meshagent | 854717a4571738e4ed8d49e7d1f9c77cf02f2aa26d7fd49cd4195b68aa44cb94

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2024 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe
Size

2.9MB
MD5

14b3ba84931f9d0d261decb8ccbaf079
SHA1

a77659ab265213a2b38384b2ae8e1a722c1d7b2e
SHA256

854717a4571738e4ed8d49e7d1f9c77cf02f2aa26d7fd49cd4195b68aa44cb94
SHA512

97c65b9d2390b0e8af2a7a4510130a92c0be4c90399223b8f5b70eddc1b916329cb005fda7c3c5209c7d83a4c4637605a4cff37304960965e2a5af045d390b98
SSDEEP

49152:iiQagHg5EVhwQd+qrW+i1w+Tqc0KxZbDOCwMDbyeKw3FGMFvfjPW21I3iIJR:3g7hRdj9iMlHBSFBWZR

Score

10^/10

meshagent personal backdoor discovery persistence rat trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

Personal

http://heimdall.hostedhero.com:443/agent.ashx

Attributes

mesh_id
0x012DB6DDE7E65372F345CC35A1186B518B2A8BBA6502557EEDF03299CB0153F34D79A8C46FF331BD838E3903EF9E37A4
server_id
316B450D4320A8D7AF354D9F06DF347C98693E4AA9014FC7CFEF9940F3F338B0853FADD2076DF2D06D5810331C87BF50
wss
wss://heimdall.hostedhero.com:443/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x000a000000023b60-80.dat	family_meshagent

MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" --installedByUser=\"S-1-5-21-4089630652-1596403869-279772308-1000\""	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe

Executes dropped EXE 1 IoCs

Processes:

MeshAgent.exe

pid	Process
4268	MeshAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

Processes:

MeshAgent.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\bcryptprimitives.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\A89D100338CC3BD1472C6639B35BD6E1CC059B00	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E73A071DD0CFDC03C2F83020019E1AD8FD1DC3EB	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\version.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\version.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\B6B5980EC0D6BDF395225AECC512A053F67D6830	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\Kernel.Appcore.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\EB30A93647370492CA5547458899529DB68DC4E8	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe

Drops file in Program Files directory 7 IoCs

Processes:

2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exeMeshAgent.exe

description	ioc	Process
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.log	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

Processes:

MeshAgent.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133776661172902010"	MeshAgent.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
3220	powershell.exe
3220	powershell.exe
60	powershell.exe
60	powershell.exe
384	powershell.exe
384	powershell.exe
4884	powershell.exe
4884	powershell.exe
4048	powershell.exe
4048	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exepowershell.exepowershell.exe

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4692	wmic.exe
Token: SeSecurityPrivilege	4692	wmic.exe
Token: SeTakeOwnershipPrivilege	4692	wmic.exe
Token: SeLoadDriverPrivilege	4692	wmic.exe
Token: SeSystemProfilePrivilege	4692	wmic.exe
Token: SeSystemtimePrivilege	4692	wmic.exe
Token: SeProfSingleProcessPrivilege	4692	wmic.exe
Token: SeIncBasePriorityPrivilege	4692	wmic.exe
Token: SeCreatePagefilePrivilege	4692	wmic.exe
Token: SeBackupPrivilege	4692	wmic.exe
Token: SeRestorePrivilege	4692	wmic.exe
Token: SeShutdownPrivilege	4692	wmic.exe
Token: SeDebugPrivilege	4692	wmic.exe
Token: SeSystemEnvironmentPrivilege	4692	wmic.exe
Token: SeRemoteShutdownPrivilege	4692	wmic.exe
Token: SeUndockPrivilege	4692	wmic.exe
Token: SeManageVolumePrivilege	4692	wmic.exe
Token: 33	4692	wmic.exe
Token: 34	4692	wmic.exe
Token: 35	4692	wmic.exe
Token: 36	4692	wmic.exe
Token: SeIncreaseQuotaPrivilege	4692	wmic.exe
Token: SeSecurityPrivilege	4692	wmic.exe
Token: SeTakeOwnershipPrivilege	4692	wmic.exe
Token: SeLoadDriverPrivilege	4692	wmic.exe
Token: SeSystemProfilePrivilege	4692	wmic.exe
Token: SeSystemtimePrivilege	4692	wmic.exe
Token: SeProfSingleProcessPrivilege	4692	wmic.exe
Token: SeIncBasePriorityPrivilege	4692	wmic.exe
Token: SeCreatePagefilePrivilege	4692	wmic.exe
Token: SeBackupPrivilege	4692	wmic.exe
Token: SeRestorePrivilege	4692	wmic.exe
Token: SeShutdownPrivilege	4692	wmic.exe
Token: SeDebugPrivilege	4692	wmic.exe
Token: SeSystemEnvironmentPrivilege	4692	wmic.exe
Token: SeRemoteShutdownPrivilege	4692	wmic.exe
Token: SeUndockPrivilege	4692	wmic.exe
Token: SeManageVolumePrivilege	4692	wmic.exe
Token: 33	4692	wmic.exe
Token: 34	4692	wmic.exe
Token: 35	4692	wmic.exe
Token: 36	4692	wmic.exe
Token: SeDebugPrivilege	3220	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeIncreaseQuotaPrivilege	60	powershell.exe
Token: SeSecurityPrivilege	60	powershell.exe
Token: SeTakeOwnershipPrivilege	60	powershell.exe
Token: SeLoadDriverPrivilege	60	powershell.exe
Token: SeSystemProfilePrivilege	60	powershell.exe
Token: SeSystemtimePrivilege	60	powershell.exe
Token: SeProfSingleProcessPrivilege	60	powershell.exe
Token: SeIncBasePriorityPrivilege	60	powershell.exe
Token: SeCreatePagefilePrivilege	60	powershell.exe
Token: SeBackupPrivilege	60	powershell.exe
Token: SeRestorePrivilege	60	powershell.exe
Token: SeShutdownPrivilege	60	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeSystemEnvironmentPrivilege	60	powershell.exe
Token: SeRemoteShutdownPrivilege	60	powershell.exe
Token: SeUndockPrivilege	60	powershell.exe
Token: SeManageVolumePrivilege	60	powershell.exe
Token: 33	60	powershell.exe
Token: 34	60	powershell.exe
Token: 35	60	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe

