0af450fb8c09b9c1c9d36cad2334b0dc5a637200da5e186cd5c9601e26e92792

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2025, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe
Size

13.0MB
MD5

d39a79a49f77d18dbb8c7b13ce466147
SHA1

1315ebc21bbcae0f266c57f27487c14ff12688b1
SHA256

0af450fb8c09b9c1c9d36cad2334b0dc5a637200da5e186cd5c9601e26e92792
SHA512

7ae10e882913268f557cda8e1205f71a826bd32c3695605c471998d784205b0c6801863bf5067cb23309cb082d870a774ab557b854addd0caf41438b3965a047
SSDEEP

98304:+AgxbhwD3HY3xC6cNYXNookfekhB3lh7xuEANLw02xdOPSU/fE8a0WiUk:qhG3HY3sDhDfLAN1aN

Score

8^/10

credential_access discovery execution spyware stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
920	chrome.exe
1576	chrome.exe
3300	msedge.exe
1900	msedge.exe
5056	msedge.exe
4256	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\debug.log	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1728	powershell.exe
3712	powershell.exe
4396	powershell.exe
4964	powershell.exe
408	powershell.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
2076	taskkill.exe
1768	taskkill.exe
1716	taskkill.exe
1408	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1728	powershell.exe
1728	powershell.exe
1728	powershell.exe
3712	powershell.exe
3712	powershell.exe
3712	powershell.exe
4396	powershell.exe
4396	powershell.exe
4964	powershell.exe
4964	powershell.exe
408	powershell.exe
408	powershell.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	4396	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeDebugPrivilege	408	powershell.exe
Token: SeDebugPrivilege	1768	taskkill.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeShutdownPrivilege	4256	chrome.exe
Token: SeCreatePagefilePrivilege	4256	chrome.exe
Token: SeDebugPrivilege	1716	taskkill.exe
Token: SeDebugPrivilege	1408	taskkill.exe
Token: SeDebugPrivilege	2076	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1728	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	84
PID 4580 wrote to memory of 1728	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	84
PID 4580 wrote to memory of 3712	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	86
PID 4580 wrote to memory of 3712	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	86
PID 4580 wrote to memory of 4396	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	89
PID 4580 wrote to memory of 4396	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	89
PID 4580 wrote to memory of 4964	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	94
PID 4580 wrote to memory of 4964	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	94
PID 4580 wrote to memory of 408	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	96
PID 4580 wrote to memory of 408	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	96
PID 4580 wrote to memory of 1768	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	114
PID 4580 wrote to memory of 1768	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	114
PID 4580 wrote to memory of 4256	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	116
PID 4580 wrote to memory of 4256	4580	2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe	116
PID 4256 wrote to memory of 2800	4256	chrome.exe	117
PID 4256 wrote to memory of 2800	4256	chrome.exe	117
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 4028	4256	chrome.exe	118
PID 4256 wrote to memory of 3252	4256	chrome.exe	119
PID 4256 wrote to memory of 3252	4256	chrome.exe	119
PID 4256 wrote to memory of 920	4256	chrome.exe	120
PID 4256 wrote to memory of 920	4256	chrome.exe	120
PID 4256 wrote to memory of 920	4256	chrome.exe	120
PID 4256 wrote to memory of 920	4256	chrome.exe	120
PID 4256 wrote to memory of 920	4256	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-12_d39a79a49f77d18dbb8c7b13ce466147_frostygoop_knight_luca-stealer_poet-rat_sliver_snatch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-Process | Select-Object -ExpandProperty ProcessName"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_Processor | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-WmiObject Win32_OperatingSystem | Select-Object -ExpandProperty TotalVisibleMemorySize"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=49422 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" https://greyshare.pics/home
  2⤵
  - Uses browser remote debugging
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdbf41cc40,0x7ffdbf41cc4c,0x7ffdbf41cc58
    3⤵
    PID:2800
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --use-angle=swiftshader-webgl --headless --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --field-trial-handle=1444,i,16465697823176305458,7242758758416180211,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:2
    3⤵
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --headless --field-trial-handle=1648,i,16465697823176305458,7242758758416180211,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:3
    3⤵
    PID:3252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --remote-debugging-port=49422 --allow-pre-commit-input --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1804,i,16465697823176305458,7242758758416180211,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:1
    3⤵
    - Uses browser remote debugging
    - Drops file in Program Files directory
    PID:920
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --headless --remote-debugging-port=49422 --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2844,i,16465697823176305458,7242758758416180211,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
    3⤵
    - Uses browser remote debugging
    - Drops file in Program Files directory
    PID:1576
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM chrome.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=49422 --remote-allow-origins=* --headless "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" https://greyshare.pics/home
  2⤵
  - Uses browser remote debugging
  PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffdbfc446f8,0x7ffdbfc44708,0x7ffdbfc44718
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1460,413015929216823170,16286121865219792552,131072 --disable-features=PaintHolding --headless --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1464 /prefetch:2
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1460,413015929216823170,16286121865219792552,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1596 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=49422 --allow-pre-commit-input --field-trial-handle=1460,413015929216823170,16286121865219792552,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1904 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=49422 --allow-pre-commit-input --field-trial-handle=1460,413015929216823170,16286121865219792552,131072 --disable-features=PaintHolding --disable-gpu-compositing --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5056
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM msedge.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
223bd4ae02766ddc32e6145fd1a29301

