b3c83ca8ac0be1a91267ff0c5f12e3db8b08b4fa0c8c44df69a4a358c946bbee

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10-09-2022 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1274bbb200f4c3c673da12d4a48e212.exe
Size

359KB
MD5

f1274bbb200f4c3c673da12d4a48e212
SHA1

8bf18a00ce229a0d9784cc9d70c197696a6537b4
SHA256

b3c83ca8ac0be1a91267ff0c5f12e3db8b08b4fa0c8c44df69a4a358c946bbee
SHA512

a8631b7b2b6a1b90e5e94ad65bf970619549dd61ac66fd327ebf1797239a8d6c1564c061186367a0f2cd7798cdb87964a5e5cc6adc9ca6e49fca3ccbae85a466
SSDEEP

6144:0p+gg5PJgKl4jw8pmRzqPc6M9IsFTCySWpx+HGqRFfHlP5Umvlx4DMla:UigKl9yIzqPc/9IsFeyxxARpHTvA4la

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe
3208	f1274bbb200f4c3c673da12d4a48e212.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\disowns\Vandfogeders\Baldrianoliens.Rec	f1274bbb200f4c3c673da12d4a48e212.exe
File opened for modification	C:\Windows\Fonts\whees\Nationalsocialistiskes\Miraculise.ini	f1274bbb200f4c3c673da12d4a48e212.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3904	powershell.exe
3904	powershell.exe
3452	powershell.exe
3452	powershell.exe
432	powershell.exe
432	powershell.exe
3652	powershell.exe
3652	powershell.exe
4144	powershell.exe
4144	powershell.exe
4972	powershell.exe
4972	powershell.exe
3572	powershell.exe
3572	powershell.exe
5072	powershell.exe
5072	powershell.exe
420	powershell.exe
420	powershell.exe
3192	powershell.exe
3192	powershell.exe
4896	powershell.exe
4896	powershell.exe
2876	powershell.exe
2876	powershell.exe
4128	powershell.exe
4128	powershell.exe
1688	powershell.exe
1688	powershell.exe
5028	powershell.exe
5028	powershell.exe
3412	powershell.exe
3412	powershell.exe
4468	powershell.exe
4468	powershell.exe
3508	powershell.exe
3508	powershell.exe
688	powershell.exe
688	powershell.exe
2412	powershell.exe
2412	powershell.exe
4056	powershell.exe
4056	powershell.exe
4848	powershell.exe
4848	powershell.exe
1880	powershell.exe
1880	powershell.exe
4100	powershell.exe
4100	powershell.exe
5084	powershell.exe
5084	powershell.exe
2348	powershell.exe
2348	powershell.exe
4000	powershell.exe
4000	powershell.exe
5036	powershell.exe
5036	powershell.exe
1100	powershell.exe
1100	powershell.exe
2096	powershell.exe
2096	powershell.exe
1112	powershell.exe
1112	powershell.exe
4152	powershell.exe
4152	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	3572	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	4896	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	3412	powershell.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	1112	powershell.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3536	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	4604	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	2296	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeDebugPrivilege	3876	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3904	3208	f1274bbb200f4c3c673da12d4a48e212.exe	82
PID 3208 wrote to memory of 3904	3208	f1274bbb200f4c3c673da12d4a48e212.exe	82
PID 3208 wrote to memory of 3904	3208	f1274bbb200f4c3c673da12d4a48e212.exe	82
PID 3208 wrote to memory of 3452	3208	f1274bbb200f4c3c673da12d4a48e212.exe	86
PID 3208 wrote to memory of 3452	3208	f1274bbb200f4c3c673da12d4a48e212.exe	86
PID 3208 wrote to memory of 3452	3208	f1274bbb200f4c3c673da12d4a48e212.exe	86
PID 3208 wrote to memory of 432	3208	f1274bbb200f4c3c673da12d4a48e212.exe	88
PID 3208 wrote to memory of 432	3208	f1274bbb200f4c3c673da12d4a48e212.exe	88
PID 3208 wrote to memory of 432	3208	f1274bbb200f4c3c673da12d4a48e212.exe	88
PID 3208 wrote to memory of 3652	3208	f1274bbb200f4c3c673da12d4a48e212.exe	91
PID 3208 wrote to memory of 3652	3208	f1274bbb200f4c3c673da12d4a48e212.exe	91
PID 3208 wrote to memory of 3652	3208	f1274bbb200f4c3c673da12d4a48e212.exe	91
PID 3208 wrote to memory of 4144	3208	f1274bbb200f4c3c673da12d4a48e212.exe	93
PID 3208 wrote to memory of 4144	3208	f1274bbb200f4c3c673da12d4a48e212.exe	93
