7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

max time kernel
300s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

svchost_dump_SCY - Copy.exe
Size

5.2MB
MD5

5fd3d21a968f4b8a1577b5405ab1c36a
SHA1

710e5ab0fceb71b982b966c3a7406ebdf1d2aa82
SHA256

7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f
SHA512

085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f
SSDEEP

98304:jgoX+R+gW1CkQFBAFGspWvuL136BRiGQiiyBrDbnh57cpbJLyns:coXxFGWL56BVrDbn77cjIs

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 8 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

2524 netsh.exe
4592 netsh.exe
5096 netsh.exe
2500 netsh.exe
4368 netsh.exe
2096 netsh.exe
2180 netsh.exe
3236 netsh.exe

pid	process
2524	netsh.exe
4592	netsh.exe
5096	netsh.exe
2500	netsh.exe
4368	netsh.exe
2096	netsh.exe
2180	netsh.exe
3236	netsh.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost_dump_SCY - Copy.exesvchost.exe~tl6A4.tmpsvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	svchost_dump_SCY - Copy.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	~tl6A4.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 3 IoCs

Processes:

svchost.exe~tl6A4.tmpsvchost.exe

pid process

3348 svchost.exe
216 ~tl6A4.tmp
2940 svchost.exe

pid	process
3348	svchost.exe
216	~tl6A4.tmp
2940	svchost.exe

Drops file in Windows directory 7 IoCs

Processes:

svchost_dump_SCY - Copy.exesvchost.exe~tl6A4.tmpsvchost.exe

description	ioc	process
File created	C:\Windows\System\xxx1.bak	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File opened for modification	C:\Windows\System\svchost.exe	svchost_dump_SCY - Copy.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tl6A4.tmp
File opened for modification	C:\Windows\System\svchost.exe	~tl6A4.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4368 schtasks.exe
4752 schtasks.exe

pid	process
4368	schtasks.exe
4752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

powershell.exepowershell.exesvchost_dump_SCY - Copy.exepowershell.exepowershell.exe~tl6A4.tmppowershell.exepowershell.exesvchost.exepowershell.exepowershell.exe

pid	process
3240	powershell.exe
3240	powershell.exe
2376	powershell.exe
2376	powershell.exe
3240	powershell.exe
2376	powershell.exe
3500	svchost_dump_SCY - Copy.exe
3500	svchost_dump_SCY - Copy.exe
5108	powershell.exe
5108	powershell.exe
1844	powershell.exe
1844	powershell.exe
216	~tl6A4.tmp
216	~tl6A4.tmp
1420	powershell.exe
1420	powershell.exe
808	powershell.exe
808	powershell.exe
216	~tl6A4.tmp
216	~tl6A4.tmp
2940	svchost.exe
2940	svchost.exe
1788	powershell.exe
1788	powershell.exe
3412	powershell.exe
3412	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4708	WMIC.exe
Token: SeSecurityPrivilege	4708	WMIC.exe
Token: SeTakeOwnershipPrivilege	4708	WMIC.exe
Token: SeLoadDriverPrivilege	4708	WMIC.exe
Token: SeSystemProfilePrivilege	4708	WMIC.exe
Token: SeSystemtimePrivilege	4708	WMIC.exe
Token: SeProfSingleProcessPrivilege	4708	WMIC.exe
Token: SeIncBasePriorityPrivilege	4708	WMIC.exe
Token: SeCreatePagefilePrivilege	4708	WMIC.exe
Token: SeBackupPrivilege	4708	WMIC.exe
Token: SeRestorePrivilege	4708	WMIC.exe
Token: SeShutdownPrivilege	4708	WMIC.exe
Token: SeDebugPrivilege	4708	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4708	WMIC.exe
Token: SeRemoteShutdownPrivilege	4708	WMIC.exe
Token: SeUndockPrivilege	4708	WMIC.exe
Token: SeManageVolumePrivilege	4708	WMIC.exe
Token: 33	4708	WMIC.exe
Token: 34	4708	WMIC.exe
Token: 35	4708	WMIC.exe
Token: 36	4708	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4708	WMIC.exe
Token: SeSecurityPrivilege	4708	WMIC.exe
Token: SeTakeOwnershipPrivilege	4708	WMIC.exe
Token: SeLoadDriverPrivilege	4708	WMIC.exe
Token: SeSystemProfilePrivilege	4708	WMIC.exe
Token: SeSystemtimePrivilege	4708	WMIC.exe
Token: SeProfSingleProcessPrivilege	4708	WMIC.exe
Token: SeIncBasePriorityPrivilege	4708	WMIC.exe
Token: SeCreatePagefilePrivilege	4708	WMIC.exe
Token: SeBackupPrivilege	4708	WMIC.exe
Token: SeRestorePrivilege	4708	WMIC.exe
Token: SeShutdownPrivilege	4708	WMIC.exe
Token: SeDebugPrivilege	4708	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4708	WMIC.exe
Token: SeRemoteShutdownPrivilege	4708	WMIC.exe
Token: SeUndockPrivilege	4708	WMIC.exe
Token: SeManageVolumePrivilege	4708	WMIC.exe
Token: 33	4708	WMIC.exe
Token: 34	4708	WMIC.exe
Token: 35	4708	WMIC.exe
Token: 36	4708	WMIC.exe
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeIncreaseQuotaPrivilege	3668	WMIC.exe
Token: SeSecurityPrivilege	3668	WMIC.exe
Token: SeTakeOwnershipPrivilege	3668	WMIC.exe
Token: SeLoadDriverPrivilege	3668	WMIC.exe
Token: SeSystemProfilePrivilege	3668	WMIC.exe
Token: SeSystemtimePrivilege	3668	WMIC.exe
Token: SeProfSingleProcessPrivilege	3668	WMIC.exe
Token: SeIncBasePriorityPrivilege	3668	WMIC.exe
Token: SeCreatePagefilePrivilege	3668	WMIC.exe
Token: SeBackupPrivilege	3668	WMIC.exe
Token: SeRestorePrivilege	3668	WMIC.exe
Token: SeShutdownPrivilege	3668	WMIC.exe
Token: SeDebugPrivilege	3668	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3668	WMIC.exe
Token: SeRemoteShutdownPrivilege	3668	WMIC.exe
Token: SeUndockPrivilege	3668	WMIC.exe
Token: SeManageVolumePrivilege	3668	WMIC.exe
Token: 33	3668	WMIC.exe
Token: 34	3668	WMIC.exe
Token: 35	3668	WMIC.exe

