64f1ea7bf1b94f612d72ab74b36c11108b4b798adba3f2db79f4d5923e6d580a

Analysis

max time kernel
79s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
11/02/2024, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Patch.exe
Size

1.2MB
MD5

bf5604a2957baa158daddaea930fb027
SHA1

b03cefe194e509bc15e63ae853ff2b1d5f2c6a52
SHA256

64f1ea7bf1b94f612d72ab74b36c11108b4b798adba3f2db79f4d5923e6d580a
SHA512

c634b4bbe7442ce5ab13e303f582ad4bacdc008e19a067f5a69e0add0c298bf33b1810251a8300ae1b0c0c8da18b1533aacbcdcecd32954e6cf67ab3fe7f2bc8
SSDEEP

24576:VrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvazHeqtGfUYh:V2EYTb8atv1orq+pEiSDTj1VyvBazHe/

Score

8^/10

evasion

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

flow	pid	Process
26	2128	PowerShell.exe
27	2128	PowerShell.exe
28	2128	PowerShell.exe
29	2128	PowerShell.exe
30	2128	PowerShell.exe
31	2128	PowerShell.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
764	netsh.exe
3548	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2016	RunAsTI.exe
2608	RunAsTI.exe

Unexpected DNS network traffic destination 16 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135
Destination IP	205.251.196.135

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Patch.exe
File opened (read-only)	\??\F:	Patch.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps	Patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Patch.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\0 = 14001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000008c003100000000009757ed03110050524f4752417e310000740009000400efbe874fdb494b589cb22e0000003f0000000000010000000000000000004a000000000036cc2400500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018005000310000000000965798be1000372d5a6970003c0009000400efbe965798be965798be2e0000004727020000001c000000000000000000000000000000aa4e400037002d005a0069007000000014000000	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	PowerShell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PowerShell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\0 = 500061007400630068002e006500780065000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005d01000000000000dd030000e0010000000000000000000000000000000000000100000000000000	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	Patch.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\MRUListEx = 00000000ffffffff	Patch.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\MRUListEx = 00000000ffffffff	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU	Patch.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\MRUListEx = 00000000ffffffff	Patch.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	PowerShell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	Patch.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Patch.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2016	RunAsTI.exe
2016	RunAsTI.exe
2608	RunAsTI.exe
2608	RunAsTI.exe
3624	PowerShell.exe
3624	PowerShell.exe
5116	Patch.exe
5116	Patch.exe
2128	PowerShell.exe
2128	PowerShell.exe
5116	Patch.exe
5116	Patch.exe
5116	Patch.exe
5116	Patch.exe
5116	Patch.exe
5116	Patch.exe
640	PowerShell.exe
640	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4136	Patch.exe
5116	Patch.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	RunAsTI.exe
Token: SeAssignPrimaryTokenPrivilege	2016	RunAsTI.exe
Token: SeIncreaseQuotaPrivilege	2016	RunAsTI.exe
Token: SeDebugPrivilege	2608	RunAsTI.exe
Token: SeAssignPrimaryTokenPrivilege	2608	RunAsTI.exe
Token: SeIncreaseQuotaPrivilege	2608	RunAsTI.exe
Token: SeDebugPrivilege	3624	PowerShell.exe
Token: SeAssignPrimaryTokenPrivilege	3624	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	3624	PowerShell.exe
Token: SeSecurityPrivilege	3624	PowerShell.exe
Token: SeTakeOwnershipPrivilege	3624	PowerShell.exe
Token: SeLoadDriverPrivilege	3624	PowerShell.exe
Token: SeSystemtimePrivilege	3624	PowerShell.exe
Token: SeBackupPrivilege	3624	PowerShell.exe
Token: SeRestorePrivilege	3624	PowerShell.exe
Token: SeShutdownPrivilege	3624	PowerShell.exe
Token: SeSystemEnvironmentPrivilege	3624	PowerShell.exe
Token: SeUndockPrivilege	3624	PowerShell.exe
Token: SeManageVolumePrivilege	3624	PowerShell.exe
Token: SeDebugPrivilege	2128	PowerShell.exe
Token: SeDebugPrivilege	640	PowerShell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5116	Patch.exe
5116	Patch.exe
5116	Patch.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 2016	4136	Patch.exe	92
PID 4136 wrote to memory of 2016	4136	Patch.exe	92
PID 5116 wrote to memory of 3624	5116	Patch.exe	96
PID 5116 wrote to memory of 3624	5116	Patch.exe	96
PID 5116 wrote to memory of 2128	5116	Patch.exe	98
PID 5116 wrote to memory of 2128	5116	Patch.exe	98
PID 5116 wrote to memory of 764	5116	Patch.exe	101
PID 5116 wrote to memory of 764	5116	Patch.exe	101
PID 5116 wrote to memory of 3548	5116	Patch.exe	102
PID 5116 wrote to memory of 3548	5116	Patch.exe	102
PID 5116 wrote to memory of 640	5116	Patch.exe	105
PID 5116 wrote to memory of 640	5116	Patch.exe	105

