f589fcc7eadd141cd236de03b7fd786668017655a0adeb057cd343f95117a6f1

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24-06-2024 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de78f05822b58389a08df867280df451.exe
Size

38.8MB
MD5

de78f05822b58389a08df867280df451
SHA1

d27954678d26afb60dd51750f69520a79bf8b997
SHA256

f589fcc7eadd141cd236de03b7fd786668017655a0adeb057cd343f95117a6f1
SHA512

8374e56d7d3e8ced16e15cd8c34e7059feacb94964b4a50c22cbf6d3045f2c52119d0393f218d0d4b445afa6ce12f607c85b09b82859275d81ebc91880ebe5d2
SSDEEP

786432:DCyIg99ycT/7t7OB2K4oX5Znw0e7s0sjgTTb2:DCxg99yaTt7G2K4opd3e7s0sjy

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1664	powershell.exe
1428	powershell.exe
2056	powershell.exe
972	powershell.exe
3380	powershell.exe
3736	powershell.exe
736	powershell.exe
2228	powershell.exe
1052	powershell.exe
5028	powershell.exe
3256	powershell.exe
4508	powershell.exe
3888	powershell.exe
3380	powershell.exe
3888	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Executes dropped EXE 5 IoCs

Processes:

de78f05822b58389a08df867280df451.exewinsvc.exewinsvc.exeWINNET.EXEWINCFG.EXE

pid process

1612 de78f05822b58389a08df867280df451.exe
896 winsvc.exe
4028 winsvc.exe
4052 WINNET.EXE
1248 WINCFG.EXE
Power Settings 1 TTPs 5 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

5084 powercfg.exe
896 powercfg.exe
4464 powercfg.exe
408 powercfg.exe
4400 powercfg.exe

pid	process
1612	de78f05822b58389a08df867280df451.exe
896	winsvc.exe
4028	winsvc.exe
4052	WINNET.EXE
1248	WINCFG.EXE

pid	process
5084	powercfg.exe
896	powercfg.exe
4464	powercfg.exe
408	powercfg.exe
4400	powercfg.exe

Drops file in System32 directory 21 IoCs

Processes:

powershell.exepowershell.exewinsvc.exeWINNET.EXEde78f05822b58389a08df867280df451.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\wincfg.exe	winsvc.exe
File created	C:\Windows\system32\data\ntcp2.keys	WINNET.EXE
File created	C:\Windows\system32\data\destinations\q4f4cvnuv2txgyumxsygms6cc3zdqyrccivg4fgvjcthyx2yj3xa.dat	WINNET.EXE
File opened for modification	C:\Windows\System32\.co3A83.tmp	de78f05822b58389a08df867280df451.exe
File opened for modification	C:\Windows\system32\.co3A83.tmp	de78f05822b58389a08df867280df451.exe
File opened for modification	C:\Windows\system32\winnet.exe	winsvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\winsvc.exe	de78f05822b58389a08df867280df451.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\data\router.keys	WINNET.EXE
File created	C:\Windows\system32\data\ssu2.keys	WINNET.EXE
File created	C:\Windows\system32\data\router.info	WINNET.EXE
File opened for modification	C:\Windows\system32\data\router.info	WINNET.EXE

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

772 sc.exe
1428 sc.exe
1368 sc.exe
3696 sc.exe

pid	process
772	sc.exe
1428	sc.exe
1368	sc.exe
3696	sc.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Processes:

resource	yara_rule
C:\Windows\System32\winnet.exe	embeds_openssl

Kills process with taskkill 12 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3360	taskkill.exe
2780	taskkill.exe
1256	taskkill.exe
2696	taskkill.exe
3140	taskkill.exe
4112	taskkill.exe
3024	taskkill.exe
1260	taskkill.exe
3044	taskkill.exe
4580	taskkill.exe
844	taskkill.exe
4608	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exe