Suspicious use of WriteProcessMemory 54 IoCs

Processes:

svchost_dump_SCY - Copy.exesvchost.exe~tl6A4.tmpsvchost.exe

description	pid	process	target process
PID 3500 wrote to memory of 4708	3500	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 3500 wrote to memory of 4708	3500	svchost_dump_SCY - Copy.exe	WMIC.exe
PID 3500 wrote to memory of 2096	3500	svchost_dump_SCY - Copy.exe	netsh.exe
PID 3500 wrote to memory of 2096	3500	svchost_dump_SCY - Copy.exe	netsh.exe
PID 3500 wrote to memory of 2180	3500	svchost_dump_SCY - Copy.exe	netsh.exe
PID 3500 wrote to memory of 2180	3500	svchost_dump_SCY - Copy.exe	netsh.exe
PID 3500 wrote to memory of 3240	3500	svchost_dump_SCY - Copy.exe	powershell.exe
PID 3500 wrote to memory of 3240	3500	svchost_dump_SCY - Copy.exe	powershell.exe
PID 3500 wrote to memory of 2376	3500	svchost_dump_SCY - Copy.exe	powershell.exe
PID 3500 wrote to memory of 2376	3500	svchost_dump_SCY - Copy.exe	powershell.exe
PID 3500 wrote to memory of 2724	3500	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 3500 wrote to memory of 2724	3500	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 3500 wrote to memory of 4368	3500	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 3500 wrote to memory of 4368	3500	svchost_dump_SCY - Copy.exe	schtasks.exe
PID 3500 wrote to memory of 3348	3500	svchost_dump_SCY - Copy.exe	svchost.exe
PID 3500 wrote to memory of 3348	3500	svchost_dump_SCY - Copy.exe	svchost.exe
PID 3348 wrote to memory of 3668	3348	svchost.exe	WMIC.exe
PID 3348 wrote to memory of 3668	3348	svchost.exe	WMIC.exe
PID 3348 wrote to memory of 3236	3348	svchost.exe	netsh.exe
PID 3348 wrote to memory of 3236	3348	svchost.exe	netsh.exe
PID 3348 wrote to memory of 2524	3348	svchost.exe	netsh.exe
PID 3348 wrote to memory of 2524	3348	svchost.exe	netsh.exe
PID 3348 wrote to memory of 5108	3348	svchost.exe	powershell.exe
PID 3348 wrote to memory of 5108	3348	svchost.exe	powershell.exe
PID 3348 wrote to memory of 1844	3348	svchost.exe	powershell.exe
PID 3348 wrote to memory of 1844	3348	svchost.exe	powershell.exe
PID 3348 wrote to memory of 216	3348	svchost.exe	~tl6A4.tmp
PID 3348 wrote to memory of 216	3348	svchost.exe	~tl6A4.tmp
PID 216 wrote to memory of 1252	216	~tl6A4.tmp	netsh.exe
PID 216 wrote to memory of 1252	216	~tl6A4.tmp	netsh.exe
PID 216 wrote to memory of 4592	216	~tl6A4.tmp	netsh.exe
PID 216 wrote to memory of 4592	216	~tl6A4.tmp	netsh.exe
PID 216 wrote to memory of 5096	216	~tl6A4.tmp	netsh.exe
PID 216 wrote to memory of 5096	216	~tl6A4.tmp	netsh.exe
PID 216 wrote to memory of 1420	216	~tl6A4.tmp	powershell.exe
PID 216 wrote to memory of 1420	216	~tl6A4.tmp	powershell.exe
PID 216 wrote to memory of 808	216	~tl6A4.tmp	powershell.exe
PID 216 wrote to memory of 808	216	~tl6A4.tmp	powershell.exe
PID 216 wrote to memory of 1580	216	~tl6A4.tmp	schtasks.exe
PID 216 wrote to memory of 1580	216	~tl6A4.tmp	schtasks.exe
PID 216 wrote to memory of 4752	216	~tl6A4.tmp	schtasks.exe
PID 216 wrote to memory of 4752	216	~tl6A4.tmp	schtasks.exe
PID 216 wrote to memory of 2940	216	~tl6A4.tmp	svchost.exe
PID 216 wrote to memory of 2940	216	~tl6A4.tmp	svchost.exe
PID 2940 wrote to memory of 2120	2940	svchost.exe	netsh.exe
PID 2940 wrote to memory of 2120	2940	svchost.exe	netsh.exe
PID 2940 wrote to memory of 2500	2940	svchost.exe	netsh.exe
PID 2940 wrote to memory of 2500	2940	svchost.exe	netsh.exe
PID 2940 wrote to memory of 4368	2940	svchost.exe	netsh.exe
PID 2940 wrote to memory of 4368	2940	svchost.exe	netsh.exe
PID 2940 wrote to memory of 1788	2940	svchost.exe	powershell.exe
PID 2940 wrote to memory of 1788	2940	svchost.exe	powershell.exe
PID 2940 wrote to memory of 3412	2940	svchost.exe	powershell.exe
PID 2940 wrote to memory of 3412	2940	svchost.exe	powershell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe
"C:\Users\Admin\AppData\Local\Temp\svchost_dump_SCY - Copy.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
2⤵
- Modifies Windows Firewall
PID:2096

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
2⤵
- Modifies Windows Firewall
PID:2180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /TN "Timer"
2⤵
PID:2724

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
2⤵
- Creates scheduled task(s)
PID:4368

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:3236

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
3⤵
- Modifies Windows Firewall
PID:2524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844

C:\Users\Admin\AppData\Local\Temp\~tl6A4.tmp
C:\Users\Admin\AppData\Local\Temp\~tl6A4.tmp
3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\SYSTEM32\netsh.exe
netsh int ipv4 set dynamicport tcp start=1025 num=64511
4⤵
PID:1252

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:4592

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
4⤵
- Modifies Windows Firewall
PID:5096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:808

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /TN "Timer"
4⤵
PID:1580

C:\Windows\SYSTEM32\schtasks.exe
schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
4⤵
- Creates scheduled task(s)
PID:4752

C:\Windows\System\svchost.exe
"C:\Windows\System\svchost.exe" formal
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SYSTEM32\netsh.exe
netsh int ipv4 set dynamicport tcp start=1025 num=64511
5⤵
PID:2120

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:2500

C:\Windows\System32\netsh.exe
"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
5⤵
- Modifies Windows Firewall
PID:4368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c2b3c973c386897fbc34b15bda1b24f6

SHA1
b250d55826d58aabb2257339b7a18efa9dfb5f0d

SHA256
8cc0d40d7c0405895b8176d6b3ac029b6bb5cb0758e9efc2e916c317599c556e

SHA512
8f2ef86c686cc45a50852c7eba4c81ac0fe87a86f4eaa415dff4468901ae95a0bde98e650a00d36c126e2ea987fb8cdbec8cc405090f9115e3c9c9d5f070db99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ba169f4dcbbf147fe78ef0061a95e83b

SHA1
92a571a6eef49fff666e0f62a3545bcd1cdcda67

SHA256
5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

SHA512
8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nesgpm5z.dbx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\~tl6A4.tmp

Filesize
385KB

MD5
e802c96760e48c5139995ffb2d891f90

SHA1
bba3d278c0eb1094a26e5d2f4c099ad685371578

SHA256
cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c

SHA512
97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
277abb67ec3376d7c576732a62c39916

SHA1
70faa899ea7c8618289668813f04c69613fd6995

SHA256
62ce6ee974509a141b66d66c4dfe41565f9ba90f3d62cd286d7a08834f2b10d4

SHA512
f385313c49f7b153488f12be7ea04ed5c1220a85b7dc1382dcb862b8d5b155c5999971d3e8c7b37abdfcf8c2ff23f971a0a477a24f23ff8d08e2bcbe90f5021b