C:\Users\Admin\AppData\Local\Temp\Patch.exe
"C:\Users\Admin\AppData\Local\Temp\Patch.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\Temp\RunAsTI.exe
  C:\Windows\Temp\RunAsTI.exe "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- - C:\Windows\Temp\RunAsTI.exe
    /t /t C:\Users\Admin\AppData\Local\Temp\Patch.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\Patch.exe
      "C:\Users\Admin\AppData\Local\Temp\Patch.exe"
      4⤵
      Enumerates connected drives
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell Set-ExecutionPolicy Bypass -scope Process -Force;(Get-NetRoute | Where-Object DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where-Object ConnectionState -eq 'Connected') -ne $null
        5⤵
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3624
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell Set-ExecutionPolicy Bypass -scope Process -Force;$ips=@();$soa=(Resolve-DnsName -Name adobe.io -Type SOA).PrimaryServer;Do{$ip=(Resolve-DnsName -Name adobe.io -Server $soa).IPAddress;$ips+=$ip;$ips=$ips|Select -Unique|Sort-Object}While($ips.Count -lt 8);$list=$ips -join ',';$list
        5⤵
        Blocklisted process makes network request
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2128
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall delete rule name="Adobe Unlicensed Pop-up"
        5⤵
        Modifies Windows Firewall
        
        PID:764
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Adobe Unlicensed Pop-up" dir=out action=block remoteip="107.22.247.231,18.207.85.246,23.22.254.206,34.193.227.236,52.202.204.11,52.5.13.197,54.144.73.197,54.227.187.23"
        5⤵
        Modifies Windows Firewall
        
        PID:3548
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell Set-ExecutionPolicy Bypass -scope Process -Force;(Get-NetRoute | Where-Object DestinationPrefix -eq '0.0.0.0/0' | Get-NetIPInterface | Where-Object ConnectionState -eq 'Connected') -ne $null
        5⤵
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:640
    - - C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
        
        PowerShell Set-ExecutionPolicy Bypass -scope Process -Force;$ips=@();$soa=(Resolve-DnsName -Name adobe.io -Type SOA).PrimaryServer;Do{$ip=(Resolve-DnsName -Name adobe.io -Server $soa).IPAddress;$ips+=$ip;$ips=$ips|Select -Unique|Sort-Object}While($ips.Count -lt 8);$list=$ips -join ',';$list
        5⤵
        
        PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\config.ini

Filesize
4KB

MD5
d6d17e00792f0b8a921a90da98368f2c

SHA1
98742206a597a6d1ebddff01e078c90148fcfe31

SHA256
fee63317eb729b3037ab4f18d4cc57d2ad39413585a8d48c9da922e4f2db1ab2

SHA512
db9ec02502590b7ab46b2eba16593e328c587d2300098356e65ef721483c415971e6bfc9f143c009a881790556923652892b185d4fcf242e4ae84c9e23a7d3dc

Download Submit
C:\Users\Default\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b8103610082fe82a9ed52aad96797352

SHA1
22b036145f7d1604a5645eb9dc5d9cf796fc1c4f

SHA256
31c9133b94257a5be0e886f4ded6b5432415af3ca1fd01580015c3d6630f96b3

SHA512
fcf35a15c38dc61f55e3864d7a7bff62211a4992a6e8fa922d646a46f5c43ee693098efe76ae789209c68dd4747c20c211c8a7c16d23f4563fedfb7e927583a5

Download Submit
C:\Users\Default\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d31f41c0b780aa9574968f1a7a9dd6dc

SHA1
ed8788e11edd29e1ee547d37865cf453c0eb9d3b

SHA256
832c68a191b3224d27f4ab368fc62f3e97c52446b560abd641774a31f0788dfb

SHA512
5bdcef73ba6a5697362d715082edccff9f4017811adf04e20c078f2843c2ebfe9b4974065a14208078119b6f679ac1c810e3d649703106b28d320aeac469b9ba

Download Submit
C:\Users\Default\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a5380f82dd29b7bd4ffbf9a5d6c6a710

SHA1
414a234baa9490ad34480d777a826880763366b2

SHA256
05493445f44db360c87d7b9be5f8535e6e61b68843524a63d42cecd72265d1e6

SHA512
3d7e6a084186e72994d7ea81b3e6b33bd29066d9aa392db2bfe40176a174777af9f2cd37e904b2131200c9515233bfdd0424bbea2fe05ed8f0ae247004f2a746

