Overview

overview

10

Static

static

3

UMMAN İHR...33.exe

windows7-x64

10

UMMAN İHR...33.exe

windows10-2004-x64

Vitaminern...es.ps1

windows7-x64

8

Vitaminern...es.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    87s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-04-2024 08:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Vitaminerne/Taksonomiske24/Trephining/Piloters/Recepternes.ps1

  • Size

    57KB

  • MD5

    24e44ec408c4fb8b429adb0ee5869985

  • SHA1

    1913f35995281fec0c9f586fd73d6a2f4e64a5ca

  • SHA256

    cf1db414b602f31a34655222809a3542f96a8ffcf0e43dfdbc341192f8298f71

  • SHA512

    76b152a80b4f9537c1cd3fb6209021040946c0e7c75fe907f9b95e9f4446b2f12ef54be9721de7b13929df0e1d555db38f470d43f9142b4c1b87e74768819425

  • SSDEEP

    1536:sHoiMTmNr5n2YDREJfm7g0ctkXRR7f8zYXJ4l:QoxOHifKciRdf8zYK

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 7 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Vitaminerne\Taksonomiske24\Trephining\Piloters\Recepternes.ps1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
      2⤵
        PID:4536
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4384
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:724
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3788
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:744
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4988
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4544
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1196
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:400
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1312
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:2888
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3236
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2448
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2160
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4496
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:764
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:4488
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4392
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3584
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:532
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4296
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4764
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1004
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1792
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:216
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:4524
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:2608
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4352
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4468
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3228
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3684
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4280
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4020
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4196
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4944
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:3916
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:3928
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:1184
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3556
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:2580
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:3508
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:4304
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3248
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4116
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:4984
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:1760
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2752
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:2196
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:2164
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                    1⤵
                                                                      PID:4344
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:988
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:468
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:4236
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4864
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:3284
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:2024

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                  Filesize

                                                                                  471B

                                                                                  MD5

                                                                                  d167bef885776a71caa9137918853a44

                                                                                  SHA1

                                                                                  938e9840d92645b708450c23ea59d988b79c0f14

                                                                                  SHA256

                                                                                  a97ae8fa2227175303e2f3ea42160aced0e5d03108b249f2607aa89d25d78c40

                                                                                  SHA512

                                                                                  b79448a89d8f1b8afd68c5d16ac20348d4eee9f49aff3384b2419766f49183b7213e82a57da91230b1b780038fc7d3d6d507913c45e206c53e01745e4fe3ad57

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                                  Filesize

                                                                                  412B

                                                                                  MD5

                                                                                  1bc9f99fa476c4d84ba89d0012806f99

                                                                                  SHA1

                                                                                  cad241246b16cc2dedc7c8b794e84dd661b2fbd7

                                                                                  SHA256

                                                                                  138e5177b661d80eead79c42174d10ffb868a8386aad5d65c6cd9ac5069a2a0f

                                                                                  SHA512

                                                                                  a167f453d9657e487b34ce0d890239fd51b334026a09b878379a34769d34594684848831c1478726614bf6ed6dbf47e25561e39fa42349ac0c08dbfa5532db73

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HXTVQGKM\microsoft.windows[1].xml
                                                                                  Filesize

                                                                                  96B

                                                                                  MD5

                                                                                  5d26d9282453709bb4b92b0583342fd8

                                                                                  SHA1

                                                                                  8234c2a047cb4d78cb8b47067fd1b11888df1497

                                                                                  SHA256

                                                                                  5ebc9ae28489a17a5ed56d73764ffe5c2b085c30736ac46e30f7a256e78b2d1d

                                                                                  SHA512

                                                                                  c44746b66392f0773090ee792e56b72bd1374fdaeb046cf0e7b3f05cd10ac2982ed16f66257d0f57366ad72fb66a5efb3c283965e958a9b33d9222f1dd28ef70

                                                                                  Download Submit

                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ndpi34j.0uf.ps1
                                                                                  Filesize

                                                                                  60B

                                                                                  MD5

                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                  SHA1

                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                  SHA256

                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                  SHA512

                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                  Download Submit