description	pid	Process	procid_target
PID 3852 wrote to memory of 4692	3852	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	83
PID 3852 wrote to memory of 4692	3852	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	83
PID 3852 wrote to memory of 2112	3852	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	86
PID 3852 wrote to memory of 2112	3852	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	86
PID 2112 wrote to memory of 3220	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	89
PID 2112 wrote to memory of 3220	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	89
PID 2112 wrote to memory of 60	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	91
PID 2112 wrote to memory of 60	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	91
PID 2112 wrote to memory of 384	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	93
PID 2112 wrote to memory of 384	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	93
PID 2112 wrote to memory of 4884	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	95
PID 2112 wrote to memory of 4884	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	95
PID 2112 wrote to memory of 4048	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	97
PID 2112 wrote to memory of 4048	2112	2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe	97

C:\Users\Admin\AppData\Local\Temp\2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4692
- C:\Users\Admin\AppData\Local\Temp\2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2024-12-03_14b3ba84931f9d0d261decb8ccbaf079_ismagent_ryuk_sliver.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "Get-Module -ListAvailable -Name netsecurity"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Management Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Management Traffic (TCP-1)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16990 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol TCP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:60
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Management Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Management Traffic (TCP-2)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16991 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol TCP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:384
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Peer-to-Peer Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Peer-to-Peer Traffic (UDP-1)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16990 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol UDP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Peer-to-Peer Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Peer-to-Peer Traffic (UDP-2)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16991 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol UDP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4048

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe" --installedByUser="S-1-5-21-4089630652-1596403869-279772308-1000"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
2.9MB

MD5
14b3ba84931f9d0d261decb8ccbaf079

SHA1
a77659ab265213a2b38384b2ae8e1a722c1d7b2e

SHA256
854717a4571738e4ed8d49e7d1f9c77cf02f2aa26d7fd49cd4195b68aa44cb94

SHA512
97c65b9d2390b0e8af2a7a4510130a92c0be4c90399223b8f5b70eddc1b916329cb005fda7c3c5209c7d83a4c4637605a4cff37304960965e2a5af045d390b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
b5f63423f55e96fabcd1b186b27ce0c4

SHA1
581b488265a2f159836409853f4b97eb5941bd48

SHA256
451cd58d101dc6219943589eedc0789ff95f35be417f63555ebde5d354e7c11a

SHA512
f1e9873c6c88964035589f1dbfa28bff55315a66d471e69332f96c837855252187b719d5660baee2d5e3bb5d86b8c42e54826546b6e0d949010a6c7d2facadeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fc08d9efbf45b4045fdf2cfc507ddceb

SHA1
7a1095765f0b9ed6a04afeb084f4e78cc25aed5c

SHA256
b11437cfbe0773154d082440842d8754f31a0ff920b86a1c518cefbe9e0bc92e

SHA512
2f765d087a043d05720445383409bbab5f2a17f46c10257589a94a8dfa22e5888692879d25df2e78192e6a226ad3c44921689104a3e40f2a45ffe2cc0ba10571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
252ed12a3ccf41ed460e77b8cc776954

SHA1
8edaae40a2697ff946b3b6ce4ed03c59755286fa

SHA256
222a4a53d070e8b033242e0e500b2af1de1aba035a24995c7d4e4d8a5c82f714

SHA512
574b9e2e5d45aa9732ad7c8e377862df755d73999346ef49e1265d2955a0f87b1eb49a0f0fab40ffe255c82e204c3f9c7317bba83ae5e744456c33502a8f2727

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a4d44ff5842b1ab143c42c586b152138

SHA1
f3a4f61e70095de87d5fdf07bc43549dbe8dc208

SHA256
44635acafccafa17a87f72958b785c57c693a7aca5e5b40a0fdf91f593145f42

SHA512
c59d9d2994c78db80627c562342e66a0c1b66916231555882ec7f33ffc387aefbcf376e23a37f50631b08f380d53128c97df3fa289900c1d30308081fb64e905

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tgokq1rd.2tu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3220-7-0x00000242E4F80000-0x00000242E4FA2000-memory.dmp

Filesize
136KB

Download
memory/3220-21-0x00000242E4FB0000-0x00000242E4FBE000-memory.dmp

Filesize
56KB

Download
memory/3220-22-0x00000242E5240000-0x00000242E525A000-memory.dmp

Filesize
104KB

Download