meshagent | aa89ac89659bffee9a9e8125f67df0c41ded196e282bcd9aa40bb703637a2527

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2025, 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe
Size

2.9MB
MD5

8cd4a310e3c4f2ce52250eca4f2c630f
SHA1

2af4e53f40b5b28613d35c82b9768bc78d2fad56
SHA256

aa89ac89659bffee9a9e8125f67df0c41ded196e282bcd9aa40bb703637a2527
SHA512

3dcae80f39b429085d4b44aad6b3108e665a6d25e74694ef6730d171866abff60c55e7b4cb31f9520f8d825b041ddc7648aeac2977027bf4d4eb482567ef10d8
SSDEEP

49152:kZFIlmhRYg1OziGQGRCv6da/KMvxZdAMBwQoxXXujOl4MPMFvfldPSFrXxn3l:jl7i86hR+fWMeP43l

Score

10^/10

meshagent 050 lisboa - zonesoft backdoor discovery persistence rat trojan

Malware Config

Extracted

Family

meshagent

Version

Botnet

050 Lisboa - Zonesoft

http://fs1.suporte.com.pt:8943/agent.ashx

Attributes

mesh_id
0x313CE7C3BD97BA4DE25768478CFB01C142A538B329BAAB8F6B3AB4F4FFEEC83BF0EBE45A831A8A61950A237224143E83
server_id
0481CF775C2137A6BF13FF516D4E688220F467FB031867C5FBA7771274EA8996A04DF952EDD29FAA3F8190D6B3985533
wss
wss://fs1.suporte.com.pt:8943/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023ca4-80.dat	family_meshagent

MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" --installedByUser=\"S-1-5-21-4050598569-1597076380-177084960-1000\""	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe

Executes dropped EXE 1 IoCs

pid	Process
1400	MeshAgent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\32BB520C2A23AAC5C4D7CED01D2D01C767808394	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\3F62DA7D86E4649D846785E9905CA401E3117B10	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shcore.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\32BB520C2A23AAC5C4D7CED01D2D01C767808394	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdiplus.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\B11F5ABEFC8CF3BD670FD28C674B2FEA00AA94CF	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\oleaut32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\version.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.log	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133825495740316689"	MeshAgent.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	powershell.exe
1244	powershell.exe
2856	powershell.exe
2856	powershell.exe
632	powershell.exe
632	powershell.exe
4372	powershell.exe
4372	powershell.exe
372	powershell.exe
372	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4868	wmic.exe
Token: SeSecurityPrivilege	4868	wmic.exe
Token: SeTakeOwnershipPrivilege	4868	wmic.exe
Token: SeLoadDriverPrivilege	4868	wmic.exe
Token: SeSystemProfilePrivilege	4868	wmic.exe
Token: SeSystemtimePrivilege	4868	wmic.exe
Token: SeProfSingleProcessPrivilege	4868	wmic.exe
Token: SeIncBasePriorityPrivilege	4868	wmic.exe
Token: SeCreatePagefilePrivilege	4868	wmic.exe
Token: SeBackupPrivilege	4868	wmic.exe
Token: SeRestorePrivilege	4868	wmic.exe
Token: SeShutdownPrivilege	4868	wmic.exe
Token: SeDebugPrivilege	4868	wmic.exe
Token: SeSystemEnvironmentPrivilege	4868	wmic.exe
Token: SeRemoteShutdownPrivilege	4868	wmic.exe
Token: SeUndockPrivilege	4868	wmic.exe
Token: SeManageVolumePrivilege	4868	wmic.exe
Token: 33	4868	wmic.exe
Token: 34	4868	wmic.exe
Token: 35	4868	wmic.exe
Token: 36	4868	wmic.exe
Token: SeIncreaseQuotaPrivilege	4868	wmic.exe
Token: SeSecurityPrivilege	4868	wmic.exe
Token: SeTakeOwnershipPrivilege	4868	wmic.exe
Token: SeLoadDriverPrivilege	4868	wmic.exe
Token: SeSystemProfilePrivilege	4868	wmic.exe
Token: SeSystemtimePrivilege	4868	wmic.exe
Token: SeProfSingleProcessPrivilege	4868	wmic.exe
Token: SeIncBasePriorityPrivilege	4868	wmic.exe
Token: SeCreatePagefilePrivilege	4868	wmic.exe
Token: SeBackupPrivilege	4868	wmic.exe
Token: SeRestorePrivilege	4868	wmic.exe
Token: SeShutdownPrivilege	4868	wmic.exe
Token: SeDebugPrivilege	4868	wmic.exe
Token: SeSystemEnvironmentPrivilege	4868	wmic.exe
Token: SeRemoteShutdownPrivilege	4868	wmic.exe
Token: SeUndockPrivilege	4868	wmic.exe
Token: SeManageVolumePrivilege	4868	wmic.exe
Token: 33	4868	wmic.exe
Token: 34	4868	wmic.exe
Token: 35	4868	wmic.exe
Token: 36	4868	wmic.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeIncreaseQuotaPrivilege	2856	powershell.exe
Token: SeSecurityPrivilege	2856	powershell.exe
Token: SeTakeOwnershipPrivilege	2856	powershell.exe
Token: SeLoadDriverPrivilege	2856	powershell.exe
Token: SeSystemProfilePrivilege	2856	powershell.exe
Token: SeSystemtimePrivilege	2856	powershell.exe
Token: SeProfSingleProcessPrivilege	2856	powershell.exe
Token: SeIncBasePriorityPrivilege	2856	powershell.exe
Token: SeCreatePagefilePrivilege	2856	powershell.exe
Token: SeBackupPrivilege	2856	powershell.exe
Token: SeRestorePrivilege	2856	powershell.exe
Token: SeShutdownPrivilege	2856	powershell.exe
Token: SeDebugPrivilege	2856	powershell.exe
Token: SeSystemEnvironmentPrivilege	2856	powershell.exe
Token: SeRemoteShutdownPrivilege	2856	powershell.exe
Token: SeUndockPrivilege	2856	powershell.exe
Token: SeManageVolumePrivilege	2856	powershell.exe
Token: 33	2856	powershell.exe
Token: 34	2856	powershell.exe
Token: 35	2856	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 4868	404	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	84
PID 404 wrote to memory of 4868	404	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	84
PID 404 wrote to memory of 2388	404	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	87
PID 404 wrote to memory of 2388	404	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	87
PID 2388 wrote to memory of 1244	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	90
PID 2388 wrote to memory of 1244	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	90
PID 2388 wrote to memory of 2856	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	92
PID 2388 wrote to memory of 2856	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	92
PID 2388 wrote to memory of 632	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	94
PID 2388 wrote to memory of 632	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	94
PID 2388 wrote to memory of 4372	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	98
PID 2388 wrote to memory of 4372	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	98
PID 2388 wrote to memory of 372	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	101
PID 2388 wrote to memory of 372	2388	2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe	101