pid	process
3256	powershell.exe
3256	powershell.exe
3256	powershell.exe
3736	powershell.exe
3736	powershell.exe
3736	powershell.exe
4508	powershell.exe
4508	powershell.exe
4508	powershell.exe
736	powershell.exe
736	powershell.exe
736	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
1664	powershell.exe
1664	powershell.exe
1664	powershell.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
2056	powershell.exe
2056	powershell.exe
2056	powershell.exe
1052	powershell.exe
1052	powershell.exe
1052	powershell.exe
972	powershell.exe
972	powershell.exe
972	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe
4028	winsvc.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepowershell.exepowershell.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	3256	powershell.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	4508	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	2228	powershell.exe
Token: SeShutdownPrivilege	4400	powercfg.exe
Token: SeCreatePagefilePrivilege	4400	powercfg.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeShutdownPrivilege	5084	powercfg.exe
Token: SeCreatePagefilePrivilege	5084	powercfg.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeShutdownPrivilege	896	powercfg.exe
Token: SeCreatePagefilePrivilege	896	powercfg.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeShutdownPrivilege	4464	powercfg.exe
Token: SeCreatePagefilePrivilege	4464	powercfg.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeShutdownPrivilege	408	powercfg.exe
Token: SeCreatePagefilePrivilege	408	powercfg.exe
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	3140	taskkill.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	972	powershell.exe
Token: SeIncreaseQuotaPrivilege	972	powershell.exe
Token: SeSecurityPrivilege	972	powershell.exe
Token: SeTakeOwnershipPrivilege	972	powershell.exe
Token: SeLoadDriverPrivilege	972	powershell.exe
Token: SeSystemtimePrivilege	972	powershell.exe
Token: SeBackupPrivilege	972	powershell.exe
Token: SeRestorePrivilege	972	powershell.exe
Token: SeShutdownPrivilege	972	powershell.exe
Token: SeSystemEnvironmentPrivilege	972	powershell.exe
Token: SeUndockPrivilege	972	powershell.exe
Token: SeManageVolumePrivilege	972	powershell.exe
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	5028	powershell.exe
Token: SeIncreaseQuotaPrivilege	5028	powershell.exe
Token: SeSecurityPrivilege	5028	powershell.exe
Token: SeTakeOwnershipPrivilege	5028	powershell.exe
Token: SeLoadDriverPrivilege	5028	powershell.exe
Token: SeSystemtimePrivilege	5028	powershell.exe
Token: SeBackupPrivilege	5028	powershell.exe
Token: SeRestorePrivilege	5028	powershell.exe
Token: SeShutdownPrivilege	5028	powershell.exe
Token: SeSystemEnvironmentPrivilege	5028	powershell.exe
Token: SeUndockPrivilege	5028	powershell.exe
Token: SeManageVolumePrivilege	5028	powershell.exe
Token: SeDebugPrivilege	4112	taskkill.exe
Token: SeDebugPrivilege	3024	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	844	taskkill.exe
Token: SeDebugPrivilege	2780	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeDebugPrivilege	4608	taskkill.exe
Token: SeDebugPrivilege	1260	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

de78f05822b58389a08df867280df451.exede78f05822b58389a08df867280df451.exewinsvc.exepowershell.exepowershell.exepowershell.exepowershell.exewinsvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process	target process
PID 3064 wrote to memory of 1612	3064	de78f05822b58389a08df867280df451.exe	de78f05822b58389a08df867280df451.exe
PID 3064 wrote to memory of 1612	3064	de78f05822b58389a08df867280df451.exe	de78f05822b58389a08df867280df451.exe
PID 1612 wrote to memory of 896	1612	de78f05822b58389a08df867280df451.exe	winsvc.exe
PID 1612 wrote to memory of 896	1612	de78f05822b58389a08df867280df451.exe	winsvc.exe
PID 896 wrote to memory of 3256	896	winsvc.exe	powershell.exe
PID 896 wrote to memory of 3256	896	winsvc.exe	powershell.exe
PID 3256 wrote to memory of 1368	3256	powershell.exe	sc.exe
PID 3256 wrote to memory of 1368	3256	powershell.exe	sc.exe
PID 896 wrote to memory of 3736	896	winsvc.exe	powershell.exe
PID 896 wrote to memory of 3736	896	winsvc.exe	powershell.exe
PID 3736 wrote to memory of 3696	3736	powershell.exe	sc.exe
PID 3736 wrote to memory of 3696	3736	powershell.exe	sc.exe
PID 896 wrote to memory of 4508	896	winsvc.exe	powershell.exe
PID 896 wrote to memory of 4508	896	winsvc.exe	powershell.exe
PID 4508 wrote to memory of 772	4508	powershell.exe	sc.exe
PID 4508 wrote to memory of 772	4508	powershell.exe	sc.exe
PID 896 wrote to memory of 736	896	winsvc.exe	powershell.exe
PID 896 wrote to memory of 736	896	winsvc.exe	powershell.exe
PID 736 wrote to memory of 1428	736	powershell.exe	sc.exe
PID 736 wrote to memory of 1428	736	powershell.exe	sc.exe
PID 4028 wrote to memory of 3380	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 3380	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 3888	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 3888	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 2228	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 2228	4028	winsvc.exe	powershell.exe
PID 2228 wrote to memory of 4400	2228	powershell.exe	powercfg.exe
PID 2228 wrote to memory of 4400	2228	powershell.exe	powercfg.exe
PID 4028 wrote to memory of 1664	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 1664	4028	winsvc.exe	powershell.exe
PID 1664 wrote to memory of 5084	1664	powershell.exe	powercfg.exe
PID 1664 wrote to memory of 5084	1664	powershell.exe	powercfg.exe
PID 4028 wrote to memory of 1428	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 1428	4028	winsvc.exe	powershell.exe
PID 1428 wrote to memory of 896	1428	powershell.exe	powercfg.exe
PID 1428 wrote to memory of 896	1428	powershell.exe	powercfg.exe
PID 4028 wrote to memory of 2056	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 2056	4028	winsvc.exe	powershell.exe
PID 2056 wrote to memory of 4464	2056	powershell.exe	powercfg.exe
PID 2056 wrote to memory of 4464	2056	powershell.exe	powercfg.exe
PID 4028 wrote to memory of 1052	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 1052	4028	winsvc.exe	powershell.exe
PID 1052 wrote to memory of 408	1052	powershell.exe	powercfg.exe
PID 1052 wrote to memory of 408	1052	powershell.exe	powercfg.exe
PID 4028 wrote to memory of 3044	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3044	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 4580	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 4580	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 2696	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 2696	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3140	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3140	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 972	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 972	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 5028	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 5028	4028	winsvc.exe	powershell.exe
PID 4028 wrote to memory of 4112	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 4112	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3024	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3024	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3360	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 3360	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 844	4028	winsvc.exe	taskkill.exe
PID 4028 wrote to memory of 844	4028	winsvc.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451.exe
"C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3064

