Analysis Overview
SHA256
ed5f392d0095487edd0f112db6a14bbd3e9dc13454e63bf17bb0816d15e93f31
Threat Level: Known bad
The file Payment Advice-BCS_ECS9522023032900460039_16922_952.exe was found to be: Known bad.
Malicious Activity Summary
Detect ZGRat V1
Remcos
ZGRat
Checks computer location settings
Suspicious use of SetThreadContext
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-12-07 07:41
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-12-07 07:41
Reported
2023-12-07 07:44
Platform
win7-20231023-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Remcos
ZGRat
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2732 set thread context of 796 | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XOXpOFSvB.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOXpOFSvB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D5A.tmp"
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
Network
| Country | Destination | Domain | Proto |
| US | 45.128.234.54:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp |
Files
memory/2732-1-0x0000000074C10000-0x00000000752FE000-memory.dmp
memory/2732-0-0x0000000000A90000-0x0000000000B9A000-memory.dmp
memory/2732-2-0x0000000004750000-0x0000000004790000-memory.dmp
memory/2732-3-0x0000000000580000-0x0000000000594000-memory.dmp
memory/2732-4-0x0000000074C10000-0x00000000752FE000-memory.dmp
memory/2732-5-0x0000000004750000-0x0000000004790000-memory.dmp
memory/2732-6-0x0000000000590000-0x000000000059C000-memory.dmp
memory/2732-7-0x00000000050D0000-0x0000000005190000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp7D5A.tmp
| MD5 | 515c05874baad4082d2a53bda7d179fe |
| SHA1 | 3b92eb40408a67dc574de6f552979e8eaa7d5b75 |
| SHA256 | 54251cb2f6fcffbcc0612c1653e12ad0f7467481f3c5f43740e2ed1393a6ff4a |
| SHA512 | 1c7ba3689ecf9a861110953aea8cec246b1f31cd6ac215cecada986b5b1cd33d56f109b7df4ca3a5e0ec059c66f7c68d454f776948ae0d1e6c81f169d59d4519 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | 34c90a9909d585dcdd6c31d00d17fb46 |
| SHA1 | 9d0fe33060ff6c7fd71aa5fc9c3d113ddfee40cf |
| SHA256 | 599cfa5e75564c085af6d5a64c122cb08b247342263405dfe67501d4f4d68ab6 |
| SHA512 | 0b60edef3541e2f11c7aa97e1f2f3f8fe66de8a9c07bf25cf2ba154c879a966c1d2841c719b8d747ad4078f3add23191df43db483fbcc53de7811d5096139bcf |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\37OL4AUQ7GBBY7HCTDHK.temp
| MD5 | 34c90a9909d585dcdd6c31d00d17fb46 |
| SHA1 | 9d0fe33060ff6c7fd71aa5fc9c3d113ddfee40cf |
| SHA256 | 599cfa5e75564c085af6d5a64c122cb08b247342263405dfe67501d4f4d68ab6 |
| SHA512 | 0b60edef3541e2f11c7aa97e1f2f3f8fe66de8a9c07bf25cf2ba154c879a966c1d2841c719b8d747ad4078f3add23191df43db483fbcc53de7811d5096139bcf |
memory/2732-20-0x00000000042A0000-0x00000000042A6000-memory.dmp
memory/2732-21-0x0000000005E80000-0x0000000005F00000-memory.dmp
memory/796-22-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-24-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-26-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-28-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2752-30-0x000000006F940000-0x000000006FEEB000-memory.dmp
memory/796-31-0x0000000000400000-0x0000000000480000-memory.dmp
memory/768-33-0x000000006F940000-0x000000006FEEB000-memory.dmp
memory/768-35-0x0000000002600000-0x0000000002640000-memory.dmp
memory/2752-36-0x0000000002770000-0x00000000027B0000-memory.dmp
memory/796-38-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-34-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2752-41-0x0000000002770000-0x00000000027B0000-memory.dmp
memory/768-42-0x0000000002600000-0x0000000002640000-memory.dmp
memory/2752-43-0x0000000002770000-0x00000000027B0000-memory.dmp
memory/796-40-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/796-47-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-49-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-50-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-52-0x0000000000400000-0x0000000000480000-memory.dmp
memory/2732-51-0x0000000074C10000-0x00000000752FE000-memory.dmp
memory/796-53-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-54-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-55-0x0000000000400000-0x0000000000480000-memory.dmp
memory/768-58-0x000000006F940000-0x000000006FEEB000-memory.dmp
memory/2752-57-0x000000006F940000-0x000000006FEEB000-memory.dmp
memory/796-59-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-60-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-61-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-63-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-64-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-65-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-67-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-68-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-69-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-71-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-72-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-73-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-75-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-76-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-77-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-79-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-80-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-81-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-83-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-84-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-85-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-87-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-88-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-89-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-90-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-92-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-93-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-94-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-96-0x0000000000400000-0x0000000000480000-memory.dmp
memory/796-97-0x0000000000400000-0x0000000000480000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-12-07 07:41
Reported
2023-12-07 07:44
Platform
win10v2004-20231127-en
Max time kernel
150s
Max time network
155s
Command Line
Signatures
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Remcos
ZGRat
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3940 set thread context of 4660 | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XOXpOFSvB.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOXpOFSvB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp"
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 34.175.53.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 39.142.81.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.252.72.23.in-addr.arpa | udp |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp | |
| US | 8.8.8.8:53 | 4.173.189.20.in-addr.arpa | udp |
