dcrat | bfe4b2b5b1b9c2e8253848be27b277f1daf99314ff0ac964dc595bdef841a6c3

Analysis

max time kernel
30s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2023 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ou6mS40OHrkbwQiM7ccaR.exe
Size

2.4MB
MD5

4ceeb0d068653ada01e702ba61dfdb7f
SHA1

0e09a416c381e657f39af975f259d09da0324300
SHA256

bfe4b2b5b1b9c2e8253848be27b277f1daf99314ff0ac964dc595bdef841a6c3
SHA512

798904e3ef1ef5f898185577c2dc15dd8872f4e70f638f8f94f90846ac11eecbad72d843406512863d58a882df8ad40c02ad2d9daa6289f3c46fff724f5f1b73
SSDEEP

24576:1RNpngHRc5DYZYLUsZ9p48N41XMFBDeQzC/tqELdO0U7TBd1X/SQOvjASm:PPDvx94V0eQuPdmJdV/J

Score

10^/10

dcrat evasion infostealer rat trojan

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	756	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1732	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	884	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1164	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1968	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3444	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4408	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4880	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3692	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3660	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1168	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	800	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3336	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	204	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5076	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3344	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5068	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4104	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4836	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3384	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5088	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1580	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4220	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4012	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	928	4116	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	4116	schtasks.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Ou6mS40OHrkbwQiM7ccaR.exe

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
behavioral2/memory/3152-132-0x0000000000820000-0x0000000000A8A000-memory.dmp	dcrat

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ou6mS40OHrkbwQiM7ccaR.exe

Drops file in Program Files directory 32 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Defender\es-ES\spoolsv.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\System.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Windows Defender\es-ES\f3b6ecef712a24	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\System.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\RCX8344.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\7a0fd90576e088	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6cb0b6c459d5d3	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\RCX7620.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\explorer.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\RCX8084.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\7-Zip\Lang\0a1fd5f707cd16	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\27d1bcfc3c54e0	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\9e8d7a4ca61bd9	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\explorer.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sppsvc.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Windows Defender\es-ES\spoolsv.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RCX78B1.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\RCX8D99.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\5b884080fd4f94	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5b884080fd4f94	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft\RCX7DF3.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\RCX956C.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\7-Zip\Lang\sppsvc.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\RCX8B08.tmp	Ou6mS40OHrkbwQiM7ccaR.exe

Drops file in Windows directory 8 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
File created	C:\Windows\twain_32\cbc753843df817	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Windows\tracing\sihost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Windows\tracing\66fc9ff0ee96c2	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Windows\twain_32\RCX85D6.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Windows\twain_32\Ou6mS40OHrkbwQiM7ccaR.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Windows\tracing\RCX92BB.tmp	Ou6mS40OHrkbwQiM7ccaR.exe
File opened for modification	C:\Windows\tracing\sihost.exe	Ou6mS40OHrkbwQiM7ccaR.exe
File created	C:\Windows\twain_32\Ou6mS40OHrkbwQiM7ccaR.exe	Ou6mS40OHrkbwQiM7ccaR.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4436 3152 WerFault.exe Ou6mS40OHrkbwQiM7ccaR.exe

pid	pid_target	process	target process
4436	3152	WerFault.exe	Ou6mS40OHrkbwQiM7ccaR.exe

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4408	schtasks.exe
4880	schtasks.exe
3344	schtasks.exe
3964	schtasks.exe
4220	schtasks.exe
1732	schtasks.exe
1164	schtasks.exe
204	schtasks.exe
824	schtasks.exe
2604	schtasks.exe
4104	schtasks.exe
756	schtasks.exe
884	schtasks.exe
800	schtasks.exe
1964	schtasks.exe
1580	schtasks.exe
928	schtasks.exe
1956	schtasks.exe
3660	schtasks.exe
3336	schtasks.exe
4332	schtasks.exe
3196	schtasks.exe
5088	schtasks.exe
4012	schtasks.exe
4432	schtasks.exe
3692	schtasks.exe
3384	schtasks.exe
3636	schtasks.exe
4080	schtasks.exe
1968	schtasks.exe
5068	schtasks.exe
1168	schtasks.exe
4836	schtasks.exe
5076	schtasks.exe
2176	schtasks.exe
2140	schtasks.exe
3040	schtasks.exe
3444	schtasks.exe
2032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

pid	process
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe
3152	Ou6mS40OHrkbwQiM7ccaR.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3152	Ou6mS40OHrkbwQiM7ccaR.exe
Token: SeDebugPrivilege	3876	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	4460	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	5032	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	600	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	pid	process	target process
PID 3152 wrote to memory of 1284	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 1284	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 3876	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 3876	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 2220	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 2220	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 5008	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 5008	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 3216	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 3216	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 4460	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 4460	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 4960	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 4960	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 5032	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 5032	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 3704	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 3704	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 4628	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 4628	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 600	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 600	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 1612	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 1612	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 2836	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 2836	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 2032	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe
PID 3152 wrote to memory of 2032	3152	Ou6mS40OHrkbwQiM7ccaR.exe	powershell.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Ou6mS40OHrkbwQiM7ccaR.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Ou6mS40OHrkbwQiM7ccaR.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	Ou6mS40OHrkbwQiM7ccaR.exe

