3c2d7b57e3fc4858d40c7693e51be03dedb932574d80d60751d69365bb8f5272

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bootstrap-update.ps1
Size 57KB
Sample261104-2rm19aeh48
SHA256 3c2d7b57e3fc4858d40c7693e51be03dedb932574d80d60751d69365bb8f5272
MD5 4de0b070df06cd3e1ac6e6856df5031a
SHA1 59f5bce736ff986b10f90e283ebdaf3f5ebb06e3
SHA512 d32d247691fc210f02c327ccdeaeeae68e51dd1f24a1446b790616e7df3ecd112df67c5c0fd3a693f4e4b7a7a960ebf522d48b9c0941252802ddcc51ca733c88
SSDEEP 768:ILOlH3r+j+7H2xwtktDOwSwFWHR6qIAIf7aUO7Xjj6YlWUJa9if3PL/Md6iros:oiXis23pFW0qVvUO7zj64W+ffzMdTEs
TLSH
T1F843E83A2550153A7183D16E58499154BB65B02FB2081E90B18CF2D8FFDE13D8BEBBF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4684	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	powershell.exe
4684	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 5236	4684	powershell.exe	85
PID 4684 wrote to memory of 4916	4684	powershell.exe	86
PID 4684 wrote to memory of 5128	4684	powershell.exe	90
PID 4684 wrote to memory of 2816	4684	powershell.exe	91
PID 4684 wrote to memory of 5028	4684	powershell.exe	92
PID 4684 wrote to memory of 5228	4684	powershell.exe	94
PID 4684 wrote to memory of 5384	4684	powershell.exe	96
PID 4684 wrote to memory of 1096	4684	powershell.exe	97
PID 4684 wrote to memory of 4068	4684	powershell.exe	98
PID 4684 wrote to memory of 3852	4684	powershell.exe	99
PID 4684 wrote to memory of 6096	4684	powershell.exe	100
PID 4684 wrote to memory of 1248	4684	powershell.exe	101
PID 4684 wrote to memory of 1480	4684	powershell.exe	103
PID 4684 wrote to memory of 1076	4684	powershell.exe	105
PID 4684 wrote to memory of 3252	4684	powershell.exe	107
PID 4684 wrote to memory of 2656	4684	powershell.exe	110
PID 4684 wrote to memory of 4164	4684	powershell.exe	115
PID 4684 wrote to memory of 5788	4684	powershell.exe	117
PID 4684 wrote to memory of 324	4684	powershell.exe	119
PID 4684 wrote to memory of 3520	4684	powershell.exe	121
PID 4684 wrote to memory of 5464	4684	powershell.exe	123
PID 4684 wrote to memory of 5612	4684	powershell.exe	125
PID 4684 wrote to memory of 1044	4684	powershell.exe	127
PID 4684 wrote to memory of 4960	4684	powershell.exe	129
PID 4684 wrote to memory of 5364	4684	powershell.exe	131
PID 4684 wrote to memory of 2648	4684	powershell.exe	133
PID 4684 wrote to memory of 1736	4684	powershell.exe	135
PID 4684 wrote to memory of 4952	4684	powershell.exe	137
PID 4684 wrote to memory of 2848	4684	powershell.exe	142
PID 4684 wrote to memory of 1944	4684	powershell.exe	144
PID 4684 wrote to memory of 3012	4684	powershell.exe	145
PID 4684 wrote to memory of 4396	4684	powershell.exe	146
PID 4684 wrote to memory of 4632	4684	powershell.exe	148
PID 4684 wrote to memory of 4432	4684	powershell.exe	150
PID 4684 wrote to memory of 4904	4684	powershell.exe	152
PID 4684 wrote to memory of 5936	4684	powershell.exe	154
PID 4684 wrote to memory of 2820	4684	powershell.exe	156
PID 4684 wrote to memory of 1636	4684	powershell.exe	158
PID 4684 wrote to memory of 3532	4684	powershell.exe	160
PID 4684 wrote to memory of 5016	4684	powershell.exe	162
PID 4684 wrote to memory of 1952	4684	powershell.exe	164

