Malware Analysis Report

2025-08-11 06:22

Sample ID 240403-m9l5cacd7w
Target PO-24-0146.exe
SHA256 4d71dea7fedeac5da79730368e3e524f82efcfa368293651bf6c0bb0e423eb8c
Tags
agenttesla keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4d71dea7fedeac5da79730368e3e524f82efcfa368293651bf6c0bb0e423eb8c

Threat Level: Known bad

The file PO-24-0146.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla keylogger spyware stealer trojan

AgentTesla

Reads user/profile data of local email clients

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Reads WinSCP keys stored on the system

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-03 11:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-03 11:09

Reported

2024-04-03 11:12

Platform

win7-20240221-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2856 set thread context of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2856 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2856 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 2856 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

"C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jIlwbG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jIlwbG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp390A.tmp"

C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

"C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp

Files

memory/2856-0-0x0000000000FF0000-0x0000000001096000-memory.dmp

memory/2856-1-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/2856-2-0x0000000004E50000-0x0000000004E90000-memory.dmp

memory/2856-3-0x0000000000400000-0x0000000000414000-memory.dmp

memory/2856-4-0x00000000006C0000-0x00000000006CA000-memory.dmp

memory/2856-5-0x00000000006D0000-0x00000000006DC000-memory.dmp

memory/2856-6-0x0000000004770000-0x00000000047F2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I7R3QBHM8M6GJHP6VANU.temp

MD5 6242e79822f3fde2d205296e5f15d80b
SHA1 f38126a1e2521d5a63d22eabba613ffd2a9fcff0
SHA256 801d43292838f34a0217f61e43f653d8689acc4169d15602ab33f44178cd9339
SHA512 160c245e94012f961882cf5ad05b2faed56af9ef926958f46299c401be89bc52ef837423429009e669ee8e2bc56edb6086af83672d31591d7550fe0b14394677

C:\Users\Admin\AppData\Local\Temp\tmp390A.tmp

MD5 0b2c5ea6422aeec3a068a115f550d5a9
SHA1 9ecbc75c9080ba0b782c4d268bf756054fe288b4
SHA256 67473788526ec0147dc873b891f9857a073fed78fcd965c5567eb67c17d78ec0
SHA512 82f0d85e5958b2f1198625fe412d6423a3b64bd0b9f5576e87cb1069069cab0496d89e900e1e6577a6bfe13904c8d9b1be7f0513b2042af66d3acd4e0c3c9b6a

memory/2740-19-0x000000006EB00000-0x000000006F0AB000-memory.dmp

memory/2700-21-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2596-23-0x000000006EB00000-0x000000006F0AB000-memory.dmp

memory/2596-20-0x000000006EB00000-0x000000006F0AB000-memory.dmp

memory/2700-24-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2700-26-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2700-27-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2700-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2700-32-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2856-34-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/2700-35-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2700-30-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2700-36-0x0000000073580000-0x0000000073C6E000-memory.dmp

memory/2596-37-0x000000006EB00000-0x000000006F0AB000-memory.dmp

memory/2700-38-0x0000000073580000-0x0000000073C6E000-memory.dmp

memory/2700-39-0x0000000004970000-0x00000000049B0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-03 11:09

Reported

2024-04-03 11:12

Platform

win10v2004-20240226-en

Max time kernel

140s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1444 set thread context of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1444 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 5012 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 1444 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 1444 wrote to memory of 4104 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Windows\SysWOW64\schtasks.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe
PID 1444 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

"C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jIlwbG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jIlwbG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E5C.tmp"

C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe

"C:\Users\Admin\AppData\Local\Temp\PO-24-0146.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 160.111.86.104.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
NL 142.250.179.138:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
US 216.239.32.29:80 pki.goog tcp
US 8.8.8.8:53 138.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 29.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 9.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 mail.issltd.org udp
US 143.95.230.109:587 mail.issltd.org tcp
US 8.8.8.8:53 109.230.95.143.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 218.110.86.104.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

memory/1444-0-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/1444-1-0x0000000000880000-0x0000000000926000-memory.dmp

memory/1444-2-0x0000000005840000-0x0000000005DE4000-memory.dmp

memory/1444-3-0x0000000005330000-0x00000000053C2000-memory.dmp

memory/1444-4-0x0000000005520000-0x0000000005530000-memory.dmp

memory/1444-5-0x00000000054C0000-0x00000000054CA000-memory.dmp

memory/1444-6-0x0000000005830000-0x0000000005844000-memory.dmp

memory/1444-7-0x00000000065F0000-0x00000000065FA000-memory.dmp

memory/1444-8-0x0000000006600000-0x000000000660C000-memory.dmp

memory/1444-9-0x0000000006670000-0x00000000066F2000-memory.dmp

memory/1444-10-0x0000000008D30000-0x0000000008DCC000-memory.dmp

memory/5012-15-0x00000000049D0000-0x0000000004A06000-memory.dmp

memory/5012-16-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/5012-17-0x00000000049C0000-0x00000000049D0000-memory.dmp

memory/5012-19-0x00000000049C0000-0x00000000049D0000-memory.dmp

memory/4960-20-0x0000000004A20000-0x0000000004A30000-memory.dmp

memory/5012-18-0x0000000005040000-0x0000000005668000-memory.dmp

memory/1444-21-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/4960-22-0x0000000074BF0000-0x00000000753A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3E5C.tmp

MD5 9ddca00edf40b6117d57d6860b8d8e12
SHA1 38d5aea7672afb5ea9663573aee7f88bf7e6eed8
SHA256 335cac4dfd901cfd7e5022ab3b9f0c84f8548ff20913f4bfad6a836a70603d2d
SHA512 92c4da73be476be2ac91db3fc4a2866eb1a71d32df019c313638b4b5c4ad0ef121024e5e8ba30fcf606cd7098374728c590b263816e262ccb4d309d4c9076c46

memory/5012-24-0x0000000005850000-0x0000000005872000-memory.dmp

memory/2428-25-0x0000000000400000-0x0000000000440000-memory.dmp

memory/1444-26-0x0000000005520000-0x0000000005530000-memory.dmp

memory/2428-27-0x0000000074BF0000-0x00000000753A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ja4pl3az.xes.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5012-41-0x0000000005990000-0x00000000059F6000-memory.dmp

memory/2428-42-0x0000000005900000-0x0000000005910000-memory.dmp

memory/1444-35-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/4960-34-0x0000000005800000-0x0000000005866000-memory.dmp

memory/4960-51-0x0000000005AD0000-0x0000000005E24000-memory.dmp

memory/5012-52-0x0000000006000000-0x000000000601E000-memory.dmp

memory/4960-53-0x0000000005F40000-0x0000000005F8C000-memory.dmp

memory/4960-54-0x0000000004A20000-0x0000000004A30000-memory.dmp

memory/5012-55-0x00000000049C0000-0x00000000049D0000-memory.dmp

memory/5012-57-0x0000000006FF0000-0x0000000007022000-memory.dmp

memory/5012-56-0x000000007FC20000-0x000000007FC30000-memory.dmp

memory/4960-59-0x0000000071030000-0x000000007107C000-memory.dmp

memory/4960-74-0x00000000063B0000-0x00000000063CE000-memory.dmp

memory/5012-58-0x0000000071030000-0x000000007107C000-memory.dmp

memory/5012-79-0x0000000007030000-0x00000000070D3000-memory.dmp

memory/5012-80-0x0000000007970000-0x0000000007FEA000-memory.dmp

memory/4960-81-0x00000000064E0000-0x00000000064FA000-memory.dmp

memory/4960-82-0x00000000071B0000-0x00000000071BA000-memory.dmp

memory/4960-83-0x0000000007440000-0x00000000074D6000-memory.dmp

memory/5012-84-0x0000000007530000-0x0000000007541000-memory.dmp

memory/5012-85-0x0000000007560000-0x000000000756E000-memory.dmp

memory/5012-86-0x0000000007570000-0x0000000007584000-memory.dmp

memory/5012-87-0x0000000007670000-0x000000000768A000-memory.dmp

memory/2428-88-0x0000000006FC0000-0x0000000007010000-memory.dmp

memory/4960-89-0x00000000074E0000-0x00000000074E8000-memory.dmp

memory/4960-92-0x0000000074BF0000-0x00000000753A0000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 20a0e17b2e1d18f0732fc45ad3d666c0
SHA1 99de4d6b09088437edd2e97ca734c99f3ad42d73
SHA256 48c77cbe94f660622a0903da0176e8229e5c1364efd57eb9e706d85e13d74602
SHA512 c2e47cc02e5c43ed25d61bb5207e8ff70c07be69483c60d6ff7ddade2f54ba1df38946da6af5a90080eed33f849bfb8685c13469e6662d340b2ecede5b245b85

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/5012-96-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/2428-97-0x0000000074BF0000-0x00000000753A0000-memory.dmp

memory/2428-98-0x0000000005900000-0x0000000005910000-memory.dmp