darktrack | e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Size

822KB
MD5

4e7cf999557893b08c6623c31c45b28d
SHA1

9f8a085de74277fe2fcd79d77037a0627b79ebc1
SHA256

e5184d8982254662e152b0f61fccf90d1230a6f173118a59bc53bc883992de26
SHA512

44711a040f3b5329d71b6f0fec1dd21adf16626ffacde92b28603b8358f81f9b8e76f68610629be9a62051273f14396ba7cd24eb87f89a60bca5260f8e337ef8
SSDEEP

24576:jYUneM0AEIl09L8fffGkPt0UBEw8qqauuNWKP1UAp9:jYSKAE1ifffJtaw8qBuucKP+A/

Score

10^/10

darktrack evasion execution persistence rat stealer trojan

Malware Config

Signatures

DarkTrack
DarkTrack is a remote administration tool written in delphi.
rat stealer darktrack

DarkTrack payload 5 IoCs

resource	yara_rule
behavioral2/memory/1752-57-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1752-58-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1752-59-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1752-61-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack
behavioral2/memory/1752-62-0x0000000000400000-0x00000000004A8000-memory.dmp	family_darktrack

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe\""	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3516	powershell.exe
3212	powershell.exe
2580	powershell.exe
4052	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Windows security modification 2 TTPs 11 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe = "0"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe"	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
22	pastebin.com
23	pastebin.com

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

pid	Process
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 992 set thread context of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1052	992	WerFault.exe	81

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1232	timeout.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2580	powershell.exe
3212	powershell.exe
4052	powershell.exe
3516	powershell.exe
3212	powershell.exe
2580	powershell.exe
3516	powershell.exe
4052	powershell.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	aspnet_state.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1232	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	83
PID 992 wrote to memory of 1232	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	83
PID 992 wrote to memory of 1232	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	83
PID 992 wrote to memory of 3212	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	93
PID 992 wrote to memory of 3212	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	93
PID 992 wrote to memory of 3212	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	93
PID 992 wrote to memory of 2580	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	95
PID 992 wrote to memory of 2580	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	95
PID 992 wrote to memory of 2580	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	95
PID 992 wrote to memory of 4052	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	97
PID 992 wrote to memory of 4052	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	97
PID 992 wrote to memory of 4052	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	97
PID 992 wrote to memory of 3516	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	99
PID 992 wrote to memory of 3516	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	99
PID 992 wrote to memory of 3516	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	99
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 992 wrote to memory of 1752	992	4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe	101
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104
PID 1752 wrote to memory of 5104	1752	aspnet_state.exe	104

C:\Users\Admin\AppData\Local\Temp\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992
- C:\Windows\SysWOW64\timeout.exe
  timeout 4
  2⤵
  - Delays execution with timeout.exe
  PID:1232
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4e7cf999557893b08c6623c31c45b28d_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:5104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 1084
  2⤵
  - Program crash
  PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 992 -ip 992
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
9aedf9cf598b6b5dc469e56d8d0a06f5

SHA1
d441977f88313a3c45d947bf0faa2a1d118485a5

SHA256
244405bd3ac939a93faeaf9261b63e8be937e69e7f2ef90a4ba8dbbcbbc0fe72

SHA512
6dab16d4964469d111a237c909d77b0fd7002d160910b129cfdbd44d16f05ee5fd69262575e2a5a532b42824fbbb5ec1978a9ef23cd589abfc86ca312611afb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
85ca0e3a05db768da19f89033cbee518

SHA1
4eb118aeb1b5e8f10cee863d296bf72730e44cbb

SHA256
0f0f00df6a3990db94b0a9940e735bd122529c3f8f5ae55558e324bcf7d63064

SHA512
baa0033ddface3b5f89c2b72e5ef5ed710e82149e704a2755f835b24299d325469059b167a78379ceb6573f379b69aaac7cf0140aca296c98ff10373c0fd3da5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
28737dc49df8c9fef900ba861381ebc0

