.16:80 185.215.113.16 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
RU 185.215.113.26:80 185.215.113.26 tcp
RU 80.66.75.114:80 80.66.75.114 tcp
DE 95.179.250.45:26212 tcp
RU 194.87.248.136:80 sevtv17sb.top tcp
RU 185.215.113.67:15206 tcp
DE 95.179.250.45:26212 tcp
DE 78.111.67.222:80 mxstat8.cfd tcp
FI 95.216.143.20:12695 tcp
TM 91.202.233.158:80 91.202.233.158 tcp
DE 95.179.250.45:26212 tcp
DE 95.179.250.45:26212 tcp
DE 78.111.75.75:56001 pexbook7.cfd tcp
DE 78.111.75.75:56002 pexbook7.cfd tcp
DE 78.111.75.75:56003 pexbook7.cfd tcp
DE 95.179.250.45:26212 tcp
US 162.255.119.24:56001 keznews17.cfd tcp
FI 81.19.139.138:443 conditionprovice.pro tcp
RU 185.215.113.19:80 185.215.113.19 tcp
RU 185.215.113.19:80 185.215.113.19 tcp

Files

memory/660-0-0x0000000000120000-0x00000000005F6000-memory.dmp

memory/660-1-0x0000000077916000-0x0000000077918000-memory.dmp

memory/660-2-0x0000000000121000-0x000000000014F000-memory.dmp

memory/660-3-0x0000000000120000-0x00000000005F6000-memory.dmp

memory/660-5-0x0000000000120000-0x00000000005F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 48a36baee2fba32fc07ba2f12526914c
SHA1 0f16d91ed72554f0bc71e3906b6532ab2ac40781
SHA256 ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978
SHA512 a7f327d00ef54a17d06b0fce5084e10bddb7c93768c995738b80d8618f320c54472aded33769facde18fef1ec8e528fc29a8e818828cebe935b2ad8ded0f59aa

memory/1152-16-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/660-18-0x0000000000120000-0x00000000005F6000-memory.dmp

memory/1152-20-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-19-0x0000000000631000-0x000000000065F000-memory.dmp

memory/1152-21-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-22-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-23-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-24-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-25-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-26-0x0000000000630000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

MD5 2d647cf43622ed10b6d733bb5f048fc3
SHA1 6b9c5f77a9ef064a23e5018178f982570cbc64c6
SHA256 41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6
SHA512 62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

memory/1620-47-0x00000000732DE000-0x00000000732DF000-memory.dmp

memory/1620-48-0x0000000000020000-0x0000000000074000-memory.dmp

memory/3852-50-0x0000000000400000-0x0000000000452000-memory.dmp

memory/3852-52-0x0000000005C80000-0x0000000006226000-memory.dmp

memory/3852-53-0x00000000057C0000-0x0000000005852000-memory.dmp

memory/3852-54-0x0000000005870000-0x000000000587A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tmp1C0F.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

memory/3852-69-0x00000000063F0000-0x0000000006466000-memory.dmp

memory/3852-70-0x0000000006AB0000-0x0000000006ACE000-memory.dmp

memory/3852-73-0x0000000007440000-0x0000000007A58000-memory.dmp

memory/3852-74-0x0000000008C00000-0x0000000008D0A000-memory.dmp

memory/3852-75-0x0000000007370000-0x0000000007382000-memory.dmp

memory/3852-76-0x00000000073D0000-0x000000000740C000-memory.dmp

memory/3852-77-0x0000000008D10000-0x0000000008D5C000-memory.dmp

memory/1152-78-0x0000000000630000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

MD5 8e74497aff3b9d2ddb7e7f819dfc69ba
SHA1 1d18154c206083ead2d30995ce2847cbeb6cdbc1
SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
SHA512 9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

memory/656-97-0x0000000000B60000-0x0000000000C72000-memory.dmp

memory/5020-99-0x0000000000400000-0x000000000050D000-memory.dmp

memory/5020-103-0x0000000000400000-0x000000000050D000-memory.dmp

memory/5020-102-0x0000000000400000-0x000000000050D000-memory.dmp

memory/5020-100-0x0000000000400000-0x000000000050D000-memory.dmp

C:\Users\Admin\AppData\Roaming\W7bixxGpWh.exe

MD5 88367533c12315805c059e688e7cdfe9
SHA1 64a107adcbac381c10bd9c5271c2087b7aa369ec
SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
SHA512 7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

