Malware Analysis Report

2024-11-16 12:44

Sample ID 240301-aaaaaagb4w
Target winact.bat
SHA256 6626cdbc6e4f16638523acfb157386e1294df9829d6b124e385a487c2dcfad90
Tags
discovery exploit
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

6626cdbc6e4f16638523acfb157386e1294df9829d6b124e385a487c2dcfad90

Threat Level: Likely malicious

The file winact.bat was found to be: Likely malicious.

Malicious Activity Summary

discovery exploit

Possible privilege escalation attempt

Modifies file permissions

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-01 00:00

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-01 00:00

Reported

2024-03-01 00:03

Platform

win7-20240221-en

Max time kernel

119s

Max time network

122s

Command Line

cmd /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2228 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2228 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2228 wrote to memory of 2124 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2228 wrote to memory of 2852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2228 wrote to memory of 2852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2228 wrote to memory of 2852 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2228 wrote to memory of 2892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2228 wrote to memory of 2892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2228 wrote to memory of 2892 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 2228 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2944 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2388 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2388 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2228 wrote to memory of 2388 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

cmd /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"

C:\Windows\system32\takeown.exe

takeown /F C:\Windows\System32\sppsvc.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32 /grant administrators:F /T

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\spp /grant administrators:F /T

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl

Network

N/A

Files

memory/2944-4-0x000000001B300000-0x000000001B5E2000-memory.dmp

memory/2944-5-0x0000000002320000-0x0000000002328000-memory.dmp

memory/2944-6-0x0000000002AA4000-0x0000000002AA7000-memory.dmp

memory/2944-7-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

memory/2944-9-0x0000000002AA0000-0x0000000002B20000-memory.dmp

memory/2944-10-0x0000000002AA0000-0x0000000002B20000-memory.dmp

memory/2944-8-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 ef4fa9d7b3b2fb4b4aff1d4dff2a4318
SHA1 0e7390b004386ccf207d40552d619d40efa0a72f
SHA256 f21f4290f360a216570df6de51c96e44e80eb38341fc6aaef01de94ec0c37284
SHA512 21f36e2a73834a6188f7cbbea50b75e84648190a935518505a98cf103815ea1fbc6d6543e797a4182eb56010952bfb05763cb9ce2134bd41e9ab44657c0e5b94

memory/2516-16-0x000000001B1A0000-0x000000001B482000-memory.dmp

memory/2516-17-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

memory/2516-18-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/2516-19-0x00000000023A0000-0x00000000023A8000-memory.dmp

memory/2516-20-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/2516-21-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

memory/2516-22-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/2516-23-0x0000000002860000-0x00000000028E0000-memory.dmp

memory/2516-24-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

memory/2528-30-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

memory/2528-31-0x00000000024F0000-0x0000000002570000-memory.dmp

memory/2528-32-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

memory/2528-33-0x00000000024F0000-0x0000000002570000-memory.dmp

memory/2528-35-0x000007FEF5370000-0x000007FEF5D0D000-memory.dmp

memory/2528-34-0x00000000024F0000-0x0000000002570000-memory.dmp

memory/2528-36-0x00000000024FB000-0x0000000002562000-memory.dmp

memory/2388-42-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

memory/2388-43-0x00000000025C0000-0x0000000002640000-memory.dmp

memory/2388-44-0x00000000025C0000-0x0000000002640000-memory.dmp

memory/2388-45-0x00000000025C0000-0x0000000002640000-memory.dmp

memory/2388-46-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

memory/2388-47-0x000007FEF49D0000-0x000007FEF536D000-memory.dmp

memory/2944-48-0x0000000002AA0000-0x0000000002B20000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-01 00:00

Reported

2024-03-01 00:02

Platform

win10v2004-20240226-en

Max time kernel

91s

Max time network

98s

Command Line

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"

Signatures

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4112 wrote to memory of 4952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 4112 wrote to memory of 4952 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 4112 wrote to memory of 1888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 4112 wrote to memory of 1888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 4112 wrote to memory of 2888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 4112 wrote to memory of 2888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\icacls.exe
PID 4112 wrote to memory of 1396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 1396 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 4700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 4700 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 2992 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 1344 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 3084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4112 wrote to memory of 3084 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\winact.bat"

C:\Windows\system32\takeown.exe

takeown /F C:\Windows\System32\sppsvc.exe

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32 /grant administrators:F /T

