Analysis
-
max time kernel
64s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 00:32
General
-
Target
DHL Shipment 7348255141.exe
-
Size
1.0MB
-
MD5
ec1721ef86c0f91cb52081731624f00b
-
SHA1
3e7900979980b88607b51f0a39faaaab5778eb6f
-
SHA256
c3678d87151b21e6a29ded035522c1c22950f97787e45b3df2dba52a4e688c97
-
SHA512
2fc3b09e286e427bd11ea822c3a55fce71c161b9cd1c8ab268eaa4214fcde3cfd73e54659c9fb3ea76d28145099811a9a30fcbf32f28e5cb6172afa0709d9f5b
Score
10/10
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
-
Checks computer location settings 2 TTPs 30 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 31 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 54 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"4⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"5⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"6⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"7⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'10⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"8⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit10⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'11⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"9⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'12⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"10⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit12⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'13⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"11⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"12⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'15⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"13⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'16⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"14⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'17⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"15⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit17⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'18⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"16⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit18⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'19⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"17⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit19⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'20⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"18⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit20⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'21⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"19⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit21⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'22⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"20⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit22⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'23⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"21⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit23⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'24⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"22⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit24⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'25⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"23⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit25⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'26⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"24⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit26⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'27⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"25⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit27⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'28⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"26⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit28⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'29⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"27⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit29⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'30⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"29⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit31⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV132⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'32⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"30⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit32⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'33⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit33⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'34⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"32⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit34⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'35⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"33⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit35⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'36⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"34⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit36⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'37⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"35⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit37⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'38⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"36⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit38⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'39⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"37⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit39⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'40⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"38⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit40⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'41⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"39⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit41⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'42⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"40⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit42⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'43⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"41⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit43⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'44⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit44⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'45⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"43⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit45⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'46⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"44⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit46⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'47⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit47⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'48⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit48⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'49⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"47⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit49⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'50⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"48⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit50⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'51⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit51⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'52⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"50⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit52⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit53⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'54⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"52⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit54⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'55⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit55⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'56⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"54⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit56⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'57⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit57⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit58⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'59⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"57⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit59⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'60⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit60⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'61⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"59⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit61⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'62⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit62⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'63⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit63⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'64⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"62⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit64⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'65⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"63⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit65⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'66⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"64⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit66⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment 7348255141.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe' & exit2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe'3⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe a85abe294c8443883f264824412b2322 NQ/kNNTifUySBzKTKfTDmg.0.1.0.0.01⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
994B
MD5334ac3d2e55f80a9b69e02d1dbc44947
SHA1dea2b26b13eca80ad781cfeeaf7082e0d0dc4f2e
SHA256cfc8439b36fdd0455772cdb646d04b93858f9bc44fc94473bf73b253c2e4f25d
SHA51283b5111afd7b24bf4bc193b01587ce590655d25ae9d0f333f6dbd1ddd2d93c2b22b48f5a52aa3c7d7d5833d774fcc729a7f6f9d1faf7277d1fc8deec16efd649
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5712a00a9d8164b3b6795c4e11800d2f1
SHA182952ef15a2e4e2b06cb149d3b206d11135128b5
SHA2562a3b20384f9ce1100ea1c1d3fc24b874446506c627102da75ace1e7bcac4a052
SHA512ab87d76996cf96e76f9182f72ffe16b1e014ac1ccbe2991a6cd85309622365fbf4a6e79023e616c529640f626cd3943bab9338816bf6ce6831cf5696d28ecd17
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5346f9f8c8b62dc1e5eb59c3de0ee104f
SHA12a34d9904a8245a20b01feaf71b806b2f1e17db7
SHA25628410c777571675d6f152a29a799c63ae9bb61cae8c70b74c877cf2d1dca23da
SHA51259fdd25fc4fbf172d5add077800d8e2683d903200c481cd6272f6564d7425f09ffaaa664a7f39bc3bcfb1d837f19f58432f2ee517bbfd95e903d2e01dd53d287
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5d1ef93c936a8593cf03d9cc87485c6b7
SHA1eb7e9f67859ea24a0db77fe9de176c34bee76556
SHA256aadd7856237a43d270c31f9080e1ace8ed3bcda3e97b18b8c37c1c3f979b95ef
SHA512873745c7111b8e0a34edf23aba3c36af646dd34bcb5e0710aaa2db956e460310c7fdf19259ed694574e091a5a3467f72255700a271822cc9a8c0da6a981a6633
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5d1ef93c936a8593cf03d9cc87485c6b7
SHA1eb7e9f67859ea24a0db77fe9de176c34bee76556
SHA256aadd7856237a43d270c31f9080e1ace8ed3bcda3e97b18b8c37c1c3f979b95ef
SHA512873745c7111b8e0a34edf23aba3c36af646dd34bcb5e0710aaa2db956e460310c7fdf19259ed694574e091a5a3467f72255700a271822cc9a8c0da6a981a6633
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5d1ef93c936a8593cf03d9cc87485c6b7
SHA1eb7e9f67859ea24a0db77fe9de176c34bee76556
SHA256aadd7856237a43d270c31f9080e1ace8ed3bcda3e97b18b8c37c1c3f979b95ef
SHA512873745c7111b8e0a34edf23aba3c36af646dd34bcb5e0710aaa2db956e460310c7fdf19259ed694574e091a5a3467f72255700a271822cc9a8c0da6a981a6633
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5d1ef93c936a8593cf03d9cc87485c6b7
SHA1eb7e9f67859ea24a0db77fe9de176c34bee76556
SHA256aadd7856237a43d270c31f9080e1ace8ed3bcda3e97b18b8c37c1c3f979b95ef
SHA512873745c7111b8e0a34edf23aba3c36af646dd34bcb5e0710aaa2db956e460310c7fdf19259ed694574e091a5a3467f72255700a271822cc9a8c0da6a981a6633
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5d1ef93c936a8593cf03d9cc87485c6b7
SHA1eb7e9f67859ea24a0db77fe9de176c34bee76556
SHA256aadd7856237a43d270c31f9080e1ace8ed3bcda3e97b18b8c37c1c3f979b95ef
SHA512873745c7111b8e0a34edf23aba3c36af646dd34bcb5e0710aaa2db956e460310c7fdf19259ed694574e091a5a3467f72255700a271822cc9a8c0da6a981a6633
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53e1a14b41250f742b7fcef9e51fec423
SHA1b07d5e81e800ec08087cca10ed049d5a2c64bd73
SHA256ea84cc36cfd7dbd220b4f028956cd435ba1d05432ba5751295e52c2bdeb8ca7b
SHA512e0997d97a6a313e6a83e8641fda48b2a449f646c80a8403503f4cf2208aee52aafcb7069f6dfc12701456b000663ecd6bb7dcb1ec76ed155dfbebe5f0fe9b259
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD531df93cd08e8001245bef2fb0de3b74e
SHA1add652e1d4f5289dcf9e306077f10645bdd4b8c9
SHA256d149ca9117d22b1b47134c1ee8b90d1344525023aaf33e9cc66492a102622037
