bitrat | 95211867154e018e2ab4ca9cb0b4fdf18c2ba79a312ccb01eba95b2eb899d0bd

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 14:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a97286be2249f7896f0a5c171deb80d0.exe
Size

2.5MB
MD5

a97286be2249f7896f0a5c171deb80d0
SHA1

f10351ff6bc3fbababea9bdf13be7e7e4a7d04e5
SHA256

95211867154e018e2ab4ca9cb0b4fdf18c2ba79a312ccb01eba95b2eb899d0bd
SHA512

bbdce4fe5ef2dcebc15ce92d174cb776de79404c70ab660c4bc5e9546004719c0e180dd185bec1dffc57a0d1be3ba76775b967a0c95f87bb1337a9c4ba110984
SSDEEP

49152:KDVzY8tMlX0pXGRMuK3JaEzXW+DHFgmDY8HrsjhqWl:PKGX0ARVK3J5zG+DH2IYysjhRl

Score

10^/10

bitrat zgrat persistence rat trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

179.43.141.103:1234

Attributes

communication_password
dc647eb65e6711e155375218212b3964
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2900-165-0x0000000000B90000-0x0000000000BF8000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-166-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-167-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-169-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-171-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-173-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-175-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-177-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-179-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-181-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-183-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-185-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-187-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-189-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-191-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-193-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-195-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-197-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-199-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-201-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-203-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-205-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-207-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-209-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-211-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-213-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-215-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-217-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-219-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-221-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-223-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-225-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-227-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1
behavioral2/memory/2900-229-0x0000000000B90000-0x0000000000BF3000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

a97286be2249f7896f0a5c171deb80d0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	a97286be2249f7896f0a5c171deb80d0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a97286be2249f7896f0a5c171deb80d0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nvidia Share = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Nvidia\\Nvidia Share.exe\""	a97286be2249f7896f0a5c171deb80d0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

a97286be2249f7896f0a5c171deb80d0.exe

pid	process
5016	a97286be2249f7896f0a5c171deb80d0.exe
5016	a97286be2249f7896f0a5c171deb80d0.exe
5016	a97286be2249f7896f0a5c171deb80d0.exe
5016	a97286be2249f7896f0a5c171deb80d0.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

a97286be2249f7896f0a5c171deb80d0.exe

description pid process target process

PID 2900 set thread context of 5016 2900 a97286be2249f7896f0a5c171deb80d0.exe a97286be2249f7896f0a5c171deb80d0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2900 set thread context of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exea97286be2249f7896f0a5c171deb80d0.exe