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\bootstrap-update.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -s --retry-all-errors --connect-timeout 10 --max-time 15 -o NUL https://api.github.com/
  2⤵
  PID:5236
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 30 -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/releases/latest
  2⤵
  PID:4916
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_93d6a87240f44ef8af03f2e8cd8fd816.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:5128
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_d334eb17492c477eb52d54f4099418fe.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/mumu-menu.ps1?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:2816
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_0dced64020264864977390d28f097ccc.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/mumu-menu.cjs?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:5028
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_44fd4cd58c904e45bae17d31917366ec.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/SKILL.md?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:5228
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_ea6a82b7878545cdaaa0a2cadf17788f.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/README.md?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:5384
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_0c21e03050bb4191833a065a4fd14c1e.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/bootstrap-update.ps1?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:1096
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_ad37cb8e84194f65bbfc421910bc0afe.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Watch-MumuConnections.ps1?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:4068
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_66a17ba0b7444005b8bef88c0dbf0758.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Test-MumuTunnelAB.ps1?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:3852
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_260c76b54b034a1183e6b4f69444a36e.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Diag-MumuNx.ps1?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:6096
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_2c05f86372344102aed422ff28b5c582.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:1248
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\mumu-menu.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/mumu-menu.ps1?ref=160f28f7ff6795d99f2faf4235a450b9e254b161
  2⤵
  PID:1480
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_05245dc71f754f64993dac20065f647d.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:1076
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\mumu-menu.cjs.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/mumu-menu.cjs?ref=v10.4.14
  2⤵
  PID:3252
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\mumu-menu.cjs.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/mumu-menu.cjs?ref=v10.4.14
  2⤵
  PID:2656
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\mumu-menu.cjs.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/mumu-menu.cjs?ref=v10.4.14
  2⤵
  PID:4164
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_edc5dfb72bc04ffa8a8b552101dddf37.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:5788
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\SKILL.md.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/SKILL.md?ref=v10.4.14
  2⤵
  PID:324
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\SKILL.md.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/SKILL.md?ref=v10.4.14
  2⤵
  PID:3520
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\SKILL.md.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/SKILL.md?ref=v10.4.14
  2⤵
  PID:5464
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_e63ff4d593f54065b346f8c6de25facb.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:5612
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\README.md.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/README.md?ref=v10.4.14
  2⤵
  PID:1044
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\README.md.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/README.md?ref=v10.4.14
  2⤵
  PID:4960
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\README.md.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/README.md?ref=v10.4.14
  2⤵
  PID:5364
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_07b75fa9ef64442c9199d04c6f03a734.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:2648
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\bootstrap-update.ps1.new.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/bootstrap-update.ps1?ref=v10.4.14
  2⤵
  PID:1736
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\bootstrap-update.ps1.new.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/bootstrap-update.ps1?ref=v10.4.14
  2⤵
  PID:4952
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\bootstrap-update.ps1.new.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/bootstrap-update.ps1?ref=v10.4.14
  2⤵
  PID:2848
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_b19316c322194d00a22f80105b9f9e4d.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:1944
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Watch-MumuConnections.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Watch-MumuConnections.ps1?ref=v10.4.14
  2⤵
  PID:3012
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Watch-MumuConnections.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Watch-MumuConnections.ps1?ref=v10.4.14
  2⤵
  PID:4396