C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-fda26a68b720c374\de78f05822b58389a08df867280df451.exe
"C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-fda26a68b720c374\de78f05822b58389a08df867280df451.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\winsvc.exe
"C:\Windows\system32\winsvc.exe" "C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-fda26a68b720c374\de78f05822b58389a08df867280df451.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "create" "winsvc" "type=own" "start=auto" "error=ignore" "binPath=\"C:\Windows\system32\winsvc.exe\"" "DisplayName=\"Windows System Service\""
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" create winsvc type=own start=auto error=ignore binPath=C:\Windows\system32\winsvc.exe "DisplayName=Windows System Service"
5⤵
- Launches sc.exe
PID:1368

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "failure" "winsvc" "reset=0" "actions=restart/0/restart/0/restart/0"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" failure winsvc reset=0 actions=restart/0/restart/0/restart/0
5⤵
- Launches sc.exe
PID:3696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "description" "winsvc" "\"Windows System Service is the main system supervision service.\""
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" description winsvc "Windows System Service is the main system supervision service."
5⤵
- Launches sc.exe
PID:772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "\"C:\Windows\system32\sc.exe\"" "start" "winsvc"
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" start winsvc
5⤵
- Launches sc.exe
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,3595107284059830391,18018199024659337217,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
1⤵
PID:1652

C:\Windows\system32\winsvc.exe
C:\Windows\system32\winsvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\system32\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Add-MpPreference" "-ExclusionPath" "\"C:\Windows\Temp\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-SETACTIVE" "8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -SETACTIVE 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-ac" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change standby-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "standby-timeout-dc" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change standby-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-ac" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-ac 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "&" "powercfg.exe" "-change" "hibernate-timeout-dc" "0"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052

C:\Windows\system32\powercfg.exe
"C:\Windows\system32\powercfg.exe" -change hibernate-timeout-dc 0
3⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:408

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "winnet.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "winnet.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "wincfg.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "wincfg.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "Remove-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\""
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" "-WindowStyle" "Hidden" "-Command" "New-NetFirewallRule" "-DisplayName" "\"Windows Network Manager\"" "-Program" "\"C:\Windows\system32\winnet.exe\"" "-Action" "Allow" "-Direction" "Inbound" "-EdgeTraversalPolicy" "Allow" "-Enabled" "True"
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3360

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2780

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINCFG.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4608

