Malware Analysis Report

2025-08-06 03:44

Sample ID 230501-j9j37seg72
Target t.png.ps1
SHA256 bf2d33230f6da074a70938e96042a56f340d26b34511ddd254e10a0293f746b6
Tags
asyncrat default rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bf2d33230f6da074a70938e96042a56f340d26b34511ddd254e10a0293f746b6

Threat Level: Known bad

The file t.png.ps1 was found to be: Known bad.

Malicious Activity Summary

asyncrat default rat

AsyncRat

Async RAT payload

Checks computer location settings

Suspicious use of SetThreadContext

Drops file in System32 directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-05-01 08:22

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-05-01 08:22

Reported

2023-05-01 08:24

Platform

win7-20230220-en

Max time kernel

126s

Max time network

29s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\t.png.ps1

Signatures

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1268 wrote to memory of 764 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 1268 wrote to memory of 764 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 1268 wrote to memory of 764 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 1768 wrote to memory of 1640 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 1768 wrote to memory of 1640 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 1768 wrote to memory of 1640 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 1640 wrote to memory of 1356 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 1640 wrote to memory of 1356 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 1640 wrote to memory of 1356 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 1356 wrote to memory of 1476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1356 wrote to memory of 1476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1356 wrote to memory of 1476 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1476 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 1468 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1768 wrote to memory of 1920 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 1768 wrote to memory of 1920 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 1768 wrote to memory of 1920 N/A C:\Windows\system32\taskeng.exe C:\Windows\System32\WScript.exe
PID 1920 wrote to memory of 1972 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 1920 wrote to memory of 1972 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 1920 wrote to memory of 1972 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 1972 wrote to memory of 320 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1972 wrote to memory of 320 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 1972 wrote to memory of 320 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 320 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 320 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 320 wrote to memory of 1628 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\t.png.ps1

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 1 /tn log /tr C:\ProgramData\log\log.vbs

C:\Windows\system32\taskeng.exe

taskeng.exe {A128CDF7-9616-43F4-B8FE-2B577A25C89D} S-1-5-21-1914912747-3343861975-731272777-1000:TMRJMUQF\Admin:Interactive:[1]

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\ProgramData\log\log.vbs"

C:\Windows\System32\cmd.exe

cmd /c ""C:\ProgramData\log\1.bat" "

C:\Windows\system32\cmd.exe

CMD /C POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\ProgramData\log\log.vbs"

C:\Windows\System32\cmd.exe

cmd /c ""C:\ProgramData\log\1.bat" "

C:\Windows\system32\cmd.exe

CMD /C POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

Network

N/A

Files

memory/1268-58-0x000000001B1A0000-0x000000001B482000-memory.dmp

memory/1268-59-0x0000000002360000-0x0000000002368000-memory.dmp

memory/1268-60-0x0000000002380000-0x0000000002400000-memory.dmp

memory/1268-61-0x0000000002380000-0x0000000002400000-memory.dmp

memory/1268-62-0x0000000002380000-0x0000000002400000-memory.dmp

memory/1268-63-0x0000000002380000-0x0000000002400000-memory.dmp

C:\ProgramData\log\log.vbs

MD5 6be0eb96c776c22e099d7643281026f5
SHA1 0f4934d51d6b7dd2a82cfe2d574c1994fe0aa67b
SHA256 3e8f8fc88258f73995eaa6ce64e5093709b1386171512161e5f0ab81c9424503
SHA512 d0c4113016953135bd1cbb6d7504918b10e503467699bd342acd4981bccebc77a1cb054c56b82ef06847cff43da4d6266f4a281ec734e75244aeac8f510e999b

C:\ProgramData\log\1.bat

MD5 1c0e3a11c13201e27ad546a96ba9b235
SHA1 fc8c268814b29dd7355380303ccf915c6a0a46de
SHA256 73de662f4a968fe1d94e3e29cfdd0a8f7e79f914cae64eca32ba55595c6b82e3
SHA512 cb30385e2813e75a02e99afbd1a7f1f288200140d1dc0e716facb708e21a4dd13581fa580a5b0e81b1c3080d107c10f3e44ab5891123236c7f9f3ba2aa31532a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 f5e4b8276f57ab37c21b51d1c00c3ce0
SHA1 0e9c208ed7d980445d220a8ea8b543a4112a9695
SHA256 02603a0f98bbb4eb7f9e2cd532a4d8f3cdaa285b5d7888bd00f8c7d58b82579b
SHA512 4d6085a8763071cc88fba0dc4c634cdd3eba196989a26aec97deaeb5910b0546414f2d1285d26b36f042077ce3013d21e5e95f637cbed699ae9fb03047fd5fb3