PID 3208 wrote to memory of 4144	3208	f1274bbb200f4c3c673da12d4a48e212.exe	93
PID 3208 wrote to memory of 4972	3208	f1274bbb200f4c3c673da12d4a48e212.exe	95
PID 3208 wrote to memory of 4972	3208	f1274bbb200f4c3c673da12d4a48e212.exe	95
PID 3208 wrote to memory of 4972	3208	f1274bbb200f4c3c673da12d4a48e212.exe	95
PID 3208 wrote to memory of 3572	3208	f1274bbb200f4c3c673da12d4a48e212.exe	98
PID 3208 wrote to memory of 3572	3208	f1274bbb200f4c3c673da12d4a48e212.exe	98
PID 3208 wrote to memory of 3572	3208	f1274bbb200f4c3c673da12d4a48e212.exe	98
PID 3208 wrote to memory of 5072	3208	f1274bbb200f4c3c673da12d4a48e212.exe	100
PID 3208 wrote to memory of 5072	3208	f1274bbb200f4c3c673da12d4a48e212.exe	100
PID 3208 wrote to memory of 5072	3208	f1274bbb200f4c3c673da12d4a48e212.exe	100
PID 3208 wrote to memory of 420	3208	f1274bbb200f4c3c673da12d4a48e212.exe	102
PID 3208 wrote to memory of 420	3208	f1274bbb200f4c3c673da12d4a48e212.exe	102
PID 3208 wrote to memory of 420	3208	f1274bbb200f4c3c673da12d4a48e212.exe	102
PID 3208 wrote to memory of 3192	3208	f1274bbb200f4c3c673da12d4a48e212.exe	106
PID 3208 wrote to memory of 3192	3208	f1274bbb200f4c3c673da12d4a48e212.exe	106
PID 3208 wrote to memory of 3192	3208	f1274bbb200f4c3c673da12d4a48e212.exe	106
PID 3208 wrote to memory of 4896	3208	f1274bbb200f4c3c673da12d4a48e212.exe	108
PID 3208 wrote to memory of 4896	3208	f1274bbb200f4c3c673da12d4a48e212.exe	108
PID 3208 wrote to memory of 4896	3208	f1274bbb200f4c3c673da12d4a48e212.exe	108
PID 3208 wrote to memory of 2876	3208	f1274bbb200f4c3c673da12d4a48e212.exe	110
PID 3208 wrote to memory of 2876	3208	f1274bbb200f4c3c673da12d4a48e212.exe	110
PID 3208 wrote to memory of 2876	3208	f1274bbb200f4c3c673da12d4a48e212.exe	110
PID 3208 wrote to memory of 4128	3208	f1274bbb200f4c3c673da12d4a48e212.exe	112
PID 3208 wrote to memory of 4128	3208	f1274bbb200f4c3c673da12d4a48e212.exe	112
PID 3208 wrote to memory of 4128	3208	f1274bbb200f4c3c673da12d4a48e212.exe	112
PID 3208 wrote to memory of 1688	3208	f1274bbb200f4c3c673da12d4a48e212.exe	114
PID 3208 wrote to memory of 1688	3208	f1274bbb200f4c3c673da12d4a48e212.exe	114
PID 3208 wrote to memory of 1688	3208	f1274bbb200f4c3c673da12d4a48e212.exe	114
PID 3208 wrote to memory of 5028	3208	f1274bbb200f4c3c673da12d4a48e212.exe	116
PID 3208 wrote to memory of 5028	3208	f1274bbb200f4c3c673da12d4a48e212.exe	116
PID 3208 wrote to memory of 5028	3208	f1274bbb200f4c3c673da12d4a48e212.exe	116
PID 3208 wrote to memory of 3412	3208	f1274bbb200f4c3c673da12d4a48e212.exe	118
PID 3208 wrote to memory of 3412	3208	f1274bbb200f4c3c673da12d4a48e212.exe	118
PID 3208 wrote to memory of 3412	3208	f1274bbb200f4c3c673da12d4a48e212.exe	118
PID 3208 wrote to memory of 4468	3208	f1274bbb200f4c3c673da12d4a48e212.exe	120
PID 3208 wrote to memory of 4468	3208	f1274bbb200f4c3c673da12d4a48e212.exe	120
PID 3208 wrote to memory of 4468	3208	f1274bbb200f4c3c673da12d4a48e212.exe	120
PID 3208 wrote to memory of 3508	3208	f1274bbb200f4c3c673da12d4a48e212.exe	122
PID 3208 wrote to memory of 3508	3208	f1274bbb200f4c3c673da12d4a48e212.exe	122
PID 3208 wrote to memory of 3508	3208	f1274bbb200f4c3c673da12d4a48e212.exe	122
PID 3208 wrote to memory of 688	3208	f1274bbb200f4c3c673da12d4a48e212.exe	124
PID 3208 wrote to memory of 688	3208	f1274bbb200f4c3c673da12d4a48e212.exe	124
PID 3208 wrote to memory of 688	3208	f1274bbb200f4c3c673da12d4a48e212.exe	124
PID 3208 wrote to memory of 2412	3208	f1274bbb200f4c3c673da12d4a48e212.exe	126
PID 3208 wrote to memory of 2412	3208	f1274bbb200f4c3c673da12d4a48e212.exe	126
PID 3208 wrote to memory of 2412	3208	f1274bbb200f4c3c673da12d4a48e212.exe	126
PID 3208 wrote to memory of 4056	3208	f1274bbb200f4c3c673da12d4a48e212.exe	128
PID 3208 wrote to memory of 4056	3208	f1274bbb200f4c3c673da12d4a48e212.exe	128
PID 3208 wrote to memory of 4056	3208	f1274bbb200f4c3c673da12d4a48e212.exe	128
PID 3208 wrote to memory of 4848	3208	f1274bbb200f4c3c673da12d4a48e212.exe	130