                                                                                • memory/216-142-0x00000287502C0000-0x00000287502E0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/216-144-0x0000028750280000-0x00000287502A0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/216-146-0x0000028750690000-0x00000287506B0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/532-132-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/764-81-0x00000228AF670000-0x00000228AF690000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/764-79-0x00000228AF6B0000-0x00000228AF6D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/764-83-0x00000228AFC80000-0x00000228AFCA0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/988-318-0x00000000040B0000-0x00000000040B1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1004-134-0x00000000047E0000-0x00000000047E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1184-251-0x0000000002620000-0x0000000002621000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/1196-34-0x00000217D05F0000-0x00000217D0610000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1196-37-0x00000217D0A00000-0x00000217D0A20000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1196-32-0x00000217D0630000-0x00000217D0650000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/1760-295-0x00000000042A0000-0x00000000042A1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2024-349-0x0000024D407D0000-0x0000024D407F0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2024-351-0x0000024D40790000-0x0000024D407B0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2024-353-0x0000024D40BA0000-0x0000024D40BC0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2160-71-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/2196-302-0x0000021CEE600000-0x0000021CEE620000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2196-304-0x0000021CEE3B0000-0x0000021CEE3D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2196-307-0x0000021CEE9C0000-0x0000021CEE9E0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2448-58-0x0000029367D20000-0x0000029367D40000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2448-61-0x0000029368120000-0x0000029368140000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2448-56-0x0000029367D60000-0x0000029367D80000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2580-264-0x000002032C320000-0x000002032C340000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2580-260-0x000002032BF20000-0x000002032BF40000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2580-258-0x000002032BF60000-0x000002032BF80000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/2888-48-0x0000000004990000-0x0000000004991000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3248-274-0x0000000002E60000-0x0000000002E61000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/3584-104-0x0000014583A80000-0x0000014583AA0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3584-102-0x0000014583AC0000-0x0000014583AE0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3584-106-0x00000145840A0000-0x00000145840C0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3684-189-0x000001C466C20000-0x000001C466C40000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3684-191-0x000001C4669D0000-0x000001C4669F0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3684-193-0x000001C466FE0000-0x000001C467000000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3928-235-0x000001EDCD210000-0x000001EDCD230000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3928-237-0x000001EDCD1D0000-0x000001EDCD1F0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/3928-240-0x000001EDCD5E0000-0x000001EDCD600000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4196-212-0x000001ED5F020000-0x000001ED5F040000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4196-216-0x000001ED5F3E0000-0x000001ED5F400000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4196-214-0x000001ED5EDD0000-0x000001ED5EDF0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4236-326-0x0000021C51520000-0x0000021C51540000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4236-328-0x0000021C511D0000-0x0000021C511F0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4236-330-0x0000021C518E0000-0x0000021C51900000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4280-204-0x00000000044E0000-0x00000000044E1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4352-166-0x00000305CEF70000-0x00000305CEF90000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4352-168-0x00000305CEF30000-0x00000305CEF50000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4352-171-0x00000305CF340000-0x00000305CF360000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4468-181-0x0000000004710000-0x0000000004711000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4488-94-0x00000000045F0000-0x00000000045F1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4524-158-0x0000000002810000-0x0000000002811000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4764-121-0x0000018D564B0000-0x0000018D564D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4764-123-0x0000018D56470000-0x0000018D56490000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4764-125-0x0000018D56A80000-0x0000018D56AA0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4864-341-0x0000000004920000-0x0000000004921000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4944-227-0x00000000046C0000-0x00000000046C1000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download

                                                                                • memory/4944-20-0x00007FFD33C50000-0x00007FFD34711000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                  Download

                                                                                • memory/4944-19-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                  Download

                                                                                • memory/4944-13-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                  Download

                                                                                • memory/4944-5-0x00000211F2F10000-0x00000211F2F32000-memory.dmp

                                                                                  Filesize

                                                                                  136KB

                                                                                  Download

                                                                                • memory/4944-12-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                  Download

                                                                                • memory/4944-11-0x00000211F2FD0000-0x00000211F2FE0000-memory.dmp

                                                                                  Filesize

                                                                                  64KB

                                                                                  Download

                                                                                • memory/4944-10-0x00007FFD33C50000-0x00007FFD34711000-memory.dmp

                                                                                  Filesize

                                                                                  10.8MB

                                                                                  Download

                                                                                • memory/4984-289-0x000002039DCC0000-0x000002039DCE0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4984-284-0x000002039D6B0000-0x000002039D6D0000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4984-282-0x000002039D6F0000-0x000002039D710000-memory.dmp

                                                                                  Filesize

                                                                                  128KB

                                                                                  Download

                                                                                • memory/4988-26-0x0000000004F70000-0x0000000004F71000-memory.dmp

                                                                                  Filesize

                                                                                  4KB

                                                                                  Download