Malware Analysis Report

2025-01-22 14:01

Sample ID 240225-f3mc7sce82
Target ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe
SHA256 ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405
Tags
agenttesla zgrat njrat hacked evasion keylogger persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405

Threat Level: Known bad

The file ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla zgrat njrat hacked evasion keylogger persistence rat spyware stealer trojan

Agenttesla family

Zgrat family

njRAT/Bladabindi

AgentTesla

ZGRat

AgentTesla payload

Detect ZGRat V1

AgentTesla payload

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Checks processor information in registry

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Kills process with taskkill

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-25 05:23

Signatures

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A

Agenttesla family

agenttesla

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Zgrat family

zgrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-25 05:23

Reported

2024-02-25 05:26

Platform

win7-20240220-en

Max time kernel

0s

Max time network

0s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe

"C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-25 05:23

Reported

2024-02-25 05:26

Platform

win10v2004-20240221-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

njRAT/Bladabindi

trojan njrat

AgentTesla payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Corporation Security = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-910440534-423636034-2318342392-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ." C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\explorer.exe\" ." C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2760 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2760 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2760 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2760 wrote to memory of 4528 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\Setup.exe
PID 2760 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe
PID 2760 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe
PID 2760 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe
PID 4528 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
PID 4528 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
PID 3044 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
PID 3044 wrote to memory of 1852 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe
PID 5040 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 5040 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1852 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 1852 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
PID 4000 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 4000 wrote to memory of 1096 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 4360 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe \??\c:\windows\system32\cmstp.exe
PID 4360 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe \??\c:\windows\system32\cmstp.exe
PID 3044 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 264 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4864 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 3044 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe C:\Windows\System32\cmd.exe
PID 264 wrote to memory of 1512 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 264 wrote to memory of 1512 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1200 wrote to memory of 1524 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1200 wrote to memory of 1524 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4864 wrote to memory of 2956 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4864 wrote to memory of 2956 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 1912 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 1912 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4724 wrote to memory of 4152 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4724 wrote to memory of 4152 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4076 wrote to memory of 4900 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4076 wrote to memory of 4900 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4360 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
PID 4360 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe
PID 2416 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe C:\Windows\SYSTEM32\netsh.exe
PID 2416 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe C:\Windows\SYSTEM32\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe

"C:\Users\Admin\AppData\Local\Temp\ffceb132ec57dd0f810dc46054662db58a25cfc0e7960d2d865a0bc60fb1c405.exe"

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

"C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe

dw20.exe -x -s 796

\??\c:\windows\system32\cmstp.exe

"c:\windows\system32\cmstp.exe" /au C:\Users\Admin\AppData\Local\Temp\0h4aqfsw.inf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /c PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\OneDrive.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Taskmgr.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

C:\Windows\system32\taskkill.exe

taskkill /IM cmstp.exe /F

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cortana.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

PowerShell.exe -windowstyle hidden Add-Mppreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemSettings.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe"

C:\Windows\SYSTEM32\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 proxy-cheap.blogspot.com udp
GB 142.250.187.225:443 proxy-cheap.blogspot.com tcp
GB 142.250.187.225:443 proxy-cheap.blogspot.com tcp
US 8.8.8.8:53 amazonhost.thedreamsop.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 107.180.41.239:80 amazonhost.thedreamsop.com tcp
US 107.180.41.239:80 amazonhost.thedreamsop.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 173.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 107.180.41.239:80 amazonhost.thedreamsop.com tcp
US 107.180.41.239:80 amazonhost.thedreamsop.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 107.180.41.239:80 amazonhost.thedreamsop.com tcp
US 107.180.41.239:80 amazonhost.thedreamsop.com tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 pcpanel.hackcrack.io udp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 8.8.8.8:53 18.221.185.147.in-addr.arpa udp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp
US 147.185.221.18:32544 pcpanel.hackcrack.io tcp

Files

memory/2760-0-0x00000000005C0000-0x0000000000936000-memory.dmp

memory/2760-1-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Setup.exe

MD5 ee76425b767c9ab812a53c133b8363f8
SHA1 1daa4700a5f1849eb7e810986ac24bd58786da61
SHA256 f962e1a60673963b7c2fa51a0663260df63771dfbd7423af67c2d142f7245747
SHA512 004d1b4acc7084ba8c520d94032c19342228ed6346321b04641450f87a32f78a92212e3940e4cf0790af2e5640c6001e7c805dc99cf8f9a146d752b5ee117c3b

memory/3044-14-0x0000000000410000-0x0000000000488000-memory.dmp

memory/3044-15-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/3044-17-0x0000000002600000-0x000000000262A000-memory.dmp

memory/3044-16-0x000000001B040000-0x000000001B050000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