C:\Users\Admin\AppData\Local\Temp\f1274bbb200f4c3c673da12d4a48e212.exe
"C:\Users\Admin\AppData\Local\Temp\f1274bbb200f4c3c673da12d4a48e212.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x05 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0B -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3452
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x1C -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x00 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0B -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x02 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7D -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7C -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x74 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x74 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0D -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3C -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2B -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2F -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3A -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2B -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x08 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x22 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2B -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0F -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4056
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x66 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x23 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3C -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7A -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2348
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x36 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x76 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7A -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x36 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x76 -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  PID:1776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:2312
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:3752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:964
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:2096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x67 -bxor 78
  2⤵
  PID:2320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:4112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x60 -bxor 78
  2⤵
  PID:3912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3C -bxor 78
  2⤵
  PID:2600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7B -bxor 78
  2⤵
  PID:2688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3F -bxor 78
  2⤵
  PID:4368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x05 -bxor 78
  2⤵
  PID:744
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0B -bxor 78
  2⤵
  PID:1540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x1C -bxor 78
  2⤵
  PID:1984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x00 -bxor 78
  2⤵
  PID:2476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0B -bxor 78
  2⤵
  PID:1864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x02 -bxor 78
  2⤵
  PID:1476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7D -bxor 78
  2⤵
  PID:5036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7C -bxor 78
  2⤵
  PID:4976
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x74 -bxor 78
  2⤵
  PID:1676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x74 -bxor 78
  2⤵
  PID:4140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x18 -bxor 78
  2⤵
  PID:764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:4060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3C -bxor 78
  2⤵
  PID:420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3A -bxor 78
  2⤵
  PID:2188
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3B -bxor 78
  2⤵
  PID:3472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2F -bxor 78
  2⤵
  PID:1500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x22 -bxor 78
  2⤵
  PID:4848
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0F -bxor 78
  2⤵
  PID:1772
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x22 -bxor 78
  2⤵
  PID:1880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x22 -bxor 78
  2⤵
  PID:4532
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x21 -bxor 78
  2⤵
  PID:3876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2D -bxor 78
  2⤵
  PID:1776
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x66 -bxor 78
  2⤵
  PID:4884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:3216
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:4284
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:2096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  PID:4844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:2088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:3768
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x36 -bxor 78
  2⤵
  PID:212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7F -bxor 78
  2⤵
  PID:3416
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:1524
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:4460
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:1384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:2340
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:3956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  PID:3704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:1676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:2096
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:1536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x36 -bxor 78
  2⤵
  PID:5104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7D -bxor 78
  2⤵
  PID:3516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:4100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:4860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x62 -bxor 78
  2⤵
  PID:612
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:3500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x27 -bxor 78
  2⤵
  PID:4424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x6E -bxor 78
  2⤵
  PID:2816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:2740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x36 -bxor 78
  2⤵
  PID:3844
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7A -bxor 78
  2⤵
  PID:4696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7E -bxor 78
  2⤵
  PID:3496
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x67 -bxor 78
  2⤵
  PID:2208
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3E -bxor 78
  2⤵
  PID:4480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x60 -bxor 78
  2⤵
  PID:1480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3C -bxor 78
  2⤵
  PID:2480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7F -bxor 78
  2⤵
  PID:3564
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3F -bxor 78
  2⤵
  PID:4888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x05 -bxor 78
  2⤵
  PID:904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0B -bxor 78
  2⤵
  PID:3204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x1C -bxor 78
  2⤵
  PID:2256
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x00 -bxor 78
  2⤵
  PID:4528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x0B -bxor 78
  2⤵
  PID:3172
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x02 -bxor 78
  2⤵
  PID:632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7D -bxor 78
  2⤵
  PID:2740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x7C -bxor 78
  2⤵
  PID:3912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x74 -bxor 78
  2⤵
  PID:444
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x74 -bxor 78
  2⤵
  PID:2928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x1D -bxor 78
  2⤵
  PID:4640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x2B -bxor 78
  2⤵
  PID:2876
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe 0x3A -bxor 78
  2⤵
  PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
557f2eea83b6091fff65108f01179042