pid	process
2780	powershell.exe
2780	powershell.exe
2780	powershell.exe
4864	powershell.exe
4864	powershell.exe
4864	powershell.exe
4604	powershell.exe
4604	powershell.exe
4604	powershell.exe
3492	powershell.exe
3492	powershell.exe
3492	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe
696	powershell.exe
696	powershell.exe
696	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe
3212	powershell.exe
3212	powershell.exe
2436	powershell.exe
2436	powershell.exe
2900	a97286be2249f7896f0a5c171deb80d0.exe
2900	a97286be2249f7896f0a5c171deb80d0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2780	powershell.exe
Token: SeSecurityPrivilege	2780	powershell.exe
Token: SeTakeOwnershipPrivilege	2780	powershell.exe
Token: SeLoadDriverPrivilege	2780	powershell.exe
Token: SeSystemProfilePrivilege	2780	powershell.exe
Token: SeSystemtimePrivilege	2780	powershell.exe
Token: SeProfSingleProcessPrivilege	2780	powershell.exe
Token: SeIncBasePriorityPrivilege	2780	powershell.exe
Token: SeCreatePagefilePrivilege	2780	powershell.exe
Token: SeBackupPrivilege	2780	powershell.exe
Token: SeRestorePrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeSystemEnvironmentPrivilege	2780	powershell.exe
Token: SeRemoteShutdownPrivilege	2780	powershell.exe
Token: SeUndockPrivilege	2780	powershell.exe
Token: SeManageVolumePrivilege	2780	powershell.exe
Token: 33	2780	powershell.exe
Token: 34	2780	powershell.exe
Token: 35	2780	powershell.exe
Token: 36	2780	powershell.exe
Token: SeIncreaseQuotaPrivilege	2780	powershell.exe
Token: SeSecurityPrivilege	2780	powershell.exe
Token: SeTakeOwnershipPrivilege	2780	powershell.exe
Token: SeLoadDriverPrivilege	2780	powershell.exe
Token: SeSystemProfilePrivilege	2780	powershell.exe
Token: SeSystemtimePrivilege	2780	powershell.exe
Token: SeProfSingleProcessPrivilege	2780	powershell.exe
Token: SeIncBasePriorityPrivilege	2780	powershell.exe
Token: SeCreatePagefilePrivilege	2780	powershell.exe
Token: SeBackupPrivilege	2780	powershell.exe
Token: SeRestorePrivilege	2780	powershell.exe
Token: SeShutdownPrivilege	2780	powershell.exe
Token: SeDebugPrivilege	2780	powershell.exe
Token: SeSystemEnvironmentPrivilege	2780	powershell.exe
Token: SeRemoteShutdownPrivilege	2780	powershell.exe
Token: SeUndockPrivilege	2780	powershell.exe
Token: SeManageVolumePrivilege	2780	powershell.exe
Token: 33	2780	powershell.exe
Token: 34	2780	powershell.exe
Token: 35	2780	powershell.exe
Token: 36	2780	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeIncreaseQuotaPrivilege	4864	powershell.exe
Token: SeSecurityPrivilege	4864	powershell.exe
Token: SeTakeOwnershipPrivilege	4864	powershell.exe
Token: SeLoadDriverPrivilege	4864	powershell.exe
Token: SeSystemProfilePrivilege	4864	powershell.exe
Token: SeSystemtimePrivilege	4864	powershell.exe
Token: SeProfSingleProcessPrivilege	4864	powershell.exe
Token: SeIncBasePriorityPrivilege	4864	powershell.exe
Token: SeCreatePagefilePrivilege	4864	powershell.exe
Token: SeBackupPrivilege	4864	powershell.exe
Token: SeRestorePrivilege	4864	powershell.exe
Token: SeShutdownPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeSystemEnvironmentPrivilege	4864	powershell.exe
Token: SeRemoteShutdownPrivilege	4864	powershell.exe
Token: SeUndockPrivilege	4864	powershell.exe
Token: SeManageVolumePrivilege	4864	powershell.exe
Token: 33	4864	powershell.exe
Token: 34	4864	powershell.exe
Token: 35	4864	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

a97286be2249f7896f0a5c171deb80d0.exe

pid process

5016 a97286be2249f7896f0a5c171deb80d0.exe
5016 a97286be2249f7896f0a5c171deb80d0.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

a97286be2249f7896f0a5c171deb80d0.exe

description	pid	process	target process
PID 2900 wrote to memory of 2780	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 2780	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 2780	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 4864	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 4864	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 4864	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 4604	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 4604	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 4604	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3492	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3492	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3492	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 1616	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 1616	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 1616	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 696	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 696	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 696	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 5084	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 5084	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 5084	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3528	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3528	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3528	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3212	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3212	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 3212	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 2436	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 2436	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 2436	2900	a97286be2249f7896f0a5c171deb80d0.exe	powershell.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe
PID 2900 wrote to memory of 5016	2900	a97286be2249f7896f0a5c171deb80d0.exe	a97286be2249f7896f0a5c171deb80d0.exe

C:\Users\Admin\AppData\Local\Temp\a97286be2249f7896f0a5c171deb80d0.exe
"C:\Users\Admin\AppData\Local\Temp\a97286be2249f7896f0a5c171deb80d0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Users\Admin\AppData\Local\Temp\a97286be2249f7896f0a5c171deb80d0.exe
C:\Users\Admin\AppData\Local\Temp\a97286be2249f7896f0a5c171deb80d0.exe
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2432,i,12161922670941700748,3348345705955601576,262144 --variations-seed-version /prefetch:8
1⤵
PID:760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
b5cb0ad8ad3c941c08f3b2ca526b42ad

SHA1
222d15cd36bf89621a620c2dbd488841ef1deffd

SHA256
5fe41a289be4ce80992aae1e8fb00e9272529b36598f15ab4509842659abd465

SHA512
85448c99f7baa870462e8f2c4b03926dfefc01b76f713e2875d3ba4388a2ff1e65c09f1bdbd813a2fa1de0aa87a50ce7aec978987aba4c40412003ab23ce49ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
20KB