SHA5126ef77f602eab6abf384a54909879980cb1120c442eee126b9a0b573cca0e016b939160e1ebc680fe5627a540b088f821ec2cbe4932198b6c8368186362c9e163
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5edb75a37ab7d64a15b859e183e3dc87a
SHA18494c2b074468c4576e2db370973b02ef5810722
SHA256f3e3ec78a8f7c88c140ddf435b262ed46922ca887319b507339777bbf46a21fe
SHA5121d428e0cc45fb98237a0d6a847c3acf4cfd6db5a5d0465a7611082eb4587d4c650d8743c82cb14e44f8b2546484eb74a032a1b8ca404f918123aa3c6c3027a91
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5f946bc591db9dfcbbf4bc364462a328d
SHA1fcd1d0337ddfb70645a945a72feea8c75c2d967f
SHA256d8f51301a7176d3a776ba3b3bad631ba7bdec0e4334630540cec11886719f705
SHA5123317a493bfe0f59cdcf30635c8606e744531195f4f4f7160c90df0f8e2fd8f4f080200dbd8b4b9c8013057055ca4a4bff00036716ce04bb3d65a1e0d75e4aa02
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5f946bc591db9dfcbbf4bc364462a328d
SHA1fcd1d0337ddfb70645a945a72feea8c75c2d967f
SHA256d8f51301a7176d3a776ba3b3bad631ba7bdec0e4334630540cec11886719f705
SHA5123317a493bfe0f59cdcf30635c8606e744531195f4f4f7160c90df0f8e2fd8f4f080200dbd8b4b9c8013057055ca4a4bff00036716ce04bb3d65a1e0d75e4aa02
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c1adabed7df310aa7517b654b21ae467
SHA1a13a52662e5264f33cb50ff81c91d2cb1eb3dab8
SHA256ba3deef4112c08b8cf0ba7dfb64480f49032208fc435a6a91f1d5bb2f08dcd34
SHA512ad2caa8e4318b440f19fa7ab7a06bb47367496755d5742a55b871d18c85fa242a260ef464192bcbd108e16fc833ec6259af51fa5be331de0786d912238c5ddb9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD57874b49e95053845522e81d05ab20b27
SHA198d594091846f94d15aee31582e018bb335c3191
SHA256bfe66fb24d19a88e72fdde888e440cb9c120a09324a4c0d7db2baa136ea1a61e
SHA5128f53f58a132f3b63f964b8133ada3a6563c3c92dd8ff2c7fee1fb9e392d25911904d0870fa482c4cf12a20e92381d3d09cad834e79b176d414476f5e82272a98
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5436d8ceafdf63e19386a8813207855ae
SHA103fd7ae28e2b5d657e8a488f5058f2db3252ef9e
SHA256ff958f02f1f7a1ce4ad5a8a650b1fa8e6f456cadf05694de3aa21c5e280e2635
SHA512d8071f20b488160a97cffc863dd204dd5faa76e2031692f9870534533ea18dd24aab400c5180ad7129783b4c69fc6f55c699fcd011c41f6b87ca4829487e893a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5436d8ceafdf63e19386a8813207855ae
SHA103fd7ae28e2b5d657e8a488f5058f2db3252ef9e
SHA256ff958f02f1f7a1ce4ad5a8a650b1fa8e6f456cadf05694de3aa21c5e280e2635
SHA512d8071f20b488160a97cffc863dd204dd5faa76e2031692f9870534533ea18dd24aab400c5180ad7129783b4c69fc6f55c699fcd011c41f6b87ca4829487e893a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5bd7a665414e10d5c07a3068811c66d2c
SHA1dab81be076e1c29223ec71952014591e40b0b0fa
SHA256c07edbfcc7b77414962ff321120c5aa2537c3179a555823dcc31743c230ca4c8
SHA512f4e5251ef3f95022b57789d23f726823bfe920a4cd21b68c57d28a09a6c81e1735c3fce59064c1674cfb9fe0a4f7dbf88058e4559b11c920b05f1a09103e851b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
244B
MD5b2ac5cb8e975cff300c900736527491d
SHA1c4fb04d65d79e0a46b40210ef7a37fb2480c76be
SHA256d8ad690f31168e4c68ce83f42e1e22499c0a120e860b96797b9ba36e194d17b0
SHA512b59a0fb91814943a32dcb6c81d5784603d0d724c0c5e342dbc66de3569e75ba4cec7dcb4b9e7a226af4a155c7c93edb5ca4673dcaf94d4ee38b2a4a351b7e360
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ecc30a26e47a4b012ea6250d5a109789
SHA19b44857fd94d2f59f725fda3d7a5815dfbdb10d4
SHA2564a80a31ca3e2379d5ea2c6cf9206e028f2f129edcaeabc7186f91174484e9953
SHA512910a6be61a2c10babb4dd5fd300800ce838e642944a89b12e47b54df9fdcf2e7fe4d9c68c46735cc16f008661f1787c2125cbf97e6d0a48a9b1e55070ce7abb6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD572c70861791fccfeff1a282e4444aaff
SHA19ea1fec443fddc76d3abd5f5701ec0c79b3af4ee
SHA256d54e3dcce5560894b574185597e61cd3137e6c4715e8254f69ae4c76c9f45fa4
SHA5122c323497c1f4c63360bbf3ed114d39973ddbcd34df4c7837b81e7a369755643ebd16e87d1876109a5d8583853a71956e3223b4bc6af5b8d56d1b5c0994b22112
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD572c70861791fccfeff1a282e4444aaff
SHA19ea1fec443fddc76d3abd5f5701ec0c79b3af4ee
SHA256d54e3dcce5560894b574185597e61cd3137e6c4715e8254f69ae4c76c9f45fa4
SHA5122c323497c1f4c63360bbf3ed114d39973ddbcd34df4c7837b81e7a369755643ebd16e87d1876109a5d8583853a71956e3223b4bc6af5b8d56d1b5c0994b22112
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5294f586205f61c75c1425bfca52f45cc
SHA16e0bf41a39aa96f2fefa6805f1dacd5efb0e2751