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Watch-MumuConnections.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Watch-MumuConnections.ps1?ref=v10.4.14
  2⤵
  PID:4632
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_d4379fc635f049dfaa0f9e26cc5a6398.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:4432
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Test-MumuTunnelAB.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Test-MumuTunnelAB.ps1?ref=v10.4.14
  2⤵
  PID:4904
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Test-MumuTunnelAB.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Test-MumuTunnelAB.ps1?ref=v10.4.14
  2⤵
  PID:5936
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Test-MumuTunnelAB.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Test-MumuTunnelAB.ps1?ref=v10.4.14
  2⤵
  PID:2820
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 60 -H "Accept: application/vnd.github.raw" -o C:\Users\Admin\AppData\Local\Temp\gh_raw_06f251f670904c15948fff301705566a.bin https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/git/ref/tags/v10.4.14
  2⤵
  PID:1636
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Diag-MumuNx.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Diag-MumuNx.ps1?ref=v10.4.14
  2⤵
  PID:3532
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Diag-MumuNx.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Diag-MumuNx.ps1?ref=v10.4.14
  2⤵
  PID:5016
- C:\Windows\system32\curl.exe
  "C:\Windows\system32\curl.exe" -sS --fail --retry 3 --retry-delay 2 --connect-timeout 30 --max-time 120 -L -H "Accept: application/vnd.github.v3.raw" -o C:\Users\Admin\AppData\Local\Temp\Diag-MumuNx.ps1.tmp https://api.github.com/repos/genrihx2/MuMuManager-CLI-Menu/contents/Diag-MumuNx.ps1?ref=v10.4.14
  2⤵
  PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_njys0qpx.euh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_njys0qpx.euh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gh_raw_0c21e03050bb4191833a065a4fd14c1e.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_0c21e03050bb4191833a065a4fd14c1e.bin
Size 57KB
SHA256 3c2d7b57e3fc4858d40c7693e51be03dedb932574d80d60751d69365bb8f5272
MD5 4de0b070df06cd3e1ac6e6856df5031a
SHA1 59f5bce736ff986b10f90e283ebdaf3f5ebb06e3
SHA512 d32d247691fc210f02c327ccdeaeeae68e51dd1f24a1446b790616e7df3ecd112df67c5c0fd3a693f4e4b7a7a960ebf522d48b9c0941252802ddcc51ca733c88
SSDEEP 768:ILOlH3r+j+7H2xwtktDOwSwFWHR6qIAIf7aUO7Xjj6YlWUJa9if3PL/Md6iros:oiXis23pFW0qVvUO7zj64W+ffzMdTEs
TLSH
T1F843E83A2550153A7183D16E58499154BB65B02FB2081E90B18CF2D8FFDE13D8BEBBF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_0dced64020264864977390d28f097ccc.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_0dced64020264864977390d28f097ccc.bin
Size 20KB
SHA256 71639e517ad19dcf14c41ae02f7aaec11d691612ea45cce56a77b1bd9f241fe7
MD5 4a7dcfbcf9564ef04b72498e298a038b
SHA1 e6049066c429a021fbcd76bab1560475d870f3c9
SHA512 70fc5526b2f658fe4d81169aba88cad8dc32bcbb166068a96b0334b08b651a5361832be33aede78aed7729a2e2e68c405882ae92d95bc484ef19f04abc275493
SSDEEP 192:ptVn95rVNMa44XsWKKabvfmjYfgV+tqyI6ccDlO0SexfjqSS5nhx5q3yJAJLLNsv:ptw4M8YfNI6lMNhzCVskm4V5u1X7zh9
TLSH
T14492B7490EFB2128597BE16B225F5036E2278403360AD9847A9C43451FD3665E3FFEBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_260c76b54b034a1183e6b4f69444a36e.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_260c76b54b034a1183e6b4f69444a36e.bin
Size 8KB
SHA256 2fa0baf77e84e92d5ac944b346d4d187d6f4199ad972868c522b80b16235055e
MD5 e023fadc11452d1ca6bee04a6ff433cf
SHA1 b4b7ff4f854d6cbebcedfc927e87738a00b9f933
SHA512 c2405abc7bc7a00eb180f6b582f16c4137c872f1947d94f1ee68aac438d4cb6bd513c0d35e0fa65e7d6eba7fcfb773b1db687d8dd5db3e589df0e9c1ebddebca
SSDEEP 192:UTy7iOTzzzcGHIg7iyqYCBfDQKtUIKuE4mlrjMi5jo05uvgHnl7Pm09jsO1:3pTzz1ji9jXtUpulmV4gE09J1
TLSH
T1FF02A6997FE8127673CFC113F5E79216E329901E09291600BABCC3D42F9683D86BD5B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_44fd4cd58c904e45bae17d31917366ec.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_44fd4cd58c904e45bae17d31917366ec.bin
Size 11KB
SHA256 d89e8bb172a3c6ae37eb44f223cffc8ae26ef76c63c3e5c3c960fae0b6978b71
MD5 c6a1136984423776c9ba51bed36611ca
SHA1 dc45fb7ee18c505d98b11532e82e7817eadfaf9c
SHA512 6c98dd43c2d9301fa86a597e27bfff56a9a077494cf7aafb31844c30689d4d625d358b7a57b0d9ebbe2341ffbea5138228189d65930187d2987e8a4e31aeae3f
SSDEEP 192:/g78cMVENILV5uiloTDa4fMA6q4Op5bRejZvAmU5WN9g6VLgiGVwozK1feVC:/Migo5uLTDJ0q7phsjZdU5AJyu8U2VC
TLSH
T12942DB5B76140335AE9B129FE16FA291FBB6C05843918C3931EE8194730B36987FF4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_66a17ba0b7444005b8bef88c0dbf0758.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_66a17ba0b7444005b8bef88c0dbf0758.bin
Size 20KB
SHA256 2058d5744d9d5fbb568cb5778129f9f5ab32ddd8c3f9eabee582793dc727985a
MD5 e91f0a7bd28942d2aee1f96df33ee4fc
SHA1 4a47a13319d3718b930c3a7d96db8c1e8eac5fc6
SHA512 f41451085b6221937ddfe0ba001efc5d5efca48468aae2873d6704db37427ceb15dfe52fea54645a18edffb9fe32a97b546c297605893469888b5a8c4ec14976
SSDEEP 384:SZKX0w84bH6M7qqHGc8zSQxfOa/YutB6Egq6ilzFRL9yW:3EwjaMXHGZzhb6wl9yW
TLSH
T13392D9BEBA899075238B117B95DB8504BF59441F400D6910B5ECC2C8AFAA17CC7F4EF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_93d6a87240f44ef8af03f2e8cd8fd816.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_93d6a87240f44ef8af03f2e8cd8fd816.bin
Size 405B
SHA256 de064026412d1df50805fbaefb0f4c92cd6f791b12f6612313a659ddba228328
MD5 b50e5e9dac006e9f61dde6f0ce3e13e2
SHA1 20a63e365cda87c950c67825d970e175f9913ae1
SHA512 3d7c914cc68ba52a1b719449086847a59dcf754f2dfb95a46367adf867b34b2829d5178179d55fc34351a602e26266dc47c3f19392f71f8c84ba1692122182eb
TLSH
T141E05561A4392823EFA4188AEE1C22C85640810F8E80AA410382C97ECF0FE721BD144E
MD5 SHA1 SHA512 TLSH