C:\Users\Admin\AppData\Local\Temp\2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\system32\wbem\wmic.exe
  wmic os get oslanguage /FORMAT:LIST
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Users\Admin\AppData\Local\Temp\2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver.exe" -fullinstall
  2⤵
  - Sets service image path in registry
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "Get-Module -ListAvailable -Name netsecurity"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Management Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Management Traffic (TCP-1)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16990 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol TCP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Management Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Management Traffic (TCP-2)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16991 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol TCP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Peer-to-Peer Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Peer-to-Peer Traffic (UDP-1)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16990 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol UDP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    /C "New-NetFirewallRule -Action Allow -Description \"Mesh Central Agent Peer-to-Peer Traffic\" -Direction Inbound -DisplayName \"Mesh Agent Peer-to-Peer Traffic (UDP-2)\" -DynamicTarget Any -EdgeTraversalPolicy Allow -Enabled True -InterfaceType Any -LocalPort 16991 -Profile \"Public, Private, Domain\" -Program \"C:\Program Files\Mesh Agent\MeshAgent.exe\" -Protocol UDP"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:372

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe" --installedByUser="S-1-5-21-4050598569-1597076380-177084960-1000"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
2.9MB

MD5
8cd4a310e3c4f2ce52250eca4f2c630f

SHA1
2af4e53f40b5b28613d35c82b9768bc78d2fad56

SHA256
aa89ac89659bffee9a9e8125f67df0c41ded196e282bcd9aa40bb703637a2527

SHA512
3dcae80f39b429085d4b44aad6b3108e665a6d25e74694ef6730d171866abff60c55e7b4cb31f9520f8d825b041ddc7648aeac2977027bf4d4eb482567ef10d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
b5f63423f55e96fabcd1b186b27ce0c4

SHA1
581b488265a2f159836409853f4b97eb5941bd48

SHA256
451cd58d101dc6219943589eedc0789ff95f35be417f63555ebde5d354e7c11a

SHA512
f1e9873c6c88964035589f1dbfa28bff55315a66d471e69332f96c837855252187b719d5660baee2d5e3bb5d86b8c42e54826546b6e0d949010a6c7d2facadeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
fc08d9efbf45b4045fdf2cfc507ddceb

SHA1
7a1095765f0b9ed6a04afeb084f4e78cc25aed5c

SHA256
b11437cfbe0773154d082440842d8754f31a0ff920b86a1c518cefbe9e0bc92e

SHA512
2f765d087a043d05720445383409bbab5f2a17f46c10257589a94a8dfa22e5888692879d25df2e78192e6a226ad3c44921689104a3e40f2a45ffe2cc0ba10571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b5461b7b030e3c0cf534f13f48b084b4

SHA1
7cc7e457fd46e10aec50338fc7e5f33371fa9012

SHA256
051a97309a5c4eff97dd12f1ca48bbea912eb1a24b0067dfb102119226de25de

SHA512
bcc06c0e0631437d672b18fdd22ff077585fdc78f057a9aa83d7870a6b889fc774d7f1590ef57235763fbbc41b7dd48346d860c752eaa79800d6a53af8317b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c5d6221bf33616310d317216ac1ba3c9

SHA1
6e1cff1bcd242d2d6e05a8a1f8feca65deca8e25

SHA256
f4f1e46227ba9a115b4801843152916ea1e42807296c9debf587e20cfbe16e66

SHA512
782bfc457319b2c10f4730dc756b83a9f537d80a4dc95d30f4bd9c0b7394b3a6a63a3162b74bf4927989febf70fbfc349e44bb2170db75f6d74e5291ca1118d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l0ne2fmr.rzm.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1244-2-0x0000021374C10000-0x0000021374C32000-memory.dmp

Filesize
136KB

Download
memory/1244-21-0x00000213771C0000-0x00000213771CE000-memory.dmp

Filesize
56KB

Download
memory/1244-22-0x0000021377330000-0x000002137734A000-memory.dmp

Filesize
104KB

Download