Analysis
-
max time kernel
181s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 20:37
Static task
static1
Behavioral task
behavioral1
Sample
MBin.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
MBin.exe
Resource
win10v2004-20220414-en
General
-
Target
MBin.exe
-
Size
929KB
-
MD5
c4cf28c1d5e4da94c3391b90cd91671d
-
SHA1
2c0db45e4852ab67255f78fe6921ada7a305244e
-
SHA256
433c68e89fe741e7ec59e064861baf726ab0b8637849d9d92fa5e3a2819d211c
-
SHA512
23590c2584a04127ec7c75f5f642a6884715390158b897e3617d4cbd536d6369388a0f3cce6d926ae7bf3e149d4cc8c99f82a35e340553421411d1c624506f39
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/228-144-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
MBin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\MBin.exe\"" MBin.exe -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
MBin.exeMBin.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation MBin.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation MBin.exe -
Drops startup file 2 IoCs
Processes:
MBin.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBin.exe MBin.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBin.exe MBin.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
MBin.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths MBin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection MBin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" MBin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" MBin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" MBin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions MBin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBin.exe = "0" MBin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MBin.exe = "0" MBin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet MBin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features MBin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" MBin.exe -
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
MBin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook MBin.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook MBin.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
MBin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MBin.exe" MBin.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MBin.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MBin.exe" MBin.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 26 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
Processes:
MBin.exepid process 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MBin.exedescription pid process target process PID 4992 set thread context of 228 4992 MBin.exe MBin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1776 4992 WerFault.exe MBin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
MBin.exepid process 228 MBin.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeMBin.exeMBin.exepowershell.exepid process 3632 powershell.exe 3560 powershell.exe 4584 powershell.exe 2752 powershell.exe 3632 powershell.exe 3560 powershell.exe 4584 powershell.exe 2752 powershell.exe 4992 MBin.exe 4992 MBin.exe 4992 MBin.exe 228 MBin.exe 228 MBin.exe 228 MBin.exe 228 MBin.exe 1068 powershell.exe 1068 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
MBin.exepowershell.exepowershell.exepowershell.exepowershell.exeMBin.exepowershell.exedescription pid process Token: SeDebugPrivilege 4992 MBin.exe Token: SeDebugPrivilege 3632 powershell.exe Token: SeDebugPrivilege 3560 powershell.exe Token: SeDebugPrivilege 4584 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe Token: SeDebugPrivilege 228 MBin.exe Token: SeDebugPrivilege 1068 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MBin.exepid process 228 MBin.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
MBin.exeMBin.exedescription pid process target process PID 4992 wrote to memory of 3632 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 3632 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 3632 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 3560 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 3560 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 3560 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 4584 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 4584 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 4584 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 2752 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 2752 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 2752 4992 MBin.exe powershell.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 4992 wrote to memory of 228 4992 MBin.exe MBin.exe PID 228 wrote to memory of 1068 228 MBin.exe powershell.exe PID 228 wrote to memory of 1068 228 MBin.exe powershell.exe PID 228 wrote to memory of 1068 228 MBin.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