SHA2562e58ef965bdf96ea285b4eb4bd0c2c93a3d81f2545af803c43e9cade8d093f5f
SHA512f36a7bc07225c78392b165de2165c8d6a612eb8da4ad60f76ace9613a8e09cba097794f153db4c44d758787ea1a3b53e064de58fc180abd77a4c29b58033a16d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c5dc084f6c61c15b7823692301922b10
SHA1be18424d12706db494bcdc0c8886f7494ffd6a5b
SHA2565dfad52593951424c0585dcdf4a94c2d5b822efdbd278498674766d56663e155
SHA512d5859a9b5cb559ed84f38e4494f66988e5a706a86e5b5a3ad9f65c8c47bde79e2526fbd1e1dc3f433dab27f7e766ec5ae346cf8acf5924f9414ea2eb01c69724
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD58169bcdf1842aa95ff3188977c854407
SHA10842ffd27a7f8a4d1fe2b0cf9261c7d66b4450aa
SHA25674415fe8049b2163da399d567e9865a0c708552c7bc77e8aa013731dda57e269
SHA512256008d74084c5bc0589ae550814c5776d67b02e17f2efbb2697dd1de4e216a99528dd648c9b4c21f565cf5a2314e419ba900c609725fb8f7f3ba56028a0287a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD58169bcdf1842aa95ff3188977c854407
SHA10842ffd27a7f8a4d1fe2b0cf9261c7d66b4450aa
SHA25674415fe8049b2163da399d567e9865a0c708552c7bc77e8aa013731dda57e269
SHA512256008d74084c5bc0589ae550814c5776d67b02e17f2efbb2697dd1de4e216a99528dd648c9b4c21f565cf5a2314e419ba900c609725fb8f7f3ba56028a0287a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD570d48d410cd8a13349432ec3c1e176a5
SHA14ba7c54d9d0932256a719e5844f27528a699c087
SHA256e771b6b8663e15ed15cdec1176df0f2acdda155d252d8d8054bce8dc3cc05512
SHA512aec88940b3088c1c1a81df7cd030dd162f00c83dc273259926a7e4d4054034b822bb52d23c082b1cbc1a7f3c0dd8e0427da93748e931b8f08bc1edb9f0bcdaea
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ea05190da76653e9b5bfe051c70edf55
SHA155cec21a5781a00aa042240feed6c15808f5da17
SHA2563f5f572f243a6777ced8044b795a1d549fc2315d731b8c114641691bbe2c0c48
SHA51256fe736b4305b89d84744ad9dee68f9faf6ed01065b130465c605bc3cdf7c4b0b249aeff6b97a1780c05e16af3915db5dc24ac3e5999f696fb1d4411d64a4c51
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5fb69a96806085437b759c666cba5a533
SHA16eb1a5912a96a405c62f45e09e0ccc63415b8627
SHA25606d24ca409eaacde15f87c2b9606899534b3ac7a9cad141413d3b66f7efe6d80
SHA5127a22be66017537a10401664534fb5224e4837717c3a30839c3a577bc8deebd94a44cca5bb77ba0402854880322fe07d4a81dd26cc4bf8a21e145b349e8b72041
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5038e3a195dbf5b69e27efbce5b8ef78e
SHA1525642162cc2c121be3835ce32950b57302bd116
SHA256357ece3055d9a1fde35972c4945e31d1d97f7307ad50cb70588952225dcd9686
SHA512757a97905468154762f2a0ec9d4969e8312cc6a7a018aac6d6d74d3eb2253c6d738ab2cee82f35c3def50b5c7303932fae13c1c524c170a97ccc7437ac280951
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5bad43e739ccf04fd816ed972c0995cda
SHA17c2b25cbdb8f5406e5b1189c283d4f3da22ac5bc
SHA2563522ff8d24263fb1671888b46d7032f287f4231ae2706fffa5150e1a8a12c7bd
SHA512fe55d68cb6eba59e432669922287b9e1131ce923cb585322d97c0e9b7a8e3a5ece305923e08509cecb82da658dc2d35544a5f802f274279867728d30b7f49c27
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5723cfb6820ef51dcbb5b0b99b6745e7d
SHA134adbb72ecb6e900829d4186401c7032f0de37f4
SHA256b108655425e5fd2386a04a66fdd92230cae2484e6a66ee9fbe8a1dc8775cf002
SHA51227dc03bc724985615755fb4444acd25b1bc83c3c63515ed0e961433f6ac5ee6beda03fcb990683efe3abcc990321b28d5b250b45dc7236f63fef5933816246d8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5723cfb6820ef51dcbb5b0b99b6745e7d
SHA134adbb72ecb6e900829d4186401c7032f0de37f4
SHA256b108655425e5fd2386a04a66fdd92230cae2484e6a66ee9fbe8a1dc8775cf002
SHA51227dc03bc724985615755fb4444acd25b1bc83c3c63515ed0e961433f6ac5ee6beda03fcb990683efe3abcc990321b28d5b250b45dc7236f63fef5933816246d8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD580bbea18670b5f931178b3b972ceb9b0
SHA1707894a570d58d7bb4664ba5cde0abf37f16bdf5
SHA256e3a889805abd977f2df1916cc7e30d3a692c66b6b168c8f7bcf2de8dc4f7ad51
SHA512cc701d138bca8dbdf60314d8c84dea2048d1f111e3c26c4c9571c1305a0e58ea297b393f7b69c8351bea4ac827d024962306ef6b381bb4718dddd43152443157
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD51cbac6632ef8c10064100693f5b51caf
SHA12840de2e65ea52c63fb32634fe2c4d56d9f25b97
SHA256bb30e3d0a78ecd43f0d3129f54508065bc2f8ecc30a500c8fe91521142b2ad43
SHA512a98f1fdc54b3630c192aa3cb560a471a88a23eda044f3d9ee3d9ffb7043165e8a860ac7f5c13e28f594212347103cceb3860ecf6216d86537143f244eb510489
-
memory/228-208-0x0000000000000000-mapping.dmp
-
