Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe
Resource
win7-20240220-en
General
-
Target
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe
-
Size
1.0MB
-
MD5
77fe62e62469db6e17cf41f91c47b5b5
-
SHA1
93d2fddd66d7fac316d26e21f4406e46f46442b7
-
SHA256
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c
-
SHA512
4150a94c5348b81aa59fa99685a7ec13528ad7baee6a377bf394cf4cad535355466d502c9c039ed8a2af479447c278923e977a1817afcc9ed9dc173032ac32b7
-
SSDEEP
24576:6AHnh+eWsN3skA4RV1Hom2KXMmHayOmwQZZE9f/5:Nh+ZkldoPK8YayOr6A
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://77.91.77.92/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
55a4er5wo
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysmablsvr.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\2374931636.exe family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
1285526012.exewupgrdsv.exedescription pid process target process PID 2080 created 3484 2080 1285526012.exe Explorer.EXE PID 2080 created 3484 2080 1285526012.exe Explorer.EXE PID 4324 created 3484 4324 wupgrdsv.exe Explorer.EXE PID 4324 created 3484 4324 wupgrdsv.exe Explorer.EXE -
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe -
XMRig Miner payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4324-91-0x00007FF65D080000-0x00007FF65D5F6000-memory.dmp xmrig behavioral2/memory/340-101-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-102-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-104-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-105-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-106-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-107-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-108-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-109-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-116-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig behavioral2/memory/340-118-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
Processes:
E416.exe2374931636.exesysmablsvr.exe30338654.exe3137232685.exe1285526012.exe237224409.exewupgrdsv.exe1166016234.exewinblrsnrcs.exepid process 4908 E416.exe 1416 2374931636.exe 2024 sysmablsvr.exe 3616 30338654.exe 4772 3137232685.exe 2080 1285526012.exe 1912 237224409.exe 4324 wupgrdsv.exe 2568 1166016234.exe 4652 winblrsnrcs.exe -
Processes:
sysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2374931636.exe1166016234.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe" 2374931636.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winblrsnrcs.exe" 1166016234.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wupgrdsv.exedescription pid process target process PID 4324 set thread context of 340 4324 wupgrdsv.exe notepad.exe -
Drops file in Windows directory 4 IoCs
Processes:
2374931636.exe1166016234.exedescription ioc process File created C:\Windows\sysmablsvr.exe 2374931636.exe File opened for modification C:\Windows\sysmablsvr.exe 2374931636.exe File created C:\Windows\winblrsnrcs.exe 1166016234.exe File opened for modification C:\Windows\winblrsnrcs.exe 1166016234.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
1285526012.exepowershell.exewupgrdsv.exepowershell.exepid process 2080 1285526012.exe 2080 1285526012.exe 4320 powershell.exe 4320 powershell.exe 4320 powershell.exe 2080 1285526012.exe 2080 1285526012.exe 4324 wupgrdsv.exe 4324 wupgrdsv.exe 3764 powershell.exe 3764 powershell.exe 3764 powershell.exe 4324 wupgrdsv.exe 4324 wupgrdsv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4320 powershell.exe Token: SeIncreaseQuotaPrivilege 4320 powershell.exe Token: SeSecurityPrivilege 4320 powershell.exe Token: SeTakeOwnershipPrivilege 4320 powershell.exe Token: SeLoadDriverPrivilege 4320 powershell.exe Token: SeSystemProfilePrivilege 4320 powershell.exe Token: SeSystemtimePrivilege 4320 powershell.exe Token: SeProfSingleProcessPrivilege 4320 powershell.exe Token: SeIncBasePriorityPrivilege 4320 powershell.exe Token: SeCreatePagefilePrivilege 4320 powershell.exe Token: SeBackupPrivilege 4320 powershell.exe Token: SeRestorePrivilege 4320 powershell.exe Token: SeShutdownPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 powershell.exe Token: SeRemoteShutdownPrivilege 4320 powershell.exe Token: SeUndockPrivilege 4320 powershell.exe Token: SeManageVolumePrivilege 4320 powershell.exe Token: 33 4320 powershell.exe Token: 34 4320 powershell.exe Token: 35 4320 powershell.exe