memory/1468-76-0x000000001B1D0000-0x000000001B4B2000-memory.dmp

memory/1468-77-0x0000000001DE0000-0x0000000001DE8000-memory.dmp

memory/1468-78-0x00000000023F0000-0x0000000002470000-memory.dmp

memory/1468-79-0x00000000023F0000-0x0000000002470000-memory.dmp

C:\ProgramData\log\log.ps1

MD5 45115fc43fe6bfb9015eecb6a682fca1
SHA1 35d5822da06aa21432025d74fb2b2baaa8dbffe1
SHA256 f501fd1cf1abab6ab840e26c5032b344ebec05c1446b160088469cbdc095303b
SHA512 1f4223e9480007b73c97215af1bd60a57d361a72be6f32c787c1760024c94aa4824d313391351e7bf8dcf9cbe8a0e4e9aa14a71864a08153c5584e680ca8dedc

memory/1468-81-0x00000000023F0000-0x0000000002470000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 8f9e9803acb767ce26582a7994562377
SHA1 79343802d23cd332bc977c9f1fe3c510aea2cc98
SHA256 dbd4c4096f54c8c57890e174f59b3e060837da818ebd86ed1df23f5658ec107c
SHA512 b250efb93f9a172fed14a7a2cca17795a26fa4967f312152135ce3f52a02f6c71dd8ae6d1b5de08b9bb0ffbb18b3508d9eef2c2cd46ab7e17f8376ff7f63c1f0

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E0WGMBWWV9U1E4PLML0V.temp

MD5 8f9e9803acb767ce26582a7994562377
SHA1 79343802d23cd332bc977c9f1fe3c510aea2cc98
SHA256 dbd4c4096f54c8c57890e174f59b3e060837da818ebd86ed1df23f5658ec107c
SHA512 b250efb93f9a172fed14a7a2cca17795a26fa4967f312152135ce3f52a02f6c71dd8ae6d1b5de08b9bb0ffbb18b3508d9eef2c2cd46ab7e17f8376ff7f63c1f0

memory/1628-87-0x0000000002640000-0x00000000026C0000-memory.dmp

memory/1628-88-0x0000000002644000-0x0000000002647000-memory.dmp

memory/1628-89-0x000000000264B000-0x0000000002682000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-05-01 08:22

Reported

2023-05-01 08:24

Platform

win10v2004-20230220-en

Max time kernel

135s

Max time network

152s

Command Line

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\t.png.ps1

Signatures

AsyncRat

rat asyncrat

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3196 wrote to memory of 4656 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 3196 wrote to memory of 4656 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\schtasks.exe
PID 4148 wrote to memory of 4048 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\cmd.exe
PID 4148 wrote to memory of 4048 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\cmd.exe
PID 4048 wrote to memory of 4180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4048 wrote to memory of 4180 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4180 wrote to memory of 3984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4180 wrote to memory of 3984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3984 wrote to memory of 5056 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4976 wrote to memory of 5052 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\cmd.exe
PID 4976 wrote to memory of 5052 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\cmd.exe
PID 5052 wrote to memory of 4040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 5052 wrote to memory of 4040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 4040 wrote to memory of 4168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4040 wrote to memory of 4168 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 4168 wrote to memory of 640 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\t.png.ps1

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /sc minute /mo 1 /tn log /tr C:\ProgramData\log\log.vbs

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\ProgramData\log\log.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\ProgramData\log\1.bat" "

C:\Windows\system32\cmd.exe

CMD /C POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\System32\WScript.exe

C:\Windows\System32\WScript.exe "C:\ProgramData\log\log.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\ProgramData\log\1.bat" "

C:\Windows\system32\cmd.exe

CMD /C POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

POWERSHELL -NOP -WIND HIDDEN -eXEC BYPASS -NONI "C:\ProgramData\log\log.ps1"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 52.152.110.14:443 tcp
IE 13.69.239.74:443 tcp
US 8.248.5.254:80 tcp
US 8.248.5.254:80 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 64.13.109.52.in-addr.arpa udp
US 8.248.5.254:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 52.152.110.14:443 tcp
US 8.8.8.8:53 alertgeeks.ddnsfree.com udp
TR 194.55.224.72:8808 alertgeeks.ddnsfree.com tcp
US 8.8.8.8:53 72.224.55.194.in-addr.arpa udp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp
US 52.152.110.14:443 tcp