MD5
372ac653ed074c0228f73109442fc009

SHA1
5bad539f782fe2c805c1489e06b72b4b91e473f8

SHA256
080a61eeabe98e51bb8b6f3667b033b56b0327bde3df0c695b1659f7088e716b

SHA512
9c6a2dea4d863cd08ab7f770c630b5df2c5338ce924449a359d76a0f49fd4fe339641ba51fc1f8fd49ec3936cdabfb927586717b446f2dfa14190936cac97ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
db2dcf9b0002770d5c1d1ecfebbb229a

SHA1
e969f9efa7add91adf187594e0bc180791c9b66b

SHA256
c203a57f28cdb157fe010b837d6c3cc9acea4e9912a1c5772a68d54e0ac160b9

SHA512
fb4e98a5686c52f2acfed490d702ad4963dcfc1783750f5f5698d8572757ca7d242111a32b13a81727001713cd799f54fe52433baa40b17262b02d31cea9c690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
5ab6c61a327acac6d1e517cebec6e302

SHA1
9dfacdfddbdef6785ca3841755123714448df930

SHA256
c59911cf18556e4a1fe7068118bf82491400947d12b3cebdab94aaa3765e9887

SHA512
7c2865180efd78e9a092435c524cf15beab74ebdabb275a18c138b82e24836b25794571334deced4f27d438c496a518f6874671ea4bb3c84a0cb2feb72a9a62d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
95cf61c0012a14f253d8f23aa41070f9

SHA1
fb1ddcff0e13c6588a10c0ac7cddbc7b11cf0dbb

SHA256
ab78a77c071e03a5a6fe181111c5b4eb5f920ffb40b8072298d44c5594745e1e

SHA512
397d75cabd7080a16a51978ffbff96edb647dfff1f6c140f614e732acba6053dafea4eae383bbbeb3635dbc08600cbeb7c470c29d9c68818256b5aca91f81730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
371b91e24ff05fb7368c8224be688fe3

SHA1
7b2101dc92ec24c00bef6dabe60a7f3344233b75

SHA256
e7ba1ec597c36512fbe4d043f6faaa366fbb3ca4be6817491c4e266f264ea602

SHA512
a32b9a3c7da0743440c7659463ce031be98b983b2a6f9732ec335fa3000acaee4a4e51b2484ccadbd1ee2da1353f9f2a7a0a849b0a8d4d9c87daf39a7f6f804b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
bf021cbab54cd478d0257e0a4efb13a4

SHA1
257a59b319f9f1689b0f472d2aee7718723c15e3

SHA256
2ecc858756bbf28024f08428c2565c6e416ea6e03d81f6219af345dcf20ba783

SHA512
3f4da1b79d6b8ca903dd510d6c9a52b62e9c6645681ce958f5fa1417cc8abac07833d11c0b734d8cbd52ca39478cb65723de0841edf271ccb1bb7f53eeab3b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
d1ac010547d9b6d8847566d8ddd3b061

SHA1
9b99fdd0dc382900ef96d93e4686adcc8e57c042

SHA256
12a43ca538d01f8ebd356f2e04d318188b0ab77b3188aa13bf92e542028ccd5b

SHA512
820a97083c7b7aae10e143d470f94805abf579b7cccb0fbb5699e04165fee46ca380cc58db8b3145efac1a96cb245d980304f55e98a40849779645a2ea3fb660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
19KB

MD5
d68bd353d04eb11430bd298d679825b4

SHA1
5d339236766cdfe8607361921af594ff490f349e

SHA256
d00355c49670dbf80cf290b096d3226f97051169d6139054485ad6807465ba3e

SHA512
8639b59156a8cca3f5f210a210bf6d5bf72c871780a37ac27499a91267f3913f50fa7736de0250ee37957b9a0512e8447cc7d196ef6bcc548e300918ad4faacc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2q32azjc.s4r.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/696-91-0x00000000051B0000-0x00000000051C0000-memory.dmp

Filesize
64KB

Download
memory/696-90-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/696-92-0x00000000051B0000-0x00000000051C0000-memory.dmp

Filesize
64KB

Download
memory/696-104-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/1616-89-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/1616-77-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2436-148-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2436-158-0x0000000006390000-0x00000000066E4000-memory.dmp