SHA1
7a00d44391e85ee56618496ee1c07d192ee8072e

SHA256
ebbc54a9dbeff6a7ebff6f88df29f481fdf711f6ab3083753c85fdc4d1e35958

SHA512
ee5cf375451b856d61e497b3f4b6a08c0925cebba1ae86a03032a5140e40cb1786dd340e1bd69c32792fd07c0f274f9b4c74f975b97e8a666e77a0e81a953017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
6a8a2439f371e6827a38ceb7fd155726

SHA1
8619b2210c3e11c738279597f018d4932b6207f3

SHA256
ed1602e55f55cd68feeb1c1f500c0829df1474a20eabe7db095d7c162ce5fe53

SHA512
484e6fea767d6b543ab208f9bf383c150fe98e37729129227cdc5bcc7fe08c110fc13f1fd950c0d3d608f023340d2eb2ba79a282ebe44f25058f5497cf7d6e5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
f70043c4e23561b1d70556b4a1e7bcb4

SHA1
53d34925eca3550b1a4fec11c7e80f68ba6a9f34

SHA256
4047ae84edcb253e2a3395524bbba7d303771a7435d759ca51d9d091cdb2717c

SHA512
c21658a6b372dcd802dd677d21d96b813df9a5158d3fb013e3de25c7bb8cdbc5bf4aa9872fb6119c44223040683f60834ead3f4fb0764d21a56c5d4c3b3158ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
4ff81d485dcfc3ec952fa73d9438df3c

SHA1
d7bc03070d5829b4d4b1747c731808a06801bc09

SHA256
df34ee3a8a5774dd26d701fa0ba9cbf0725701cf93ce2a8a1dc7a674022304ba

SHA512
e556550de737b2e37b0b7eda5332867d0e9460eb0e7a420e6e65f462e76c7830033c914d4f006a0fade935391f1de7e8b720724b513537524b35d2ea5cbfaa30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
79144198777e6e630c636b172aad9be8

SHA1
4a161e375f0b8db173bbcccad9a3a31f53d4ac9c

SHA256
7685e1f497af22f8536d493b5950a047bcd616301adb7b997f7fc7d2f4f0a781

SHA512
1365546e09229691160acdd0f72a6effe40f577ab5a94aa5de1d3e6e7b80166700280807529427102766bacc38a7834f4a964df0ea8b6571029ba56483e9bf74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
15ee6145f9d263ea9dd61fd58bdc6479

SHA1
e23e291df86ba52a680ba51bb7cffef41c9464f3

SHA256
09d955feac6b12f4ae428ae7aaff1a979dd09c20dafd2ea091398f6b0e3d34bf

SHA512
67c7357fa17902f60611e3c551a65226a9a1c9b0c1d19af97482e010011b8cf1829db3d0a9da04361e702a211cacaad160f3d5209c20007fd54d3d0a044e7baa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
5fe1bbfb35bb84e5c0a9dcc5843fda12