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
8.2MB

MD5
97e5d25e56392e0cfb357813ebcc8e54

SHA1
92e2ff1972fa2af93e0c673a32b5c83638388cff

SHA256
97ba77178f6fee225d12983754c52ce91f51f2f82b7b35223dfe4876550153e5

SHA512
4c31a0d4bf1950328d95c38d5450480164947e943e1846686c2a2bbeab12831e3f9d3729520ccfa162e0a72623610fd8a991d84196543dae4cce014c65634cf4

Download Submit
C:\Windows\System\svchost.exe

Filesize
5.2MB

MD5
5fd3d21a968f4b8a1577b5405ab1c36a

SHA1
710e5ab0fceb71b982b966c3a7406ebdf1d2aa82

SHA256
7ac7b42889e14cbd8c7cebe692566ca045d0034f9ff103fc3ef9c5e035dc594f

SHA512
085a31c0412ba0a3d612a66ec8d95ce900e148240f92f9ec8c4d07b6c8e32cf233e92aefc7b4b53a91f5eacacd1cf3a8fcdf8cd7c206afa46014a9e4a9ddf53f

Download Submit
memory/216-178-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/216-129-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/216-133-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/216-135-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/216-132-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/216-134-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/808-164-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/808-149-0x0000021DE2EB0000-0x0000021DE2EC0000-memory.dmp

Filesize
64KB

Download
memory/808-148-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/1420-137-0x000001E28AFF0000-0x000001E28B000000-memory.dmp

Filesize
64KB

Download
memory/1420-161-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/1420-159-0x000001E28AFF0000-0x000001E28B000000-memory.dmp

Filesize
64KB

Download
memory/1420-136-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/1788-190-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/1788-192-0x00000247C41E0000-0x00000247C41F0000-memory.dmp

Filesize
64KB

Download
memory/1788-191-0x00000247C41E0000-0x00000247C41F0000-memory.dmp

Filesize
64KB

Download
memory/1788-206-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/1844-56-0x00007FF9AF470000-0x00007FF9AFF31000-memory.dmp

Filesize
10.8MB

Download
memory/1844-72-0x00007FF9AF470000-0x00007FF9AFF31000-memory.dmp

Filesize
10.8MB

Download
memory/1844-58-0x00000204C6510000-0x00000204C6520000-memory.dmp

Filesize
64KB

Download
memory/2376-14-0x00007FF9AEE20000-0x00007FF9AF8E1000-memory.dmp

Filesize
10.8MB

Download
memory/2376-25-0x000001E66C060000-0x000001E66C070000-memory.dmp

Filesize
64KB

Download
memory/2376-31-0x00007FF9AEE20000-0x00007FF9AF8E1000-memory.dmp

Filesize
10.8MB

Download
memory/2940-176-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2940-177-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/2940-179-0x0000000140000000-0x000000014015E400-memory.dmp

Filesize
1.4MB

Download
memory/3240-6-0x000001B17D510000-0x000001B17D532000-memory.dmp

Filesize
136KB

Download
memory/3240-13-0x000001B17D5C0000-0x000001B17D5D0000-memory.dmp

Filesize
64KB

Download
memory/3240-32-0x00007FF9AEE20000-0x00007FF9AF8E1000-memory.dmp

Filesize
10.8MB

Download
memory/3240-12-0x000001B17D5C0000-0x000001B17D5D0000-memory.dmp

Filesize
64KB

Download
memory/3240-11-0x00007FF9AEE20000-0x00007FF9AF8E1000-memory.dmp

Filesize
10.8MB

Download
memory/3348-73-0x0000000031C20000-0x0000000032102000-memory.dmp

Filesize
4.9MB

Download
memory/3348-57-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/3348-131-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/3348-41-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/3412-209-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/3412-207-0x000001A4AF2F0000-0x000001A4AF300000-memory.dmp

Filesize
64KB

Download
memory/3412-194-0x000001A4AF2F0000-0x000001A4AF300000-memory.dmp

Filesize
64KB

Download
memory/3412-193-0x00007FF9B0C90000-0x00007FF9B1751000-memory.dmp

Filesize
10.8MB

Download
memory/3500-24-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/3500-0-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/3500-42-0x0000000140000000-0x0000000140636000-memory.dmp

Filesize
6.2MB

Download
memory/5108-53-0x00007FF9AF470000-0x00007FF9AFF31000-memory.dmp

Filesize
10.8MB

Download
memory/5108-54-0x000001466BD30000-0x000001466BD40000-memory.dmp

Filesize
64KB

Download
memory/5108-55-0x000001466BD30000-0x000001466BD40000-memory.dmp

Filesize
64KB

Download
memory/5108-69-0x00007FF9AF470000-0x00007FF9AFF31000-memory.dmp

Filesize
10.8MB

Download