| N/A | 127.0.0.1:56932 | tcp | |
| US | 45.128.234.54:56932 | tcp |
Files
memory/3940-1-0x0000000075300000-0x0000000075AB0000-memory.dmp
memory/3940-0-0x0000000000BC0000-0x0000000000CCA000-memory.dmp
memory/3940-2-0x0000000005BD0000-0x0000000006174000-memory.dmp
memory/3940-3-0x00000000056C0000-0x0000000005752000-memory.dmp
memory/3940-4-0x0000000005680000-0x0000000005690000-memory.dmp
memory/3940-5-0x0000000005870000-0x000000000587A000-memory.dmp
memory/3940-6-0x0000000002F20000-0x0000000002F34000-memory.dmp
memory/3940-7-0x0000000075300000-0x0000000075AB0000-memory.dmp
memory/3940-8-0x0000000005680000-0x0000000005690000-memory.dmp
memory/3940-9-0x0000000002FB0000-0x0000000002FBC000-memory.dmp
memory/3940-10-0x00000000081F0000-0x00000000082B0000-memory.dmp
memory/3940-11-0x0000000008450000-0x00000000084EC000-memory.dmp
memory/4760-16-0x0000000004F20000-0x0000000004F56000-memory.dmp
memory/4760-18-0x0000000075300000-0x0000000075AB0000-memory.dmp
memory/4760-17-0x0000000005610000-0x0000000005C38000-memory.dmp
memory/4760-19-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
memory/3572-21-0x0000000005830000-0x0000000005852000-memory.dmp
memory/3572-22-0x00000000055E0000-0x00000000055F0000-memory.dmp
memory/3572-25-0x00000000055E0000-0x00000000055F0000-memory.dmp
memory/4760-24-0x0000000005C40000-0x0000000005CA6000-memory.dmp
memory/4760-26-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp
| MD5 | 186e94f3a87674fc48dd7a4f052b8ebd |
| SHA1 | c07f63475cb6349a7ef791585789ac9cf380f65c |
| SHA256 | f6c892732e56b30de5b4554d7fa459e3d614a992d32605ef5bc955085666e30d |
| SHA512 | 55214198f32a42b0a0a8934b266a00cc0c26525b27caa225195d1413c48f0e3bd6cc4e548252e8d5ea50cd46a3bd16fcee8d54baa03103831b1ed22a6bbe9e90 |
memory/3572-27-0x0000000005AE0000-0x0000000005B46000-memory.dmp
memory/3572-20-0x0000000075300000-0x0000000075AB0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ppnqhq43.4ht.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3940-46-0x00000000083F0000-0x00000000083F6000-memory.dmp
memory/3572-47-0x0000000006250000-0x00000000065A4000-memory.dmp
memory/3940-48-0x0000000008C10000-0x0000000008C90000-memory.dmp
memory/4660-49-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-50-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4760-52-0x0000000006510000-0x000000000652E000-memory.dmp
memory/4660-53-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3940-54-0x0000000075300000-0x0000000075AB0000-memory.dmp
memory/4760-55-0x0000000006A80000-0x0000000006ACC000-memory.dmp
memory/4660-57-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-58-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-59-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4760-60-0x0000000004FD0000-0x0000000004FE0000-memory.dmp
memory/4760-61-0x000000007F210000-0x000000007F220000-memory.dmp
memory/3572-63-0x000000007EEE0000-0x000000007EEF0000-memory.dmp
memory/4760-64-0x000000006FD90000-0x000000006FDDC000-memory.dmp
memory/3572-65-0x000000006FD90000-0x000000006FDDC000-memory.dmp
memory/4760-75-0x0000000006AD0000-0x0000000006AEE000-memory.dmp
memory/4760-62-0x0000000007510000-0x0000000007542000-memory.dmp
memory/4760-85-0x0000000007550000-0x00000000075F3000-memory.dmp
memory/4760-87-0x0000000007820000-0x000000000783A000-memory.dmp
memory/3572-86-0x0000000008070000-0x00000000086EA000-memory.dmp
memory/4760-88-0x0000000007890000-0x000000000789A000-memory.dmp
memory/3572-89-0x0000000007CB0000-0x0000000007D46000-memory.dmp
memory/4760-90-0x0000000007A20000-0x0000000007A31000-memory.dmp
memory/4660-91-0x0000000000400000-0x0000000000480000-memory.dmp
memory/3572-93-0x0000000007C60000-0x0000000007C6E000-memory.dmp
memory/3572-94-0x0000000007C70000-0x0000000007C84000-memory.dmp
memory/4760-96-0x0000000007B40000-0x0000000007B48000-memory.dmp
memory/4760-95-0x0000000007B60000-0x0000000007B7A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 139fde2d3b02f5cbfb89f2b6d68660df |
| SHA1 | dd66efa7b159bbe66ffb23a3920223611ea958a9 |
| SHA256 | 25b5ca10a64ef0c138ddcaa0c983facf2e11168b101ce5b1a41a992e5280bb02 |
| SHA512 | 3247276087b517556b03896e54cfb5b3970a5230b679c046dbc8aa721a8c7f554bd6d2d7e37ee2c4d53d99d7f96249cb0592327694903bf0876547bd0196ea5b |
memory/4760-103-0x0000000075300000-0x0000000075AB0000-memory.dmp
memory/3572-102-0x0000000075300000-0x0000000075AB0000-memory.dmp
memory/4660-104-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-105-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-106-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-108-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-109-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-110-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-112-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-113-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-114-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-115-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-117-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-118-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-119-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-121-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-122-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-123-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-125-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-126-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-127-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-129-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-130-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-131-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-133-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-134-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-135-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-137-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-138-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-139-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-141-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-142-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-143-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-145-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-146-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-147-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-149-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-150-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-151-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-153-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-154-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-155-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-157-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-158-0x0000000000400000-0x0000000000480000-memory.dmp
memory/4660-159-0x0000000000400000-0x0000000000480000-memory.dmp