C:\Users\Admin\AppData\Roaming\famaMzsduL.exe

MD5 30f46f4476cdc27691c7fdad1c255037
SHA1 b53415af5d01f8500881c06867a49a5825172e36
SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
SHA512 271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

memory/5020-124-0x0000000000400000-0x000000000050D000-memory.dmp

memory/1680-127-0x00000000000A0000-0x00000000000F2000-memory.dmp

memory/3228-129-0x0000000000920000-0x00000000009AE000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4272559161-3282441186-401869126-1000\76b53b3ec448f7ccdda2063b15d2bfc3_e1cb8dfe-5215-4859-82e0-ad3714d680b0

MD5 f274a9e352eebc907d684f8c35c87ee1
SHA1 4b2ba319f6a6228b1ec341d41bd15b969578a468
SHA256 a5ac9c9fef455797abb9b78b53682010995f9a1a79121fae518a37bc45339e58
SHA512 40f77bbcccee3a73ebc33725bace69ad3b826837891eb09351af23e6258f03ded058bf45b9a767590445f31d19899fdf3786df7d114ad3ac195a99a158258355

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 f25ea0aff7f3ed07990ea3b05b5440fd
SHA1 66df6b04a1a5f5c3ccf3b5aaeb6d4287fda786f5
SHA256 5b0fa941d94657b7a0fc0e241b34e4ad674ce6842d0fbfb4c86d342e2ff77a6a
SHA512 1e3965ba2991658691736161378c7d0ddaa3e98099253dc8e1040fe958c94b890ed07afb2ddd27056c0efa01469a0c6793b20f32a37d1e9a7a7d1d7a24c7dd3c

C:\Users\Public\Desktop\Google Chrome.lnk

MD5 a8ea919515ad98d65a73bf06ce725c81
SHA1 c5353949e0c719c765bf2d0b1db5e72083339206
SHA256 e5b1b0655fb8e3f8c7bc68a15cf6dfdaa52e7c08e25558e5c4e71b9251c334ba
SHA512 5df6ac7477484ff979ef0dd8a39659d6e64055831b970427be112c662fb6e72b7936fd1ac5ec5589eb52a4cdd04f4128cf9fe3020ad2985ae50b27eae42af464

C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

memory/1516-190-0x0000000000670000-0x00000000008B3000-memory.dmp

memory/3228-193-0x0000000008D90000-0x0000000008DF6000-memory.dmp

memory/3228-194-0x0000000009BC0000-0x0000000009D82000-memory.dmp

memory/3228-195-0x000000000A410000-0x000000000A93C000-memory.dmp

memory/1680-198-0x0000000006F90000-0x0000000006FE0000-memory.dmp

memory/1152-199-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/4520-203-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/4520-205-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-206-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-207-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1516-208-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000129001\Sеtup.exe

MD5 7985b190e7f7c0a3271b8f9a9850912a
SHA1 ee545a02350e1c28b29b83d8d3a23ee0d1f8fe07
SHA256 42379aae45e27eeb485b1f6956c2fc63a8da3a23c343ae9dfbc3ebebdc77855e
SHA512 4b48881e9ea7799295606b1e928fc6ef2f98f1296cab4ad09b15a8982a3d15ce6ddcda50ec5c1a7cd5cfc96e166645d270128ca31d0d8a585dae1ccb0a3fd1d6

memory/1152-255-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-256-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/1152-260-0x0000000000630000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe

MD5 5f1dffeff8714e88b493506256db8f8a
SHA1 d554da350b41da8556ce83ed851b975d2325a3d2
SHA256 e372a2d6ea5d76b0ffbccfa5b6574b910826fb5b5998e8e5cc4dcd49f6dffff0
SHA512 4bf57a4af1514111e301f8a1c8f3e2c145d078ba45a94edb71af6b1f9ca6dcfb3bd35d5114936f5c97ab4b1561b7b5afd4bfcc6d37b2f39b3aca0c96e0b28960

memory/1152-277-0x0000000000630000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

