Malware Analysis Report

2024-11-30 05:50

Sample ID 240610-cc3eysba64
Target 3f24b8845c43b9a8d469b7535e178189b12441426875858edff8c638c8ce31e5.zip
SHA256 3f24b8845c43b9a8d469b7535e178189b12441426875858edff8c638c8ce31e5
Tags
agenttesla execution keylogger persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3f24b8845c43b9a8d469b7535e178189b12441426875858edff8c638c8ce31e5

Threat Level: Known bad

The file 3f24b8845c43b9a8d469b7535e178189b12441426875858edff8c638c8ce31e5.zip was found to be: Known bad.

Malicious Activity Summary

agenttesla execution keylogger persistence spyware stealer trojan

AgentTesla

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Detects executables referencing Windows vault credential objects. Observed in infostealers

Detect packed .NET executables. Mostly AgentTeslaV4.

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Detects executables referencing many file transfer clients. Observed in information stealers

Detects executables referencing many email and collaboration clients. Observed in information stealers

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-10 01:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-10 01:56

Reported

2024-06-10 02:35

Platform

win7-20240419-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3000 set thread context of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2676 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 3000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 3000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 3000 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 3000 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe

"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYctFdAIXtTSr.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYctFdAIXtTSr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6690.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

N/A

Files

memory/3000-0-0x0000000073F9E000-0x0000000073F9F000-memory.dmp

memory/3000-1-0x0000000001230000-0x00000000012DE000-memory.dmp

memory/3000-2-0x0000000073F90000-0x000000007467E000-memory.dmp

memory/3000-3-0x00000000008F0000-0x0000000000906000-memory.dmp

memory/3000-5-0x0000000000BF0000-0x0000000000C00000-memory.dmp

memory/3000-4-0x0000000000BE0000-0x0000000000BEE000-memory.dmp

memory/3000-6-0x0000000001150000-0x00000000011D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp6690.tmp

MD5 d4d52aad04408fe50a535dce8199dda6
SHA1 6572100a1c7695146f1452b69ea6e69576ffa70e
SHA256 16cd19619be373c5becb52e3742b8da476e29bb770f6ef5e55a772c98fb22eeb
SHA512 488b7e9eaa4c1d4f6d97ab57f8001f4821a8265a6e55db654544a3e401d28be3bea84d9b1aab44b70ccabf0d1fd38707df13483bccc2468bf1eb9a27575ea669

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ABOR2UZ50GH99PLP0H96.temp

MD5 c0ccf5e02e811b898943999cf0329191
SHA1 ba72b9e888d5ba2d25f318be105963ebfb7092ff
SHA256 ce7f03b3c247af02c6c5a2743fdbedc5c6457c8588c12967d39c10dd89fb522b
SHA512 aa67d56ec073f9239f62e754abb9f383251a3f4c1655db866c21bfcad3246158997c2b896dca90f64e8552661eba15a4273f8f563260fcdec7a66d1d2c06bffd

memory/2456-29-0x0000000000400000-0x0000000000442000-memory.dmp

memory/3000-32-0x0000000073F90000-0x000000007467E000-memory.dmp

memory/2456-31-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2456-28-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2456-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2456-25-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2456-23-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2456-21-0x0000000000400000-0x0000000000442000-memory.dmp

memory/2456-19-0x0000000000400000-0x0000000000442000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-10 01:56

Reported

2024-06-10 02:35

Platform

win10v2004-20240508-en

Max time kernel

24s

Max time network

103s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect packed .NET executables. Mostly AgentTeslaV4.

Description Indicator Process Target
N/A N/A N/A N/A

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing Windows vault credential objects. Observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many email and collaboration clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables referencing many file transfer clients. Observed in information stealers

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1984 set thread context of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1984 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1984 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1984 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1984 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\SysWOW64\schtasks.exe
PID 1984 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
PID 1984 wrote to memory of 1764 N/A C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe

"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gYctFdAIXtTSr.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYctFdAIXtTSr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8750.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/1984-0-0x000000007515E000-0x000000007515F000-memory.dmp

memory/1984-1-0x00000000003F0000-0x000000000049E000-memory.dmp

memory/1984-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

memory/1984-3-0x0000000002A10000-0x0000000002AA2000-memory.dmp

memory/1984-4-0x0000000075150000-0x0000000075900000-memory.dmp

memory/1984-5-0x0000000002AB0000-0x0000000002ABA000-memory.dmp

memory/1984-6-0x0000000005490000-0x00000000054A6000-memory.dmp

memory/1984-8-0x00000000067F0000-0x0000000006800000-memory.dmp

memory/1984-7-0x00000000054B0000-0x00000000054BE000-memory.dmp

memory/1984-10-0x0000000008F20000-0x0000000008FBC000-memory.dmp

memory/1984-9-0x0000000006850000-0x00000000068D2000-memory.dmp

memory/1984-15-0x000000007515E000-0x000000007515F000-memory.dmp

memory/3812-16-0x00000000027D0000-0x0000000002806000-memory.dmp

memory/3812-18-0x0000000075150000-0x0000000075900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp8750.tmp

MD5 f0a2080309a53a5048ab511f5ff9bf6d
SHA1 1656d22f1f61d8561ab7d92349f9dd9c53d10775
SHA256 3d83b588f76fab2d8412c6649a3c1cde23b55718ab27f3ff2cfe78d1f72ab0c0
SHA512 3539a11abd70375106077c2609e1eff27093c26fd940b369474aa233d811691b8ed70fbd09cb8f502ef96404dc3ed6388520c71cd725fdc1e089d5a6462dbeb1

memory/4508-21-0x0000000004F60000-0x0000000004F82000-memory.dmp

memory/4508-24-0x0000000075150000-0x0000000075900000-memory.dmp

memory/4508-35-0x0000000075150000-0x0000000075900000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5qescuto.c5t.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1764-46-0x0000000000400000-0x0000000000442000-memory.dmp

memory/3812-49-0x0000000075150000-0x0000000075900000-memory.dmp

memory/1984-50-0x0000000075150000-0x0000000075900000-memory.dmp

memory/4508-51-0x0000000006030000-0x000000000604E000-memory.dmp

memory/1984-47-0x0000000075150000-0x0000000075900000-memory.dmp

memory/4508-52-0x0000000006630000-0x000000000667C000-memory.dmp

memory/4508-45-0x0000000075150000-0x0000000075900000-memory.dmp

memory/3812-25-0x0000000005A80000-0x0000000005DD4000-memory.dmp

memory/3812-23-0x00000000059D0000-0x0000000005A36000-memory.dmp

memory/4508-22-0x0000000005100000-0x0000000005166000-memory.dmp

memory/3812-19-0x0000000075150000-0x0000000075900000-memory.dmp

memory/3812-17-0x0000000005250000-0x0000000005878000-memory.dmp

memory/4508-75-0x0000000007050000-0x00000000070F3000-memory.dmp

memory/4508-73-0x00000000065A0000-0x00000000065BE000-memory.dmp

memory/3812-55-0x00000000759B0000-0x00000000759FC000-memory.dmp

memory/3812-77-0x0000000007A40000-0x00000000080BA000-memory.dmp

memory/4508-78-0x00000000073D0000-0x00000000073DA000-memory.dmp

memory/4508-76-0x0000000007360000-0x000000000737A000-memory.dmp

memory/4508-79-0x00000000075E0000-0x0000000007676000-memory.dmp

memory/3812-80-0x0000000007600000-0x0000000007611000-memory.dmp

memory/4508-54-0x00000000759B0000-0x00000000759FC000-memory.dmp

memory/4508-53-0x0000000007010000-0x0000000007042000-memory.dmp

memory/3812-81-0x0000000007630000-0x000000000763E000-memory.dmp

memory/4508-83-0x00000000075A0000-0x00000000075B4000-memory.dmp

memory/3812-85-0x0000000007720000-0x0000000007728000-memory.dmp

memory/3812-84-0x0000000007740000-0x000000000775A000-memory.dmp

memory/4508-92-0x0000000075150000-0x0000000075900000-memory.dmp

memory/3812-91-0x0000000075150000-0x0000000075900000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0621c5d55cd9f3d9a1586cc25cac3872
SHA1 a6441c2313d6d233fe1b14f1c4ecd15f97ef36a3
SHA256 aeda54099b8c97c37fbbcdac2be9010154d6f6d34b55fc00c201a97dc0522950
SHA512 69eab6a2a13f844cab18a7e1a9f8d244f08cbe680724958a59765ae3cb22212e428bacdbb6821b88f810e08bbe8a9a89b6dba25cc6e77349fcffde8ef62395e4

memory/1764-93-0x0000000005D40000-0x0000000005D90000-memory.dmp