Overview
overview
9Static
static
3KernelOS-Modules.zip
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...64.cab
windows10-2004-x64
1KernelOS-M...86.cab
windows10-2004-x64
1KernelOS-M...UP.dll
windows10-2004-x64
4KernelOS-M...H2.bat
windows10-2004-x64
3KernelOS-M...64.exe
windows10-2004-x64
KernelOS-M...86.exe
windows10-2004-x64
7KernelOS-M...64.exe
windows10-2004-x64
7KernelOS-M...86.exe
windows10-2004-x64
7KernelOS-M...64.exe
windows10-2004-x64
7KernelOS-M...86.exe
windows10-2004-x64
7KernelOS-M...64.exe
windows10-2004-x64
7KernelOS-M...86.exe
windows10-2004-x64
7KernelOS-M...64.exe
windows10-2004-x64
7KernelOS-M...86.exe
windows10-2004-x64
7KernelOS-M...64.exe
windows10-2004-x64
7KernelOS-M...86.exe
windows10-2004-x64
7KernelOS-M...et.bat
windows10-2004-x64
9KernelOS-M...ss.exe
windows10-2004-x64
6KernelOS-M...nd.exe
windows10-2004-x64
1Analysis
-
max time kernel
1698s -
max time network
1179s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-es -
resource tags
arch:x64arch:x86image:win10v2004-20240426-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
16-05-2024 00:01
Static task
static1
Behavioral task
behavioral1
Sample
KernelOS-Modules.zip
Resource
win10v2004-20240426-es
Behavioral task
behavioral2
Sample
KernelOS-Modules/DirectX/APR2007_XACT_x64.cab
Resource
win10v2004-20240226-es
Behavioral task
behavioral3
Sample
KernelOS-Modules/DirectX/APR2007_XACT_x86.cab
Resource
win10v2004-20240508-es
Behavioral task
behavioral4
Sample
KernelOS-Modules/DirectX/APR2007_d3dx10_33_x64.cab
Resource
win10v2004-20240426-es
Behavioral task
behavioral5
Sample
KernelOS-Modules/DirectX/APR2007_d3dx10_33_x86.cab
Resource
win10v2004-20240426-es
Behavioral task
behavioral6
Sample
KernelOS-Modules/DirectX/APR2007_d3dx9_33_x64.cab
Resource
win10v2004-20240426-es
Behavioral task
behavioral7
Sample
KernelOS-Modules/DirectX/APR2007_d3dx9_33_x86.cab
Resource
win10v2004-20240508-es
Behavioral task
behavioral8
Sample
KernelOS-Modules/DirectX/APR2007_xinput_x64.cab
Resource
win10v2004-20240426-es
Behavioral task
behavioral9
Sample
KernelOS-Modules/DirectX/APR2007_xinput_x86.cab
Resource
win10v2004-20240508-es
Behavioral task
behavioral10
Sample
KernelOS-Modules/DirectX/AUG2006_XACT_x64.cab
Resource
win10v2004-20240426-es
Behavioral task
behavioral11
Sample
KernelOS-Modules/DirectX/AUG2006_XACT_x86.cab
Resource
win10v2004-20240508-es
Behavioral task
behavioral12
Sample
KernelOS-Modules/DirectX/AUG2006_xinput_x64.cab
Resource
win10v2004-20240508-es
Behavioral task
behavioral13
Sample
KernelOS-Modules/DirectX/AUG2006_xinput_x86.cab
Resource
win10v2004-20240426-es
Behavioral task
behavioral14
Sample
KernelOS-Modules/DirectX/AUG2007_XACT_x64.cab
Resource
win10v2004-20240508-es
Behavioral task
behavioral15
Sample
KernelOS-Modules/DirectX/AUG2007_XACT_x86.cab
Resource
win10v2004-20240226-es
Behavioral task
behavioral16
Sample
KernelOS-Modules/DirectX/DSETUP.dll
Resource
win10v2004-20240508-es
Behavioral task
behavioral17
Sample
KernelOS-Modules/KernelOS22H2.bat
Resource
win10v2004-20240426-es
Behavioral task
behavioral18
Sample
KernelOS-Modules/VisualAIO/vcredist2005_x64.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral19
Sample
KernelOS-Modules/VisualAIO/vcredist2005_x86.exe
Resource
win10v2004-20240426-es
Behavioral task
behavioral20
Sample
KernelOS-Modules/VisualAIO/vcredist2008_x64.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral21
Sample
KernelOS-Modules/VisualAIO/vcredist2008_x86.exe
Resource
win10v2004-20240426-es
Behavioral task
behavioral22
Sample
KernelOS-Modules/VisualAIO/vcredist2010_x64.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral23
Sample
KernelOS-Modules/VisualAIO/vcredist2010_x86.exe
Resource
win10v2004-20240426-es
Behavioral task
behavioral24
Sample
KernelOS-Modules/VisualAIO/vcredist2012_x64.exe
Resource
win10v2004-20240426-es
Behavioral task
behavioral25