SHA1
9c5cf805f6f0386ae66861b88dd76985ed442b34

SHA256
49b9011e1d2e47cb13fb56ecdef4a2bd6c1888eb13218731d09a604a33a7decc

SHA512
5475b6e63ae7876906d2da66391ea406baefbc854bff4e55ab6ff7a55d4fde9d5dc2b7403839fbe9851a52458b144be08dd35e98136149eebb02fa41885d0563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
336e270d2f9df11082881b126fb31cd0

SHA1
2f0a07552241912d3b00ea92c0b8b52dfd91e3ac

SHA256
111e08be70eb595bdb8ee77de4382eba0a1005ab88131642c90e85d7538264f7

SHA512
5c58143af8454bf82b466c6ff9b7ceff749aa82ee2f1cd5e2752e6c64292d5ee32a249340779a25382e1e6a31014920f8a81c25c39dcf5e3af103ff56561e42f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
610b781f9b8b0a27efea420796a02492

SHA1
d78af5f5bfe2b26bcbb7ba041f1d97f1498c6a79

SHA256
91b93486f20148b5594074a33ec5192d3dae015bce43491f7acd64cfe804a91c

SHA512
fea5da96e2fe2a4ecbfa13c2112a2702ee85d0805cedf4e9434538f430133aa6c85d4fa0915460880b81ed5748ccfae75e6538201177930d503b6bfe8afd69ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
032c2fe17fe3b33f162726723ea816c1

SHA1
4bc04dcf697960bea4da2d10d9f98c80a9fa1c02

SHA256
aac4906d6e6ff75e0a602c9a354602a6c9821f3f9e4f69d50a73000b4a53c5ef

SHA512
d621b9de171113f8c26bcd2a1a4f49820364820c010f3e97c954603ed4d7d203ca52e5ce00fa0ceed7f732889cd02ef05f6c97a8c85298b5226d0bcf6ff06b78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
92a05323294cfaefd1a8d7f80abca5eb

SHA1
d4fa1b846a5425b32ea14eca87e3809826c30de4

SHA256
6781c8a27419d30fdcc8b428d00be983cbfff4fa7729413470bf9fd709da8484

SHA512
c6bf1548492b543fb6da2492cf19386d74605db1dfb7f40a201d4aa920f0dbaab0b80ca8302d45d9339daf8989b6d9f7341c8deb134304a72779f539d406c35c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
b31e2c56c08fd2f2aaf1175dd490aaeb

SHA1
ff04c061f2a0f92cb1b8c42c678ad7c451e6f9a2

SHA256
503b165dd17e4966f131fe4bf500e9826e058cc379364d58ee56fcaffc0dfa6d

SHA512
c10436d0434dec48920e4e2020ebe18d9c2d49ade32acdb7e6619380fa6c250ac7816054e59b7b933ade9e78663dffe09c5eccfbdd96b7134176171995e5477a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
7c097c270f4e39435809799657f41503

SHA1
e1ed06bb362fe3539536e669c89d3b493977d397

SHA256
2f75449d9181b511cc9df2d5fb1514bfdb653678aa1ea75e41f7c3a2f6176d2f

SHA512
bd580a22e6f1a4ec9d981e82ff37fdad298a5816153c105d8cdfa27b022f88a87a9d9f33ac808977b22e749a21559288854c23fbd134d9fa6f483fe8a9cfcef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
12264bed97440c9074e5c5ec121260ee

SHA1
fe8ecccf4818ee7903c10074b7adfc356db5fe1d

SHA256
6fff5dac17e28607fc5482b9e89ca8d2545522ca3a8791db15e2e3b04feb3dd3

SHA512
596b1586b2074035f93169381e61e9f9b37f8e5b9b94510006b9392bccf099886c5011c4d6967b76bad351e1a97ed0dcad05f48f95f757856b1598e10d87b0de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
31563489c32d4ba40f9d92376c1e2791

SHA1
52d30cc7215457e1d8ec6e5b5646ac9c35963297

SHA256
0b6df4913dc496933f02af9511f4d8720153389c5201c0613e3e56fb1de84371

SHA512
7c2246a0484e8b1aaa21b07c19bd751443cad3607bfe00511d966fb1e9533c2ea0d951597c99eda543cfdec83ff1e36c698020505272209fa36ba98671037d80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
fe042238df48869a3a795695345d41b0

