Analysis

  • max time kernel
    95s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-08-2024 02:04

General

  • Target

    MediaCreationTool.bat

  • Size

    129KB

  • MD5

    998ca6b423965b3a357e57c27a4a850b

  • SHA1

    b18a2ad0999bf7a9f898d771503020eacb5d617d

  • SHA256

    4b1486451a42cfc8d1372026c91ac09ae47bd010ec88d0233b93c0f4f8113296

  • SHA512

    23b63cb6c0beca86bdbef612dbfe3150ed6295e5987843e3ead36b038133f17cbf0860aef28fc3b3021056afac2996bc2eca1d35186a4a9c934a995ecfaef6e8

  • SSDEEP

    3072:ISME2DYVQ2w33dFepssMCy6nMuumU6VxjuBxpro2A+N/Lhu:ISME2DYVQV33dFmDnMuumNuDprTw

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Download via BitsAdmin 1 TTPs 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

  • Drops file in Windows directory 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MediaCreationTool.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Windows\system32\chcp.com
      chcp 437
      2⤵
        PID:1000
      • C:\Windows\system32\reg.exe
        reg add HKCU\Console /v ForceV2 /d 0x01 /t reg_dword /f
        2⤵
        • Modifies registry key
        PID:372
      • C:\Windows\system32\reg.exe
        reg add "HKCU\Console\MCT" /v ScreenColors /d 31 /t reg_dword /f
        2⤵
          PID:1592
        • C:\Windows\system32\reg.exe
          reg add "HKCU\Console\MCT" /v ColorTable00 /d 0x000000 /t reg_dword /f
          2⤵
            PID:3100
          • C:\Windows\system32\reg.exe
            reg add "HKCU\Console\MCT" /v ColorTable08 /d 0x767676 /t reg_dword /f
            2⤵
              PID:4500
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Console\MCT" /v ColorTable01 /d 0x9e5a00 /t reg_dword /f
              2⤵
                PID:3772
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Console\MCT" /v ColorTable09 /d 0xff783b /t reg_dword /f
                2⤵
                  PID:4008
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Console\MCT" /v ColorTable02 /d 0x0ea113 /t reg_dword /f
                  2⤵
                    PID:640
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Console\MCT" /v ColorTable10 /d 0x0cc616 /t reg_dword /f
                    2⤵
                      PID:1344
                    • C:\Windows\system32\reg.exe
                      reg add "HKCU\Console\MCT" /v ColorTable03 /d 0xdd963a /t reg_dword /f
                      2⤵
                        PID:3636
                      • C:\Windows\system32\reg.exe
                        reg add "HKCU\Console\MCT" /v ColorTable11 /d 0xd6d661 /t reg_dword /f
                        2⤵
                          PID:4208
                        • C:\Windows\system32\reg.exe
                          reg add "HKCU\Console\MCT" /v ColorTable04 /d 0x1f0fc5 /t reg_dword /f
                          2⤵
                            PID:4900
                          • C:\Windows\system32\reg.exe
                            reg add "HKCU\Console\MCT" /v ColorTable12 /d 0x5648e7 /t reg_dword /f
                            2⤵
                              PID:4264
                            • C:\Windows\system32\reg.exe
                              reg add "HKCU\Console\MCT" /v ColorTable05 /d 0x981788 /t reg_dword /f
                              2⤵
                                PID:3292
                              • C:\Windows\system32\reg.exe
                                reg add "HKCU\Console\MCT" /v ColorTable13 /d 0x9e00b4 /t reg_dword /f
                                2⤵
                                  PID:2104
                                • C:\Windows\system32\reg.exe
                                  reg add "HKCU\Console\MCT" /v ColorTable06 /d 0x009cc1 /t reg_dword /f
                                  2⤵
                                    PID:5032
                                  • C:\Windows\system32\reg.exe
                                    reg add "HKCU\Console\MCT" /v ColorTable14 /d 0xa5f1f9 /t reg_dword /f
                                    2⤵
                                      PID:1328
                                    • C:\Windows\system32\reg.exe
                                      reg add "HKCU\Console\MCT" /v ColorTable07 /d 0xcccccc /t reg_dword /f
                                      2⤵
                                        PID:4908
                                      • C:\Windows\system32\reg.exe
                                        reg add "HKCU\Console\MCT" /v ColorTable15 /d 0xffffff /t reg_dword /f
                                        2⤵
                                          PID:2356
                                        • C:\Windows\system32\reg.exe
                                          reg add "HKCU\Console\MCT" /v QuickEdit /d 0x0000 /t reg_dword /f
                                          2⤵
                                            PID:1640
                                          • C:\Windows\system32\reg.exe
                                            reg add "HKCU\Console\MCT" /v LineWrap /d 0 /t reg_dword /f
                                            2⤵
                                              PID:3244
                                            • C:\Windows\system32\reg.exe
                                              reg add "HKCU\Console\MCT" /v LineSelection /d 0x0001 /t reg_dword /f
                                              2⤵
                                                PID:3252
                                              • C:\Windows\system32\reg.exe
                                                reg add "HKCU\Console\MCT" /v CtrlKeyShortcutsDisabled /d 0 /t reg_dword /f
                                                2⤵
                                                  PID:740
                                                • C:\Windows\system32\reg.exe
                                                  reg add "HKCU\Console\MCT" /v WindowSize /d 2097272 /t reg_dword /f
                                                  2⤵
                                                    PID:3296
                                                  • C:\Windows\system32\reg.exe
                                                    reg add "HKCU\Console\MCT" /v ScreenBufferSize /d 655294584 /t reg_dword /f
                                                    2⤵
                                                      PID:3176
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKCU\Console\MCT" /v FontSize /d 0x00100008 /t reg_dword /f
                                                      2⤵
                                                        PID:228
                                                      • C:\Windows\system32\reg.exe
                                                        reg add "HKCU\Console\MCT" /v FaceName /d "Consolas" /t reg_sz /f
                                                        2⤵
                                                          PID:1728
                                                        • C:\Windows\System32\attrib.exe
                                                          attrib -R -S -H "C:\ESD"
                                                          2⤵
                                                          • Views/modifies file attributes
                                                          PID:1060
                                                        • C:\Windows\System32\Robocopy.exe
                                                          robocopy "C:\Users\Admin\AppData\Local\Temp\/" "C:\ESD/" "MediaCreationTool.bat"
                                                          2⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2380
                                                        • C:\Windows\System32\cmd.exe
                                                          cmd /d /x /c set "ROOT=C:\Users\Admin\AppData\Local\Temp" & call "C:\ESD\MediaCreationTool.bat" set
                                                          2⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1724
                                                          • C:\Windows\System32\chcp.com
                                                            chcp 437
                                                            3⤵