Submit Download

gh_raw_ad37cb8e84194f65bbfc421910bc0afe.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_ad37cb8e84194f65bbfc421910bc0afe.bin
Size 4KB
SHA256 d5226c1033508e779e420bb25ab468040afc000cd210dbed6ee857fa91b30147
MD5 d12adeb6769e83e99ad86a66d04c4cd0
SHA1 87d705a837ebf125347ac874372aaf452e0c7413
SHA512 a70da2a90e507e3b05ec96d871d3a8e58840203619b038c14bbfb6ce43d68c773384953cd1caad67c513433e8fbfe97847b3228b5ca8bc7e851f5c9e0d2aeea9
SSDEEP 96:JgXPmGpmAZYljrRhPRTLeH2nNDWskhuUCyl2RA:2VmAal5hPRTyuxWhCPRA
TLSH
T11EA1C820FA694A357BDB1067908BD410BB06C03F52296550B4EEE3D45FA6508D0BDF7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_d334eb17492c477eb52d54f4099418fe.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_d334eb17492c477eb52d54f4099418fe.bin
Size 624KB
SHA256 63f40022e9aeb505732de7b84a57c2d922f47ef3dcbb44ed366c268c7404118a
MD5 281391221b9e79fe48c3762e80c1a4a1
SHA1 77e115b344cdeacbe0e953bbc54196bb6ba0432a
SHA512 553022bc44d6b6488030799aa1023c7df9fbbcfad02e4946adb38ff22f95960505820e946e08473d8eb41916924715505d61a452d22716d69266f50525ae0761
SSDEEP 12288:D9euQTTg/4AtrS7jRzAw7NCt2TLkhvIZe:5euQTTg/4AtrS7jRzAw7NCtQ44e
TLSH
T1FDD4D83A6941053E6683107F5C999054BBA6903FD24D2EC4B48C91E4BFDA13DC3BABF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gh_raw_ea6a82b7878545cdaaa0a2cadf17788f.bin

Path C:\Users\Admin\AppData\Local\Temp\gh_raw_ea6a82b7878545cdaaa0a2cadf17788f.bin
Size 59KB
SHA256 3f0441128b5010045111b5c6791cb1f3ebbae73535ff529781657c4823ec8a7f
MD5 e720c844354da0e98e0f0c0ff5b39b80
SHA1 63739c73135c980ac46673066d17170bfc5b5115
SHA512 94b67db5ab15021b0e1e8f84173acb706599b2428cc3d5fe7aa322f2fa45e91588589dafb3e42344b9f637aa7df8ecb6b13711554ca44d44d992302f366fc411
SSDEEP 1536:eU7ZuYBQYOLZLmrXDPZl2Hw/tsJoLSN3qSqZqTAY:eUFuYBQ3ZLmrXDPCQ/tsJoLSN3qSqUTL
TLSH
T18A537421569D14EE0601F00BE908BB4D7EA744FE3B6B576615F82E7E35E2028C27E39D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4684-11-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-10-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-12-0x000002177EC10000-0x000002177EDD2000-memory.dmp

Download

memory/4684-7-0x000002177E890000-0x000002177E8B2000-memory.dmp

Download

memory/4684-13-0x0000021702CD0000-0x00000217031F8000-memory.dmp

Download

memory/4684-0-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-1-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-47-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-46-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-48-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download

memory/4684-49-0x000002177EA30000-0x000002177EA40000-memory.dmp

Download