85e46e5e1a9b0117c0f1992ae253eac8fb69f854d35e7236583da529985204fc

Analysis

max time kernel
595s
max time network
599s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ConsoleApplication2.exe
Size 4.5MB
Sample240607-2127jadg8s
SHA256 85e46e5e1a9b0117c0f1992ae253eac8fb69f854d35e7236583da529985204fc
MD5 ba6ea0efc527f2dcd8c13606a5e24e9a
SHA1 43a92bb3a589acf1a8480c7f0aeb14c7def349bd
SHA512 f4e7e4828bae57b8fac2e61ba254806408ef1aa2f35ac0da2b8b9fa5de25e2eaa537344138460f78b0271b82904a3b2e22f3ba078c9d8c3fe46c4f490c0462b5
SSDEEP 49152:mIvjeYIhNma2OwgHK0FqFREXY3Dl11tB+ugTizmRK6HeLAiIM1QfJPgDEWzIOwLy:mIvjeYgGoqF5DlzqTMTDEa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ConsoleApplication2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ConsoleApplication2"	ConsoleApplication2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
68	discord.com
69	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	ipinfo.io
16	ipinfo.io
23	ipinfo.io
55	ipinfo.io
56	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
388	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1212	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2056	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3864	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4576	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4896	ConsoleApplication2.exe
4896	ConsoleApplication2.exe
3320	powershell.exe
3320	powershell.exe
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe
388	powershell.exe
388	powershell.exe
388	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3356	WMIC.exe
Token: SeSecurityPrivilege	3356	WMIC.exe
Token: SeTakeOwnershipPrivilege	3356	WMIC.exe
Token: SeLoadDriverPrivilege	3356	WMIC.exe
Token: SeSystemProfilePrivilege	3356	WMIC.exe
Token: SeSystemtimePrivilege	3356	WMIC.exe
Token: SeProfSingleProcessPrivilege	3356	WMIC.exe
Token: SeIncBasePriorityPrivilege	3356	WMIC.exe
Token: SeCreatePagefilePrivilege	3356	WMIC.exe
Token: SeBackupPrivilege	3356	WMIC.exe
Token: SeRestorePrivilege	3356	WMIC.exe
Token: SeShutdownPrivilege	3356	WMIC.exe
Token: SeDebugPrivilege	3356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3356	WMIC.exe
Token: SeRemoteShutdownPrivilege	3356	WMIC.exe
Token: SeUndockPrivilege	3356	WMIC.exe
Token: SeManageVolumePrivilege	3356	WMIC.exe
Token: 33	3356	WMIC.exe
Token: 34	3356	WMIC.exe
Token: 35	3356	WMIC.exe
Token: 36	3356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3356	WMIC.exe
Token: SeSecurityPrivilege	3356	WMIC.exe
Token: SeTakeOwnershipPrivilege	3356	WMIC.exe
Token: SeLoadDriverPrivilege	3356	WMIC.exe
Token: SeSystemProfilePrivilege	3356	WMIC.exe
Token: SeSystemtimePrivilege	3356	WMIC.exe
Token: SeProfSingleProcessPrivilege	3356	WMIC.exe
Token: SeIncBasePriorityPrivilege	3356	WMIC.exe
Token: SeCreatePagefilePrivilege	3356	WMIC.exe
Token: SeBackupPrivilege	3356	WMIC.exe
Token: SeRestorePrivilege	3356	WMIC.exe
Token: SeShutdownPrivilege	3356	WMIC.exe
Token: SeDebugPrivilege	3356	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3356	WMIC.exe
Token: SeRemoteShutdownPrivilege	3356	WMIC.exe
Token: SeUndockPrivilege	3356	WMIC.exe
Token: SeManageVolumePrivilege	3356	WMIC.exe
Token: 33	3356	WMIC.exe
Token: 34	3356	WMIC.exe
Token: 35	3356	WMIC.exe
Token: 36	3356	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2704	WMIC.exe
Token: SeSecurityPrivilege	2704	WMIC.exe
Token: SeTakeOwnershipPrivilege	2704	WMIC.exe
Token: SeLoadDriverPrivilege	2704	WMIC.exe
Token: SeSystemProfilePrivilege	2704	WMIC.exe
Token: SeSystemtimePrivilege	2704	WMIC.exe
Token: SeProfSingleProcessPrivilege	2704	WMIC.exe
Token: SeIncBasePriorityPrivilege	2704	WMIC.exe
Token: SeCreatePagefilePrivilege	2704	WMIC.exe
Token: SeBackupPrivilege	2704	WMIC.exe
Token: SeRestorePrivilege	2704	WMIC.exe
Token: SeShutdownPrivilege	2704	WMIC.exe
Token: SeDebugPrivilege	2704	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2704	WMIC.exe
Token: SeRemoteShutdownPrivilege	2704	WMIC.exe
Token: SeUndockPrivilege	2704	WMIC.exe
Token: SeManageVolumePrivilege	2704	WMIC.exe
Token: 33	2704	WMIC.exe
Token: 34	2704	WMIC.exe
Token: 35	2704	WMIC.exe
Token: 36	2704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2704	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 3752	4896	ConsoleApplication2.exe	92
PID 4896 wrote to memory of 3752	4896	ConsoleApplication2.exe	92
PID 4896 wrote to memory of 3752	4896	ConsoleApplication2.exe	92
PID 3752 wrote to memory of 4576	3752	cmd.exe	93
PID 3752 wrote to memory of 4576	3752	cmd.exe	93
PID 3752 wrote to memory of 4576	3752	cmd.exe	93
PID 4896 wrote to memory of 2432	4896	ConsoleApplication2.exe	94
PID 4896 wrote to memory of 2432	4896	ConsoleApplication2.exe	94
PID 4896 wrote to memory of 2432	4896	ConsoleApplication2.exe	94
PID 2432 wrote to memory of 3356	2432	cmd.exe	95
PID 2432 wrote to memory of 3356	2432	cmd.exe	95
PID 2432 wrote to memory of 3356	2432	cmd.exe	95
PID 4896 wrote to memory of 4836	4896	ConsoleApplication2.exe	97
PID 4896 wrote to memory of 4836	4896	ConsoleApplication2.exe	97
PID 4896 wrote to memory of 4836	4896	ConsoleApplication2.exe	97
PID 4836 wrote to memory of 2704	4836	cmd.exe	98
PID 4836 wrote to memory of 2704	4836	cmd.exe	98