C:\Windows\system32\taskkill.exe
"taskkill.exe" "/F" "/IM" "WINNET.exe"
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\WINDOWS\SYSTEM32\WINNET.EXE
"C:\WINDOWS\SYSTEM32\WINNET.EXE" "--datadir=C:\Windows\system32\data" "--precomputation.elgamal=false" "--persist.profiles=false" "--persist.addressbook=false" "--cpuext.aesni" "--cpuext.avx" "--ipv4" "--ipv6" "--bandwidth=X" "--share=100" "--floodfill" "--nat" "--upnp.enabled=true" "--upnp.name=Microsoft" "--insomnia" "--nettime.enabled=true" "--nettime.ntpsyncinterval=1" "--sam.enabled=true" "--sam.singlethread=false" "--http.enabled=false" "--bob.enabled=false" "--httpproxy.enabled=false" "--socksproxy.enabled=false" "--i2cp.enabled=false" "--i2pcontrol.enabled=false" "--loglevel=none" "--log=stdout"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4052

C:\WINDOWS\SYSTEM32\WINCFG.EXE
"C:\WINDOWS\SYSTEM32\WINCFG.EXE"
2⤵
- Executes dropped EXE
PID:1248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
a6c9d692ed2826ecb12c09356e69cc09

SHA1
def728a6138cf083d8a7c61337f3c9dade41a37f

SHA256
a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

SHA512
2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bybmvevd.ier.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\de78f05822b58389a08df867280df451-fda26a68b720c374\de78f05822b58389a08df867280df451.exe
Filesize
42.5MB

MD5
18c3c899c9a4b44417d8153a948ae5ca

SHA1
8560c64c60ce15cb849b031d0690793e8b8793ec

SHA256
01e5fb6db31037b5e6f6ac1839d556c806b3fbdb31c2b4f5a7c19734e5420c70

SHA512
d058c166ca467978ce69b5a7ae16bd85c190ff9de562c020214c81e255e1ea0cecd132683d38302ac1cdb8f1399d89dd85d33fdf3b5a243812dd510fb1556cf4

Download Submit
C:\WINDOWS\SYSTEM32\WINCFG.EXE
Filesize
34.7MB

MD5
b969b295f08994b53015e7b0807ed43f

SHA1
e67a88f291df370105130dbe28e4798a8a8906ae

SHA256
513db022bfe45ca351ca8eb72b22389703b0d4932a64d144d00d616d89c24b83

SHA512
3fc4577ad19deeb5a39691ff58e4190dd3b1447a308cbddb8193301605e124ed7a59c91a63007fc9a04d46da2b7bb50d992a7a5ad50d2b9723252c9f687e7a7b

Download Submit
C:\Windows\System32\data\router.info
Filesize
931B

MD5
928763045152a88b2a6e5b2534c15ca2

SHA1
b297a0254d35d4abbb87947b3c31563a1edbe6e5

SHA256
a4f97be1752534eecc95d231ad73792758e169f0f8313556e13972f234fbbe8b

SHA512
765bb87b89b5ada3e827105124b9871ad2f5f8cce43a10a0415d5fb01be547d809b8cfdb9c071745a2d86f0538605a7329fc29e0e7ae6b09176a5a16b4d27845

Download Submit
C:\Windows\System32\winnet.exe
Filesize
9.1MB

MD5
2fdbf4ba6ab24cf44aa0cc08cd77ca66

SHA1
df5e034ba45a932b9f5d3ed7adc4a71e0b376984

SHA256
fcd362e0632b35dad13a87f09ea6da4d07fa89516f42d64236d2cc3e3b2b725b

SHA512
81d73f7540ede7337922dc18fc6b110c87f621bc0349c3fa17f50d1cb924b0d9b30a4a772b2d548238b65a1be43d458f1991320e7308e608c6cf40ccc3e59a51

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
4KB

MD5
7b1fe6890101f73a0c9796d8d585b168

SHA1
56eb99ee341b880cf7a80ebc705371aea87b3743

SHA256
93ea56ad38069dbc3d1ae192afd3f3dc8704e9298752f73729b95cf3298dcaca

SHA512
fe73cccfadc916f613fbcc7a80ec82ae1228ea2aa28bba4515851e82463e76942ff3a3d6bcc78ea666a841d89220fb49b8fa52279985e88fe0aec6728f21aefa

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
2722730a0cf82161fb1452b600334796

SHA1
4479415f50cd9ab55c4f7bcdc1a0a5177492f053

SHA256
a44ba59eb52b4d6555065fa840ac7162080eb538e6b6a47198fe4961d0297833

SHA512
54ec97b79003db56fb1ca44b33a1c2a9748014a3c1dc84fdb2afca84d3c6618ad88ccb353d52078789e3e0ed0ee6c763a74bf34cea1334e427a264db9171dfb0

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
432d76a8e9150e0bc7b02dba789b034f