MBin.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe -
outlook_win_path 1 IoCs
Processes:
MBin.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MBin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MBin.exe"C:\Users\Admin\AppData\Local\Temp\MBin.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBin.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBin.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBin.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MBin.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\MBin.exe"C:\Users\Admin\AppData\Local\Temp\MBin.exe"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\MBin.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4992 -s 13282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4992 -ip 49921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
54KB
MD58cac77e8fc9193fb3f7e46d0fcbdfd2f
SHA146c3f9e46cab5cd7cc3073bd8cd00ad5a47577b2
SHA256188dc4bf8463234d87bb0d4c6bf87a2c405c3a3e1a67a63f5ae11293ee13d650
SHA5120ef180ad0458d4514ae23abf41e1542c95b89f1bee8ccc0759fc5db9ea77e39f1b7748f3325f2109aaf12dd286f8fa5bb600edd9673b1c66eabb264c50574fa4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
54KB
MD58cac77e8fc9193fb3f7e46d0fcbdfd2f
SHA146c3f9e46cab5cd7cc3073bd8cd00ad5a47577b2
SHA256188dc4bf8463234d87bb0d4c6bf87a2c405c3a3e1a67a63f5ae11293ee13d650
SHA5120ef180ad0458d4514ae23abf41e1542c95b89f1bee8ccc0759fc5db9ea77e39f1b7748f3325f2109aaf12dd286f8fa5bb600edd9673b1c66eabb264c50574fa4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD56d6a42f2284e57b24075bdbcfa5f560a
SHA1f5f0b09d9b6f4325c57b19b0dab87fa44532f09c
SHA256a4cfe63c20d0d90d9898ad26feb9432c912408d50257d4f960fdc86979864781
SHA5121edaba2cd913ffd41b67ba6219a596752647943c1ef4ca10758ad8b70ee3ac548075ccf4c8b17a4a5db307e16392834684a12a25ae7f85dafbdd2b8a09e6c726
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD56d6a42f2284e57b24075bdbcfa5f560a
SHA1f5f0b09d9b6f4325c57b19b0dab87fa44532f09c
SHA256a4cfe63c20d0d90d9898ad26feb9432c912408d50257d4f960fdc86979864781
SHA5121edaba2cd913ffd41b67ba6219a596752647943c1ef4ca10758ad8b70ee3ac548075ccf4c8b17a4a5db307e16392834684a12a25ae7f85dafbdd2b8a09e6c726
-
memory/228-145-0x0000000004FE0000-0x0000000005072000-memory.dmpFilesize
584KB
-
memory/228-168-0x0000000006CF0000-0x0000000006D40000-memory.dmpFilesize
320KB
-
memory/228-143-0x0000000000000000-mapping.dmp
-
memory/228-144-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/228-169-0x0000000006CA0000-0x0000000006CAA000-memory.dmpFilesize
40KB
-
memory/1068-172-0x0000000070810000-0x000000007085C000-memory.dmpFilesize
304KB
-
memory/1068-166-0x0000000000000000-mapping.dmp
-
memory/2752-151-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/2752-137-0x0000000000000000-mapping.dmp
-
memory/3560-134-0x0000000000000000-mapping.dmp
-
memory/3560-158-0x0000000007AB0000-0x0000000007B46000-memory.dmpFilesize
600KB
-
memory/3560-152-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/3560-159-0x0000000007A70000-0x0000000007A7E000-memory.dmpFilesize
56KB
-
memory/3560-140-0x0000000005D20000-0x0000000005D86000-memory.dmpFilesize
408KB
-
memory/3632-153-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/3632-138-0x00000000052F0000-0x0000000005918000-memory.dmpFilesize
6.2MB
-
memory/3632-133-0x0000000000000000-mapping.dmp
-
memory/3632-157-0x00000000072F0000-0x00000000072FA000-memory.dmpFilesize
40KB
-
memory/3632-135-0x0000000002690000-0x00000000026C6000-memory.dmpFilesize
216KB
-
memory/3632-155-0x0000000007900000-0x0000000007F7A000-memory.dmpFilesize
6.5MB
-
memory/3632-139-0x0000000004FC0000-0x0000000004FE2000-memory.dmpFilesize
136KB
-
memory/3632-141-0x0000000005920000-0x0000000005986000-memory.dmpFilesize
408KB
-
memory/3632-142-0x0000000005F90000-0x0000000005FAE000-memory.dmpFilesize
120KB
-
memory/3632-149-0x0000000006570000-0x00000000065A2000-memory.dmpFilesize
200KB
-
memory/4584-161-0x0000000007710000-0x0000000007718000-memory.dmpFilesize
32KB
-
memory/4584-160-0x0000000007730000-0x000000000774A000-memory.dmpFilesize
104KB
-
memory/4584-154-0x0000000006680000-0x000000000669E000-memory.dmpFilesize
120KB
-
memory/4584-136-0x0000000000000000-mapping.dmp
-
memory/4584-150-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/4584-156-0x00000000073E0000-0x00000000073FA000-memory.dmpFilesize
104KB
-
memory/4992-130-0x0000000000890000-0x000000000097C000-memory.dmpFilesize
944KB
-
memory/4992-132-0x0000000005910000-0x0000000005EB4000-memory.dmpFilesize
5.6MB
-
memory/4992-131-0x00000000052C0000-0x000000000535C000-memory.dmpFilesize
624KB