Token: 36 4320 powershell.exe Token: SeIncreaseQuotaPrivilege 4320 powershell.exe Token: SeSecurityPrivilege 4320 powershell.exe Token: SeTakeOwnershipPrivilege 4320 powershell.exe Token: SeLoadDriverPrivilege 4320 powershell.exe Token: SeSystemProfilePrivilege 4320 powershell.exe Token: SeSystemtimePrivilege 4320 powershell.exe Token: SeProfSingleProcessPrivilege 4320 powershell.exe Token: SeIncBasePriorityPrivilege 4320 powershell.exe Token: SeCreatePagefilePrivilege 4320 powershell.exe Token: SeBackupPrivilege 4320 powershell.exe Token: SeRestorePrivilege 4320 powershell.exe Token: SeShutdownPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 powershell.exe Token: SeRemoteShutdownPrivilege 4320 powershell.exe Token: SeUndockPrivilege 4320 powershell.exe Token: SeManageVolumePrivilege 4320 powershell.exe Token: 33 4320 powershell.exe Token: 34 4320 powershell.exe Token: 35 4320 powershell.exe Token: 36 4320 powershell.exe Token: SeIncreaseQuotaPrivilege 4320 powershell.exe Token: SeSecurityPrivilege 4320 powershell.exe Token: SeTakeOwnershipPrivilege 4320 powershell.exe Token: SeLoadDriverPrivilege 4320 powershell.exe Token: SeSystemProfilePrivilege 4320 powershell.exe Token: SeSystemtimePrivilege 4320 powershell.exe Token: SeProfSingleProcessPrivilege 4320 powershell.exe Token: SeIncBasePriorityPrivilege 4320 powershell.exe Token: SeCreatePagefilePrivilege 4320 powershell.exe Token: SeBackupPrivilege 4320 powershell.exe Token: SeRestorePrivilege 4320 powershell.exe Token: SeShutdownPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 powershell.exe Token: SeRemoteShutdownPrivilege 4320 powershell.exe Token: SeUndockPrivilege 4320 powershell.exe Token: SeManageVolumePrivilege 4320 powershell.exe Token: 33 4320 powershell.exe Token: 34 4320 powershell.exe Token: 35 4320 powershell.exe Token: 36 4320 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exepid process 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exepid process 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exeE416.exe2374931636.exesysmablsvr.exe3137232685.exewupgrdsv.exe1166016234.exedescription pid process target process PID 1716 wrote to memory of 4908 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe E416.exe PID 1716 wrote to memory of 4908 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe E416.exe PID 1716 wrote to memory of 4908 1716 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe E416.exe PID 4908 wrote to memory of 1416 4908 E416.exe 2374931636.exe PID 4908 wrote to memory of 1416 4908 E416.exe 2374931636.exe PID 4908 wrote to memory of 1416 4908 E416.exe 2374931636.exe PID 1416 wrote to memory of 2024 1416 2374931636.exe sysmablsvr.exe PID 1416 wrote to memory of 2024 1416 2374931636.exe sysmablsvr.exe PID 1416 wrote to memory of 2024 1416 2374931636.exe sysmablsvr.exe PID 2024 wrote to memory of 3616 2024 sysmablsvr.exe 30338654.exe PID 2024 wrote to memory of 3616 2024 sysmablsvr.exe 30338654.exe PID 2024 wrote to memory of 3616 2024 sysmablsvr.exe 30338654.exe PID 2024 wrote to memory of 4772 2024 sysmablsvr.exe 3137232685.exe PID 2024 wrote to memory of 4772 2024 sysmablsvr.exe 3137232685.exe PID 2024 wrote to memory of 4772 2024 sysmablsvr.exe 3137232685.exe PID 4772 wrote to memory of 2080 4772 3137232685.exe 1285526012.exe PID 4772 wrote to memory of 2080 4772 3137232685.exe 1285526012.exe PID 2024 wrote to memory of 1912 2024 sysmablsvr.exe 237224409.exe PID 2024 wrote to memory of 1912 2024 sysmablsvr.exe 237224409.exe PID 2024 wrote to memory of 1912 2024 sysmablsvr.exe 237224409.exe PID 2024 wrote to memory of 2568 2024 sysmablsvr.exe 1166016234.exe PID 2024 wrote to memory of 2568 2024 sysmablsvr.exe 1166016234.exe PID 2024 wrote to memory of 2568 2024 sysmablsvr.exe 1166016234.exe PID 4324 wrote to memory of 340 4324 wupgrdsv.exe notepad.exe PID 2568 wrote to memory of 4652 2568 1166016234.exe winblrsnrcs.exe PID 2568 wrote to memory of 4652 2568 1166016234.exe winblrsnrcs.exe PID 2568 wrote to memory of 4652 2568 1166016234.exe winblrsnrcs.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe"C:\Users\Admin\AppData\Local\Temp\58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E416.exe"C:\Users\Admin\AppData\Local\Temp\E416.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2374931636.exeC:\Users\Admin\AppData\Local\Temp\2374931636.