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32\spp /grant administrators:F /T

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SPPSVC' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'HKLM:\SYSTEM\WPA'; $rule = New-Object System.Security.AccessControl.RegistryAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'HKLM:\SYSTEM\WPA' -AclObject $acl

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -c $acl = Get-Acl 'C:\Windows\System32'; $rule = New-Object System.Security.AccessControl.FileSystemAccessRule ('NT Service\sppsvc','FullControl','ContainerInherit, ObjectInherit','None','Allow'); $acl.SetAccessRule($rule); Set-Acl -Path 'C:\Windows\System32' -AclObject $acl

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4eljoejr.hb0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1396-9-0x00000244EB250000-0x00000244EB272000-memory.dmp

memory/1396-10-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/1396-11-0x00000244EB2B0000-0x00000244EB2C0000-memory.dmp

memory/1396-12-0x00000244EB2B0000-0x00000244EB2C0000-memory.dmp

memory/1396-15-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8fe7bd6cd1d64bcdabbf2e2ae72c5a28
SHA1 5e1080c3b8cc4c5bffc73ffe6d45fa073335d0de
SHA256 5054cd4d79ca09e90169cdaee05c1e3dfc5d6fa1ad1275e11fd094521fed3fb8
SHA512 658004888ba70fa4a8c4b573d439496532c08b81afdc0b2419187c2ec9f3e42408d9a7c2bd2c73efd06fd5ada7ea57e1bb5d188e57ead32a7c0c900a82099f68

memory/4700-22-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6bacbdfa362c3dabcb200c9accfbd836
SHA1 32869e376a77f4a1e609d191fc252c409a04e8ad
SHA256 395e9885ff8593eb2002301c85919f0aadf6af6fa42b2cb78441e1e926e575a9
SHA512 7427d35c4a508641ad0ffbde4d0192ca038c9be4fb5add6b18220db3d8a7b88e59c12c947a888010a9ed36f62af27c1191edfc0619e6d85899692e345ddcdde2

memory/4700-28-0x0000018857B30000-0x0000018857B40000-memory.dmp

memory/4700-29-0x0000018857B30000-0x0000018857B40000-memory.dmp

memory/4700-31-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/2992-42-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 33f526f6596f73ba293247cc2e790a94
SHA1 d11d735da502cbb913e257f2bf6456f126d91613
SHA256 2af624a2765ef3e28d52862732c34c0f1e0947ca0ea0a1151edd898829577088
SHA512 9777f3fa777d3d8aef22c0b4f8f33d95ccf575a44a641b308e222725d093dc6b5794a43ac5458bca8264143a566e472e73204621b63b32019e3e0d95e6ff3591

memory/2992-43-0x0000019FFCE30000-0x0000019FFCE40000-memory.dmp

memory/2992-45-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/1344-46-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/1344-56-0x00000212F61A0000-0x00000212F61B0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 9944e1a23780e34a1240b8977eea565d
SHA1 a509b71263e790d800970dbfc7f6255fc9ed256d
SHA256 1ff2581cf8e69f3ce057ebf7ef736746fc35ee87fbd15baf7846911d97ecfebd
SHA512 ac60f75c8cd7cfc012049dd60c9d9b4d3503e6cf3aa9d3a03ce05dd8caab129a2705a5f65fd71c1cb73ec48243265397cd9eeadd1ccbde813aa3a735ff2eea37

memory/1344-58-0x00000212F61A0000-0x00000212F61B0000-memory.dmp

memory/1344-60-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/3084-72-0x00000180F47F0000-0x00000180F4800000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d52a6cabb7897a46bc444de1db94f68a
SHA1 62427bdd0993afd235fc686b6ea2f8826bb5480e
SHA256 7f4f3fad38e34c5d655f3017530ca5a62eab4a3bda033db9a240567b1869deec
SHA512 60f451295f140fbf5371465ecee1fb89e16a61cc1d52578350cf20a989f0a72492dbd942b0edf4f09eef71ea73124711855cdbe551ffd7545ec336de77729ea6

memory/3084-70-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/3084-73-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp

memory/3084-74-0x00000180F47F0000-0x00000180F4800000-memory.dmp

memory/3084-75-0x00000180F47F0000-0x00000180F4800000-memory.dmp

memory/3084-77-0x00007FFE7D3A0000-0x00007FFE7DE61000-memory.dmp