MD5 b6a17adf6c356cc0007722c102e05ef1
SHA1 ceb34c2eac1a5d5cb2803f6eab34f4e0c1b15e4d
SHA256 0ef45bdf29e9bd2da871af058e676d6c33c6ea5b95a1587fc8025a4ca1f49197
SHA512 75e06fd4448c5df480c45a2f713bc7e806847c8e58fab7382eb61cd5e2c2b54f43ca162d739de2284af7ae6163670d4802dfbdedc2b6b4aa2d73a512a614c051

memory/4528-31-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

MD5 cd35f448685e44afc2f65854d087f07b
SHA1 2184dfbb615e437c3807da0f04a8b1cd91ed55c2
SHA256 f37d07238e2ee5234a64daa2b3704444f72e790802e83f533908ef4d675241da
SHA512 50aec6c69687e8e18ccb51c09a728933789c4d093ccc283fe3ae9be1be7d1e343fbb33860828ee3525338d9283af719dedb9c51f364374780a8f91cbb92c28ef

C:\Users\Admin\AppData\Local\Temp\KeywordKing .exe

MD5 d4941525df91a894119bd6ec6190583b
SHA1 0b114d6428d86d5326ddfe06680ea2e566741823
SHA256 b8edfc4c4993e8277129a8939ce37df083635205e2dbb88524d2d0027fdfcd2e
SHA512 c01b33be43502b0dc6c85f8f3a81f2f70012023db3938f438b2ed88ea3456e1c00484515ba4015c0c1b6248251740ea664d301ad3fea9e344ca9c93d1d3d63f1

memory/4528-40-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

memory/2760-41-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

MD5 5c8053e0987abd96bbe3908486feb5c0
SHA1 2b218cfa22419227a055ba25a54ce9d4c3b04ee6
SHA256 9a54618271f6c9437c8cdfd40a5a5d4f43c163cf073bc219bb9ba1bcf0b66ee9
SHA512 20e0a75cfd4eba55554009efd78e8b63594122aa3d0eb5a60e80594fa9c44eb242b0f5f38785d19638e79b1e847bb058d7dcf43afafde6a52c9b44efcfce66b4

memory/3868-42-0x0000000000610000-0x0000000000906000-memory.dmp

memory/3868-43-0x0000000074960000-0x0000000075110000-memory.dmp

memory/3868-44-0x0000000005770000-0x0000000005D14000-memory.dmp

memory/3868-45-0x00000000051C0000-0x0000000005252000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.exe

MD5 f36e535fdc82208fca08acfa44f790c6
SHA1 a3cc1aa7d614094faebada2aed1e6c519bd18c94
SHA256 51efbe235b492c7e99c480915c7eeecf85f5ee6d540189ee5aa54fe9f0fafcdc
SHA512 631db5246159e045ed6911867f25991ae8824951e608c2fef25bc48482271aeb3ad26f1c98a04b4cbbf431ce20ef027cacb4bf0b3d85e048885da2b709f3a9af

memory/5040-48-0x00000000000A0000-0x00000000000F6000-memory.dmp

memory/1852-50-0x000000001BBD0000-0x000000001BBD8000-memory.dmp

memory/3044-53-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/5040-52-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/3868-55-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/3868-56-0x0000000005280000-0x000000000528A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Setup.exe.log

MD5 7ca69c3a50dd1e107b36424371d545aa
SHA1 af96b7133f339588b8de9e29be762dd8fbe2da08
SHA256 fb56bfa6682034270cd833c70e9ab03a606372aef15b2e305da0318873394664
SHA512 bf3b5a590335e671cd44f244bf20fc30028a56c55f69f4f8b0a46aba787b248c343391998ed5267b5ca9aa0075697e169056120c18837ddc3ca97c5ace83c6fd

memory/1852-57-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/4528-59-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/3868-58-0x0000000005420000-0x0000000005616000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\svchost.zip

MD5 a1814c03d8d16639b62d770e246e1bdd
SHA1 89670fc4cd0673219f92945e2cbc4a40efcaeaae
SHA256 4c45a9ae842dd14a49e3231890a734e09ea285c48f9e867d865ca74ae358ab2b
SHA512 5e7a92f3dc1b99cfc6cbc407b56162b8982ce367cc23700c4745f6e3959d6c5bf0f1a876e08d33964b4ca30e51d72afcf83fcff8b837ecf31b9bc9d5e59cb1fe

memory/3868-60-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/3868-61-0x0000000006A70000-0x0000000006A8A000-memory.dmp

memory/3868-64-0x00000000090C0000-0x0000000009170000-memory.dmp

memory/3868-65-0x0000000074960000-0x0000000075110000-memory.dmp

memory/5040-66-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/3868-67-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/1852-68-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/3868-69-0x0000000002B60000-0x0000000002B70000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

MD5 a9b0d84f4872b4352371e33a973cfdda
SHA1 6a2f976500c939987ed0427a5c7c88103e79471a
SHA256 937c2943f9773d84a1ad3540115abe9447c74085a08f1c5f5ec19c5d6145b1bb
SHA512 f56ef1f698c8bfd8e047f19b1e5da6dc1fb8f07e441bc2efebda2beb6f63725e385ee28946baa0841cad007288fd8524c799504708bce880e2358bdac2505662