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmablsvr.exeC:\Windows\sysmablsvr.exe5⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\30338654.exeC:\Users\Admin\AppData\Local\Temp\30338654.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3137232685.exeC:\Users\Admin\AppData\Local\Temp\3137232685.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1285526012.exeC:\Users\Admin\AppData\Local\Temp\1285526012.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\237224409.exeC:\Users\Admin\AppData\Local\Temp\237224409.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1166016234.exeC:\Users\Admin\AppData\Local\Temp\1166016234.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\winblrsnrcs.exeC:\Windows\winblrsnrcs.exe7⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,6041070687820623968,3004230300437737550,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:81⤵
-
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5fc35bf2367ee5c6feb084ab39f5c26eb
SHA1cd9742c05391a92780a81fe836797a5909c7f9c1
SHA2567ad08f1c2e7df4102eb3a6d213f4a0c245300c275fd53e463655a8ab9fa3ec64
SHA5120b6662ea93907902c9f5db98bed4e9d322a69e7b8df921f6b8bd8026fdbfa556b0afe29013e3ecc8982a6339c48b4fe371ba587f02c39de72cb3840ed0e6747b
-
C:\Users\Admin\AppData\Local\Temp\1166016234.exeFilesize
18KB
MD530dca8b68825d5b3db7a685aa3da0a13
SHA107320822d14d6caf8825dd6d806c0cde398584f3
SHA256f2dc635cb5fe8b8815ea98d909b67016975ca8e5a43cb39e47595ecd01038a96
SHA512b5f3be086d3f7c751028d8d8a025069743b2472cec10252627f5583492383a5a865e88ad5839d83bf3a3c31b5b630753e77a2c02433d7fbe90aa11acd0f35f0c
-
C:\Users\Admin\AppData\Local\Temp\1285526012.exeFilesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
C:\Users\Admin\AppData\Local\Temp\237224409.exeFilesize
11KB
MD5cafd277c4132f5d0f202e7ea07a27d5c
SHA172c8c16a94cce56a3e01d91bc1276dafc65b351d
SHA256e5162fa594811f0f01fc76f4acbd9fe99b2265df9cfcbc346023f28775c19f1e
SHA5127c87d1dec61b78e0f223e8f9fec019d96509813fa6d96129289aab00b2d6f05bf91fe1fafd680b7d9e746f4c2c8cbe48a3028bcaad479048d00d79a19f71b196
-
C:\Users\Admin\AppData\Local\Temp\2374931636.exeFilesize
88KB
MD54505daf4c08fc8e8e1380911e98588aa
SHA1d990eb1b2ccbb71c878944be37923b1ebd17bc72
SHA256a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40
SHA512bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec
-
C:\Users\Admin\AppData\Local\Temp\30338654.exeFilesize
7KB
MD577eed2bbe1769686fbfaba7c0fca9f79
SHA1d70bbf046b40f09420aa8938dcb49890db48f976
SHA25694084872fe25303309a1a35fadae3b75ae99c9ffb94926e1c7640f8d3469d0e2
SHA512e3e0d1d4f25553c13343bd80e59fcdfc690c20605f8ade8e86ba0eef9a6d20249f9f8f46b5fde494e781b2dcc28cc00c7143f8e425d8edcf2dfa6a2a03b89ec8
-
C:\Users\Admin\AppData\Local\Temp\3137232685.exeFilesize
10KB
MD56567b839ec69322ba1aa41b15fbd1e64
SHA10a2a0770afe094765a5eb88f6201847bf642bea9
SHA2568a4b87ed94fc50767d0bc91291a8b8a436b941b273b29ab0d442ba1cc10b76fb
SHA5122e4798244bf3891beea64ee0b0d106c6f47b7c7d6daf222af6192874dc0ef67491c82e93821c1ff9fbd25cf9ec50178e959adb466b210ff9754dd4e8387a30cf
-
C:\Users\Admin\AppData\Local\Temp\3192227273.exeFilesize
86KB
MD5fe1e93f12cca3f7c0c897ef2084e1778
SHA1fb588491ddad8b24ea555a6a2727e76cec1fade3
SHA2562ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
SHA51236e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
-
C:\Users\Admin\AppData\Local\Temp\E416.exeFilesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k0f5dsot.mc2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/340-101-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-108-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-90-0x000001B2BCE70000-0x000001B2BCE90000-memory.dmpFilesize
128KB
-
memory/340-118-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-116-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-102-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-104-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-105-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-106-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-107-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/340-109-0x00007FF7513E0000-0x00007FF751BCF000-memory.dmpFilesize
7.9MB
-
memory/1716-17-0x0000000004E00000-0x0000000004E04000-memory.dmpFilesize
16KB
-
memory/2080-67-0x00007FF691630000-0x00007FF691BA6000-memory.dmpFilesize
5.5MB
-
memory/4320-62-0x00000170444E0000-0x0000017044502000-memory.dmpFilesize
136KB
-
memory/4324-91-0x00007FF65D080000-0x00007FF65D5F6000-memory.dmpFilesize
5.5MB