Malware Analysis Report

2024-12-07 22:45

Sample ID 240719-l4mm9ayfle
Target MalwareBazaar.2
SHA256 665029b14081d957509bdf72be22ab7fd8f5aa2f63ad55339fe4d006647b9a29
Tags
execution remcos newremcosfile rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

665029b14081d957509bdf72be22ab7fd8f5aa2f63ad55339fe4d006647b9a29

Threat Level: Known bad

The file MalwareBazaar.2 was found to be: Known bad.

Malicious Activity Summary

execution remcos newremcosfile rat

Remcos

Command and Scripting Interpreter: PowerShell

Uses the VBS compiler for execution

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-19 10:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-19 10:05

Reported

2024-07-19 10:07

Platform

win7-20240705-en

Max time kernel

16s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Uses the VBS compiler for execution

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1496 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2936 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 2940 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1496 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 1496 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 1496 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe

"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZSsJaPlbmNJLf.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZSsJaPlbmNJLf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC3FB.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Network

N/A

Files

memory/1496-0-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

memory/1496-1-0x00000000002A0000-0x0000000000388000-memory.dmp

memory/1496-2-0x0000000074B50000-0x000000007523E000-memory.dmp

memory/1496-3-0x00000000006A0000-0x00000000006BA000-memory.dmp

memory/1496-4-0x00000000006D0000-0x00000000006DE000-memory.dmp

memory/1496-5-0x0000000004E50000-0x0000000004F10000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 913a9c9e7362646acae75bbe01f8e34f
SHA1 1421b1d368b9935e579d63e174b020f433157811
SHA256 e24c8489c202a76a23dddd95dff2ec20147c0308098c9a4ad65e6819f3692961
SHA512 5e5896d86146b5c8bab9e543d06a24e4cfe7f0926029bfed0df090ec61bbe8b93cef74b832eac71746e75d3b9bd31c52590e92ff8d4263193d052b589e2ca0c6

C:\Users\Admin\AppData\Local\Temp\tmpC3FB.tmp

MD5 97095de8e8a3c9d253cafcbb47aaea82
SHA1 6adc2ca553767e7fde58bb6317050a8b6df1e7bd
SHA256 d541ee555d8a8a56be4deabf3caf3a48e2ff0c13960b8c108c411fad206025a9
SHA512 a1ecba7b3b3a369570244b9fbd462d7ee53cca20fbc14654dc1c5995e9291a6078685670fa416c60a707062f4d73e8934e25a3f95d1d17fd4ffb3073ec57697c

memory/1496-18-0x0000000074B50000-0x000000007523E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-19 10:05

Reported

2024-07-19 10:08

Platform

win10v2004-20240709-en

Max time kernel

150s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"

Signatures

Remcos

rat remcos

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe N/A

Uses the VBS compiler for execution

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4684 set thread context of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4684 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 3620 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 4684 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 4684 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\SysWOW64\schtasks.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
PID 4684 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe

"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZSsJaPlbmNJLf.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZSsJaPlbmNJLf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC3FC.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 19.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
SE 185.29.9.110:2404 tcp
US 8.8.8.8:53 110.9.29.185.in-addr.arpa udp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 8.8.8.8:53 50.33.237.178.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/4684-0-0x0000000074BCE000-0x0000000074BCF000-memory.dmp

memory/4684-1-0x00000000004C0000-0x00000000005A8000-memory.dmp

memory/4684-2-0x0000000005440000-0x00000000059E4000-memory.dmp

memory/4684-3-0x0000000004F30000-0x0000000004FC2000-memory.dmp

memory/4684-4-0x0000000004E60000-0x0000000004E6A000-memory.dmp

memory/4684-5-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/4684-6-0x0000000005380000-0x000000000539A000-memory.dmp

memory/4684-7-0x00000000053C0000-0x00000000053CE000-memory.dmp

memory/4684-8-0x0000000006290000-0x0000000006350000-memory.dmp

memory/4684-9-0x00000000088A0000-0x000000000893C000-memory.dmp

memory/3620-14-0x0000000002780000-0x00000000027B6000-memory.dmp

memory/3620-16-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/4364-15-0x0000000005890000-0x0000000005EB8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpC3FC.tmp

