af6a3a206daa66c291daac3dc17f29dd7d0e1504a92b6346b5c5fa252dcc3ef5

Resubmissions

30/05/2024, 20:32

240530-zblgdahd7x 10

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tthyperRuntimedhcpSvc.exe
Size

1.5MB
MD5

7a4073a468cf2d6ae2836893f467c81d
SHA1

ff54a200d4f6a1a696182f2cfde6e735b2580f37
SHA256

af6a3a206daa66c291daac3dc17f29dd7d0e1504a92b6346b5c5fa252dcc3ef5
SHA512

8df794241d4162850b5243b0844b3818a6ff010f2dda65bdae3a88a69e6f368c700c81997d781568652cb3b42ec98bd5d25ba86fec7d3b7a5856d459dba3bdd5
SSDEEP

24576:6Rcf6gYLRV8nJ4BMFvJw184tEAXQKQq6i0c:6cyloWgvJw1Zsi

Score

10^/10

execution spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1472	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4716	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2492	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3184	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3504	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4000	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3648	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2584	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4288	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	4432	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	468	4432	schtasks.exe	84

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4316	powershell.exe
4808	powershell.exe
1968	powershell.exe
4696	powershell.exe
1220	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	tthyperRuntimedhcpSvc.exe

Executes dropped EXE 1 IoCs

pid	Process
2820	unsecapp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\MSBuild\Microsoft\e1ef82546f0b02	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Windows Media Player\9e8d7a4ca61bd9	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backgroundTaskHost.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\eddb19405b7ce1	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe	tthyperRuntimedhcpSvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\unsecapp.exe	tthyperRuntimedhcpSvc.exe
File opened for modification	C:\Windows\Migration\WTR\unsecapp.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Windows\Migration\WTR\29c1c3cc0f7685	tthyperRuntimedhcpSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4716	schtasks.exe
1716	schtasks.exe
1108	schtasks.exe
2496	schtasks.exe
1472	schtasks.exe
3184	schtasks.exe
3504	schtasks.exe
4000	schtasks.exe
3648	schtasks.exe
2420	schtasks.exe
4288	schtasks.exe
468	schtasks.exe
2492	schtasks.exe
2584	schtasks.exe
2312	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings	tthyperRuntimedhcpSvc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe
2652	tthyperRuntimedhcpSvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	tthyperRuntimedhcpSvc.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	2820	unsecapp.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1968	2652	tthyperRuntimedhcpSvc.exe	100
PID 2652 wrote to memory of 1968	2652	tthyperRuntimedhcpSvc.exe	100
PID 2652 wrote to memory of 4808	2652	tthyperRuntimedhcpSvc.exe	101
PID 2652 wrote to memory of 4808	2652	tthyperRuntimedhcpSvc.exe	101
PID 2652 wrote to memory of 4316	2652	tthyperRuntimedhcpSvc.exe	102
PID 2652 wrote to memory of 4316	2652	tthyperRuntimedhcpSvc.exe	102
PID 2652 wrote to memory of 1220	2652	tthyperRuntimedhcpSvc.exe	103
PID 2652 wrote to memory of 1220	2652	tthyperRuntimedhcpSvc.exe	103
PID 2652 wrote to memory of 4696	2652	tthyperRuntimedhcpSvc.exe	104
PID 2652 wrote to memory of 4696	2652	tthyperRuntimedhcpSvc.exe	104
PID 2652 wrote to memory of 4428	2652	tthyperRuntimedhcpSvc.exe	110
PID 2652 wrote to memory of 4428	2652	tthyperRuntimedhcpSvc.exe	110
PID 4428 wrote to memory of 3980	4428	cmd.exe	112
PID 4428 wrote to memory of 3980	4428	cmd.exe	112
PID 4428 wrote to memory of 452	4428	cmd.exe	113
PID 4428 wrote to memory of 452	4428	cmd.exe	113
PID 4428 wrote to memory of 2820	4428	cmd.exe	118
PID 4428 wrote to memory of 2820	4428	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tthyperRuntimedhcpSvc.exe
"C:\Users\Admin\AppData\Local\Temp\tthyperRuntimedhcpSvc.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\unsecapp.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backgroundTaskHost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\fontdrvhost.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4696
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\iEhViyqa8z.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3980
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:452
- - C:\Windows\Migration\WTR\unsecapp.exe
    "C:\Windows\Migration\WTR\unsecapp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Media Player\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Users\Public\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Public\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4288

