Malware Analysis Report

2024-11-13 14:21

Sample ID 240617-v49mfsxelg
Target Bill of Ladden,Invoice & Packing List.exe
SHA256 3bab8fe003450bf70cd9ec8c2b92d042d92167da4942046f104f6b3139663a96
Tags
agenttesla execution keylogger spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3bab8fe003450bf70cd9ec8c2b92d042d92167da4942046f104f6b3139663a96

Threat Level: Known bad

The file Bill of Ladden,Invoice & Packing List.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla execution keylogger spyware stealer trojan

AgentTesla

Command and Scripting Interpreter: PowerShell

Reads data files stored by FTP clients

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Reads WinSCP keys stored on the system

Checks computer location settings

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-17 17:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-17 17:33

Reported

2024-06-17 17:36

Platform

win7-20240611-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2644 set thread context of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 2644 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 2644 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 2644 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 2644 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 2644 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yHYZVcCCPt.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yHYZVcCCPt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3488.tmp"

C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp

Files

memory/2644-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

memory/2644-1-0x0000000001150000-0x0000000001200000-memory.dmp

memory/2644-2-0x00000000748E0000-0x0000000074FCE000-memory.dmp

memory/2644-3-0x0000000000620000-0x000000000063A000-memory.dmp

memory/2644-4-0x00000000003D0000-0x00000000003E0000-memory.dmp

memory/2644-5-0x0000000007DD0000-0x0000000007E52000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SIY21YY8SGPP62ZNF6LS.temp

MD5 0767f181bb156b519f8e81be1068da68
SHA1 2318b0f44620eee2b32cbf9653c0eaf5c7a370e6
SHA256 e7b7379eb98fe8ae305ae5a799710a78ceb60f5d1f805de2a24fa8d856a4d5a2
SHA512 6d8ed65bf4c468b08e0ae5f09f2fe39ea21841929f37ccf92ca30430b22f8439f4eb82d16ad31835e237d5289cf86a394aa8c9f0de8aa1e64202ff65fb1bfded

C:\Users\Admin\AppData\Local\Temp\tmp3488.tmp

MD5 bc8266a8cc090827f82dd7944289f716
SHA1 092092493e3c703e7a28bf4102ce091ff3ad7d10
SHA256 74f7709a7dbb23e27c3f7427d94a5bb62a156e4f85384b843518f5846c98bfa8
SHA512 e2119c503fc723baaae6edd98108f368cfe7405d47cde846db7fc44945b5d16068b33acefd7363676fc34b70625d3bdcc5c2c6492c11a22107b6433499e8a1cb

memory/2560-18-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2560-25-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2560-28-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2560-27-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2560-30-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2560-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2560-22-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2560-20-0x0000000000400000-0x0000000000440000-memory.dmp

memory/2644-31-0x00000000748E0000-0x0000000074FCE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-17 17:33

Reported

2024-06-17 17:36

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4520 set thread context of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4520 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4520 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 4520 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 4520 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Windows\SysWOW64\schtasks.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe
PID 4520 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\yHYZVcCCPt.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yHYZVcCCPt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7465.tmp"

C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe

"C:\Users\Admin\AppData\Local\Temp\Bill of Ladden,Invoice & Packing List.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp

Files

memory/4520-0-0x000000007464E000-0x000000007464F000-memory.dmp

memory/4520-1-0x0000000000CB0000-0x0000000000D60000-memory.dmp

memory/4520-2-0x0000000005DB0000-0x0000000006354000-memory.dmp

memory/4520-3-0x0000000005800000-0x0000000005892000-memory.dmp

memory/4520-4-0x00000000058F0000-0x00000000058FA000-memory.dmp

memory/4520-5-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/4520-6-0x0000000005AC0000-0x0000000005ADA000-memory.dmp

memory/4520-7-0x0000000005A10000-0x0000000005A20000-memory.dmp

memory/4520-8-0x0000000006A60000-0x0000000006AE2000-memory.dmp

memory/4520-9-0x000000000AA70000-0x000000000AB0C000-memory.dmp

memory/2792-14-0x0000000002D10000-0x0000000002D46000-memory.dmp

memory/2792-15-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/2792-17-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/2792-16-0x0000000005820000-0x0000000005E48000-memory.dmp

memory/2792-18-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1696-19-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/2792-22-0x0000000005FB0000-0x0000000006016000-memory.dmp

memory/2792-21-0x0000000005E50000-0x0000000005EB6000-memory.dmp

memory/2792-20-0x0000000005640000-0x0000000005662000-memory.dmp

memory/1696-24-0x0000000074640000-0x0000000074DF0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7465.tmp

MD5 f20b977923afd4a86218dd16c53264ae
SHA1 400e78bc0387c74b389de701c593b0805a802429
SHA256 9f26b25306e4d1c0c6dd8bf5aad784fb02c3451042ee45c93d2d375230f05638
SHA512 e399e8e10d752b72c7a69d31d77bc92f42e7f3b76cd63f6c8356a304d5bdfefd7fbda8bb5f420d067bb9786439adcf161f2d4055ed5c02403a4ef0c779687567

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z5oydfpb.xjl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2792-31-0x0000000006020000-0x0000000006374000-memory.dmp

memory/1696-30-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/3108-45-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4520-47-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1696-48-0x00000000066F0000-0x000000000670E000-memory.dmp

memory/1696-49-0x0000000006740000-0x000000000678C000-memory.dmp

memory/2792-52-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/1696-54-0x0000000074ED0000-0x0000000074F1C000-memory.dmp

memory/1696-53-0x0000000006D00000-0x0000000006D32000-memory.dmp

memory/1696-64-0x00000000076F0000-0x000000000770E000-memory.dmp

memory/1696-65-0x0000000007920000-0x00000000079C3000-memory.dmp

memory/1696-67-0x0000000007A50000-0x0000000007A6A000-memory.dmp

memory/1696-66-0x00000000080A0000-0x000000000871A000-memory.dmp

memory/1696-68-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

memory/1696-69-0x0000000007CD0000-0x0000000007D66000-memory.dmp

memory/1696-70-0x0000000007C50000-0x0000000007C61000-memory.dmp

memory/1696-71-0x0000000007C80000-0x0000000007C8E000-memory.dmp

memory/1696-72-0x0000000007C90000-0x0000000007CA4000-memory.dmp

memory/1696-73-0x0000000007D90000-0x0000000007DAA000-memory.dmp

memory/1696-74-0x0000000007D70000-0x0000000007D78000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5a98ef11bcff2eb97a4c85775de41410
SHA1 dcd18fd49359ecf06e994689aab1fde354d55dfc
SHA256 a684e4f4e0156ec798ee031cb74adcb45de4e65da6575b87f66e5152f8a248a7
SHA512 d74ab5aa7121f47c1fa5e1ee4ccbc1c3bf47edef2fdf6b72457f322f23a059a26dda034ccd8de1f627e3348720b90794339f28b47770b8929fe8d711abf01ce6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

memory/1696-78-0x0000000074640000-0x0000000074DF0000-memory.dmp

memory/3108-79-0x00000000067B0000-0x0000000006800000-memory.dmp