MD5 5b360d38ad1097174cae56c47e9ea33c
SHA1 02d3a662225b4309a1dd07c2709eccfa2d398c6b
SHA256 2725f12af18c27538d8aba9a18e0a9c3af2f6f9af06b5811ef8050c712fc846e
SHA512 41479041787db3adb4c6e893b99e2b7d687abd77e51082d96f2e2b523e56d14ca619007d8774ab8f95a6d6ff967d5f83d582db5b75923c7b3a84575bf2e8d7ba

memory/3620-18-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/3620-21-0x00000000059F0000-0x0000000005A56000-memory.dmp

memory/3620-22-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/3620-20-0x0000000005980000-0x00000000059E6000-memory.dmp

memory/3620-19-0x00000000052A0000-0x00000000052C2000-memory.dmp

memory/1692-25-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-34-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4364-41-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/1692-39-0x0000000000400000-0x0000000000482000-memory.dmp

memory/4684-42-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/1692-31-0x0000000000400000-0x0000000000482000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gisf22vk.og0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1692-24-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3620-23-0x0000000005A60000-0x0000000005DB4000-memory.dmp

memory/3620-53-0x0000000006070000-0x000000000608E000-memory.dmp

memory/3620-55-0x00000000065C0000-0x000000000660C000-memory.dmp

memory/4364-54-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/4364-52-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/1692-56-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-58-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-57-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-60-0x0000000000400000-0x0000000000482000-memory.dmp

memory/3620-61-0x0000000007050000-0x0000000007082000-memory.dmp

memory/3620-62-0x0000000075450000-0x000000007549C000-memory.dmp

memory/4364-72-0x0000000075450000-0x000000007549C000-memory.dmp

memory/3620-82-0x0000000006620000-0x000000000663E000-memory.dmp

memory/4364-83-0x00000000079E0000-0x0000000007A83000-memory.dmp

memory/3620-84-0x00000000073A0000-0x00000000073BA000-memory.dmp

memory/4364-85-0x0000000008170000-0x00000000087EA000-memory.dmp

memory/3620-86-0x0000000007410000-0x000000000741A000-memory.dmp

memory/3620-87-0x0000000007620000-0x00000000076B6000-memory.dmp

memory/4364-88-0x0000000007D30000-0x0000000007D41000-memory.dmp

memory/3620-89-0x00000000075D0000-0x00000000075DE000-memory.dmp

memory/3620-90-0x00000000075E0000-0x00000000075F4000-memory.dmp

memory/3620-91-0x00000000076E0000-0x00000000076FA000-memory.dmp

memory/4364-92-0x0000000007E50000-0x0000000007E58000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 796588dc79964afe9f80401f82a97fb7
SHA1 61111de3d40395a89328f7685b22f027a616321f
SHA256 fa8de0b6fe200cd505308ebc684f2128ace7585f111e0759886902caad805197
SHA512 dd3e1422be5f80e6b52d78807aead28a62d5bf1aae8fe9f98c671c68dc29551221efea397b0e4b08da1a89c0c6884dba183753c3ca9e04420926449b23b98508

memory/3620-99-0x0000000074BC0000-0x0000000075370000-memory.dmp

memory/4364-98-0x0000000074BC0000-0x0000000075370000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/1692-101-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-102-0x0000000000400000-0x0000000000482000-memory.dmp

C:\ProgramData\vipvipvip\logs.dat

MD5 b229d361004e2671a97eaeea976d6a05
SHA1 fe688d0d4c299424f7b5471e894eb8d5045dc7b2
SHA256 3c65a60b6ee605f905ac04b229d24012351d5537975e482c26946c4eaa542893
SHA512 49acef42d4a3b46a53abf801d06cb9e79b1b1a627ebae7ba4cfa56131b1f978f464cd574e38f39688c99d7e2d260b2cc9ea98713d8d724f13cb1db64b688f683

memory/1692-109-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-110-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-118-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-119-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-126-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-127-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-134-0x0000000000400000-0x0000000000482000-memory.dmp

memory/1692-135-0x0000000000400000-0x0000000000482000-memory.dmp