06ab5377341cf38c3a3c6628b5bf91d545b7dcd153c629d5025582274a371f43

Analysis

max time kernel
64s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ConsoleApplication2.exe
Size

4.4MB
MD5

a0f170a09dcc8f9161efe47a518d5a01
SHA1

3fefa661fb68a1dd43ddff16202650e0b26ecb20
SHA256

06ab5377341cf38c3a3c6628b5bf91d545b7dcd153c629d5025582274a371f43
SHA512

eaefca62badab468db04dd77812318d50fab36fbc2ce7f2c08163dbda08207c2734a0829793fdacf5c2ac4c3de5d96c6f53f6d0555e5e6f6f145cef810257c44
SSDEEP

49152:M9v90k5HkzhwSUiUCAOygB+fEjGDYG12089DZujZGUOutEdNkzRvP61crzPBdWzc:M9v90kOnU7OyYjQsuhVPtd

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
95	discord.com
106	discord.com
32	discord.com
33	discord.com
45	discord.com
54	discord.com
77	discord.com
86	discord.com

Looks up external IP address via web service 11 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	ipinfo.io
79	ipinfo.io
90	ipinfo.io
107	ipinfo.io
14	ipinfo.io
15	ipinfo.io
47	ipinfo.io
78	ipinfo.io
98	ipinfo.io
18	ipinfo.io
35	ipinfo.io