memory/360-150-0x0000000000000000-mapping.dmp
-
memory/412-202-0x0000000000000000-mapping.dmp
-
memory/548-146-0x0000000000000000-mapping.dmp
-
memory/620-177-0x0000000000000000-mapping.dmp
-
memory/908-173-0x0000000005990000-0x00000000059F6000-memory.dmpFilesize
408KB
-
memory/908-162-0x0000000005A00000-0x0000000006028000-memory.dmpFilesize
6.2MB
-
memory/908-158-0x0000000000000000-mapping.dmp
-
memory/908-185-0x0000000007F10000-0x000000000858A000-memory.dmpFilesize
6.5MB
-
memory/1056-175-0x0000000000000000-mapping.dmp
-
memory/1088-196-0x0000000000000000-mapping.dmp
-
memory/1108-194-0x0000000000000000-mapping.dmp
-
memory/1120-151-0x0000000000000000-mapping.dmp
-
memory/1240-148-0x0000000000000000-mapping.dmp
-
memory/1356-176-0x0000000000000000-mapping.dmp
-
memory/1364-209-0x0000000000000000-mapping.dmp
-
memory/1404-147-0x0000000000000000-mapping.dmp
-
memory/1440-144-0x0000000000000000-mapping.dmp
-
memory/1472-164-0x0000000000000000-mapping.dmp
-
memory/1672-168-0x0000000000000000-mapping.dmp
-
memory/1716-152-0x0000000000000000-mapping.dmp
-
memory/1732-174-0x0000000000000000-mapping.dmp
-
memory/1836-172-0x0000000000000000-mapping.dmp
-
memory/1872-200-0x0000000000000000-mapping.dmp
-
memory/1888-130-0x00000000009A0000-0x0000000000AAC000-memory.dmpFilesize
1.0MB
-
memory/1888-132-0x0000000005520000-0x0000000005523000-memory.dmpFilesize
12KB
-
memory/1964-182-0x0000000000000000-mapping.dmp
-
memory/1972-188-0x0000000000000000-mapping.dmp
-
memory/1996-145-0x0000000000000000-mapping.dmp
-
memory/2120-159-0x0000000000000000-mapping.dmp
-
memory/2180-201-0x0000000000000000-mapping.dmp
-
memory/2188-157-0x0000000000000000-mapping.dmp
-
memory/2260-193-0x0000000000000000-mapping.dmp
-
memory/2560-167-0x0000000000000000-mapping.dmp
-
memory/2700-170-0x0000000000000000-mapping.dmp
-
memory/3008-154-0x0000000000000000-mapping.dmp
-
memory/3152-156-0x0000000000000000-mapping.dmp
-
memory/3152-160-0x00000000023C0000-0x00000000023F6000-memory.dmpFilesize
216KB
-
memory/3160-166-0x0000000000000000-mapping.dmp
-
memory/3168-191-0x0000000000000000-mapping.dmp
-
memory/3192-203-0x0000000000000000-mapping.dmp
-
memory/3224-149-0x0000000000000000-mapping.dmp
-
memory/3228-161-0x0000000000000000-mapping.dmp
-
memory/3312-169-0x0000000000000000-mapping.dmp
-
memory/3460-141-0x0000000000000000-mapping.dmp
-
memory/3536-133-0x0000000000400000-0x00000000004B8000-memory.dmpFilesize
736KB
-
memory/3536-184-0x0000000000000000-mapping.dmp
-
memory/3536-136-0x00000000059E0000-0x0000000005A46000-memory.dmpFilesize
408KB
-
memory/3536-131-0x0000000000000000-mapping.dmp
-
memory/3536-134-0x0000000005E00000-0x00000000063A4000-memory.dmpFilesize
5.6MB
-
memory/3536-143-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3536-135-0x0000000005850000-0x00000000058EC000-memory.dmpFilesize
624KB
-
memory/3580-192-0x0000000000000000-mapping.dmp
-
memory/3596-206-0x0000000000000000-mapping.dmp
-
memory/3748-163-0x0000000000000000-mapping.dmp
-
memory/3748-171-0x00000000051B0000-0x00000000051D2000-memory.dmpFilesize
136KB
-
memory/3748-178-0x0000000006160000-0x000000000617E000-memory.dmpFilesize
120KB
-
memory/3748-186-0x0000000006630000-0x000000000664A000-memory.dmpFilesize
104KB
-
memory/3748-197-0x0000000007320000-0x0000000007342000-memory.dmpFilesize
136KB
-
memory/3812-165-0x0000000000000000-mapping.dmp
-
memory/3812-195-0x00000000077E0000-0x0000000007876000-memory.dmpFilesize
600KB
-
memory/3884-138-0x0000000000000000-mapping.dmp
-
memory/4176-179-0x0000000000000000-mapping.dmp
-
memory/4224-187-0x0000000000000000-mapping.dmp
-
memory/4272-139-0x0000000000000000-mapping.dmp
-
memory/4272-181-0x0000000000000000-mapping.dmp
-
memory/4296-180-0x0000000000000000-mapping.dmp
-
memory/4352-183-0x0000000000000000-mapping.dmp
-
memory/4424-140-0x0000000000000000-mapping.dmp
-
memory/4556-207-0x0000000000000000-mapping.dmp
-
memory/4740-189-0x0000000000000000-mapping.dmp
-
memory/4760-137-0x0000000000000000-mapping.dmp
-
memory/4820-142-0x0000000000000000-mapping.dmp
-
memory/4824-198-0x0000000000000000-mapping.dmp
-
memory/4856-190-0x0000000000000000-mapping.dmp
-
memory/4856-210-0x0000000000000000-mapping.dmp
-
memory/4876-205-0x0000000000000000-mapping.dmp
-
memory/4892-155-0x0000000000000000-mapping.dmp
-
memory/4964-199-0x0000000000000000-mapping.dmp
-
memory/5072-204-0x0000000000000000-mapping.dmp