Sample
KernelOS-Modules/VisualAIO/vcredist2012_x86.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral26
Sample
KernelOS-Modules/VisualAIO/vcredist2013_x64.exe
Resource
win10v2004-20240426-es
Behavioral task
behavioral27
Sample
KernelOS-Modules/VisualAIO/vcredist2013_x86.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral28
Sample
KernelOS-Modules/VisualAIO/vcredist2015_2017_2019_2022_x64.exe
Resource
win10v2004-20240226-es
Behavioral task
behavioral29
Sample
KernelOS-Modules/VisualAIO/vcredist2015_2017_2019_2022_x86.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral30
Sample
KernelOS-Modules/drvset.bat
Resource
win10v2004-20240508-es
Behavioral task
behavioral31
Sample
KernelOS-Modules/oss.exe
Resource
win10v2004-20240508-es
Behavioral task
behavioral32
Sample
KernelOS-Modules/pssuspend.exe
Resource
win10v2004-20240426-es
General
-
Target
KernelOS-Modules/KernelOS22H2.bat
-
Size
63KB
-
MD5
32d7f72b68d881ed12300ca88b68cd54
-
SHA1
4e95abacf4a54720785e31a7c408609d3e3478be
-
SHA256
2b841784fbb8345e3bf40ab4950b60c7aee4633973ffea33f5325a0cb25da973
-
SHA512
a805b7373d823ea8c5cd33f69b71f759d9edf5dc0c38c53ac2dd0e1b9048bbfd243494e30e72fd5e399afaa6c389f6d3f5d7ac10501c1db8d4cc6ad665bc5047
-
SSDEEP
768:lTIyf6W5oGNbfrdAUY5eC9vOcbXmB9ofdfv3h8mox+QRv2WYV5FEvUr:hJi
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 7 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4516 timeout.exe 1228 timeout.exe 4024 timeout.exe 684 timeout.exe 3008 timeout.exe 3588 timeout.exe 1584 timeout.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1712 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepowershell.exepid process 3012 powershell.exe 3012 powershell.exe 3012 powershell.exe 4280 powershell.exe 4280 powershell.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
taskkill.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exedescription pid process Token: SeDebugPrivilege 1712 taskkill.exe Token: SeDebugPrivilege 3012 powershell.exe Token: SeShutdownPrivilege 1944 powercfg.exe Token: SeCreatePagefilePrivilege 1944 powercfg.exe Token: SeShutdownPrivilege 3736 powercfg.exe Token: SeCreatePagefilePrivilege 3736 powercfg.exe Token: SeShutdownPrivilege 1916 powercfg.exe Token: SeCreatePagefilePrivilege 1916 powercfg.exe Token: SeShutdownPrivilege 1580 powercfg.exe Token: SeCreatePagefilePrivilege 1580 powercfg.exe Token: SeShutdownPrivilege 3564 powercfg.exe Token: SeCreatePagefilePrivilege 3564 powercfg.exe Token: SeShutdownPrivilege 4320 powercfg.exe Token: SeCreatePagefilePrivilege 4320 powercfg.exe Token: SeDebugPrivilege 4280 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.execmd.execmd.exedescription pid process target process PID 5052 wrote to memory of 4760 5052 cmd.exe cmd.exe PID 5052 wrote to memory of 4760 5052 cmd.exe cmd.exe PID 4760 wrote to memory of 4924 4760 cmd.exe chcp.com PID 4760 wrote to memory of 4924 4760 cmd.exe chcp.com PID 5052 wrote to memory of 4880 5052 cmd.exe chcp.com PID 5052 wrote to memory of 4880 5052 cmd.exe chcp.com PID 5052 wrote to memory of 536 5052 cmd.exe cmd.exe PID 5052 wrote to memory of 536 5052 cmd.exe cmd.exe PID 536 wrote to memory of 8 536 cmd.exe mode.com PID 536 wrote to memory of 8 536 cmd.exe mode.com PID 536 wrote to memory of 1712 536 cmd.exe taskkill.exe PID 536 wrote to memory of 1712 536 cmd.exe taskkill.exe PID 536 wrote to memory of 3012 536 cmd.exe powershell.exe PID 536 wrote to memory of 3012 536 cmd.exe powershell.exe PID 536 wrote to memory of 4024 536 cmd.exe timeout.exe PID 536 wrote to memory of 4024 536 cmd.exe timeout.exe PID 536 wrote to memory of 1944 536 cmd.exe powercfg.exe PID 536 wrote to memory of 1944 536 cmd.exe powercfg.exe PID 536 wrote to memory of 3736 536 cmd.exe powercfg.exe PID 536 wrote to memory of 3736 536 cmd.exe powercfg.exe PID 536 wrote to memory of 1916 536 cmd.exe powercfg.exe PID 