PID 4836 wrote to memory of 2704	4836	cmd.exe	98
PID 4896 wrote to memory of 4416	4896	ConsoleApplication2.exe	99
PID 4896 wrote to memory of 4416	4896	ConsoleApplication2.exe	99
PID 4896 wrote to memory of 4416	4896	ConsoleApplication2.exe	99
PID 4416 wrote to memory of 3320	4416	cmd.exe	100
PID 4416 wrote to memory of 3320	4416	cmd.exe	100
PID 4416 wrote to memory of 3320	4416	cmd.exe	100
PID 4896 wrote to memory of 1480	4896	ConsoleApplication2.exe	104
PID 4896 wrote to memory of 1480	4896	ConsoleApplication2.exe	104
PID 4896 wrote to memory of 1480	4896	ConsoleApplication2.exe	104
PID 1480 wrote to memory of 1212	1480	cmd.exe	105
PID 1480 wrote to memory of 1212	1480	cmd.exe	105
PID 1480 wrote to memory of 1212	1480	cmd.exe	105
PID 4896 wrote to memory of 448	4896	ConsoleApplication2.exe	106
PID 4896 wrote to memory of 448	4896	ConsoleApplication2.exe	106
PID 4896 wrote to memory of 448	4896	ConsoleApplication2.exe	106
PID 448 wrote to memory of 5092	448	cmd.exe	107
PID 448 wrote to memory of 5092	448	cmd.exe	107
PID 448 wrote to memory of 5092	448	cmd.exe	107
PID 4896 wrote to memory of 3472	4896	ConsoleApplication2.exe	110
PID 4896 wrote to memory of 3472	4896	ConsoleApplication2.exe	110
PID 4896 wrote to memory of 3472	4896	ConsoleApplication2.exe	110
PID 3472 wrote to memory of 3612	3472	cmd.exe	111
PID 3472 wrote to memory of 3612	3472	cmd.exe	111
PID 3472 wrote to memory of 3612	3472	cmd.exe	111
PID 4896 wrote to memory of 2924	4896	ConsoleApplication2.exe	112
PID 4896 wrote to memory of 2924	4896	ConsoleApplication2.exe	112
PID 4896 wrote to memory of 2924	4896	ConsoleApplication2.exe	112
PID 2924 wrote to memory of 4084	2924	cmd.exe	113
PID 2924 wrote to memory of 4084	2924	cmd.exe	113
PID 2924 wrote to memory of 4084	2924	cmd.exe	113
PID 4896 wrote to memory of 1504	4896	ConsoleApplication2.exe	114
PID 4896 wrote to memory of 1504	4896	ConsoleApplication2.exe	114
PID 4896 wrote to memory of 1504	4896	ConsoleApplication2.exe	114
PID 1504 wrote to memory of 3528	1504	cmd.exe	115
PID 1504 wrote to memory of 3528	1504	cmd.exe	115
PID 1504 wrote to memory of 3528	1504	cmd.exe	115
PID 4896 wrote to memory of 1912	4896	ConsoleApplication2.exe	117
PID 4896 wrote to memory of 1912	4896	ConsoleApplication2.exe	117
PID 4896 wrote to memory of 1912	4896	ConsoleApplication2.exe	117
PID 1912 wrote to memory of 2056	1912	cmd.exe	118
PID 1912 wrote to memory of 2056	1912	cmd.exe	118
PID 1912 wrote to memory of 2056	1912	cmd.exe	118
PID 4896 wrote to memory of 3628	4896	ConsoleApplication2.exe	120
PID 4896 wrote to memory of 3628	4896	ConsoleApplication2.exe	120
PID 4896 wrote to memory of 3628	4896	ConsoleApplication2.exe	120
PID 3628 wrote to memory of 3864	3628	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 1.1.1.1
    3⤵
    - Runs ping.exe
    PID:4576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:3612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get currentrefreshrate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get currentrefreshrate
    3⤵
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-Content (Get-PSReadlineOption).HistorySavePath
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Content (Get-PSReadlineOption).HistorySavePath
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:4468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
  2⤵
  PID:1384
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
    3⤵
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
  2⤵
  PID:224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:3324
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:528
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:3992
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4168,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
1⤵
PID:1620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x150
1⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1692,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
MD5 def65711d78669d7f8e69313be4acf2e
SHA1 6522ebf1de09eeb981e270bd95114bc69a49cda6
SHA512 05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 8bd4c124c9a450f81983206fb691fff32f49b745cb9636ed9998975392244b3a
MD5 6aa14918810680b4265af58115ecec18
SHA1 f63010afab1800a82abd5290e8b58dfd664fec56
SHA512 4693be45412d68c5be2cc0385cc882830c3a6835a8e65bd4834060674912b5f8d9fadb2ccb7f4b0140b8fa70f2d471e4aa9b3f10a6d2bf1c4cc5547ae1176e95
SSDEEP 384:/rf+UW/9i+ZTeKjFNL4iojJkEo9o2TVK6seYUME/t03SoZhfYSggjEBjhFRiVFDd:TfctTeKX4ioupo2TVNzrWSMWeElsVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 30df36b044f59adaa168798821219bcf7497836738ed7a4bae368e48120c3b77
MD5 7335f9b91e5fb606c5c9cbfc1435ab00
SHA1 4ba115cc010cc83ef4076a952c6e4b7316ca2c83
SHA512 87da3d7fcb71395de9ae4e88a716e98c159535b798f8ee9a751416d7980e6c478ef709e6276bd6288459356dbf84b13b217b3807474ceb59a13ea46105c0e26e
SSDEEP 384:hrf+cJaV91l/KwGsNJk5M06iO6fIg9ARZfMzHTRmF08ReZZCNm07kwZVSf3s0SO1:pfd4tlzzc5t6iO+IHrfydmF0ubtrZkfZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0vqp2qzd.zgj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0vqp2qzd.zgj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Nagogy-Grabber (Admin).zip