                                                              PID:1284
                                                            • C:\Windows\System32\attrib.exe
                                                              attrib -R -S -H "C:\ESD"
                                                              3⤵
                                                              • Views/modifies file attributes
                                                              PID:2896
                                                            • C:\Windows\System32\Robocopy.exe
                                                              robocopy "C:\ESD\/" "C:\ESD/" "MediaCreationTool.bat"
                                                              3⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4868
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c echo prompt $h$s$h:|cmd /d
                                                              3⤵
                                                                PID:5104
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo prompt $h$s$h:"
                                                                  4⤵
                                                                    PID:3120
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd /d
                                                                    4⤵
                                                                      PID:2016
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuildNumber" /se "|" 2>nul
                                                                    3⤵
                                                                      PID:664
                                                                      • C:\Windows\System32\reg.exe
                                                                        reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentBuildNumber" /se "|"
                                                                        4⤵
                                                                          PID:3668
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "DisplayVersion" /se "|" 2>nul
                                                                        3⤵
                                                                          PID:3600
                                                                          • C:\Windows\System32\reg.exe
                                                                            reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "DisplayVersion" /se "|"
                                                                            4⤵
                                                                              PID:804
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "EditionID" /se "|" 2>nul
                                                                            3⤵
                                                                              PID:1392
                                                                              • C:\Windows\System32\reg.exe
                                                                                reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "EditionID" /se "|"
                                                                                4⤵
                                                                                  PID:2520
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName" /se "|" 2>nul
                                                                                3⤵
                                                                                  PID:3076
                                                                                  • C:\Windows\System32\reg.exe
                                                                                    reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductName" /se "|"
                                                                                    4⤵
                                                                                      PID:2476
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c reg query "HKU\S-1-5-18\Control Panel\Desktop\MuiCached" /v "MachinePreferredUILanguages" /se "|" 2>nul
                                                                                    3⤵
                                                                                      PID:1556
                                                                                      • C:\Windows\System32\reg.exe
                                                                                        reg query "HKU\S-1-5-18\Control Panel\Desktop\MuiCached" /v "MachinePreferredUILanguages" /se "|"
                                                                                        4⤵
                                                                                          PID:4932
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c cmd /q /v:on /c echo !.:~2,1!
                                                                                        3⤵
                                                                                          PID:4060
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            cmd /q /v:on /c echo !.:~2,1!
                                                                                            4⤵
                                                                                              PID:720
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c cmd /q /v:on /c echo !.:~2,1!
                                                                                            3⤵
                                                                                              PID:3516
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                cmd /q /v:on /c echo !.:~2,1!
                                                                                                4⤵
                                                                                                  PID:3432
                                                                                              • C:\Windows\System32\findstr.exe
                                                                                                findstr /c:\ /a:f0 " Detected Media "\..\c nul
                                                                                                3⤵
                                                                                                  PID:1300
                                                                                                • C:\Windows\System32\findstr.exe
                                                                                                  findstr /c:\ /a:6f " en-US "\..\c nul
                                                                                                  3⤵
                                                                                                    PID:3144
                                                                                                  • C:\Windows\System32\findstr.exe
                                                                                                    findstr /c:\ /a:9f " Professional "\..\c nul
                                                                                                    3⤵
                                                                                                      PID:1672
                                                                                                    • C:\Windows\System32\findstr.exe
                                                                                                      findstr /c:\ /a:2f " x64 "\..\c nul
                                                                                                      3⤵
                                                                                                        PID:4120
                                                                                                      • C:\Windows\System32\findstr.exe