SHA1
59ae5e75c2c56df8f76239367c0220d91ce3920d

SHA256
d6c8b1483a891c89d457b096e17cea78e7b37d1396cabb46fe326f051a74b948

SHA512
4f30778f9494d7b94493caaac6bded742c985e85b795746d5291a2359ef6f533e4186b7130243edb3ea17fe81d59b23eb26e62b5dca6ecdc0a61b6fbdf064943

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2v1uaiv.eol.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/992-4-0x0000000004E80000-0x0000000004F38000-memory.dmp

Filesize
736KB

Download
memory/992-6-0x0000000005570000-0x0000000005B14000-memory.dmp

Filesize
5.6MB

Download
memory/992-5-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/992-3-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/992-2-0x0000000004DE0000-0x0000000004E7C000-memory.dmp

Filesize
624KB

Download
memory/992-112-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/992-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/992-1-0x0000000000380000-0x0000000000452000-memory.dmp

Filesize
840KB

Download
memory/1752-57-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1752-62-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1752-61-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1752-59-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/1752-58-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2580-25-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2580-124-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2580-110-0x0000000007460000-0x00000000074F6000-memory.dmp

Filesize
600KB

Download
memory/2580-108-0x00000000071E0000-0x00000000071FA000-memory.dmp

Filesize
104KB

Download
memory/2580-36-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2580-84-0x000000006F6A0000-0x000000006F6EC000-memory.dmp

Filesize
304KB

Download
memory/2580-12-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3212-26-0x0000000006320000-0x0000000006674000-memory.dmp

Filesize
3.3MB

Download
memory/3212-19-0x0000000006140000-0x00000000061A6000-memory.dmp

Filesize
408KB

Download
memory/3212-8-0x0000000002EE0000-0x0000000002F16000-memory.dmp

Filesize
216KB

Download
memory/3212-65-0x000000006F6A0000-0x000000006F6EC000-memory.dmp

Filesize
304KB

Download
memory/3212-20-0x00000000061B0000-0x0000000006216000-memory.dmp

Filesize
408KB

Download
memory/3212-9-0x0000000005A20000-0x0000000006048000-memory.dmp

Filesize
6.2MB

Download
memory/3212-85-0x0000000006DC0000-0x0000000006DDE000-memory.dmp

Filesize
120KB

Download
memory/3212-127-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3212-64-0x0000000007A00000-0x0000000007A32000-memory.dmp

Filesize
200KB

Download
memory/3212-10-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3212-13-0x0000000005940000-0x0000000005962000-memory.dmp

Filesize
136KB

Download
memory/3212-11-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3212-56-0x0000000006D70000-0x0000000006DBC000-memory.dmp

Filesize
304KB

Download
memory/3212-55-0x0000000006800000-0x000000000681E000-memory.dmp

Filesize
120KB

Download
memory/3516-113-0x0000000007780000-0x000000000778E000-memory.dmp

Filesize
56KB

Download
memory/3516-111-0x0000000007750000-0x0000000007761000-memory.dmp

Filesize
68KB

Download
memory/3516-115-0x0000000007890000-0x00000000078AA000-memory.dmp

Filesize
104KB

Download
memory/3516-109-0x00000000075C0000-0x00000000075CA000-memory.dmp

Filesize
40KB

Download
memory/3516-107-0x0000000007B90000-0x000000000820A000-memory.dmp

Filesize
6.5MB

Download
memory/3516-106-0x0000000007410000-0x00000000074B3000-memory.dmp

Filesize
652KB

Download
memory/3516-75-0x000000006F6A0000-0x000000006F6EC000-memory.dmp

Filesize
304KB

Download
memory/4052-114-0x0000000007600000-0x0000000007614000-memory.dmp

Filesize
80KB

Download
memory/4052-116-0x00000000076E0000-0x00000000076E8000-memory.dmp

Filesize
32KB

Download
memory/4052-86-0x000000006F6A0000-0x000000006F6EC000-memory.dmp

Filesize
304KB

Download
memory/5104-60-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download