MD5 7e6a519688246fe1180f35fe0d25d370
SHA1 8e8719ac897dfef7305311dc216f570af40709af
SHA256 32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a
SHA512 a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

memory/4944-304-0x0000000000400000-0x0000000001066000-memory.dmp

memory/1152-309-0x0000000000630000-0x0000000000B06000-memory.dmp

memory/2984-310-0x0000000000630000-0x0000000000B06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

MD5 03cf06e01384018ac325de8bc160b4b2
SHA1 1853505e502b392fd556a9ce6050207230cc70cd
SHA256 5ab3785b2b72eaf7edff8961eb8ff8dd3dc6cc7031bc96ceb06a899b6fb3bbbc
SHA512 be1f2cf898db93e96e8817bf2d0ab0ef0f49d5bba4efba2de4046f6b381e8eda6ff5fcfdc057b6cbc4de5b3a7b096612c1e0d6b0d395ee685b3844ba5dc0e1b6

memory/3724-333-0x0000000000AD0000-0x0000000000B60000-memory.dmp

memory/2984-335-0x0000000000630000-0x0000000000B06000-memory.dmp

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

MD5 30daa686c1f31cc4833bd3d7283d8cdc
SHA1 70f74571fafe1b359cfe9ce739c3752e35d16cf5
SHA256 504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822
SHA512 9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

memory/4484-372-0x00000000008F0000-0x0000000000942000-memory.dmp

memory/1900-398-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1080-399-0x0000000000400000-0x000000000079D000-memory.dmp

memory/1516-397-0x0000000000670000-0x00000000008B3000-memory.dmp

memory/1900-396-0x0000000000400000-0x0000000000643000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost015.exe

MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

memory/1900-393-0x0000000000400000-0x0000000000643000-memory.dmp

memory/1516-400-0x0000000000670000-0x00000000008B3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000267001\ldx111.exe

MD5 2d1fc8d83178bbbe12c246412224dc12
SHA1 c573fab55dab8527b94e2679cdd4d97192c12601
SHA256 90d841da88320cac9daa43c1af2de6e5e1156cb44727c2fc1121e33ce6c7543b
SHA512 2ea5faf7fb6feab88694ee67b75e1b7b5544e995820d87c2453a9010c890a64165e51581c3dd6fc1029551ac6aa35cf5004c658ccf037f3cb94476b6dd4656e7

memory/5112-419-0x0000000000780000-0x00000000009D8000-memory.dmp

memory/5112-420-0x0000000005690000-0x00000000058B0000-memory.dmp

memory/5112-421-0x00000000069E0000-0x0000000006C00000-memory.dmp

memory/5112-437-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-422-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-440-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-447-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-445-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-441-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-435-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-433-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-431-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-429-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-427-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-425-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-423-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-443-0x00000000069E0000-0x0000000006BFA000-memory.dmp

memory/5112-1499-0x0000000005360000-0x00000000053AC000-memory.dmp

memory/5112-1498-0x00000000058F0000-0x0000000005A8C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\km111.exe

MD5 5d047c85071d16b5884a694cd1b9e339
SHA1 004ceeff566381efde2cab50ccb003a2d127b18c
SHA256 76e4e1e740d7e7317b9b66258b00723d0ef766301ccb164d09826178418c80ac
SHA512 1ad94386559b29d858f8712532ce270262ef353fc577f429bce1fd69411a6867da5323b55a77322478367a3b4907cab0299556842ca3f35cf9c547eb564630e2