                                                                                                        findstr /c:\ /a:1f "1 Auto Upgrade : MCT gets detected media, script assists setupprep for upgrading "\..\c nul
                                                                                                        3⤵
                                                                                                          PID:2440
                                                                                                        • C:\Windows\System32\findstr.exe
                                                                                                          findstr /c:\ /a:1f "2 Auto ISO : MCT gets detected media, script assists making ISO here | C:ESD "\..\c nul
                                                                                                          3⤵
                                                                                                            PID:4340
                                                                                                          • C:\Windows\System32\findstr.exe
                                                                                                            findstr /c:\ /a:1f "3 Auto USB : MCT gets detected media, script assists making USB stick target "\..\c nul
                                                                                                            3⤵
                                                                                                              PID:2480
                                                                                                            • C:\Windows\System32\findstr.exe
                                                                                                              findstr /c:\ /a:1f "4 Select : MCT gets selected Edition, Language, Arch onto specified target "\..\c nul
                                                                                                              3⤵
                                                                                                                PID:4432
                                                                                                              • C:\Windows\System32\findstr.exe
                                                                                                                findstr /c:\ /a:1f "5 MCT Defaults : MCT runs unassisted, creating media without script modification "\..\c nul
                                                                                                                3⤵
                                                                                                                  PID:3132
                                                                                                                • C:\Windows\System32\findstr.exe
                                                                                                                  findstr /c:\ /a:17 "1-4 adds to media: PID.txt, EI.cfg, $ISO$ dir, auto.cmd for upgrade and tpm checks "\..\c nul
                                                                                                                  3⤵
                                                                                                                    PID:4092
                                                                                                                  • C:\Windows\System32\findstr.exe
                                                                                                                    findstr /c:\ /a:17 "can rename script: "\..\c nul
                                                                                                                    3⤵
                                                                                                                      PID:4848
                                                                                                                    • C:\Windows\System32\findstr.exe
                                                                                                                      findstr /c:\ /a:1f "def MediaCreationTool.bat"\..\c nul
                                                                                                                      3⤵
                                                                                                                        PID:1980
                                                                                                                      • C:\Windows\System32\findstr.exe
                                                                                                                        findstr /c:\ /a:17 " to always create unmodified MCT media "\..\c nul
                                                                                                                        3⤵
                                                                                                                          PID:1856
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c powershell -nop -c ";$f0=[io.file]::ReadAllText($env:0); $0=($f0-split '#\:CHOICES2\:' ,3)[1]; $1=$env:1-replace'([`@$])','`$1'; iex($0+$1)"
                                                                                                                          3⤵
                                                                                                                            PID:4460
                                                                                                                            • C:\Windows\System32\windowspowershell\v1.0\powershell.exe
                                                                                                                              powershell -nop -c ";$f0=[io.file]::ReadAllText($env:0); $0=($f0-split '#\:CHOICES2\:' ,3)[1]; $1=$env:1-replace'([`@$])','`$1'; iex($0+$1)"
                                                                                                                              4⤵
                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3856
                                                                                                                          • C:\Windows\System32\fltMC.exe
                                                                                                                            fltmc
                                                                                                                            3⤵
                                                                                                                              PID:3712
                                                                                                                            • C:\Windows\System32\attrib.exe
                                                                                                                              attrib -R -S -H "C:\ESD" /D
                                                                                                                              3⤵
                                                                                                                              • Views/modifies file attributes
                                                                                                                              PID:2004
                                                                                                                            • C:\Windows\System32\findstr.exe
                                                                                                                              findstr /c:\ /a:f0 " Windows 10 Version "\..\c nul
                                                                                                                              3⤵
                                                                                                                                PID:3960
                                                                                                                              • C:\Windows\System32\findstr.exe