SHA1
900cfd6526d7e33fb4039a1cc2790ea049bc2c5b

SHA256
1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e

SHA512
648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1ef85a547edc27c13271009c36d9a8de

SHA1
84197cd759db579e2e4bd7c03aa4de36b515c1fd

SHA256
c2c5895f3a9356b6be3feeeb3ce2878d498ab230370532189f1156a9f848a14d

SHA512
65cf5104560f49b9a6dba0d901db4529ef416202eed3fcf6b28be86f8fb4cddc931400be8d4723198750226123d2a711dba83166dbe4c507ffcbcf8f5ecbcb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3f77c39844c3d0494bfe0a9da985d24b

SHA1
eb52637768c77cc407686bf2a61f220a4b27d56f

SHA256
970506a3142d9e900889ad7e1f3867d91fb1c301b656841e8c797441c112cb79

SHA512
44fd5175895f6c3f4bf2fba0f15a3767cddb78f272143e702c7c819eaee4316b7ba756b31ade303af1b4cb6f2884c53bb567134c3770658083669ffe124dce6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c15aebf2b4c8b24eae2ff87622d00f0c

SHA1
bd029551cc24b2cfb556c4bb4452a654665e82d8

SHA256
54b8636f970908bf4f36d8db1af07e73a493c9423a67aad0806737f49297a02b

SHA512
d1fbc4378aff78624501fe50128f6b57e0ea3edcee053f5821b06f87a468618a065adf106b4c92fdb0e2e3063b3db12263f86eff681fcbe5e2292f74692319ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
95fe0f51cedca051753d9935e25a9519

SHA1
f842066b67a9d083abe3f74cf3b17b25e1ef2d19

SHA256
0b76c98b2c3454b25171f7e84a0a12c4d1aab7635150b074e59294df3d960883

SHA512
f548f228e79636ab9cff4fbf6b6d2b1bc3ca8cae0d4b8311d079761efb6a9ca2af606125648a74154ab5e713fafc54c8d776fca8d258bdb018794ef0ebc9218c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.bak

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cxojahn1.vhl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1728-12-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download
memory/1728-15-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download
memory/1728-0-0x00007FFDC04C3000-0x00007FFDC04C5000-memory.dmp

Filesize
8KB

Download
memory/1728-11-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download
memory/1728-10-0x0000022342FC0000-0x0000022342FE2000-memory.dmp

Filesize
136KB

Download
memory/3712-28-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download
memory/3712-31-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download
memory/3712-27-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download
memory/3712-17-0x00007FFDC04C0000-0x00007FFDC0F81000-memory.dmp

Filesize
10.8MB

Download