SHA1
b8c2c5e97c3ad1d47fb138e9b23cd85d994f4f50

SHA256
68c476aab2eeb669423b6bdc27fa48c787e897f2c97b69770320f363f50c446a

SHA512
c23aaf660f0d20bf05e5e45159cc9601d9f108994773c92e9d20f2256ecec258645ca3f8de6016f7fa8a6fb4e5ffb8c445dec006c5be2b4e7d975ef7bb0e38f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
54cbca0a51714bf1757fca4ab83100e3

SHA1
ff7561a7ee8c8eefa90ebdd8e54fd23e9b03111f

SHA256
1afd2a0304f87b5e4fef610023f6b6832195fa27453cb5d075cf262cd03d043d

SHA512
9813e214c5c122517eeaf1e10d4dd8d4b5af57f7c8f2d151f9383ac46e4b06df6fa46cb2e3ad04a8c52d777f5fa1e979fcad475d804ea462d089e854ec976f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
de92e1df893e11c1eafe41ba67931771

SHA1
6a317255c4408e0fd3b6973e0988e0159a65c2fa

SHA256
6da5becced4a6e2da4bec0a1d4b3b107e773bb9f05473fcb2f9a410b4158195c

SHA512
46f0db1214bc90e9097ce00c704eea8af80615aa7af475661aef8fc446624ee0b98c7a09f83883c4651736995c61824bb7345c5bab49430c9bea04e67145a605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
e49a845d17dca444d4cf97d4f568aa7a

SHA1
d04ed533f42b3f9c4337e60f5560456957e72dee

SHA256
4a4212cb6c9df614557ce4473811bf95f00b50b0274c7e7cddbc6ee64474e2c0

SHA512
1aa1061bfcbf2e4faff5a35d634942c1f6918364fbc7924474493e5e685a663d959f8b6eb450f29bc7cfccd22751e4473213fd28af3f00093b58bdc8b053f3e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
75aa20fa9c69fe3aae2c2251ec729b80

SHA1
59879d84f740875498957932ff55f858a62f8fff

SHA256
7d18e49935a04985656821f0bdb672f5d155b1fde92eb6fee37bd38d2b204f66

SHA512
c6f24d96b98e193ac600e81b7150e2abdda8f6955e36e86d8dc930ad3fd79d1321225aa6939cc7d0ae3896d5a2a05daeec2a578a1c9ca580de3e3ad19520ea05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
61042f0fe5fda41fe71948deda67a05a

SHA1
8c8f3418fb3c9b6b588ab1144431ee328574ee0b

SHA256
139dd88299b7c77add730f170a1544c62f5a9545f354fea44d449d8b4a6795e6

SHA512
302b9d9f47f7bba18d5a3d30a40b960863c762d31a7beb4776c909c3cd4dc4ab364634decc5875d6eb7895c0936752abc57ca8b462c88330aab33441820d5b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3ee2034eb3390d44148ac458324d813e

SHA1
c16107d3da72cc7d09413d19e1014adb0d717d55

SHA256
c5a512b3b38c2e0f3bd962b36943d017e4b2710f02f66c61b475b6230ae4cca4

SHA512
e07027a2249a4ee9029095f7e6cda4c57bcf40f9229017c40377a4dc4ba6495dc00a04cc164ef593b2ae07dad7dc5c250a5b1dc44aedcbcf49766d70ee582cce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
be59d36153ebd5872a3554953fb9687c

SHA1
d5f8be2ff9040f8e56423bb7124d9587c4d4fe05

SHA256
04ada355cdf4e3e9bd0430955c4b635182e792dbd778f61715f6ae279d884234

SHA512
50b1fe6698052ec2442060bc2489ee8691050a34220f8d34c1334d9fd64777fbe4fd213cda8ec8e231ccdc5f541f29e88c9f4c5aad255faa91b1159445abeab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
e4c4ac0b7044628e979b779d372120c9

SHA1
2187dc17b2252963eb63ff2178e3ad2ac399e791

SHA256
dc402a31ba415aaf1adda06e37c699aa465d1cff57f7c6e92f0a8eca4fff0862

SHA512
4a1a98f2ccc21da37565a2d1f5c07be72641da30d24a86982243ec04348a79b837791b51927dd0ce1320d0f40826280286bbe31a32518b14a8774b2122b58889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
e601d2bf2416592b6c2fd6636e7a7b7e

