Overview

overview

7

Static

static

10

Ultimate Tweaks.exe

windows7-x64

7

Ultimate Tweaks.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

Ultimate Tweaks.exe

windows7-x64

1

Ultimate Tweaks.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

3

resources/elevate.exe

windows10-2004-x64

3

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...7z.dll

windows7-x64

3

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • submitted
    11/07/2024, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ultimate Tweaks.exe
  • Sample240711-wwpsraybql
Score
7/10
execution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 60 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
    "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
      "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1668 --field-trial-handle=1728,i,2206644298330825004,12810255971596741461,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
      2⤵
        PID:3508
      • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
        "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --mojo-platform-channel-handle=2008 --field-trial-handle=1728,i,2206644298330825004,12810255971596741461,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
        2⤵
          PID:3684
        • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
          "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2396 --field-trial-handle=1728,i,2206644298330825004,12810255971596741461,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
          2⤵
          • Checks computer location settings
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:1668
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "chcp"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3564
            • C:\Windows\system32\chcp.com
              chcp
              4⤵
                PID:5056
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4120
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3056
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2740
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1220
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2088
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2420
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4904
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3688
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2268
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4648
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1592
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3056
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:924
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2636
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4212
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4696
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2468
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4648
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:728
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2100
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1168
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2268
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1000
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:452
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4100
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1604
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:968
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:2940
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4176
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:640
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:208
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4784
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4116
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4440
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4552
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2524
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2664
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2756
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1116
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4332
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3960
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1784
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4564
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2576
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2664
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4368
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1472
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:228
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3096
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3756
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1708
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1604
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4212
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3460
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4420
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2288
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1780
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2044
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2056
          • C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe
            "C:\Users\Admin\AppData\Local\Temp\Ultimate Tweaks.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Ultimate Tweaks" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1172 --field-trial-handle=1728,i,2206644298330825004,12810255971596741461,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
            2⤵
              PID:376

