Analysis
-
max time kernel
299s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 15:02
Behavioral task
behavioral1
Sample
336488519.exe
Resource
win7-20240220-en
General
-
Target
336488519.exe
-
Size
93KB
-
MD5
a318cc45e79498b93e40d5e5b9b76be4
-
SHA1
4ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5
-
SHA256
4b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2
-
SHA512
3131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c
-
SSDEEP
1536:zL0IGzbFmav82I3dTCPu0864k/+ELInCSA+HK:30poOPPuRxk/jr+HK
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://5.42.96.117/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
plo7udsa2s
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
syslmgrsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" syslmgrsvc.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule C:\Windows\syslmgrsvc.exe family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
2954410113.exewupgrdsv.exedescription pid process target process PID 3692 created 3540 3692 2954410113.exe Explorer.EXE PID 3692 created 3540 3692 2954410113.exe Explorer.EXE PID 3612 created 3540 3612 wupgrdsv.exe Explorer.EXE PID 3612 created 3540 3612 wupgrdsv.exe Explorer.EXE -
Processes:
syslmgrsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslmgrsvc.exe -
XMRig Miner payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/3612-83-0x00007FF6D5CE0000-0x00007FF6D6256000-memory.dmp xmrig behavioral2/memory/1712-86-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-88-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-89-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-90-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-97-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-105-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-106-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig behavioral2/memory/1712-108-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
Processes:
syslmgrsvc.exe199701040.exe1426525829.exeWindows Security Upgrade Service.exe2894816939.exe2954410113.exeWindows Security Upgrade Service.exewupgrdsv.exeWindows Security Upgrade Service.exe288412878.exepid process 2088 syslmgrsvc.exe 1544 199701040.exe 3928 1426525829.exe 988 Windows Security Upgrade Service.exe 4104 2894816939.exe 3692 2954410113.exe 3900 Windows Security Upgrade Service.exe 3612 wupgrdsv.exe 1136 Windows Security Upgrade Service.exe 2804 288412878.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
syslmgrsvc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" syslmgrsvc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" syslmgrsvc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
336488519.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syslmgrsvc.exe" 336488519.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wupgrdsv.exedescription pid process target process PID 3612 set thread context of 1712 3612 wupgrdsv.exe notepad.exe -
Drops file in Windows directory 2 IoCs
Processes:
336488519.exedescription ioc process File created C:\Windows\syslmgrsvc.exe 336488519.exe File opened for modification C:\Windows\syslmgrsvc.exe 336488519.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2954410113.exepowershell.exewupgrdsv.exepowershell.exepid process 3692 2954410113.exe 3692 2954410113.exe 428 powershell.exe 428 powershell.exe 3692 2954410113.exe 3692 2954410113.exe 3612 wupgrdsv.exe 3612 wupgrdsv.exe 3188 powershell.exe 3188 powershell.exe 3612 wupgrdsv.exe 3612 wupgrdsv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 428 powershell.exe Token: SeIncreaseQuotaPrivilege 428 powershell.exe Token: SeSecurityPrivilege 428 powershell.exe Token: SeTakeOwnershipPrivilege 428 powershell.exe Token: SeLoadDriverPrivilege 428 powershell.exe Token: SeSystemProfilePrivilege 428 powershell.exe Token: SeSystemtimePrivilege 428 powershell.exe Token: SeProfSingleProcessPrivilege 428 powershell.exe Token: SeIncBasePriorityPrivilege 428 powershell.exe Token: SeCreatePagefilePrivilege 428 powershell.exe Token: SeBackupPrivilege 428 powershell.exe Token: SeRestorePrivilege 428 powershell.exe Token: SeShutdownPrivilege 428 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeSystemEnvironmentPrivilege 428 powershell.exe Token: SeRemoteShutdownPrivilege 428 powershell.exe Token: SeUndockPrivilege 428 powershell.exe Token: SeManageVolumePrivilege 428 powershell.exe Token: 33 428 powershell.exe Token: 34 428 powershell.exe Token: 35 428 powershell.exe Token: 36 428 powershell.exe Token: SeIncreaseQuotaPrivilege 428 powershell.exe Token: SeSecurityPrivilege 428 powershell.exe Token: