Malware Analysis Report

2024-11-30 06:50

Sample ID 240604-b6x7naha9x
Target abc1ab2d94c3bf032086a2428825c22ba00b3654c6c6aae9bcc36d9c6050a535.rar
SHA256 abc1ab2d94c3bf032086a2428825c22ba00b3654c6c6aae9bcc36d9c6050a535
Tags
agenttesla execution keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

abc1ab2d94c3bf032086a2428825c22ba00b3654c6c6aae9bcc36d9c6050a535

Threat Level: Known bad

The file abc1ab2d94c3bf032086a2428825c22ba00b3654c6c6aae9bcc36d9c6050a535.rar was found to be: Known bad.

Malicious Activity Summary

agenttesla execution keylogger persistence spyware stealer trojan

AgentTesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detects executables referencing many file transfer clients. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-04 01:46

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-04 01:46

Reported

2024-06-04 01:48

Platform

win7-20240221-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1968 set thread context of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1968 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2460 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1968 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1968 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1968 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1968 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1968 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\shipping documents.exe

"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mUsYIbZfsGwZQG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mUsYIbZfsGwZQG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFF74.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/1968-0-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

memory/1968-1-0x00000000001A0000-0x0000000000254000-memory.dmp

memory/1968-2-0x0000000074D20000-0x000000007540E000-memory.dmp

memory/1968-3-0x0000000000350000-0x0000000000368000-memory.dmp

memory/1968-4-0x0000000000370000-0x0000000000380000-memory.dmp

memory/1968-5-0x0000000005DB0000-0x0000000005E34000-memory.dmp

memory/1968-6-0x0000000074D2E000-0x0000000074D2F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpFF74.tmp

MD5 a04a1fa40c56b9cf4205108d990ebb45
SHA1 d0c63ad5f9d620b393110e0b304a6f6a9612b4ba
SHA256 6aeb74319492a7560fcf5266278591bad5d002ebb6fe0f7e4d2be410cc00d3d8
SHA512 73f33149732821d8df19a590866034ff053e370f07ac6d097ef169a50d16f7679af7363608dd3d8dc97adfe0814bae3966bd541f5406ac59b2495ce5be9a21db

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\M9R7D1UZNZ63FLRDTW2W.temp

MD5 856912ba94239cc4c6e98aefb768617e
SHA1 58f2398190468a0b3fe569cf559011d02f85fd38
SHA256 24e92e896b4c97822ab0c751747dffc6cbf21a293c93420097aa8a1f6d21bfc0
SHA512 af8fc63d790d40411115ae90133c79dbcdd22af1d4cf365967fb55aefc67c33653aab36dc7669f4e1eea9b71de249ccf8e2988772b1140dd478cd4befc4e18e5

memory/2736-19-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-23-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-30-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-29-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-28-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2736-25-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2736-21-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1968-31-0x0000000074D20000-0x000000007540E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-04 01:46

Reported

2024-06-04 01:48

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\shipping documents.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1496 set thread context of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1496 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 4588 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 4428 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 2356 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1496 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\shipping documents.exe

"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mUsYIbZfsGwZQG.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mUsYIbZfsGwZQG" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84DF.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/1496-0-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/1496-2-0x0000000005D10000-0x00000000062B4000-memory.dmp

memory/1496-3-0x0000000005800000-0x0000000005892000-memory.dmp

memory/1496-1-0x0000000000E40000-0x0000000000EF4000-memory.dmp

memory/1496-5-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/1496-4-0x0000000005770000-0x000000000577A000-memory.dmp

memory/1496-6-0x0000000005CD0000-0x0000000005CE8000-memory.dmp

memory/1496-7-0x0000000005CF0000-0x0000000005D00000-memory.dmp

memory/1496-8-0x0000000006C70000-0x0000000006CF4000-memory.dmp

memory/1496-9-0x0000000009610000-0x00000000096AC000-memory.dmp

memory/1496-14-0x00000000748AE000-0x00000000748AF000-memory.dmp

memory/4504-15-0x0000000002770000-0x00000000027A6000-memory.dmp

memory/4504-16-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4504-17-0x00000000053A0000-0x00000000059C8000-memory.dmp

memory/4504-19-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/1496-18-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4504-22-0x0000000005180000-0x00000000051E6000-memory.dmp

memory/4504-23-0x00000000051F0000-0x0000000005256000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5m535rkg.c4x.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4504-21-0x0000000004FE0000-0x0000000005002000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp84DF.tmp

MD5 e6b390d6f6d704a944b6524939727e86
SHA1 5480b0b0798f808b9389600270048d3de963224c
SHA256 4f7993aaa4d8dfd8ef5e849aee5a0c13ac11636107eb7e046fe971cc8a398932
SHA512 79920921bdda8539bc51c3a9192cb97b3edf8d5407131999e4e6504b0eb1a9199f3785d2dd35a4d18c62e959491ded46aa1ba4938d791c1f2f636125c9f823fe

memory/4588-30-0x0000000006290000-0x00000000065E4000-memory.dmp

memory/4588-29-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4588-31-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4588-44-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/1404-46-0x0000000000400000-0x0000000000442000-memory.dmp

memory/1496-48-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4504-49-0x00000000060A0000-0x00000000060BE000-memory.dmp

memory/4504-50-0x0000000006600000-0x000000000664C000-memory.dmp

memory/4588-51-0x0000000007840000-0x0000000007872000-memory.dmp

memory/4504-63-0x0000000075100000-0x000000007514C000-memory.dmp

memory/4588-73-0x0000000007A90000-0x0000000007B33000-memory.dmp

memory/4588-62-0x0000000006E60000-0x0000000006E7E000-memory.dmp

memory/4588-52-0x0000000075100000-0x000000007514C000-memory.dmp

memory/4588-75-0x0000000007BE0000-0x0000000007BFA000-memory.dmp

memory/4504-74-0x0000000007A10000-0x000000000808A000-memory.dmp

memory/4504-76-0x0000000007430000-0x000000000743A000-memory.dmp

memory/4588-77-0x0000000007E60000-0x0000000007EF6000-memory.dmp

memory/4588-78-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

memory/4504-79-0x00000000075F0000-0x00000000075FE000-memory.dmp

memory/4504-81-0x0000000007600000-0x0000000007614000-memory.dmp

memory/4504-83-0x00000000076E0000-0x00000000076E8000-memory.dmp

memory/4504-82-0x0000000007700000-0x000000000771A000-memory.dmp

memory/4588-87-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/4504-86-0x00000000748A0000-0x0000000075050000-memory.dmp

memory/1404-88-0x00000000066B0000-0x0000000006700000-memory.dmp