Malware Analysis Report

2025-01-03 05:21

Sample ID 230211-lkxzwadc5v
Target 0e5fadebbb63160d78fab09972b795f7.exe
SHA256 fc729002ac4f2ca65757920fe60351d318b329d854cbf709addf0761d0c68664
Tags
bitrat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc729002ac4f2ca65757920fe60351d318b329d854cbf709addf0761d0c68664

Threat Level: Known bad

The file 0e5fadebbb63160d78fab09972b795f7.exe was found to be: Known bad.

Malicious Activity Summary

bitrat trojan upx

BitRAT

Checks computer location settings

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-11 09:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-11 09:36

Reported

2023-02-11 09:39

Platform

win7-20220812-en

Max time kernel

75s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

Signatures

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 668 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 668 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 668 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 668 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 668 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 668 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1560 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 668 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OHAxhhFlhLD.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHAxhhFlhLD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp53F.tmp"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

Network

N/A

Files

memory/668-54-0x00000000000E0000-0x00000000002F6000-memory.dmp

memory/668-55-0x0000000075981000-0x0000000075983000-memory.dmp

memory/668-56-0x00000000007A0000-0x00000000007B4000-memory.dmp

memory/668-57-0x0000000001F40000-0x0000000001F4C000-memory.dmp

memory/668-58-0x0000000008490000-0x0000000008664000-memory.dmp

memory/816-59-0x0000000000000000-mapping.dmp

memory/1684-61-0x0000000000000000-mapping.dmp

memory/676-62-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp53F.tmp

MD5 7e27a57ca0363b47c5a883cd84bd21b7
SHA1 9f40f0b545ccabe599de4e1b580c7cc16d0f013c
SHA256 9e71bd2085431f14145f71c86be5f1920cceb8169780a6152eee0a774099681d
SHA512 e14386e84ec40ed797543a83b0ea110c6c18877933ede0ad386957e11557e12ebaf5f24f60092cdec3bfb9f8550df5f869ec9a92a6b2db21738b6247a4cd46b9

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 0822b979676e2929d9a2ac57523c8c7a
SHA1 cd1e8e182a71941c7af8a2e722c037e716bb1a36
SHA256 58d67692db6eb8fdaec532d5ae24c0a780873075964afe00fdd05964c1ade399
SHA512 6b225a48dc7f5a510070fead877efc446c8f2cba520e5eaac142a8fb0780adbc4ab7cd1ef3b5fcea022e4c783ad4e4bcffb7e6f1bb92744a0b734e3c67a17d8b

memory/668-66-0x0000000009D60000-0x0000000009EDA000-memory.dmp

memory/1684-67-0x000000006D120000-0x000000006D6CB000-memory.dmp

memory/816-68-0x000000006D120000-0x000000006D6CB000-memory.dmp

memory/1684-70-0x000000006D120000-0x000000006D6CB000-memory.dmp

memory/816-69-0x000000006D120000-0x000000006D6CB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-11 09:36

Reported

2023-02-11 09:39

Platform

win10v2004-20221111-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

Signatures

BitRAT

trojan bitrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4880 set thread context of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4880 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 1144 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4880 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Windows\SysWOW64\schtasks.exe
PID 4880 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 3540 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe
PID 4880 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OHAxhhFlhLD.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OHAxhhFlhLD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe

"C:\Users\Admin\AppData\Local\Temp\0e5fadebbb63160d78fab09972b795f7.exe"

Network

Country Destination Domain Proto
US 72.21.81.240:80 tcp
US 20.42.73.24:443 tcp
NL 104.80.225.205:443 tcp
US 72.21.81.240:80 tcp
US 72.21.81.240:80 tcp
US 72.21.81.240:80 tcp
US 93.184.221.240:80 tcp
BG 101.99.94.203:1234 tcp
NL 8.238.177.126:80 tcp
NL 8.238.177.126:80 tcp

Files

memory/4880-132-0x0000000000FE0000-0x00000000011F6000-memory.dmp

memory/4880-133-0x00000000061C0000-0x0000000006764000-memory.dmp

memory/4880-134-0x0000000005C10000-0x0000000005CA2000-memory.dmp

memory/4880-135-0x0000000005B90000-0x0000000005B9A000-memory.dmp

memory/4880-136-0x0000000009EB0000-0x0000000009F4C000-memory.dmp

memory/1144-137-0x0000000000000000-mapping.dmp

memory/3816-138-0x0000000000000000-mapping.dmp

memory/3644-139-0x0000000000000000-mapping.dmp

memory/1144-140-0x0000000002750000-0x0000000002786000-memory.dmp

memory/1144-141-0x00000000052B0000-0x00000000058D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFFEB.tmp

MD5 9a53402bd346fdc2a36143ea42a1ae3a
SHA1 1ad4e9eec239834f340857da46ca9702ecb2cb87
SHA256 377f16767d69cbc7e7b3395360f479ae4ad7184544aeb8012f9ece77e0208414
SHA512 daeadd9d6945a5c672353541039bc82fb572ddb952422a9e85b59558b7aaffd2a58486bcebee671e86cfe7f60f7c245d9adc0ad4880722f6e23dc9bef0df00b3

memory/3816-143-0x0000000004FF0000-0x0000000005012000-memory.dmp

memory/3816-144-0x0000000005210000-0x0000000005276000-memory.dmp

memory/1144-145-0x0000000005A10000-0x0000000005A76000-memory.dmp

memory/3540-146-0x0000000000000000-mapping.dmp

memory/524-147-0x0000000000000000-mapping.dmp

memory/524-148-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/524-149-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/524-150-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/524-151-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/524-153-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/1144-152-0x0000000006040000-0x000000000605E000-memory.dmp

memory/524-154-0x0000000070C60000-0x0000000070C99000-memory.dmp

memory/1144-155-0x0000000007040000-0x0000000007072000-memory.dmp

memory/3816-157-0x0000000075080000-0x00000000750CC000-memory.dmp

memory/1144-156-0x0000000075080000-0x00000000750CC000-memory.dmp

memory/1144-158-0x00000000065F0000-0x000000000660E000-memory.dmp

memory/524-159-0x0000000070BC0000-0x0000000070BF9000-memory.dmp

memory/3816-160-0x00000000073F0000-0x000000000740A000-memory.dmp

memory/1144-161-0x00000000079B0000-0x000000000802A000-memory.dmp

memory/3816-162-0x0000000007460000-0x000000000746A000-memory.dmp

memory/524-163-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/3816-164-0x0000000007670000-0x0000000007706000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e