C:\Users\Admin\AppData\Local\Temp\Ou6mS40OHrkbwQiM7ccaR.exe
"C:\Users\Admin\AppData\Local\Temp\Ou6mS40OHrkbwQiM7ccaR.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Ou6mS40OHrkbwQiM7ccaR.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\Lang\sppsvc.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3876

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\RuntimeBroker.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\System.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\Ou6mS40OHrkbwQiM7ccaR.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\explorer.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3152 -s 1476
2⤵
- Program crash
PID:4436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\explorer.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\tracing\sihost.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:756

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Program Files\7-Zip\Lang\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1164

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\odt\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\odt\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3336

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Photo Viewer\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:204

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ou6mS40OHrkbwQiM7ccaRO" /sc MINUTE /mo 13 /tr "'C:\Windows\twain_32\Ou6mS40OHrkbwQiM7ccaR.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ou6mS40OHrkbwQiM7ccaR" /sc ONLOGON /tr "'C:\Windows\twain_32\Ou6mS40OHrkbwQiM7ccaR.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Ou6mS40OHrkbwQiM7ccaRO" /sc MINUTE /mo 6 /tr "'C:\Windows\twain_32\Ou6mS40OHrkbwQiM7ccaR.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1580

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Windows\tracing\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\tracing\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Windows\tracing\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:928

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\es-ES\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4080

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 3152 -ip 3152
1⤵
PID:4736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
61e06aa7c42c7b2a752516bcbb242cc1

SHA1
02c54f8b171ef48cad21819c20b360448418a068

SHA256
5bb0254e8f0220caab64dcc785f432820350471bfcdcb98240c3e0e71a709f5d

SHA512
03731f49999ec895370100a4dfeee674bbe5baa50d82007256e6914c323412eef8936b320d2738774758fbbfd76d4c3d391d9e144e65587eba700d98d0362346

Download Submit
memory/600-168-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/600-188-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/600-152-0x0000000000000000-mapping.dmp

Download
memory/1284-155-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/1284-195-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/1284-141-0x0000000000000000-mapping.dmp

Download
memory/1612-153-0x0000000000000000-mapping.dmp

Download
memory/1612-169-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/1612-189-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2032-158-0x0000000000000000-mapping.dmp

Download
memory/2032-171-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2032-199-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2220-159-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2220-193-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2220-143-0x0000000000000000-mapping.dmp

Download
memory/2836-187-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2836-170-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/2836-157-0x0000000000000000-mapping.dmp

Download
memory/3152-160-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3152-134-0x000000001B690000-0x000000001B6E0000-memory.dmp

Filesize
320KB

Download
memory/3152-138-0x000000001CCD4000-0x000000001CCD7000-memory.dmp

Filesize
12KB

Download
memory/3152-135-0x000000001D400000-0x000000001D928000-memory.dmp

Filesize
5.2MB

Download
memory/3152-145-0x000000001B6E9000-0x000000001B6EF000-memory.dmp

Filesize
24KB

Download
memory/3152-132-0x0000000000820000-0x0000000000A8A000-memory.dmp

Filesize
2.4MB

Download
memory/3152-137-0x000000001CCD0000-0x000000001CCD4000-memory.dmp

Filesize
16KB

Download
memory/3152-136-0x000000001B6E9000-0x000000001B6EF000-memory.dmp

Filesize
24KB

Download
memory/3152-139-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3152-133-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3152-140-0x000000001CCD7000-0x000000001CCDA000-memory.dmp

Filesize
12KB

Download
memory/3216-146-0x0000000000000000-mapping.dmp

Download
memory/3216-163-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3216-191-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3704-198-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3704-167-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3704-150-0x0000000000000000-mapping.dmp

Download
memory/3876-142-0x0000000000000000-mapping.dmp

Download
memory/3876-154-0x000001921F450000-0x000001921F472000-memory.dmp

Filesize
136KB

Download
memory/3876-196-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/3876-156-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/4460-147-0x0000000000000000-mapping.dmp

Download
memory/4460-162-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/4460-192-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/4628-151-0x0000000000000000-mapping.dmp

Download
memory/4628-166-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/4628-197-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/4960-164-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/4960-148-0x0000000000000000-mapping.dmp

Download
memory/4960-194-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/5008-144-0x0000000000000000-mapping.dmp

Download
memory/5008-161-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/5008-172-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/5032-149-0x0000000000000000-mapping.dmp

Download
memory/5032-190-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download
memory/5032-165-0x00007FF9D4C80000-0x00007FF9D5741000-memory.dmp

Filesize
10.8MB

Download