SHA1
52d55441ee954e9b169266e5da02972692518e1a

SHA256
918004fb90d3a1017f2c914f26b2c07c63df5197f7248c554b93c35c8a4fefc6

SHA512
9ae0432d1a134fac4c2c39909fcc7a623171a2aead62554d9cedd7bd9e1d526960c9499d32785b454c1c829328af58c306fea080cf205572ec7ea0cf488910fa

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
f3acacde0a846542e5c6e79343d773c7

SHA1
e264a96d9fc8399e2f782bedad1a0e1a8e603b51

SHA256
2eac87d3cec3fa785351ebecbf173b7777afa5fc4563f42ed043afc09c68da20

SHA512
f20c90cfb737f954a0cd51386144c7e6785d129c40f95bc10579867a072c2df11835e65393f9045aa3f81e7ab459214841b6fa9112303e31a949c6bbd27d29a4

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
8857491a4a65a9a1d560c4705786a312

SHA1
4f3caf2ad5d66a2410c9cca0381d26a46e832cb4

SHA256
b6e1a16a11075cb4e0bae0cebdb6ac15f5d66e0005f557703708a04cd11bd360

SHA512
d9497c47898cdc4c4fc62158830dc931990e08bb4a28a5d19d4187a87a2afab8a4bd58ca346563210b476c9adb9a714bfe1057e0ebce85d1fd94731be6d02660

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
29442acfcea052903b5c4f857ba3eefa

SHA1
f9ecae4f723437cd30b00a731afa954acb2f49c6

SHA256
9fec71c3a64bb88903871778fb3abb83f784a8b07ddbd2a65cdae5601ae3d887

SHA512
60120eb6ff9b43db358aa5ccc578be3a4bcab7d8569f6cdbede3e5c50782cee39b53d3399bf14f2596871c69363d8dd0662f3611283ac09bf2b75fd2d22361e9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2ad33642f863ae14ee53bc6853ee330e

SHA1
ca81cc7d8c33a46ebe97bc1d3db55e41a813029e

SHA256
17c7b3c895766071a0d87318ec4134a9032ed113b46d3ba75889819a61a9cc19

SHA512
52c59a7bde3751e07da53f3942c15cc3e19a4bf1929fbc28ae568ed96531852747b4f724e01438e159c4c98bf2d846db205c48e32f4b5984e9fddeb936eb8aa9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
96e66c6151c6ef0aa0810f6b2896f65b

SHA1
0191114d00782a6fe104cb07f1797238ee5e0136

SHA256
22074d71dbf4636080ee3b4af53612f2f1c6b0fd1dfb2e18893d267e60f3d06d

SHA512
e7999e91eafe60a06366ec10565265f5517fd5f8f5fceb2ef86816752b6ed1700c80a49babd84e1beab63413e71a8637174438a4dfe6f0bcc846641d83fad982

Download Submit
memory/972-215-0x000001797F8C0000-0x000001797F8DA000-memory.dmp

Filesize
104KB

Download
memory/972-214-0x000001797F860000-0x000001797F86E000-memory.dmp

Filesize
56KB

Download
memory/3256-18-0x000002A62B520000-0x000002A62B542000-memory.dmp

Filesize
136KB

Download
memory/3380-98-0x000001E8712A0000-0x000001E8712A8000-memory.dmp

Filesize
32KB

Download
memory/3380-100-0x000001E8712E0000-0x000001E8712EA000-memory.dmp

Filesize
40KB

Download
memory/3380-99-0x000001E8712D0000-0x000001E8712D6000-memory.dmp

Filesize
24KB

Download
memory/3380-97-0x000001E8712F0000-0x000001E87130A000-memory.dmp

Filesize
104KB

Download
memory/3380-96-0x000001E871290000-0x000001E87129A000-memory.dmp

Filesize
40KB

Download
memory/3380-95-0x000001E8712B0000-0x000001E8712CC000-memory.dmp

Filesize
112KB

Download
memory/3380-94-0x000001E86EDA0000-0x000001E86EDAA000-memory.dmp

Filesize
40KB

Download
memory/3380-93-0x000001E871090000-0x000001E871145000-memory.dmp

Filesize
724KB

Download
memory/3380-92-0x000001E871070000-0x000001E87108C000-memory.dmp

Filesize
112KB

Download
memory/4028-69-0x00007FF72F690000-0x00007FF72F6A0000-memory.dmp

Filesize
64KB

Download
memory/4028-68-0x00007FF72F680000-0x00007FF72F690000-memory.dmp

Filesize
64KB

Download
memory/4052-278-0x00007FF609DD0000-0x00007FF60A6FC000-memory.dmp

Filesize
9.2MB

Download