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.zip

MD5 3d3435b18469b7d581bcaffea5397df0
SHA1 6b22009c0b6bc7f7fff9cf1bd4f749300d8cad7c
SHA256 7c7d6e28fbee6b1a0686950ab4ea4b954b7f3a52c770e439b84e77e74cf574c9
SHA512 2833ca96cdfb39d211c2e678e643f5530664d5122d914d4be507a928ab5819bd23f27b365d47d79b649ac7dfa936cc186d4f71c2fdf0de469fe684d57d3eb515

memory/5040-86-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log

MD5 cafd74774ee92e32d33d986aa1d02887
SHA1 4eba3d811e150ea0e03193916820ceb1353d7d3a
SHA256 a9a2445fa2c7695be72695fb46f2d5fbb7106691d7840d454fac2b91ddd014b0
SHA512 27baef4953ca7ffd10dfc22d6ee2e6b961c1c08aa2a9813737afb4a265bfa9dfa56d577b20b0aefa84c157ab8fbc3fc4a7456c4e5093dd480f22c3fbdef30bf6

memory/1852-90-0x00007FFDF0140000-0x00007FFDF0C01000-memory.dmp

memory/4360-89-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

memory/4360-91-0x0000000000DF0000-0x0000000000E00000-memory.dmp

memory/4360-92-0x000000001B550000-0x000000001B5F6000-memory.dmp

memory/4360-93-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

memory/4000-94-0x0000000001430000-0x0000000001440000-memory.dmp

memory/4360-97-0x000000001C220000-0x000000001C6EE000-memory.dmp

memory/4000-98-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0h4aqfsw.inf

MD5 6f1420f2133f3e08fd8cdea0e1f5fe27
SHA1 3aa41ec75adc0cf50e001ca91bbfa7f763adf70b
SHA256 aed1ac2424a255f231168bcb02f16b6ea89603e0045465c2149abcde33a06242
SHA512 d5629e9835f881cd271e88d9ec2d2c27b9d5d1b25329ade5cfb9824a6358c9e98e66f1b89ac9459b4c540c02af2728129dd8523bdf007cadf28b5fa2d199a2aa

memory/4000-104-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

memory/4000-108-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

memory/4360-109-0x000000001B830000-0x000000001B8CC000-memory.dmp

memory/4360-110-0x0000000000F40000-0x0000000000F48000-memory.dmp

memory/4360-111-0x0000000000DF0000-0x0000000000E00000-memory.dmp

memory/4360-114-0x0000000000F20000-0x0000000000F2C000-memory.dmp

memory/3044-116-0x0000000000F10000-0x0000000000F20000-memory.dmp

memory/3044-117-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

memory/3044-115-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\version.exe

MD5 10d90137afcca51c429a2c0aa78c92d6
SHA1 c7cb2762e0a31b06aaca0c440db5556fd23df24f
SHA256 44a4f73cc6a5a89208372ded41ed5e3cecc8bf2064ee1224275f21061dae11a1
SHA512 c914381e197450f3e576d3c77f103796be594444499ff2397e0bb74f9249baff973ea5c66ab42540835e060ad6032694fc2b8d01c95795d71adf6f1c91d000b0

memory/3044-119-0x00007FFDEC0A0000-0x00007FFDECA41000-memory.dmp

memory/1524-121-0x0000022DB8150000-0x0000022DB8160000-memory.dmp

memory/1524-122-0x0000022DB8150000-0x0000022DB8160000-memory.dmp

memory/2956-123-0x00000193E86B0000-0x00000193E86C0000-memory.dmp

memory/1524-120-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

memory/2956-124-0x00000193E86B0000-0x00000193E86C0000-memory.dmp

memory/2956-135-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

memory/1524-134-0x0000022DD0C40000-0x0000022DD0C62000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avmt1km2.wiv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4152-136-0x000001CACA670000-0x000001CACA680000-memory.dmp

memory/1512-143-0x00000284F2170000-0x00000284F2180000-memory.dmp

memory/1512-148-0x00000284F2170000-0x00000284F2180000-memory.dmp

memory/1512-142-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

memory/1912-149-0x00007FFDEF700000-0x00007FFDF01C1000-memory.dmp

memory/1912-159-0x000002A0AB6F0000-0x000002A0AB700000-memory.dmp

memory/4900-170-0x000002D7A5D50000-0x000002D7A5D60000-memory.dmp

memory/1912-160-0x000002A0AB6F0000-0x000002A0AB700000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\explorer.exe.log

MD5 e9b84a8ca80d8de18390d788a80f3721
SHA1 0d9eae4cb2aad66bcf93e996cb8407dbc2311a84
SHA256 57c4764bb9a07ebfc036015105d466c65da3d97a2fed4006d4690c76bdc8bc59
SHA512 9183a91e1a583a66d6b5fb8d30dcc05f6f3e3419ba3aa7885d8f35981058dc803b01cd1f7e33f4109cd8da1e3457fd6ed088b07acf5fb3a9c9ae080a1749fe5b