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\MSBuild\Microsoft\SppExtComObj.exe

Filesize
1.5MB

MD5
7a4073a468cf2d6ae2836893f467c81d

SHA1
ff54a200d4f6a1a696182f2cfde6e735b2580f37

SHA256
af6a3a206daa66c291daac3dc17f29dd7d0e1504a92b6346b5c5fa252dcc3ef5

SHA512
8df794241d4162850b5243b0844b3818a6ff010f2dda65bdae3a88a69e6f368c700c81997d781568652cb3b42ec98bd5d25ba86fec7d3b7a5856d459dba3bdd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e448fe0d240184c6597a31d3be2ced58

SHA1
372b8d8c19246d3e38cd3ba123cc0f56070f03cd

SHA256
c660f0db85a1e7f0f68db19868979bf50bd541531babf77a701e1b1ce5e6a391

SHA512
0b7f7eae7700d32b18eee3677cb7f89b46ace717fa7e6b501d6c47d54f15dff7e12b49f5a7d36a6ffe4c16165c7d55162db4f3621db545b6af638035752beab4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
496B

MD5
d98e03487c2bdab91270679ca24eda02

SHA1
8a471b9256bb4ddfcce85606e27797cb2fbc69cd

SHA256
03db3287e21797440f8c3d663d4258237f9f602c6a35a33f24a682263391cba8

SHA512
c277f640763b89625b08857961062a84525f77d63cdefa17d6e9ecd480c4f4bc0b2e27aac2feb41a5c7c4c1e0e82d007d25e8ca9eae6d80c01a978d26c4aebcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3yah31di.xc5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\iEhViyqa8z.bat

Filesize
213B

MD5
c61645c8b4b48af69f0ddc8ddf4650c8

SHA1
f9f35fa224675c7d100cf2b4097e1d19a52bddbe

SHA256
a908cf8e1ce331f5038703d937c474973130ade7862e7a2ad9f880b6149a54d8

SHA512
0c74f78a9666802a3209e7d6e8e9d3c2978440ccb7398ae9f9685e2f29c879e4bdefc31198816f5848b6a8447d1442088244e46c7404d4f0c04f178b41372733

Download Submit
memory/1220-48-0x0000026C4EB40000-0x0000026C4EB62000-memory.dmp

Filesize
136KB

Download
memory/2652-10-0x0000000002D70000-0x0000000002D88000-memory.dmp

Filesize
96KB

Download
memory/2652-13-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-17-0x0000000002D90000-0x0000000002D9C000-memory.dmp

Filesize
48KB

Download
memory/2652-19-0x0000000002DA0000-0x0000000002DAE000-memory.dmp

Filesize
56KB

Download
memory/2652-22-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-21-0x0000000002DB0000-0x0000000002DBC000-memory.dmp

Filesize
48KB

Download
memory/2652-23-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-24-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-25-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-26-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-27-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-15-0x0000000002D40000-0x0000000002D4E000-memory.dmp

Filesize
56KB

Download
memory/2652-12-0x0000000002D30000-0x0000000002D3E000-memory.dmp

Filesize
56KB

Download
memory/2652-0-0x00007FF9EBA33000-0x00007FF9EBA35000-memory.dmp

Filesize
8KB

Download
memory/2652-67-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-8-0x000000001B7B0000-0x000000001B800000-memory.dmp

Filesize
320KB

Download
memory/2652-7-0x0000000002D50000-0x0000000002D6C000-memory.dmp

Filesize
112KB

Download
memory/2652-5-0x0000000002D20000-0x0000000002D2E000-memory.dmp

Filesize
56KB

Download
memory/2652-3-0x00007FF9EBA30000-0x00007FF9EC4F1000-memory.dmp

Filesize
10.8MB

Download
memory/2652-2-0x0000000002BE0000-0x0000000002BE6000-memory.dmp

Filesize
24KB

Download
memory/2652-1-0x0000000000A10000-0x0000000000B94000-memory.dmp

Filesize
1.5MB

Download
memory/2820-113-0x00000000030D0000-0x00000000030D8000-memory.dmp

Filesize
32KB

Download