536 wrote to memory of 1916 536 cmd.exe powercfg.exe PID 536 wrote to memory of 1580 536 cmd.exe powercfg.exe PID 536 wrote to memory of 1580 536 cmd.exe powercfg.exe PID 536 wrote to memory of 3564 536 cmd.exe powercfg.exe PID 536 wrote to memory of 3564 536 cmd.exe powercfg.exe PID 536 wrote to memory of 4320 536 cmd.exe powercfg.exe PID 536 wrote to memory of 4320 536 cmd.exe powercfg.exe PID 536 wrote to memory of 684 536 cmd.exe timeout.exe PID 536 wrote to memory of 684 536 cmd.exe timeout.exe PID 536 wrote to memory of 3008 536 cmd.exe timeout.exe PID 536 wrote to memory of 3008 536 cmd.exe timeout.exe PID 536 wrote to memory of 3588 536 cmd.exe timeout.exe PID 536 wrote to memory of 3588 536 cmd.exe timeout.exe PID 536 wrote to memory of 1584 536 cmd.exe timeout.exe PID 536 wrote to memory of 1584 536 cmd.exe timeout.exe PID 536 wrote to memory of 4088 536 cmd.exe reg.exe PID 536 wrote to memory of 4088 536 cmd.exe reg.exe PID 536 wrote to memory of 2516 536 cmd.exe reg.exe PID 536 wrote to memory of 2516 536 cmd.exe reg.exe PID 536 wrote to memory of 2384 536 cmd.exe reg.exe PID 536 wrote to memory of 2384 536 cmd.exe reg.exe PID 536 wrote to memory of 2700 536 cmd.exe reg.exe PID 536 wrote to memory of 2700 536 cmd.exe reg.exe PID 536 wrote to memory of 4480 536 cmd.exe reg.exe PID 536 wrote to memory of 4480 536 cmd.exe reg.exe PID 536 wrote to memory of 1592 536 cmd.exe reg.exe PID 536 wrote to memory of 1592 536 cmd.exe reg.exe PID 536 wrote to memory of 1928 536 cmd.exe reg.exe PID 536 wrote to memory of 1928 536 cmd.exe reg.exe PID 536 wrote to memory of 3260 536 cmd.exe reg.exe PID 536 wrote to memory of 3260 536 cmd.exe reg.exe PID 536 wrote to memory of 1172 536 cmd.exe reg.exe PID 536 wrote to memory of 1172 536 cmd.exe reg.exe PID 536 wrote to memory of 2832 536 cmd.exe reg.exe PID 536 wrote to memory of 2832 536 cmd.exe reg.exe PID 536 wrote to memory of 4900 536 cmd.exe reg.exe PID 536 wrote to memory of 4900 536 cmd.exe reg.exe PID 536 wrote to memory of 5020 536 cmd.exe reg.exe PID 536 wrote to memory of 5020 536 cmd.exe reg.exe PID 536 wrote to memory of 3492 536 cmd.exe reg.exe PID 536 wrote to memory of 3492 536 cmd.exe reg.exe PID 536 wrote to memory of 740 536 cmd.exe reg.exe PID 536 wrote to memory of 740 536 cmd.exe reg.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KernelOS-Modules\KernelOS22H2.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp3⤵
-
C:\Windows\system32\chcp.comchcp 7082⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\KernelOS-Modules\KernelOS22H2.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=203⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "Set-ExecutionPolicy -ExecutionPolicy Unrestricted"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\powercfg.exepowercfg /import "C:\KernelOS-Modules\KernelOS Performance v6.1 IDLE ON.pow" 01001011-0100-1111-0101-0011888888843⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /import "C:\KernelOS-Modules\UltimatePerformance.pow" 01001011-0100-1111-0101-0011888888833⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /s 01001011-0100-1111-0101-0011888888843⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg -delete 381b4222-f694-41f0-9685-ff5bb260df2e3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg -delete 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg -delete a1841308-3541-4fab-bc81-f71556f20b4a3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu" /v "ShowedStyle2" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "Version" /t REG_DWORD /d "67371168" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "SkipMetro" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "StartScreenShortcut" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "InvertMetroIcons" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "MainMenuAnimation" /t REG_SZ /d "Slide" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "MainMenuAnimationSpeed" /t REG_DWORD /d "550" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "SubMenuAnimation" /t REG_SZ /d "Slide" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "SubMenuAnimationAlways" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "NumericSort" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "FontSmoothing" /t REG_SZ /d "Default" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "MenuShadow" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "EnableGlass" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "GlassOverride" /t REG_DWORD /d "1" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "GlassColor" /t REG_DWORD /d "6908265" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "GlassOpacity" /t REG_DWORD /d "100" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "SkinW7" /t REG_SZ /d "KernelOS" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "SkinVariationW7" /t REG_SZ /d "" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "SkinOptionsW7" /t REG_MULTI_SZ /d "" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "CustomTaskbar" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "OpenMouseMonitor" /t REG_DWORD /d "0" /f3⤵
-
C:\Windows\system32\reg.exeReg.exe add "HKEY_CURRENT_USER\SOFTWARE\OpenShell\StartMenu\Settings" /v "MenuItems7" /t REG_MULTI_SZ /d "Item1.Command=computer\0Item1.Settings=NOEXPAND\0Item2.Command=control_panel\0Item2.Settings=TRACK_RECENT\0Item3.Command=downloads\0Item3.Tip=$Menu.DownloadTip\0Item4.Command=C:\Windows\POST-INSTALL\0Item4.Label=POST-INSTALL\0Item4.Tip=$Menu.PrintersTip\0Item4.Icon=shell32.dll, 5\0Item5.Link=https://twitter.com/KernelPan1c5750\0Item5.Label=Twitter\0Item5.Tip=$Menu.PrintersTip\0Item5.Icon=%SystemDrive%\twitter.ico\0Item5.Settings=NOEXPAND\0Item6.Link=https://www.dsc.gg/kernelos\0Item6.Label=Discord KernelOS\0Item6.Icon=%SystemDrive%\discord.ico\0Item6.Settings=NOEXPAND" /f3⤵
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe "Get-AppxPackage -AllUsers *WindowsStore* | Remove-AppxPackage"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d136d3411d4aa688242c53cafb993aa6
SHA11a81cc78e3ca445d5a5193e49ddce26d5e25179f
SHA25600ae5433c0107cc164516c7849b4cff7b6faeb52e5afa65c01dbd8c7a5efe397
SHA512282ea53f8093c00e8c64d253782068211f8c4187391d5078755f55dedb8825c0042173d82f489d7b6c06e88184b70e83c1e92dadb80f57bd96c95855ac6b3da1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD55caad758326454b5788ec35315c4c304
SHA13aef8dba8042662a7fcf97e51047dc636b4d4724
SHA25683e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA5124e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4egos0de.2hl.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/3012-16-0x00000159615D0000-0x00000159615DA000-memory.dmpFilesize
40KB
-
memory/3012-8-0x00007FFE5D690000-0x00007FFE5E151000-memory.dmpFilesize
10.8MB
-
memory/3012-14-0x0000015961590000-0x00000159615A0000-memory.dmpFilesize
64KB
-
memory/3012-9-0x00007FFE5D690000-0x00007FFE5E151000-memory.dmpFilesize
10.8MB
-
memory/3012-15-0x00000159616B0000-0x00000159617B2000-memory.dmpFilesize
1.0MB
-
memory/3012-0-0x00007FFE5D693000-0x00007FFE5D695000-memory.dmpFilesize
8KB
-
memory/3012-19-0x00007FFE5D690000-0x00007FFE5E151000-memory.dmpFilesize
10.8MB
-
memory/3012-7-0x0000015961460000-0x0000015961482000-memory.dmpFilesize
136KB
-
memory/3012-1-0x0000015961B20000-0x0000015961BA2000-memory.dmpFilesize
520KB
-
memory/4280-31-0x0000024FB4BB0000-0x0000024FB4BC4000-memory.dmpFilesize
80KB
-
memory/4280-32-0x0000024FB6EF0000-0x0000024FB6F06000-memory.dmpFilesize
88KB
-
memory/4280-33-0x0000024FB4BA0000-0x0000024FB4BAA000-memory.dmpFilesize
40KB
-
memory/4280-34-0x0000024FB6F80000-0x0000024FB6FA6000-memory.dmpFilesize
152KB
-
memory/4280-35-0x0000024FB4BD0000-0x0000024FB4BD8000-memory.dmpFilesize
32KB