memory/3568-1512-0x00000000002E0000-0x0000000000442000-memory.dmp

memory/3568-1515-0x0000000004EB0000-0x0000000004FDA000-memory.dmp

memory/5112-1510-0x0000000005AC0000-0x0000000005B14000-memory.dmp

memory/3568-1518-0x0000000005120000-0x000000000524A000-memory.dmp

memory/3568-2595-0x0000000005330000-0x00000000053D6000-memory.dmp

memory/1712-2601-0x0000000000910000-0x000000000096E000-memory.dmp

memory/1712-2602-0x0000000004D90000-0x0000000004E4C000-memory.dmp

memory/1900-2605-0x0000000000400000-0x0000000000643000-memory.dmp

memory/572-2606-0x0000000002810000-0x0000000002846000-memory.dmp

memory/572-2607-0x0000000005420000-0x0000000005A4A000-memory.dmp

memory/572-2608-0x0000000005250000-0x0000000005272000-memory.dmp

memory/572-2609-0x00000000052F0000-0x0000000005356000-memory.dmp

memory/572-2615-0x0000000005B30000-0x0000000005E87000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fru55d1g.per.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/572-2619-0x0000000006000000-0x000000000601E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

MD5 37d198ad751d31a71acc9cb28ed0c64e
SHA1 8eb519b7a6df66d84c566605da9a0946717a921d
SHA256 1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde
SHA512 60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

memory/572-2643-0x00000000065A0000-0x00000000065C2000-memory.dmp

memory/572-2642-0x0000000006510000-0x000000000652A000-memory.dmp

memory/572-2641-0x0000000007050000-0x00000000070E6000-memory.dmp

memory/3456-2644-0x00000000002B0000-0x0000000000328000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

MD5 03b1ed4c105e5f473357dad1df17cf98
SHA1 faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA256 6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA512 3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

memory/856-2668-0x000002698F340000-0x000002698F4A0000-memory.dmp

memory/856-2669-0x00000269A9AF0000-0x00000269A9C1A000-memory.dmp

memory/856-2670-0x00000269A9C20000-0x00000269A9D4C000-memory.dmp

memory/856-3745-0x00000269A9E50000-0x00000269A9EF4000-memory.dmp

memory/3456-3749-0x0000000005000000-0x000000000501A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000305001\acentric.exe

MD5 0828801c76d932613728631f82025732
SHA1 ae7c80120b5b1ab83129be69d91a918f757ef985
SHA256 3db92ab2a4539e8bcaa64ddc18812ed36ba97c96e401b9f9dec7080e86a0b5f8
SHA512 fc3cae1e13e1ac8c63f3ca1579ca8bca9b76a7a5aaee82eb0c82060fc5ae6bd4655f36cd3ec1832e98ba62808247e2c23f854fa6cac3adf7a92a7bf539d72b37

C:\Users\Admin\AppData\Local\Temp\272559161328

MD5 8cf2d41e0ea55a8101f7894d7c6efe98
SHA1 759f2057f547b595365003acea505e23ebeb0590
SHA256 89d8f18635ea1c50143754865a4abcc15dca4a1bda200568d90a4dccdf8d9837
SHA512 a4eb8dba9d79763e58dd9b0dc03794065aefb8ef01cdc10343e90375b0929d4ed145705d872542d7509a7eaf138a70e65cac737a4ff8204668cc4d878f354185

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

MD5 cd4a7065e3712d2ba913f35f4ed6cf3a
SHA1 f9e4fe56555781b2dccef1ca114ed4dd59ae782c
SHA256 b7586da7c86b7cccb7b03d25879f5032b1f10ced9f09fb1d5e67bfe64dfebc52
SHA512 3546b1721fa1036ab2e6c1b1abf95294f7e04046c3a114ab8c189944372f9f60703c01fa8751fb43d9bb80f04bb7a79c26c088bcef5e7b4f0d3261db6f8ad5fe

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

MD5 442cad195a6dab16a829252adaa2a501
SHA1 3322b875a8345ba7e3acb1de0682a5eae77e9c31
SHA256 c8c047c41f78ae5e76a0709fa05e99ae0651efd3cdceb4271b7dcd0cd6386c93
SHA512 c22142cab050ae12fe2e31b93dac8888be7ba3e0de4725e4f0f28e2580b270c171733fb5a6f2232e359413ffe1d200920bb32383ccb40f19fa73f6aad73c3808

memory/5976-3818-0x0000000000B40000-0x0000000000BCC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000306001\vlst.exe