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1520	powershell.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2616	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4128	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3444	systeminfo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3240	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1036	powershell.exe
1036	powershell.exe
2868	powershell.exe
2868	powershell.exe
1520	powershell.exe
1520	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3248	WMIC.exe
Token: SeSecurityPrivilege	3248	WMIC.exe
Token: SeTakeOwnershipPrivilege	3248	WMIC.exe
Token: SeLoadDriverPrivilege	3248	WMIC.exe
Token: SeSystemProfilePrivilege	3248	WMIC.exe
Token: SeSystemtimePrivilege	3248	WMIC.exe
Token: SeProfSingleProcessPrivilege	3248	WMIC.exe
Token: SeIncBasePriorityPrivilege	3248	WMIC.exe
Token: SeCreatePagefilePrivilege	3248	WMIC.exe
Token: SeBackupPrivilege	3248	WMIC.exe
Token: SeRestorePrivilege	3248	WMIC.exe
Token: SeShutdownPrivilege	3248	WMIC.exe
Token: SeDebugPrivilege	3248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3248	WMIC.exe
Token: SeRemoteShutdownPrivilege	3248	WMIC.exe
Token: SeUndockPrivilege	3248	WMIC.exe
Token: SeManageVolumePrivilege	3248	WMIC.exe
Token: 33	3248	WMIC.exe
Token: 34	3248	WMIC.exe
Token: 35	3248	WMIC.exe
Token: 36	3248	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3248	WMIC.exe
Token: SeSecurityPrivilege	3248	WMIC.exe
Token: SeTakeOwnershipPrivilege	3248	WMIC.exe
Token: SeLoadDriverPrivilege	3248	WMIC.exe
Token: SeSystemProfilePrivilege	3248	WMIC.exe
Token: SeSystemtimePrivilege	3248	WMIC.exe
Token: SeProfSingleProcessPrivilege	3248	WMIC.exe
Token: SeIncBasePriorityPrivilege	3248	WMIC.exe
Token: SeCreatePagefilePrivilege	3248	WMIC.exe
Token: SeBackupPrivilege	3248	WMIC.exe
Token: SeRestorePrivilege	3248	WMIC.exe
Token: SeShutdownPrivilege	3248	WMIC.exe
Token: SeDebugPrivilege	3248	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3248	WMIC.exe
Token: SeRemoteShutdownPrivilege	3248	WMIC.exe
Token: SeUndockPrivilege	3248	WMIC.exe
Token: SeManageVolumePrivilege	3248	WMIC.exe
Token: 33	3248	WMIC.exe
Token: 34	3248	WMIC.exe
Token: 35	3248	WMIC.exe
Token: 36	3248	WMIC.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	WMIC.exe
Token: SeSecurityPrivilege	2616	WMIC.exe
Token: SeTakeOwnershipPrivilege	2616	WMIC.exe
Token: SeLoadDriverPrivilege	2616	WMIC.exe
Token: SeSystemProfilePrivilege	2616	WMIC.exe
Token: SeSystemtimePrivilege	2616	WMIC.exe
Token: SeProfSingleProcessPrivilege	2616	WMIC.exe
Token: SeIncBasePriorityPrivilege	2616	WMIC.exe
Token: SeCreatePagefilePrivilege	2616	WMIC.exe
Token: SeBackupPrivilege	2616	WMIC.exe
Token: SeRestorePrivilege	2616	WMIC.exe
Token: SeShutdownPrivilege	2616	WMIC.exe
Token: SeDebugPrivilege	2616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2616	WMIC.exe
Token: SeRemoteShutdownPrivilege	2616	WMIC.exe
Token: SeUndockPrivilege	2616	WMIC.exe
Token: SeManageVolumePrivilege	2616	WMIC.exe
Token: 33	2616	WMIC.exe
Token: 34	2616	WMIC.exe
Token: 35	2616	WMIC.exe
Token: 36	2616	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1708	1364	ConsoleApplication2.exe	83
PID 1364 wrote to memory of 1708	1364	ConsoleApplication2.exe	83
PID 1364 wrote to memory of 1708	1364	ConsoleApplication2.exe	83
PID 1708 wrote to memory of 3240	1708	cmd.exe	84
PID 1708 wrote to memory of 3240	1708	cmd.exe	84
PID 1708 wrote to memory of 3240	1708	cmd.exe	84
PID 1364 wrote to memory of 4840	1364	ConsoleApplication2.exe	85
PID 1364 wrote to memory of 4840	1364	ConsoleApplication2.exe	85
PID 1364 wrote to memory of 4840	1364	ConsoleApplication2.exe	85
PID 4840 wrote to memory of 3248	4840	cmd.exe	86
PID 4840 wrote to memory of 3248	4840	cmd.exe	86
PID 4840 wrote to memory of 3248	4840	cmd.exe	86
PID 1364 wrote to memory of 3028	1364	ConsoleApplication2.exe	88
PID 1364 wrote to memory of 3028	1364	ConsoleApplication2.exe	88
PID 1364 wrote to memory of 3028	1364	ConsoleApplication2.exe	88
PID 3028 wrote to memory of 1036	3028	cmd.exe	89
PID 3028 wrote to memory of 1036	3028	cmd.exe	89
PID 3028 wrote to memory of 1036	3028	cmd.exe	89
PID 1364 wrote to memory of 5036	1364	ConsoleApplication2.exe	93
PID 1364 wrote to memory of 5036	1364	ConsoleApplication2.exe	93
PID 1364 wrote to memory of 5036	1364	ConsoleApplication2.exe	93
PID 5036 wrote to memory of 2616	5036	cmd.exe	94
PID 5036 wrote to memory of 2616	5036	cmd.exe	94
PID 5036 wrote to memory of 2616	5036	cmd.exe	94
PID 1364 wrote to memory of 1524	1364	ConsoleApplication2.exe	95
PID 1364 wrote to memory of 1524	1364	ConsoleApplication2.exe	95
PID 1364 wrote to memory of 1524	1364	ConsoleApplication2.exe	95
PID 1524 wrote to memory of 3280	1524	cmd.exe	96
PID 1524 wrote to memory of 3280	1524	cmd.exe	96
PID 1524 wrote to memory of 3280	1524	cmd.exe	96
PID 1364 wrote to memory of 452	1364	ConsoleApplication2.exe	97
PID 1364 wrote to memory of 452	1364	ConsoleApplication2.exe	97
PID 1364 wrote to memory of 452	1364	ConsoleApplication2.exe	97
PID 452 wrote to memory of 3900	452	cmd.exe	98
PID 452 wrote to memory of 3900	452	cmd.exe	98
PID 452 wrote to memory of 3900	452	cmd.exe	98
PID 1364 wrote to memory of 3924	1364	ConsoleApplication2.exe	99
PID 1364 wrote to memory of 3924	1364	ConsoleApplication2.exe	99
PID 1364 wrote to memory of 3924	1364	ConsoleApplication2.exe	99
PID 3924 wrote to memory of 2092	3924	cmd.exe	100
PID 3924 wrote to memory of 2092	3924	cmd.exe	100
PID 3924 wrote to memory of 2092	3924	cmd.exe	100
PID 1364 wrote to memory of 3632	1364	ConsoleApplication2.exe	103
PID 1364 wrote to memory of 3632	1364	ConsoleApplication2.exe	103
PID 1364 wrote to memory of 3632	1364	ConsoleApplication2.exe	103
PID 3632 wrote to memory of 2868	3632	cmd.exe	104
PID 3632 wrote to memory of 2868	3632	cmd.exe	104
PID 3632 wrote to memory of 2868	3632	cmd.exe	104
PID 1364 wrote to memory of 2256	1364	ConsoleApplication2.exe	106
PID 1364 wrote to memory of 2256	1364	ConsoleApplication2.exe	106
PID 1364 wrote to memory of 2256	1364	ConsoleApplication2.exe	106
PID 2256 wrote to memory of 4128	2256	cmd.exe	107
PID 2256 wrote to memory of 4128	2256	cmd.exe	107
PID 2256 wrote to memory of 4128	2256	cmd.exe	107
PID 1364 wrote to memory of 3168	1364	ConsoleApplication2.exe	108
PID 1364 wrote to memory of 3168	1364	ConsoleApplication2.exe	108
PID 1364 wrote to memory of 3168	1364	ConsoleApplication2.exe	108
PID 3168 wrote to memory of 3444	3168	cmd.exe	109
PID 3168 wrote to memory of 3444	3168	cmd.exe	109
PID 3168 wrote to memory of 3444	3168	cmd.exe	109
PID 1364 wrote to memory of 3616	1364	ConsoleApplication2.exe	113
PID 1364 wrote to memory of 3616	1364	ConsoleApplication2.exe	113
PID 1364 wrote to memory of 3616	1364	ConsoleApplication2.exe	113
PID 3616 wrote to memory of 2376	3616	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe
"C:\Users\Admin\AppData\Local\Temp\ConsoleApplication2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping -n 1 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 1 1.1.1.1
    3⤵
    - Runs ping.exe
    PID:3240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:3280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path win32_VideoController get currentrefreshrate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic path win32_VideoController get currentrefreshrate
    3⤵
    PID:2092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell Get-Content (Get-PSReadlineOption).HistorySavePath
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Get-Content (Get-PSReadlineOption).HistorySavePath
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan show profile
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\SysWOW64\netsh.exe
    netsh wlan show profile
    3⤵
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
  2⤵
  PID:1928
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get /value
    3⤵
    PID:932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Get-ItemProperty HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate, InstallLocation"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:5036
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:3860
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:3708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:4880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:544
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:948
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:4848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:1256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:868
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:1044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get Caption /value
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic os get Caption /value
    3⤵
    PID:2668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic csproduct get uuid
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic csproduct get uuid
    3⤵
    PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
b9db64cd4ebe329ccc3479bd16e7d1e8