Path C:\Users\Admin\AppData\Local\Temp\f6HSjykrvUdpuozP\Nagogy-Grabber (Admin).zip
Size 7.7MB
SHA256 b4b077b0a4c16e4e3f5d272bec336ebaeda3bd90f2201e64d88621a2b18a84d5
MD5 07fcd15bd754520d8a24722444309866
SHA1 8fd906f1424cd9b7d53d60ec60615990f7af90f2
SHA512 217120ef908cb323612502673b0f6a7bf7c12cd2f6d0be15cd03f26a61cf0f47b968c30988b3f34215eece60ea012109e25668a692d9a48980eb9d06a5888dd0
SSDEEP 196608:I57AYGUGM3T9AvQdtiigJXURskGlgB4j2p2xxkiENp6v:I57kLYsQLiigJEFOgqj2p2xeiUp6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-63-0x0000000006B90000-0x0000000006BDC000-memory.dmp

Download

memory/388-52-0x0000000005F40000-0x0000000006294000-memory.dmp

Download

memory/3320-20-0x0000000007750000-0x0000000007CF4000-memory.dmp

Download

memory/3320-4-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Download

memory/3320-17-0x0000000007100000-0x0000000007196000-memory.dmp

Download

memory/3320-18-0x00000000065E0000-0x00000000065FA000-memory.dmp

Download

memory/3320-19-0x0000000006FF0000-0x0000000007012000-memory.dmp

Download

memory/3320-0-0x00000000027C0000-0x00000000027F6000-memory.dmp

Download

memory/3320-15-0x00000000060E0000-0x00000000060FE000-memory.dmp

Download

memory/3320-1-0x00000000052E0000-0x0000000005908000-memory.dmp

Download

memory/3320-14-0x0000000005C20000-0x0000000005F74000-memory.dmp

Download

memory/3320-2-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/3320-3-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Download

memory/3320-16-0x0000000006110000-0x000000000615C000-memory.dmp

Download

memory/3528-39-0x00000000081A0000-0x000000000881A000-memory.dmp

Download

memory/3528-38-0x0000000007AA0000-0x0000000007B16000-memory.dmp

Download

memory/3528-37-0x0000000006BE0000-0x0000000006C24000-memory.dmp

Download

memory/3528-36-0x0000000006C40000-0x0000000006C8C000-memory.dmp

Download

memory/3528-30-0x0000000006070000-0x00000000063C4000-memory.dmp

Download

memory/4896-88-0x0000000075520000-0x0000000075559000-memory.dmp

Download

memory/4896-185-0x0000000075520000-0x0000000075559000-memory.dmp

Download