Filesize
3.3MB

Download
memory/2436-161-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2780-8-0x0000000005380000-0x0000000005390000-memory.dmp

Filesize
64KB

Download
memory/2780-28-0x0000000007720000-0x0000000007742000-memory.dmp

Filesize
136KB

Download
memory/2780-29-0x00000000089D0000-0x000000000904A000-memory.dmp

Filesize
6.5MB

Download
memory/2780-31-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2780-27-0x0000000006C30000-0x0000000006C4A000-memory.dmp

Filesize
104KB

Download
memory/2780-26-0x0000000006CA0000-0x0000000006D36000-memory.dmp

Filesize
600KB

Download
memory/2780-25-0x00000000067A0000-0x00000000067EC000-memory.dmp

Filesize
304KB

Download
memory/2780-24-0x0000000006750000-0x000000000676E000-memory.dmp

Filesize
120KB

Download
memory/2780-23-0x00000000062B0000-0x0000000006604000-memory.dmp

Filesize
3.3MB

Download
memory/2780-18-0x0000000006140000-0x00000000061A6000-memory.dmp

Filesize
408KB

Download
memory/2780-12-0x0000000006060000-0x00000000060C6000-memory.dmp

Filesize
408KB

Download
memory/2780-11-0x0000000005890000-0x00000000058B2000-memory.dmp

Filesize
136KB

Download
memory/2780-10-0x00000000059C0000-0x0000000005FE8000-memory.dmp

Filesize
6.2MB

Download
memory/2780-9-0x0000000005380000-0x0000000005390000-memory.dmp

Filesize
64KB

Download
memory/2780-7-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2780-6-0x0000000002E10000-0x0000000002E46000-memory.dmp

Filesize
216KB

Download
memory/2900-187-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-205-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-2178-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2900-229-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-227-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-225-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-223-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-48-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/2900-221-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-45-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2900-219-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-217-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-215-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-213-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-211-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-209-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-207-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-203-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-201-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-199-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-197-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-195-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-5-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Filesize
40KB

Download
memory/2900-193-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-4-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/2900-3-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Filesize
584KB

Download
memory/2900-2-0x00000000051D0000-0x0000000005774000-memory.dmp

Filesize
5.6MB

Download
memory/2900-1-0x0000000000010000-0x000000000028A000-memory.dmp

Filesize
2.5MB

Download
memory/2900-162-0x00000000007D0000-0x0000000000846000-memory.dmp

Filesize
472KB

Download
memory/2900-163-0x0000000006B10000-0x0000000006D1A000-memory.dmp

Filesize
2.0MB

Download
memory/2900-164-0x0000000000880000-0x000000000089E000-memory.dmp

Filesize
120KB

Download
memory/2900-165-0x0000000000B90000-0x0000000000BF8000-memory.dmp

Filesize
416KB

Download
memory/2900-166-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-167-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-169-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-171-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-173-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-175-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-177-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-179-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-181-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-183-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-185-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-0-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/2900-189-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/2900-191-0x0000000000B90000-0x0000000000BF3000-memory.dmp

Filesize
396KB

Download
memory/3212-147-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/3212-135-0x0000000002260000-0x0000000002270000-memory.dmp

Filesize
64KB

Download
memory/3212-134-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/3492-63-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/3492-73-0x00000000059D0000-0x0000000005D24000-memory.dmp

Filesize
3.3MB

Download
memory/3492-76-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/3528-130-0x0000000005440000-0x0000000005794000-memory.dmp

Filesize
3.3MB

Download
memory/3528-120-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/3528-133-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4604-49-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4604-62-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4604-50-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/4864-33-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/4864-43-0x0000000006050000-0x00000000063A4000-memory.dmp

Filesize
3.3MB

Download
memory/4864-47-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/4864-32-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/5016-2177-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5016-2180-0x0000000074F60000-0x0000000074F99000-memory.dmp

Filesize
228KB

Download
memory/5016-2188-0x00000000752E0000-0x0000000075319000-memory.dmp

Filesize
228KB

Download
memory/5016-2189-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/5016-2192-0x00000000752E0000-0x0000000075319000-memory.dmp

Filesize
228KB

Download
memory/5084-105-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/5084-106-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/5084-107-0x0000000002460000-0x0000000002470000-memory.dmp

Filesize
64KB

Download
memory/5084-119-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download