SHA1
1cbebfaa2e8b8a98a0675f72e185d154750557d1

SHA256
682396aed1e1bc8bd7f79e59a28dd622accf9eff1b7a96d3dfb46fcb844f8cd9

SHA512
63bdd7e6e761f9c673bf83ba339e0e0f698ca02ac129c8c80af391873be08756606c35decb42032017f21519a2edb74dea708e86cf1ceac038c496faea45930b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
e28c372864d077cce3a2a7f1323de934

SHA1
c38653645f1b88bcc36281c60402ac8728dbef3f

SHA256
984f865eb2752e41ce85297d281a8844e8f284d72dcd75c72df0837295bb255d

SHA512
6ff682d1cb17bbfca7fd4149ae721ea6697f2a506814062837fe35f5af6721c1a0fda64f9b8cf84fa878ac887cdaac613b25acefb7629d5f6714e1f799056171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
763ece609e78f1a7b22dde559c2a0851

SHA1
97d0de921f315a9104f76159c08913d29ef09293

SHA256
d9b61296eb64b0f3350a3d6bce7c88878983a41f572fa7d5ba8cc2dd0eaea20e

SHA512
33cf95b05b60b98c494e21526f9290a7ca0634500a1f85ae88cd7c5ec8cc5bf2cf2a75aaac4578bcefdfaffa6765496e0f565093944632721b149f8a7131e548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
847c805dbfc85e79853caef5c33e4155

SHA1
38c28f190f45dbeae97c36323fb6adc1ace90790

SHA256
bff92c5013bdef8441adc6f869574356b4c2bed45f0d3ce28c5c7a9092a790b0

SHA512
7a92d785867dee296665e8d76a0a54570ca3f4fc904bef71e349f6087289ea633743bc8d2a5eb9ad7386eef361381170b65f5a4e16bc1b5266b483f9566eb0de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
9c3db91ab6d80c6e16d0662a7595c494

SHA1
bdfd819bceb2f2e9c8ba49a95844ae3955df10ae

SHA256
4c343c237dbf9112bff88831bae97fa687e66addb630cb240a0019729a73980d

SHA512
2bae33629062f9d87af91796a0d186534ef46c40a1fc70ab9bab4718f1aa797e8e987e1be4aae93d8c7115faf7c12270af3ffca8222c8af4e375fa86263acaaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
358529bb3e89707b2eb1a34639a2603e

SHA1
bffd629ec8ee47b7bc13cac5f6e76b7593e279a1

SHA256
c521d219bac3ea01e5d3aaba8910205d24612e4b98598a1fc38d969696b01748

SHA512
eb8d45a12819666d15afd7354281804bedf5d22b1b6a6a94096ac93559d5ccba113c7af71e8b1c75d9f6fc96ed222b99861cb157316caf0df7aee06ca0348dc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
c3cac1362c50525c2edce7079b76fee2

SHA1
fdbd58d8167896f1d5cbd028e26648748a9d279d

SHA256
3bca1ac58ece1ca183546d87369739f4408f9146e733a91d5b13e3c3a1430b1d

SHA512
5528f8f82494033a64f5c847ee5207ced530fca97a2d5ecb8ead97073aad88c4407b420944af23a9be87313453e334155f4d21aa06c6a6a37882b86f88cff235

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsr67BA.tmp\nsExec.dll

Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
memory/420-163-0x0000000000000000-mapping.dmp