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
5KB

MD5
33c8d3e3fbe5bb8c78c99b02d7329672

SHA1
ce3b9a79792b05c78a703c5bd53988ea800b0836

SHA256
ad00598abd97db3f2865642d040f968ca462f03f24039a3b591b1fec6457d177

SHA512
09460b48d11fac808c6e504a5e7f88713fbd23a7e3f53ce9fa5e8fd04274697832cbb82c49acf8f8e949217c552170dadb5bb6ad6a0ab6539278efcafdc9006e

Download Submit
C:\Windows\Temp\RunAsTI.exe

Filesize
26KB

MD5
80454e70784f1ddb0c91d41469e2498d

SHA1
2f3f04ef670895de12cdfbae17c9d427e7caa97a

SHA256
a3e0ba70ba908de8a75825c3a1ff36147e02c686280993c2caa8a9a6968764b0

SHA512
709ed0fc9e2520a5beb57379e90be12cac680060b4c72ff50e9d9897f3a4d7a57f84b9be04b78974e6f6b73cda7202bfc617835cee3011eed7f0ee6f5e82edf7

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_ehmr2qqs.kz4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/640-125-0x00007FF4AD000000-0x00007FF4AD010000-memory.dmp

Filesize
64KB

Download
memory/640-124-0x000001359ADC0000-0x000001359AE75000-memory.dmp

Filesize
724KB

Download
memory/640-104-0x000001359A030000-0x000001359A040000-memory.dmp

Filesize
64KB

Download
memory/640-103-0x00007FFDF6910000-0x00007FFDF73D1000-memory.dmp

Filesize
10.8MB

Download
memory/640-126-0x000001359A030000-0x000001359A040000-memory.dmp

Filesize
64KB

Download
memory/640-128-0x00007FFDF6910000-0x00007FFDF73D1000-memory.dmp

Filesize
10.8MB

Download
memory/2128-71-0x0000015950240000-0x0000015950250000-memory.dmp

Filesize
64KB

Download
memory/2128-72-0x0000015950490000-0x00000159504AA000-memory.dmp

Filesize
104KB

Download
memory/2128-50-0x000001594F520000-0x000001594F530000-memory.dmp

Filesize
64KB

Download
memory/2128-49-0x00007FFDF7250000-0x00007FFDF7D11000-memory.dmp

Filesize
10.8MB

Download
memory/2128-70-0x000001594F520000-0x000001594F530000-memory.dmp

Filesize
64KB

Download
memory/2128-74-0x00007FFDF7250000-0x00007FFDF7D11000-memory.dmp

Filesize
10.8MB

Download
memory/3624-42-0x00007FF4486A0000-0x00007FF4486B0000-memory.dmp

Filesize
64KB

Download
memory/3624-29-0x00000262D6EA0000-0x00000262D6EB0000-memory.dmp

Filesize
64KB

Download
memory/3624-45-0x00000262D6E70000-0x00000262D6E7A000-memory.dmp

Filesize
40KB

Download
memory/3624-43-0x00000262D6EA0000-0x00000262D6EB0000-memory.dmp

Filesize
64KB

Download
memory/3624-44-0x00000262EFDD0000-0x00000262EFE85000-memory.dmp

Filesize
724KB

Download
memory/3624-48-0x00007FFDF7250000-0x00007FFDF7D11000-memory.dmp

Filesize
10.8MB

Download
memory/3624-41-0x00000262D6E80000-0x00000262D6E9C000-memory.dmp

Filesize
112KB

Download
memory/3624-31-0x00000262D6D50000-0x00000262D6D72000-memory.dmp

Filesize
136KB

Download
memory/3624-30-0x00000262D6EA0000-0x00000262D6EB0000-memory.dmp

Filesize
64KB

Download
memory/3624-46-0x00000262D6ED0000-0x00000262D6EEC000-memory.dmp

Filesize
112KB

Download
memory/3624-28-0x00007FFDF7250000-0x00007FFDF7D11000-memory.dmp

Filesize
10.8MB

Download
memory/4136-130-0x000001F8D3D60000-0x000001F8D3D70000-memory.dmp

Filesize
64KB

Download
memory/4136-129-0x00007FFDF6910000-0x00007FFDF73D1000-memory.dmp

Filesize
10.8MB

Download
memory/4136-152-0x000001F8D3D60000-0x000001F8D3D70000-memory.dmp

Filesize
64KB

Download
memory/4136-151-0x000001F8ED0A0000-0x000001F8ED155000-memory.dmp

Filesize
724KB

Download
memory/4136-150-0x00007FF4ABBD0000-0x00007FF4ABBE0000-memory.dmp

Filesize
64KB

Download
memory/4136-154-0x00007FFDF6910000-0x00007FFDF73D1000-memory.dmp

Filesize
10.8MB

Download