                                                                                                                                findstr /c:\ /a:5f " 1803 "\..\c nul
                                                                                                                                3⤵
                                                                                                                                  PID:1728
                                                                                                                                • C:\Windows\System32\findstr.exe
                                                                                                                                  findstr /c:\ /a:f1 " 17134.112.180619-1212.rs4_release_svc_refresh "\..\c nul
                                                                                                                                  3⤵
                                                                                                                                    PID:332
                                                                                                                                  • C:\Windows\System32\findstr.exe
                                                                                                                                    findstr /c:\ /a:6f " en-US "\..\c nul
                                                                                                                                    3⤵
                                                                                                                                      PID:3020
                                                                                                                                    • C:\Windows\System32\findstr.exe
                                                                                                                                      findstr /c:\ /a:9f " Consumer "\..\c nul
                                                                                                                                      3⤵
                                                                                                                                        PID:1060
                                                                                                                                      • C:\Windows\System32\findstr.exe
                                                                                                                                        findstr /c:\ /a:2f " x64 "\..\c nul
                                                                                                                                        3⤵
                                                                                                                                          PID:1504
                                                                                                                                        • C:\Windows\System32\windowspowershell\v1.0\powershell.exe
                                                                                                                                          powershell -nop -c ";$f0=[io.file]::ReadAllText($env:0); $0=($f0-split '#\:DOWNLOAD\:' ,3)[1]; $1=$env:1-replace'([`@$])','`$1'; iex($0+$1)"
                                                                                                                                          3⤵
                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:4408
                                                                                                                                          • C:\Windows\System32\bitsadmin.exe
                                                                                                                                            "C:\Windows\System32\bitsadmin.exe" /transfer 638587659788329374 /priority foreground http://software-download.microsoft.com/download/pr/MediaCreationTool1803.exe C:\ESD\MCT\MediaCreationTool1803.exe
                                                                                                                                            4⤵
                                                                                                                                            • Download via BitsAdmin
                                                                                                                                            PID:3696
                                                                                                                                          • C:\Windows\System32\bitsadmin.exe
                                                                                                                                            "C:\Windows\System32\bitsadmin.exe" /transfer 638587659807860838 /priority foreground https://software-download.microsoft.com/download/pr/MediaCreationTool1803.exe C:\ESD\MCT\MediaCreationTool1803.exe
                                                                                                                                            4⤵
                                                                                                                                            • Download via BitsAdmin
                                                                                                                                            PID:4060
                                                                                                                                        • C:\Windows\System32\windowspowershell\v1.0\powershell.exe
                                                                                                                                          powershell -nop -c ";$f0=[io.file]::ReadAllText($env:0); $0=($f0-split '#\:DOWNLOAD\:' ,3)[1]; $1=$env:1-replace'([`@$])','`$1'; iex($0+$1)"
                                                                                                                                          3⤵
                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:924
                                                                                                                                        • C:\Windows\System32\expand.exe
                                                                                                                                          expand.exe -R products1803.cab -F:* .
                                                                                                                                          3⤵
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:4948
                                                                                                                                        • C:\Windows\System32\findstr.exe
                                                                                                                                          findstr /c:\ /a:4f " ERROR "\..\c nul
                                                                                                                                          3⤵
                                                                                                                                            PID:4848
                                                                                                                                          • C:\Windows\System32\findstr.exe
                                                                                                                                            findstr /c:\ /a:0f " Check urls in browser | del ESD dir | use powershell v3.0+ | unblock powershell | enable BITS serv "\..\c nul
                                                                                                                                            3⤵
                                                                                                                                              PID:1980