SHA1
b0e5efadc66687da6625be8be49812823df7e1ce

SHA256
6c7fab9e412aa18ea97d2f3f03c038e1d3897d7489671ea6891a2b7442ab6c48

SHA512
341170908dd522028dae040c5b92d5a3caa2cddeb3a3d0ec9c0dcdd63923748c3c9b4591347f2434c2bbae29cc01966be56c750c97a2cddccf627fb1a05aa28c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
6bd10b3742df9a4b0d57a5241e168325

SHA1
5d267208c3dd08764d63a9163083d009b8b141c3

SHA256
4c3e961d875575f32d29b282999788d7e8b164a8c0c6dca3cf7a79d399994b8d

SHA512
8960d44803a16b6df29f1f10687846154e03baeb1c2a22d0eab6d2553ea25a44c20bcc8be8c7f28835bf731cca6f8e635b6f77469ba6b1cc0a490bbf1e853ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_52u3vpwe.kzq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pTb2Tlyz8TK5kbXI\Nagogy-Grabber (Admin).zip

Filesize
191KB

MD5
88adeaf84cd09f799d274577f1b5588f

SHA1
799f7efae378efcf4c567730fc5646f4b172f296

SHA256
252e08bb560860d8b9bdbded093a088412a97caa1f7239466930f3f5f0b63586

SHA512
5dd833fa8b3c45f1eac0d307de5efdb687dded10c4a898ec81161a970a4a2786306bef859cede5e7a763d18802e94fe19a7f39f13d746633d9d537b0ff64fb4e

Download Submit
memory/1036-22-0x0000000006410000-0x0000000006432000-memory.dmp

Filesize
136KB

Download
memory/1036-26-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1036-7-0x0000000005870000-0x00000000058D6000-memory.dmp

Filesize
408KB

Download
memory/1036-5-0x0000000004F00000-0x0000000004F22000-memory.dmp

Filesize
136KB

Download
memory/1036-17-0x00000000058E0000-0x0000000005C34000-memory.dmp

Filesize
3.3MB

Download
memory/1036-18-0x0000000005EC0000-0x0000000005EDE000-memory.dmp

Filesize
120KB

Download
memory/1036-19-0x0000000005F10000-0x0000000005F5C000-memory.dmp

Filesize
304KB

Download
memory/1036-20-0x0000000006440000-0x00000000064D6000-memory.dmp

Filesize
600KB

Download
memory/1036-21-0x00000000063C0000-0x00000000063DA000-memory.dmp

Filesize
104KB

Download
memory/1036-0-0x000000007460E000-0x000000007460F000-memory.dmp

Filesize
4KB

Download
memory/1036-23-0x0000000007440000-0x00000000079E4000-memory.dmp

Filesize
5.6MB

Download
memory/1036-6-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/1036-4-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1036-1-0x0000000002580000-0x00000000025B6000-memory.dmp

Filesize
216KB

Download
memory/1036-2-0x00000000051D0000-0x00000000057F8000-memory.dmp

Filesize
6.2MB

Download
memory/1036-3-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1520-65-0x00000000060F0000-0x0000000006444000-memory.dmp

Filesize
3.3MB

Download
memory/1520-67-0x0000000006500000-0x000000000654C000-memory.dmp

Filesize
304KB

Download
memory/2868-41-0x00000000067E0000-0x0000000006824000-memory.dmp

Filesize
272KB

Download
memory/2868-42-0x0000000007600000-0x0000000007676000-memory.dmp

Filesize
472KB

Download
memory/2868-43-0x0000000007D00000-0x000000000837A000-memory.dmp

Filesize
6.5MB

Download
memory/2868-40-0x0000000006470000-0x00000000064BC000-memory.dmp

Filesize
304KB

Download
memory/2868-34-0x0000000005C60000-0x0000000005FB4000-memory.dmp

Filesize
3.3MB

Download