MD5 929d51766dd14fbc2fa936540c2ddc07
SHA1 df221aef491abc8e6b7f5c462ba676f9d4967034
SHA256 5a705346b4e02a548a793c3b0769d588a3c471d720e49b0e848a3b4a7df5c146
SHA512 d6b7baf1853a497617c8b52d53f43bf337e169105954cfe8ec1fde7bd3b11d7966ca7a6632f2a43d492ae9497cb712d2c9a50ccffe0c9426d02a597dcf632d24

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-08 11:01

Reported

2024-09-08 11:03

Platform

win10v2004-20240802-en

Max time kernel

142s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A

Indicator Removal: File Deletion

defense_evasion

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3592 set thread context of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\axplong.job C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1932 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 1932 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
PID 4092 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe
PID 4092 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe
PID 3592 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 1712 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 5108 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4120 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
PID 3592 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3592 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe

"C:\Users\Admin\AppData\Local\Temp\ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

"C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

"C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe' -Force

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
RU 185.215.113.16:80 185.215.113.16 tcp
US 8.8.8.8:53 16.113.215.185.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FR 176.150.119.15:56001 tcp
US 8.8.8.8:53 15.119.150.176.in-addr.arpa udp

Files

memory/1932-0-0x0000000000110000-0x00000000005E6000-memory.dmp

memory/1932-1-0x0000000076EF4000-0x0000000076EF6000-memory.dmp

memory/1932-2-0x0000000000111000-0x000000000013F000-memory.dmp

memory/1932-3-0x0000000000110000-0x00000000005E6000-memory.dmp

memory/1932-4-0x0000000000110000-0x00000000005E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

MD5 48a36baee2fba32fc07ba2f12526914c
SHA1 0f16d91ed72554f0bc71e3906b6532ab2ac40781
SHA256 ee6bf4a67ac2157703f50a3f71ae2dfd5bd9f602ed3cb466b957beb4711ee978
SHA512 a7f327d00ef54a17d06b0fce5084e10bddb7c93768c995738b80d8618f320c54472aded33769facde18fef1ec8e528fc29a8e818828cebe935b2ad8ded0f59aa

memory/4092-18-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/1932-17-0x0000000000110000-0x00000000005E6000-memory.dmp

memory/4092-19-0x0000000000611000-0x000000000063F000-memory.dmp

memory/4092-20-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-21-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-22-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-23-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-24-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-25-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-26-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-27-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-28-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/2340-30-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/2340-31-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/2340-32-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/2340-34-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/4092-35-0x0000000000610000-0x0000000000AE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

MD5 03b1ed4c105e5f473357dad1df17cf98
SHA1 faf5046ff19eafd3a59dcf85be30496f90b5b6b1
SHA256 6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba
SHA512 3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

memory/3592-54-0x000001E0C5840000-0x000001E0C59A0000-memory.dmp

memory/3592-55-0x000001E0DFFA0000-0x000001E0E00CA000-memory.dmp

memory/3592-56-0x000001E0E00D0000-0x000001E0E01FC000-memory.dmp

memory/3592-88-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-90-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-110-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-108-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-106-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-104-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-103-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-100-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-96-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-94-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-92-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-86-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-84-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-82-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-78-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-76-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-74-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-72-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-70-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-66-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-64-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-62-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-60-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-58-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-112-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-98-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-80-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-68-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-57-0x000001E0E00D0000-0x000001E0E01F5000-memory.dmp

memory/3592-1131-0x000001E0E0200000-0x000001E0E02A4000-memory.dmp

memory/3592-1132-0x000001E0C7690000-0x000001E0C76DC000-memory.dmp

memory/3592-1138-0x000001E0E02B0000-0x000001E0E0304000-memory.dmp

memory/4120-1142-0x0000018384840000-0x00000183848FC000-memory.dmp

memory/4668-1148-0x0000018DE6D80000-0x0000018DE6DA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n21owazb.xdr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1948-1159-0x0000000000610000-0x0000000000AE6000-memory.dmp

memory/1948-1161-0x0000000000610000-0x0000000000AE6000-memory.dmp