Download
memory/432-145-0x0000000000000000-mapping.dmp

Download
memory/688-193-0x0000000000000000-mapping.dmp

Download
memory/816-257-0x0000000000000000-mapping.dmp

Download
memory/1100-223-0x0000000000000000-mapping.dmp

Download
memory/1100-243-0x0000000000000000-mapping.dmp

Download
memory/1112-229-0x0000000000000000-mapping.dmp

Download
memory/1204-255-0x0000000000000000-mapping.dmp

Download
memory/1488-260-0x0000000000000000-mapping.dmp

Download
memory/1536-258-0x0000000000000000-mapping.dmp

Download
memory/1540-249-0x0000000000000000-mapping.dmp

Download
memory/1596-234-0x0000000000000000-mapping.dmp

Download
memory/1688-178-0x0000000000000000-mapping.dmp

Download
memory/1720-253-0x0000000000000000-mapping.dmp

Download
memory/1880-205-0x0000000000000000-mapping.dmp

Download
memory/1896-261-0x0000000000000000-mapping.dmp

Download
memory/2044-252-0x0000000000000000-mapping.dmp

Download
memory/2096-226-0x0000000000000000-mapping.dmp

Download
memory/2296-256-0x0000000000000000-mapping.dmp

Download
memory/2312-240-0x0000000000000000-mapping.dmp

Download
memory/2316-245-0x0000000000000000-mapping.dmp

Download
memory/2348-214-0x0000000000000000-mapping.dmp

Download
memory/2412-196-0x0000000000000000-mapping.dmp

Download
memory/2736-235-0x0000000000000000-mapping.dmp

Download
memory/2876-172-0x0000000000000000-mapping.dmp

Download
memory/2944-263-0x0000000000000000-mapping.dmp

Download
memory/3192-166-0x0000000000000000-mapping.dmp

Download
memory/3232-262-0x0000000000000000-mapping.dmp

Download
memory/3412-184-0x0000000000000000-mapping.dmp

Download
memory/3452-141-0x0000000000000000-mapping.dmp

Download
memory/3508-190-0x0000000000000000-mapping.dmp

Download
memory/3524-264-0x0000000000000000-mapping.dmp

Download
memory/3536-238-0x0000000000000000-mapping.dmp

Download
memory/3572-157-0x0000000000000000-mapping.dmp

Download
memory/3652-148-0x0000000000000000-mapping.dmp

Download
memory/3664-246-0x0000000000000000-mapping.dmp

Download
memory/3704-242-0x0000000000000000-mapping.dmp

Download
memory/3876-265-0x0000000000000000-mapping.dmp

Download
memory/3892-239-0x0000000000000000-mapping.dmp

Download
memory/3904-135-0x0000000004CD0000-0x00000000052F8000-memory.dmp

Filesize
6.2MB

Download
memory/3904-133-0x0000000000000000-mapping.dmp

Download
memory/3904-134-0x00000000022C0000-0x00000000022F6000-memory.dmp

Filesize
216KB

Download
memory/3904-139-0x0000000005BD0000-0x0000000005BEE000-memory.dmp

Filesize
120KB

Download
memory/3904-137-0x00000000054C0000-0x0000000005526000-memory.dmp

Filesize
408KB

Download
memory/3904-138-0x00000000055A0000-0x0000000005606000-memory.dmp

Filesize
408KB

Download
memory/3904-136-0x0000000004C10000-0x0000000004C32000-memory.dmp

Filesize
136KB

Download
memory/3928-237-0x0000000000000000-mapping.dmp

Download
memory/3964-250-0x0000000000000000-mapping.dmp

Download
memory/4000-217-0x0000000000000000-mapping.dmp

Download
memory/4056-199-0x0000000000000000-mapping.dmp

Download
memory/4100-208-0x0000000000000000-mapping.dmp

Download
memory/4128-175-0x0000000000000000-mapping.dmp

Download
memory/4132-254-0x0000000000000000-mapping.dmp

Download
memory/4144-151-0x0000000000000000-mapping.dmp

Download
memory/4152-232-0x0000000000000000-mapping.dmp

Download
memory/4224-241-0x0000000000000000-mapping.dmp

Download
memory/4468-187-0x0000000000000000-mapping.dmp

Download
memory/4528-244-0x0000000000000000-mapping.dmp

Download
memory/4604-251-0x0000000000000000-mapping.dmp

Download
memory/4776-247-0x0000000000000000-mapping.dmp

Download
memory/4848-202-0x0000000000000000-mapping.dmp

Download
memory/4860-236-0x0000000000000000-mapping.dmp

Download
memory/4880-248-0x0000000000000000-mapping.dmp

Download
memory/4896-169-0x0000000000000000-mapping.dmp

Download
memory/4972-154-0x0000000000000000-mapping.dmp

Download
memory/5012-259-0x0000000000000000-mapping.dmp

Download
memory/5028-181-0x0000000000000000-mapping.dmp

Download
memory/5036-220-0x0000000000000000-mapping.dmp

Download
memory/5072-160-0x0000000000000000-mapping.dmp

Download
memory/5084-211-0x0000000000000000-mapping.dmp

Download