Analysis Overview
SHA256
a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b
Threat Level: Known bad
The file a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b was found to be: Known bad.
Malicious Activity Summary
MassLogger
MassLogger log file
Reads user/profile data of web browsers
Deletes itself
Checks computer location settings
Looks up external IP address via web service
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
outlook_office_path
outlook_win_path
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-05-21 12:18
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-21 12:18
Reported
2022-05-21 12:33
Platform
win7-20220414-en
Max time kernel
57s
Max time network
58s
Command Line
Signatures
MassLogger
MassLogger log file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1336 set thread context of 988 | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | C:\Users\Admin\AppData\Local\Temp\Dekont.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Dekont.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"
C:\Users\Admin\AppData\Local\Temp\Dekont.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"
C:\Users\Admin\AppData\Local\Temp\Dekont.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe' & exit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe'
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 52.20.78.240:80 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | mail.nartaccess.com | udp |
Files
memory/1336-54-0x0000000000880000-0x000000000098A000-memory.dmp
memory/1336-55-0x0000000074B51000-0x0000000074B53000-memory.dmp
memory/1336-56-0x00000000007B0000-0x000000000086C000-memory.dmp
memory/988-57-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/988-58-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/988-60-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/988-61-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/988-62-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/988-63-0x00000000004BF8CE-mapping.dmp
memory/988-66-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/988-68-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/2020-65-0x0000000000000000-mapping.dmp
memory/988-70-0x00000000022F0000-0x0000000002368000-memory.dmp
memory/2020-72-0x000000006FA70000-0x000000007001B000-memory.dmp
memory/988-73-0x00000000005B5000-0x00000000005C6000-memory.dmp
memory/988-74-0x0000000000850000-0x0000000000864000-memory.dmp
memory/1888-75-0x0000000000000000-mapping.dmp
memory/1452-76-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
| MD5 | aef5dbb4bf2efedb9561b6266960f3e5 |
| SHA1 | 99e5628ab9fca96abfa92df12e760ad7ffdc1038 |
| SHA256 | ce0807429c279525d2348707ad7cc40898f02aea691fcbdd6ff708d0e58b9e47 |
| SHA512 | 4449bbc136362ce10640a498ea5eb6ab9b424c825015750b7ef5fe1709a3b372240bb40629260525bc3ef32141c4371bc1c22195249f31ddad8a4fbc709bbaf1 |
memory/1452-79-0x0000000072E40000-0x00000000733EB000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-21 12:18
Reported
2022-05-21 12:33
Platform
win10v2004-20220414-en
Max time kernel
90s
Max time network
140s
Command Line
Signatures
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4972 set thread context of 1392 | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | C:\Users\Admin\AppData\Local\Temp\Dekont.exe |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Dekont.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\Dekont.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"
C:\Users\Admin\AppData\Local\Temp\Dekont.exe
"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
C:\Windows\SysWOW64\cmd.exe
"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe' & exit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe'
Network
| Country | Destination | Domain | Proto |
| NL | 104.110.191.140:80 | tcp | |
| BE | 8.238.110.126:80 | tcp |
Files
memory/4972-130-0x0000000000A80000-0x0000000000B8A000-memory.dmp
memory/4972-131-0x0000000005A00000-0x0000000005FA4000-memory.dmp
memory/4972-132-0x0000000005450000-0x00000000054E2000-memory.dmp
memory/4972-133-0x00000000030D0000-0x00000000030DA000-memory.dmp
memory/4972-134-0x00000000079E0000-0x0000000007A56000-memory.dmp
memory/4972-135-0x00000000059B0000-0x00000000059CE000-memory.dmp
memory/4972-136-0x0000000007BA0000-0x0000000007C06000-memory.dmp
memory/1392-137-0x0000000000000000-mapping.dmp
memory/1392-138-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/1132-139-0x0000000000000000-mapping.dmp
memory/1392-140-0x0000000004ED0000-0x0000000004F6C000-memory.dmp
memory/1132-141-0x0000000005380000-0x00000000053B6000-memory.dmp
memory/1132-142-0x0000000005A50000-0x0000000006078000-memory.dmp
memory/1132-143-0x0000000005950000-0x0000000005972000-memory.dmp
memory/1132-144-0x0000000006180000-0x00000000061E6000-memory.dmp
memory/1132-145-0x0000000006930000-0x000000000694E000-memory.dmp
memory/1132-146-0x0000000007930000-0x0000000007962000-memory.dmp
memory/1132-147-0x0000000071440000-0x000000007148C000-memory.dmp
memory/1132-148-0x0000000006EC0000-0x0000000006EDE000-memory.dmp
memory/1132-149-0x00000000082A0000-0x000000000891A000-memory.dmp
memory/1132-150-0x0000000007C40000-0x0000000007C5A000-memory.dmp
memory/1132-151-0x0000000007CA0000-0x0000000007CAA000-memory.dmp
memory/1132-152-0x0000000007EB0000-0x0000000007F46000-memory.dmp
memory/1132-153-0x0000000007E70000-0x0000000007E7E000-memory.dmp
memory/1132-154-0x0000000007F80000-0x0000000007F9A000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont.exe.log
| MD5 | 64db62f1fcd6f05a3298e223fe336792 |
| SHA1 | c71bec9b3dbb6ec42e03ea82a9de0ad85ddbe54e |
| SHA256 | 48e2648284e19b36808a8979cfd32e0e272bc52446854784328343912c808989 |
| SHA512 | 222caa4f30f905b008651506122d7b1c4119277d9cdb69aa3bf3ea911285f94176f257d9f76d4a5097b501d097910e1fea78eaaab9b00543e16b573fba618228 |
memory/1196-155-0x0000000000000000-mapping.dmp
memory/1132-157-0x0000000007F60000-0x0000000007F68000-memory.dmp
memory/4944-158-0x0000000000000000-mapping.dmp
memory/4944-159-0x0000000006550000-0x0000000006572000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 8ef3408a69c8d8d355d01fec045fc466 |
| SHA1 | 902571f67e8098a380fbb4c94da004c44c716d6d |
| SHA256 | c5d6dab8e30b6ec09130f138a5ab61ecfba811d954b68ff58f51753c0932a371 |
| SHA512 | b1e9eac3c765d7aa6b1b95376066bd19e2a112e3d21b09c9bdf18775488cefc0ebba8dd6a11f1fbde40926c39559e75de5b76ad7c815902b032abcb49c1d55a0 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |