Malware Analysis Report

2024-10-18 23:14

Sample ID 240514-xelv7sag5y
Target documents_24.5.13YTKargo.pdf.001.rar
SHA256 c4f7cc89b9b27846908b3d2b85ee17f24a773666d1dfa62a59bcf202aeae8ed4
Tags
execution snakekeylogger collection keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c4f7cc89b9b27846908b3d2b85ee17f24a773666d1dfa62a59bcf202aeae8ed4

Threat Level: Known bad

The file documents_24.5.13YTKargo.pdf.001.rar was found to be: Known bad.

Malicious Activity Summary

execution snakekeylogger collection keylogger spyware stealer

Snake Keylogger

Snake Keylogger payload

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

outlook_win_path

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-14 18:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-14 18:46

Reported

2024-05-14 18:48

Platform

win7-20231129-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2044 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2044 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 2044 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2488 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 2044 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

Processes

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EDqfTdWmvf.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EDqfTdWmvf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3BD8.tmp"

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

Network

N/A

Files

memory/2044-0-0x000000007409E000-0x000000007409F000-memory.dmp

memory/2044-1-0x00000000003B0000-0x000000000044A000-memory.dmp

memory/2044-2-0x0000000074090000-0x000000007477E000-memory.dmp

memory/2044-3-0x00000000005D0000-0x00000000005F0000-memory.dmp

memory/2044-4-0x0000000000580000-0x0000000000590000-memory.dmp

memory/2044-5-0x0000000000630000-0x0000000000646000-memory.dmp

memory/2044-6-0x00000000052D0000-0x0000000005338000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3BD8.tmp

MD5 d0d01c2860a1e16c2e51e61c001202e0
SHA1 bb5673ab505bee8d2324cee249199f7e2166c943
SHA256 9e8219e2363947d39f8ca13660c7e892020427cb5743d21c912b7bd116bc2245
SHA512 e463a421298554e9e2102ca67b90e02d1c5546c0ac4ae4433230e55c1fc3e217e98ed060169c474f610120b2e17e101fe51b85a74d07809eb140ec83c0d43671

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6L9RZQM4XER9E8BBNG3U.temp

MD5 5608e1b594dda99f57f45f33c3107f96
SHA1 dad58fff3a3b6002ddc2220b8836ce388b4c7e22
SHA256 2f163a05f34bed4808ce59ee0c07fb4c3cbeb5a1bcec69f0b999b9ff19c12a7a
SHA512 1c92c536599b3b1dac33fcff15e533673c6e51474f8a7ecbbc83e87601e84011afe502e7533fc51684aa127e5d55bea366cba0b07f10f391877f295d58895acd

memory/2044-19-0x0000000074090000-0x000000007477E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-14 18:46

Reported

2024-05-14 18:48

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

Signatures

Snake Keylogger

stealer keylogger snakekeylogger

Snake Keylogger payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 448 set thread context of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 448 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 448 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 448 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 448 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 448 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 448 wrote to memory of 4612 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 448 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 448 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 448 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Windows\SysWOW64\schtasks.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe
PID 448 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\EDqfTdWmvf.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EDqfTdWmvf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6793.tmp"

C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe

"C:\Users\Admin\AppData\Local\Temp\documents_24.5.13YTKargo.pdf.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 checkip.dyndns.org udp
JP 132.226.8.169:80 checkip.dyndns.org tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 169.8.226.132.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 172.67.177.134:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 134.177.67.172.in-addr.arpa udp
US 8.8.8.8:53 scratchdreams.tk udp
US 104.21.27.85:443 scratchdreams.tk tcp
US 8.8.8.8:53 85.27.21.104.in-addr.arpa udp
US 8.8.8.8:53 113.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/448-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

memory/448-1-0x0000000000B80000-0x0000000000C1A000-memory.dmp

memory/448-2-0x0000000005CC0000-0x0000000006264000-memory.dmp

memory/448-3-0x00000000055F0000-0x0000000005682000-memory.dmp

memory/448-4-0x00000000056A0000-0x00000000056AA000-memory.dmp

memory/448-5-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/448-6-0x0000000005C40000-0x0000000005C60000-memory.dmp

memory/448-7-0x0000000005C80000-0x0000000005C90000-memory.dmp

memory/448-8-0x0000000005C90000-0x0000000005CA6000-memory.dmp

memory/448-9-0x0000000006F60000-0x0000000006FC8000-memory.dmp

memory/448-10-0x00000000095B0000-0x000000000964C000-memory.dmp

memory/4156-15-0x0000000002A00000-0x0000000002A36000-memory.dmp

memory/4156-16-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/4156-18-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/4156-17-0x0000000005630000-0x0000000005C58000-memory.dmp

memory/4612-19-0x0000000074BA0000-0x0000000075350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6793.tmp

MD5 516d5d6bddce066b1ae971fccaf11880
SHA1 4da4485a33fbdd8927cd677bf0f16818dd012217
SHA256 77de518f161c38c78a0fd91112c4a10224610a6458c59f3143c08f6c05317687
SHA512 fa44bd5428ad43c1e47f6527f3507addeab1304215a668c5d29c60df4cda17969ed020ff370042daad30ee9d6857020cf6cd1a7b9f9cd95ea6153f0c4e7d15c9

memory/4156-23-0x00000000053F0000-0x0000000005456000-memory.dmp

memory/4156-24-0x0000000005460000-0x00000000054C6000-memory.dmp

memory/4156-22-0x0000000005350000-0x0000000005372000-memory.dmp

memory/4156-21-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/4612-26-0x00000000054F0000-0x0000000005844000-memory.dmp

memory/3716-27-0x0000000000400000-0x0000000000426000-memory.dmp

memory/4612-28-0x0000000074BA0000-0x0000000075350000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bt10crbn.myl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/448-48-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/4612-25-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/4156-50-0x00000000068A0000-0x00000000068EC000-memory.dmp

memory/4156-49-0x0000000006310000-0x000000000632E000-memory.dmp

memory/4612-53-0x0000000071380000-0x00000000713CC000-memory.dmp

memory/4156-52-0x0000000071380000-0x00000000713CC000-memory.dmp

memory/4156-51-0x0000000007330000-0x0000000007362000-memory.dmp

memory/4612-72-0x0000000006A40000-0x0000000006A5E000-memory.dmp

memory/4156-73-0x0000000007370000-0x0000000007413000-memory.dmp

memory/4612-74-0x0000000007450000-0x0000000007ACA000-memory.dmp

memory/4612-75-0x0000000006E10000-0x0000000006E2A000-memory.dmp

memory/4612-76-0x0000000006E80000-0x0000000006E8A000-memory.dmp

memory/4156-77-0x00000000078B0000-0x0000000007946000-memory.dmp

memory/4612-78-0x0000000007010000-0x0000000007021000-memory.dmp

memory/4612-79-0x0000000007040000-0x000000000704E000-memory.dmp

memory/4156-80-0x0000000007870000-0x0000000007884000-memory.dmp

memory/4156-81-0x0000000007970000-0x000000000798A000-memory.dmp

memory/4156-82-0x0000000007950000-0x0000000007958000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 778555116f62bab0c408556db2ed219e
SHA1 4baf3643a212d47cd1b6a29788cdb6c6c650962b
SHA256 f020ac2d1ea646f5f271298e18e7270a8241f2f7efb5edf02eb338d4ccda578d
SHA512 8239f59fc9b501db3a8a07fde0bf27bb3eb052b852485550f9510cd907c2c413a01223e63ff2be3fe43d18501c860088ce7b3e3acb1a891a3a0d33e3946c2ac4

memory/4612-88-0x0000000074BA0000-0x0000000075350000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4156-89-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/3716-90-0x0000000006C90000-0x0000000006CE0000-memory.dmp

memory/3716-91-0x0000000006EB0000-0x0000000007072000-memory.dmp