Malware Analysis Report

2024-11-30 14:49

Sample ID 240925-fv24paxarj
Target 25092024_0512_24092024_NEW PO - 4067543012.gz
SHA256 0b44cef4107229e61686d9dd28adbe4aaa5cb12893b4ad4b805aeb11b47a820b
Tags
discovery execution vipkeylogger collection keylogger spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0b44cef4107229e61686d9dd28adbe4aaa5cb12893b4ad4b805aeb11b47a820b

Threat Level: Known bad

The file 25092024_0512_24092024_NEW PO - 4067543012.gz was found to be: Known bad.

Malicious Activity Summary

discovery execution vipkeylogger collection keylogger spyware stealer

VIPKeylogger

Command and Scripting Interpreter: PowerShell

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Checks computer location settings

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Unsigned PE

outlook_win_path

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-25 05:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-25 05:12

Reported

2024-09-25 05:17

Platform

win7-20240708-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1700 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 1700 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

Processes

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sYpAHmjKhppP.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sYpAHmjKhppP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE734.tmp"

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

Network

N/A

Files

memory/1700-0-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

memory/1700-1-0x0000000000360000-0x000000000043C000-memory.dmp

memory/1700-2-0x0000000074B60000-0x000000007524E000-memory.dmp

memory/1700-3-0x0000000000490000-0x000000000049E000-memory.dmp

memory/1700-4-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

memory/1700-5-0x0000000074B60000-0x000000007524E000-memory.dmp

memory/1700-6-0x0000000005DC0000-0x0000000005E4A000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 8d5d27092a8aa8d8969e1b48cf302ae3
SHA1 bd63f1dd22ee8c1982af92710f884f968abb146e
SHA256 f90071b74639656a889b18f8e78d11dd26e40fce8480fe46a9cea1b7a58b0f32
SHA512 da43a977bf65df34a37bc5e64cb7eac9e21087cd5a6bc7f8b6a019449b95e4c2b56c53283a19c6c19b97d2141199430105c496a279ef8af5a3b85f91e6733713

C:\Users\Admin\AppData\Local\Temp\tmpE734.tmp

MD5 3344c8036a1cf194fac069c74fc03f0a
SHA1 dfa6bfb9151fe2df2318ed5157dd75640d969514
SHA256 af7a4f64e8bff6f00ba9fd8d9334d89c5ec0aab913debcbac5eb866d08d53af9
SHA512 ce19de96eb0593c61db28fea3585444d6ceee362cfbce56af97abf885c96f787688d4881eda8bff892c6e8d794fbdb0470313210e822ddfbf444facde51f153e

memory/1700-19-0x0000000074B60000-0x000000007524E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-25 05:12

Reported

2024-09-25 05:17

Platform

win10v2004-20240802-en

Max time kernel

118s

Max time network

203s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4136 set thread context of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4136 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4136 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4136 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4136 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4136 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4136 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4136 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 5020 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Windows\SysWOW64\schtasks.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe
PID 4136 wrote to memory of 664 N/A C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sYpAHmjKhppP.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sYpAHmjKhppP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF53D.tmp"

C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe

"C:\Users\Admin\AppData\Local\Temp\NEW PO - 4067543012.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 0.130.122.193.in-addr.arpa udp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 23.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4136-0-0x000000007525E000-0x000000007525F000-memory.dmp

memory/4136-1-0x0000000000E70000-0x0000000000F4C000-memory.dmp

memory/4136-2-0x0000000005F10000-0x00000000064B4000-memory.dmp

memory/4136-3-0x0000000005960000-0x00000000059F2000-memory.dmp

memory/4136-4-0x0000000005900000-0x000000000590A000-memory.dmp

memory/4136-5-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/4136-6-0x0000000005BA0000-0x0000000005C3C000-memory.dmp

memory/4136-7-0x0000000005B80000-0x0000000005B8E000-memory.dmp

memory/4136-8-0x000000007525E000-0x000000007525F000-memory.dmp

memory/4136-9-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/4136-10-0x0000000008560000-0x00000000085EA000-memory.dmp

memory/3272-15-0x0000000002620000-0x0000000002656000-memory.dmp

memory/3272-16-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3272-18-0x00000000051D0000-0x00000000057F8000-memory.dmp

memory/3272-17-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3272-19-0x0000000075250000-0x0000000075A00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpF53D.tmp

MD5 2df3eb85d418f0944c6132f467bba009
SHA1 ac7384527bd00594d8f5ac12d9eb4ce2856f990e
SHA256 d31cbd0b3096847e8bbf9957bf4140e0948110a0cd4ac882966bc06d78eda4cb
SHA512 65d5b43593a6c7b3f4496185735b2a932da6b38bc455bcebd59b59586279265f6664806925b29ae92a0d128d2a4e80bea0fcf913ebbb1e0636a0a1f29d17f029

memory/4872-21-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/4872-22-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/664-25-0x0000000000400000-0x0000000000448000-memory.dmp

memory/3272-26-0x0000000005160000-0x00000000051C6000-memory.dmp

memory/3272-24-0x00000000050F0000-0x0000000005156000-memory.dmp

memory/4136-34-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3272-33-0x00000000058C0000-0x0000000005C14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_msuqwggr.tuo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3272-23-0x0000000005050000-0x0000000005072000-memory.dmp

memory/4872-48-0x0000000005F70000-0x0000000005F8E000-memory.dmp

memory/4872-49-0x0000000006000000-0x000000000604C000-memory.dmp

memory/4872-50-0x0000000006F00000-0x0000000006F32000-memory.dmp

memory/4872-51-0x00000000719A0000-0x00000000719EC000-memory.dmp

memory/3272-61-0x00000000719A0000-0x00000000719EC000-memory.dmp

memory/3272-71-0x00000000070E0000-0x00000000070FE000-memory.dmp

memory/3272-72-0x0000000007110000-0x00000000071B3000-memory.dmp

memory/4872-73-0x00000000078F0000-0x0000000007F6A000-memory.dmp

memory/4872-74-0x00000000072B0000-0x00000000072CA000-memory.dmp

memory/3272-75-0x00000000072B0000-0x00000000072BA000-memory.dmp

memory/3272-76-0x00000000074C0000-0x0000000007556000-memory.dmp

memory/3272-77-0x0000000007440000-0x0000000007451000-memory.dmp

memory/4872-78-0x00000000074E0000-0x00000000074EE000-memory.dmp

memory/4872-79-0x00000000074F0000-0x0000000007504000-memory.dmp

memory/4872-80-0x00000000075F0000-0x000000000760A000-memory.dmp

memory/3272-81-0x0000000007560000-0x0000000007568000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0535873437a1fe9bed5398c82c074ba6
SHA1 ebd2316ef18085c9e1815eab005cebc24338bf6a
SHA256 89845a36cbd4db189ba53361f242f5b08393a6119f85d7d050344873a447ec42
SHA512 87dd46d546d09af232d1a01c6f942bda19f9cfc49b9b790499e02f0204dde4996a251906c81efea8dbf9c0664e088f85aaa10e8b6e58bdbf191eea5c1829479a

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/4872-88-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/3272-87-0x0000000075250000-0x0000000075A00000-memory.dmp

memory/664-89-0x0000000006EA0000-0x0000000007062000-memory.dmp

memory/664-90-0x0000000006D20000-0x0000000006D70000-memory.dmp