Files

memory/3196-138-0x000001CF5F0F0000-0x000001CF5F112000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3wnzpxy.5ai.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3196-143-0x000001CF5E3C0000-0x000001CF5E3D0000-memory.dmp

memory/3196-145-0x000001CF5E3C0000-0x000001CF5E3D0000-memory.dmp

memory/3196-144-0x000001CF5E3C0000-0x000001CF5E3D0000-memory.dmp

memory/3196-150-0x000001CF5E3C0000-0x000001CF5E3D0000-memory.dmp

memory/3196-151-0x000001CF5E3C0000-0x000001CF5E3D0000-memory.dmp

memory/3196-152-0x000001CF5E3C0000-0x000001CF5E3D0000-memory.dmp

C:\ProgramData\log\log.vbs

MD5 6be0eb96c776c22e099d7643281026f5
SHA1 0f4934d51d6b7dd2a82cfe2d574c1994fe0aa67b
SHA256 3e8f8fc88258f73995eaa6ce64e5093709b1386171512161e5f0ab81c9424503
SHA512 d0c4113016953135bd1cbb6d7504918b10e503467699bd342acd4981bccebc77a1cb054c56b82ef06847cff43da4d6266f4a281ec734e75244aeac8f510e999b

C:\ProgramData\log\1.bat

MD5 1c0e3a11c13201e27ad546a96ba9b235
SHA1 fc8c268814b29dd7355380303ccf915c6a0a46de
SHA256 73de662f4a968fe1d94e3e29cfdd0a8f7e79f914cae64eca32ba55595c6b82e3
SHA512 cb30385e2813e75a02e99afbd1a7f1f288200140d1dc0e716facb708e21a4dd13581fa580a5b0e81b1c3080d107c10f3e44ab5891123236c7f9f3ba2aa31532a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d096831023867930e62e6d8b3d4d8ca6
SHA1 404a1e73dc1590f1c8b9327c396591567dac7365
SHA256 167f75b42ae614a8d6b0497779ff12f09605328533487f235b029e0db03ad23b
SHA512 31333100ddd8e04bf730118ea800843720c0f3fb69e27b89dda7fa4d717d25e838ad55a0919d47a44dd8a78d724ef8c105cfa230987cc46ba94a2b790ff91b75

C:\ProgramData\log\log.ps1

MD5 45115fc43fe6bfb9015eecb6a682fca1
SHA1 35d5822da06aa21432025d74fb2b2baaa8dbffe1
SHA256 f501fd1cf1abab6ab840e26c5032b344ebec05c1446b160088469cbdc095303b
SHA512 1f4223e9480007b73c97215af1bd60a57d361a72be6f32c787c1760024c94aa4824d313391351e7bf8dcf9cbe8a0e4e9aa14a71864a08153c5584e680ca8dedc

memory/3984-170-0x000001FCDE210000-0x000001FCDE220000-memory.dmp

memory/3984-171-0x000001FCDE210000-0x000001FCDE220000-memory.dmp

memory/3984-172-0x000001FCDE210000-0x000001FCDE220000-memory.dmp

memory/5056-173-0x0000000000400000-0x0000000000416000-memory.dmp

memory/5056-175-0x0000000005530000-0x0000000005540000-memory.dmp

memory/5056-176-0x0000000005E10000-0x00000000063B4000-memory.dmp

memory/5056-177-0x0000000005A50000-0x0000000005AE2000-memory.dmp

memory/5056-178-0x0000000005A30000-0x0000000005A3A000-memory.dmp

memory/5056-179-0x0000000005D40000-0x0000000005DDC000-memory.dmp

memory/5056-180-0x0000000006600000-0x0000000006666000-memory.dmp

memory/5056-181-0x0000000005530000-0x0000000005540000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 4feb08d678114967a3064e2bf6515706
SHA1 f617b3f4f9d3e4d80d0bad2231c1fec79b6ec8d3
SHA256 15af4b9b55a562a5791b65421f0b2562d8b4a72d87d43c630dd667cb9dcf0ef5
SHA512 c1f7b9bd49aabd5e33564f1b3de01b9db6627f923fe95322775328012fbfbe29c9da907cdfe4a8641575002ea7699dcc92947362906e30269a46db752d463738

memory/4168-192-0x0000023D625F0000-0x0000023D62600000-memory.dmp

memory/4168-193-0x0000023D625F0000-0x0000023D62600000-memory.dmp

memory/4168-194-0x0000023D625F0000-0x0000023D62600000-memory.dmp

memory/640-197-0x0000000002590000-0x00000000025A0000-memory.dmp