                                                                                                                                        Network

                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • C:\ESD\MediaCreationTool.bat

                                                                                                                                          Filesize

                                                                                                                                          129KB

                                                                                                                                          MD5

                                                                                                                                          998ca6b423965b3a357e57c27a4a850b

                                                                                                                                          SHA1

                                                                                                                                          b18a2ad0999bf7a9f898d771503020eacb5d617d

                                                                                                                                          SHA256

                                                                                                                                          4b1486451a42cfc8d1372026c91ac09ae47bd010ec88d0233b93c0f4f8113296

                                                                                                                                          SHA512

                                                                                                                                          23b63cb6c0beca86bdbef612dbfe3150ed6295e5987843e3ead36b038133f17cbf0860aef28fc3b3021056afac2996bc2eca1d35186a4a9c934a995ecfaef6e8

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                          Filesize

                                                                                                                                          3KB

                                                                                                                                          MD5

                                                                                                                                          a8abfac46fecead606749e07ddd5fde3

                                                                                                                                          SHA1

                                                                                                                                          b016ccf671ed81f4d1687c5614169bfc516b36db

                                                                                                                                          SHA256

                                                                                                                                          d84f53499110d4dfe73bf1cc9e6a0a167d5c02a18bd07e90d053b9f475eb70e5

                                                                                                                                          SHA512

                                                                                                                                          0d135b229051d857c360cdae26f974bbf70256c0743d0b1b56f9d2bc9b6e1671e6ab0e9711326f69563943f00d79d8a3b2ca3e1551a40046026d7a3e34fbc4bf

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          667045c59e581a86e3c631dbfb08a083

                                                                                                                                          SHA1

                                                                                                                                          924e72ccb1a5679bd07032c2f1b6b506d805c1da

                                                                                                                                          SHA256

                                                                                                                                          20af0263adaf76d15bdf41aa3c5cb02d6868bbb2a13ae96cb839202df7421275

                                                                                                                                          SHA512

                                                                                                                                          6a4184be6ffdd498f503255cf29e439448a10b2a1eba16f3d7d697d2225b96feca062cf72f91845f69ba4200df6b47d46357ff565eb0b0f39c3834e721d0d5f0

                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                          Filesize

                                                                                                                                          1KB

                                                                                                                                          MD5

                                                                                                                                          8e16939e1c08c53d76d61d7ed974ecf8

                                                                                                                                          SHA1

                                                                                                                                          6a2185d65319c7cbc6629daf8c0dd1404173d041

                                                                                                                                          SHA256

                                                                                                                                          861bb189fb8050f7962a94067616b0332d3e90007c2721dc773bcbb7a836e1c0

                                                                                                                                          SHA512

                                                                                                                                          7bc73bb757a8b1f7594cd3463070a129229bc544b1707b00e1d67e6a8f98f577f83ff5d9c3cd330629ed193034913b2e1060d3f565e1550bb84bfafcc12fe995

                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mlrpxszm.2oj.ps1

                                                                                                                                          Filesize

                                                                                                                                          60B

                                                                                                                                          MD5

                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                          SHA1

                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                          SHA256

                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                          SHA512

                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                        • C:\Users\Admin\AppData\Roaming\c

                                                                                                                                          Filesize

                                                                                                                                          1B

                                                                                                                                          MD5

                                                                                                                                          28d397e87306b8631f3ed80d858d35f0

                                                                                                                                          SHA1

                                                                                                                                          08534f33c201a45017b502e90a800f1b708ebcb3

                                                                                                                                          SHA256

                                                                                                                                          a9253dc8529dd214e5f22397888e78d3390daa47593e26f68c18f97fd7a3876b

                                                                                                                                          SHA512

                                                                                                                                          0a0cd116c2c57fb125fd9ada131f6ca964587a9958a214814a623db1821ed5ce32daeec4085a14e31d900a357b1e2549319b2e0cc2c8cfbafc6a4a4aafebe203

                                                                                                                                        • memory/924-43-0x000001B1F0E00000-0x000001B1F0E26000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          152KB

                                                                                                                                        • memory/3856-7-0x000001375CD90000-0x000001375CDB2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/4408-30-0x00000226F09C0000-0x00000226F09E6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          152KB

                                                                                                                                        • memory/4408-31-0x00000226F0A30000-0x00000226F0A44000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          80KB