SeTakeOwnershipPrivilege 428 powershell.exe Token: SeLoadDriverPrivilege 428 powershell.exe Token: SeSystemProfilePrivilege 428 powershell.exe Token: SeSystemtimePrivilege 428 powershell.exe Token: SeProfSingleProcessPrivilege 428 powershell.exe Token: SeIncBasePriorityPrivilege 428 powershell.exe Token: SeCreatePagefilePrivilege 428 powershell.exe Token: SeBackupPrivilege 428 powershell.exe Token: SeRestorePrivilege 428 powershell.exe Token: SeShutdownPrivilege 428 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeSystemEnvironmentPrivilege 428 powershell.exe Token: SeRemoteShutdownPrivilege 428 powershell.exe Token: SeUndockPrivilege 428 powershell.exe Token: SeManageVolumePrivilege 428 powershell.exe Token: 33 428 powershell.exe Token: 34 428 powershell.exe Token: 35 428 powershell.exe Token: 36 428 powershell.exe Token: SeIncreaseQuotaPrivilege 428 powershell.exe Token: SeSecurityPrivilege 428 powershell.exe Token: SeTakeOwnershipPrivilege 428 powershell.exe Token: SeLoadDriverPrivilege 428 powershell.exe Token: SeSystemProfilePrivilege 428 powershell.exe Token: SeSystemtimePrivilege 428 powershell.exe Token: SeProfSingleProcessPrivilege 428 powershell.exe Token: SeIncBasePriorityPrivilege 428 powershell.exe Token: SeCreatePagefilePrivilege 428 powershell.exe Token: SeBackupPrivilege 428 powershell.exe Token: SeRestorePrivilege 428 powershell.exe Token: SeShutdownPrivilege 428 powershell.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeSystemEnvironmentPrivilege 428 powershell.exe Token: SeRemoteShutdownPrivilege 428 powershell.exe Token: SeUndockPrivilege 428 powershell.exe Token: SeManageVolumePrivilege 428 powershell.exe Token: 33 428 powershell.exe Token: 34 428 powershell.exe Token: 35 428 powershell.exe Token: 36 428 powershell.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
336488519.exesyslmgrsvc.exe1426525829.exe2894816939.exewupgrdsv.exedescription pid process target process PID 4876 wrote to memory of 2088 4876 336488519.exe syslmgrsvc.exe PID 4876 wrote to memory of 2088 4876 336488519.exe syslmgrsvc.exe PID 4876 wrote to memory of 2088 4876 336488519.exe syslmgrsvc.exe PID 2088 wrote to memory of 1544 2088 syslmgrsvc.exe 199701040.exe PID 2088 wrote to memory of 1544 2088 syslmgrsvc.exe 199701040.exe PID 2088 wrote to memory of 1544 2088 syslmgrsvc.exe 199701040.exe PID 2088 wrote to memory of 3928 2088 syslmgrsvc.exe 1426525829.exe PID 2088 wrote to memory of 3928 2088 syslmgrsvc.exe 1426525829.exe PID 2088 wrote to memory of 3928 2088 syslmgrsvc.exe 1426525829.exe PID 3928 wrote to memory of 988 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3928 wrote to memory of 988 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3928 wrote to memory of 988 3928 1426525829.exe Windows Security Upgrade Service.exe PID 2088 wrote to memory of 4104 2088 syslmgrsvc.exe 2894816939.exe PID 2088 wrote to memory of 4104 2088 syslmgrsvc.exe 2894816939.exe PID 2088 wrote to memory of 4104 2088 syslmgrsvc.exe 2894816939.exe PID 4104 wrote to memory of 3692 4104 2894816939.exe 2954410113.exe PID 4104 wrote to memory of 3692 4104 2894816939.exe 2954410113.exe PID 3928 wrote to memory of 3900 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3928 wrote to memory of 3900 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3928 wrote to memory of 3900 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3612 wrote to memory of 1712 3612 wupgrdsv.exe notepad.exe PID 3928 wrote to memory of 1136 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3928 wrote to memory of 1136 3928 1426525829.exe Windows Security Upgrade Service.exe PID 3928 wrote to memory of 1136 3928 1426525829.exe Windows Security Upgrade Service.exe PID 2088 wrote to memory of 2804 2088 syslmgrsvc.exe 288412878.exe PID 2088 wrote to memory of 2804 2088 syslmgrsvc.exe 288412878.exe PID 2088 wrote to memory of 2804 2088 syslmgrsvc.exe 288412878.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\336488519.exe"C:\Users\Admin\AppData\Local\Temp\336488519.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\syslmgrsvc.exeC:\Windows\syslmgrsvc.exe3⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\199701040.exeC:\Users\Admin\AppData\Local\Temp\199701040.exe4⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\1426525829.exeC:\Users\Admin\AppData\Local\Temp\1426525829.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"5⤵
- Executes dropped EXE
PID:988 -