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 3KB
                • SHA256 5a48860ad5bdf15d7a241aa16124163ec48adc0f0af758e43561ac07e4f163b2
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 4ea873fb3d77a2f8eefae82c943f621f16723516e181bde133568f8f0c91290c
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 66f7c6207155d64aaddc5435df6cbb1ea42eb70af306786eebf1eb6e0d689f86
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 65871b63ad5fa521b2b646056ecda5ce8404ab3eebe16bdcee34078fcac20dcb
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 8056b36e544e7968ce4c020a4d69b67402fff68af49436d8196f2bc4b0971485
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 783b10abe2769fcf7ddd863acc526d4890c3b4575c4749b53560db053a24df7a
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 104B
                • SHA256 669bebb6086fb3e2f63d49b364e6a27f853e216dd0f24f9f94b2f957a72620d9
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 ecd1c98607751a2881b937b92114f54e1156d0c559fc70e96db5a501b51a81e0
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 2b13c9abece19514d0599ebdcec7ed9361045d7739e9e9d64bf4b417660b9194
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 104B
                • SHA256 c212a791ea66edb958f897f5274df86916619d30950626aea2ddf097c85fd243
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 c24bde0f7d17546dc4f4ea4b71c0f32f65869346839b078f769bd52e80d39d02
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 d111416eb6f1b483916bb32fe0e96750d187831227b560a23af55ca03e15d57f
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 176B
                • SHA256 ab94e284400050eb9e33149c3bab63ce20cffac31ab721676d9e1c5220af4562
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 3ab496f0c0bea27beeb465e519677e273a35ecce40d8981eadc24fd51917adde
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 e223bece0470aaf31ae6a7bbcb5e392b6d643c124312581e22ca8597d153d33f
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 ac4d373cf9674d34a47ae79350bbb17677d88972f0d065efdc2194e4027a139b
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 b782cdaffcef8a9b747fb638091d9dd4ebce158203f229d009f66e0b49298f08
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 80e6d1e2dad5aa8e835fdd98ad1f64efeebedab9eedcd35ab77c36119fb5e47f
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 104B
                • SHA256 30452104e27f755b1e8cb62adbc8cedcc5a69a5fe4ab1357b375c40227e0feae
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 ecb062f707cf5a4e81df37e42615abe0ca79d90afcfee28fff6153e7fee3a157
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 a8a26dc016f7ed98f7c20d3a19a17c20bc357671caf801a2071770c51de144dc
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 64B
                • SHA256 d959ead78917087e70d72425b7da352277221e16227ce63a07b5690bf2f97839
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 1a4bcd7c82e7e763f036fb3471be5e0014187ff51abf2b07de96802302b64aa2
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 a9e74f3d1752c23ad85b75bfc6384d9fc19028ef8097aab93d5edbde9bd93885
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 f5e1997de3937a16df783c011390f226604f6f004cafc295e36e3ec5b6403ef1
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 6728c35f56b73daba878fe8eae923420c0686ac3daef799d247e482e9163eafa
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 0583b26e4ebb2d0a45f250d10744ac8c83b5dcf8267daae4f5b4cb06777464de
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 176B
                • SHA256 13c7101180418b09a529ad4b5e8437427dd510d13867074707e2acff1de6ea25
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 2c2ade2708f5bdb20ccea96c24a4d3ee4a5989750dd07b8ad308e410d58104b8
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 0e760532df8c8a7640b9655189601c967df977715ec12344ca72b0aa44e06d2d
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 3d79e149ed087178dbbce516388d690d46fc57012d9e5993c789c6e798ad8243
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 104B
                • SHA256 3e14f18f7c6a78c5092731f529fd0a009438b42fccf11d4c448e716c5011b743
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 596baf4fdf7696f187272236f4ec6de74a1b08a6aa8dd56edf58a1a64e68ba8e
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 ac20a3e877e928c28eeb70de43f9d5fd735225bb0323db2e14f6cc6d72d4b1b0
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 a82831e7990095ac0b19e4fe315414817b36adebddd910d2fb29fd40f3c7ee00
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 aba661b082cebae8ab0a7d9375fae10e3cc87841689552a465d9cfff4d5f630f
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 2b08807b745fc13505838906db90357dad1a150146318b0a1bcfb2e492eeea21
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 2KB
                • SHA256 77f080d815a42f896f34265874e8940fe76e1e97831c0a4f58493667e7fd9291
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-Interactive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                • Size 104B
                • SHA256 0152026317860bf57ee02d6248c3db3b054cbda85adb54b6b4f2c5e2d4755714
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_o25khtpz.2l3.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o25khtpz.2l3.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                default.dic
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                • Size 2B
                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State
                • Size 967B
                • SHA256 1824ed48375545735d6e2808130f50176344e202ec969c6ff4a1af94eefde0d6
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State~RFe58af75.TMP
                • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Network\Network Persistent State~RFe58af75.TMP
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences
                • Size 57B
                • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
                • MD5 SHA1 SHA512
                Submit Download

                Preferences~RFe57c37f.TMP
                • Path C:\Users\Admin\AppData\Roaming\Ultimate Tweaks\Preferences~RFe57c37f.TMP
                • Size 86B
                • SHA256 8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
                • MD5 SHA1 SHA512
                Submit Download

                memory/376-740-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-734-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-739-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-738-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-737-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-736-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-735-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-729-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-730-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/376-728-0x000002698E270000-0x000002698E271000-memory.dmp
                Download

                memory/3056-96-0x000001F7C7ED0000-0x000001F7C7EF4000-memory.dmp
                Download

                memory/3056-95-0x000001F7C7ED0000-0x000001F7C7EFA000-memory.dmp
                Download

                memory/3056-70-0x000001F7AF220000-0x000001F7AF242000-memory.dmp
                Download

                memory/4120-90-0x000002BCFAC00000-0x000002BCFAC76000-memory.dmp
                Download

                memory/4120-89-0x000002BCFA910000-0x000002BCFA954000-memory.dmp
                Download