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"5⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"5⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2894816939.exeC:\Users\Admin\AppData\Local\Temp\2894816939.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\2954410113.exeC:\Users\Admin\AppData\Local\Temp\2954410113.exe5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\288412878.exeC:\Users\Admin\AppData\Local\Temp\288412878.exe4⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:428 -
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"2⤵PID:2836
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188 -
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵PID:1712
-
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3612
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52e6370355138fe6f0ff8789a59af0e1d
SHA1454eca544a4e2045e202e0d7a1414777e76392cc
SHA256f86f4ce6ead9e89561cdea866e7f7254694ee69a61a045a51f61fc82dd60a708
SHA512616e98275ac0fb49a3e85d732c7660a386a4f796e5559d184d9f34d9c5911395cbf7666768332fe9964bf0c861a935867c9de2c84bd3d28e6c10a2cee51cd34b
-
C:\Users\Admin\AppData\Local\Temp\1378211069.exeFilesize
86KB
MD5fe1e93f12cca3f7c0c897ef2084e1778
SHA1fb588491ddad8b24ea555a6a2727e76cec1fade3
SHA2562ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
SHA51236e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
-
C:\Users\Admin\AppData\Local\Temp\1426525829.exeFilesize
10KB
MD547340d40e7f73e62cf09ac60fd16ad68
SHA1effd38f6561155802d3e5090f5714589eae5ce6e
SHA256e8a0c46342abd882318dbfdb17b7d3cb93d7138564878a15c5b91229ed81689c
SHA5122d5fbacad67eba3c42c2be95c3bf64d787d15cf96d5afe827d6f9bdb175295859e684202ff5afc773202f4b9d0b3135e913c997bbe72026cd7a7ca96ecf5aa08
-
C:\Users\Admin\AppData\Local\Temp\288412878.exeFilesize
11KB
MD5cafd277c4132f5d0f202e7ea07a27d5c
SHA172c8c16a94cce56a3e01d91bc1276dafc65b351d
SHA256e5162fa594811f0f01fc76f4acbd9fe99b2265df9cfcbc346023f28775c19f1e
SHA5127c87d1dec61b78e0f223e8f9fec019d96509813fa6d96129289aab00b2d6f05bf91fe1fafd680b7d9e746f4c2c8cbe48a3028bcaad479048d00d79a19f71b196
-
C:\Users\Admin\AppData\Local\Temp\2894816939.exeFilesize
10KB
MD5c8cf446ead193a3807472fbd294c5f23
SHA12162f28c919222f75ce5f52e4bb1155255ae5368
SHA256e5d12658a690c62af7d4fc7b26735affc7210e3bfb6b2241de1bf90aebdc0717
SHA512fc94014fabf204ecd57990db4b05b81cbda0a314b621cbfa755296ddf5493ec55fb129d12eff5f92863d9f1d7fea679dc2aeb62baf898791448cb4fe34b595c1
-
C:\Users\Admin\AppData\Local\Temp\2954410113.exeFilesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
C:\Users\Admin\AppData\Local\Temp\768825363.exeFilesize
80KB
MD52ff2bb06682812eeb76628bfbe817fbb
SHA118e86614d0f4904e1fe97198ccda34b25aab7dae
SHA256985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d
SHA5125cd3b5a1e16202893b08c0ae70d3bcd9e7a49197ebf1ded08e01395202022b3b6c2d8837196ef0415fea6497d928b44e03544b934f8e062ddbb6c6f79fb6f440
-
C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exeFilesize
20KB
MD5de36bc2bfc3c67820ebd75c912fadc3d
SHA138bd51e1052ae5bede5293827e87d6f494b204c8
SHA2562a5083d6e55f5cb56764fc4ed7ad082a0ef75a908ed03132178cc80f802c3d16
SHA512efbc8a797e95f00c142c4c02c2f3faf4f46fabcdcd1a99d81df7581244a22f0b81f846d15de3b5f4b6d323deff555fd569db57aff3171ffebf27c03e4d53e6ef
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qpitikgl.13r.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\tbtnds.datFilesize
4KB
MD5330086c407958b0a0e8ff14aea1c58d5
SHA19b2623bac981a60780fd6dfc76e220d6df946bac
SHA256295480d5d31c501dfaa88d0a2a1c5872821ac1e6e103abd5a3def21ea0b17191
SHA51213fa7cbb5974b640fa6af10571beed68d96d263a63bbfc29ff1e442968b4205526fd60e886322b1dc2951a836ac0d04d1cf9c6cdc8d2aeb7f6f607980df8982f
-
C:\Windows\syslmgrsvc.exeFilesize
93KB
MD5a318cc45e79498b93e40d5e5b9b76be4
SHA14ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5
SHA2564b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2
SHA5123131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c
-
memory/428-53-0x000001F3C7E40000-0x000001F3C7E62000-memory.dmpFilesize
136KB
-
memory/1712-97-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-88-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-89-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-90-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-86-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-84-0x0000025A37100000-0x0000025A37120000-memory.dmpFilesize
128KB
-
memory/1712-105-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-106-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/1712-108-0x00007FF6C9950000-0x00007FF6CA13F000-memory.dmpFilesize
7.9MB
-
memory/3612-83-0x00007FF6D5CE0000-0x00007FF6D6256000-memory.dmpFilesize
5.5MB
-
memory/3692-67-0x00007FF6F0110000-0x00007FF6F0686000-memory.dmpFilesize
5.5MB