Analysis
-
max time kernel
98s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe
Resource
win10v2004-20220414-en
General
-
Target
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe
-
Size
1.5MB
-
MD5
000f1831732413a98b9f38ce657dab21
-
SHA1
0375a5e61afe2e1a9b2f9a1812ed5a15f1e1df06
-
SHA256
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5
-
SHA512
22be98db2ba49aa8b202dd3bf9c142c5a710c57f15382128e99fff4b62f8e2cbc7a09b25945ce44cb7b401e0c56a54542b26ccd121a6724e4035fbd4ececc93e
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe\"" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Turns off Windows Defender SpyNet reporting 2 TTPs
-
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Drops startup file 2 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe" 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription pid process target process PID 1600 set thread context of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1468 2260 WerFault.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid process 1756 powershell.exe 2896 powershell.exe 632 powershell.exe 3788 powershell.exe 1756 powershell.exe 2896 powershell.exe 632 powershell.exe 3788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 2896 powershell.exe Token: SeDebugPrivilege 632 powershell.exe Token: SeDebugPrivilege 3788 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exedescription pid process target process PID 1600 wrote to memory of 2896 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 2896 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 2896 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 632 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 632 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 632 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 1756 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 1756 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 1756 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 3788 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 3788 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 3788 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe powershell.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe PID 1600 wrote to memory of 2260 1600 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe 16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe"C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe"C:\Users\Admin\AppData\Local\Temp\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 8443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2260 -ip 22601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Winlogon Helper DLL
1Modify Existing Service
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
6Disabling Security Tools
4Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\16823d06e4fa5f54618475d675ff8bfe434b1b89b344a41a81b2d3edc0bbc2e5.exe.logFilesize
1KB
MD578de7805f6690cabfbd1de459db6d114
SHA1e2065ffecf5377d717440fd592c3d1d8320b1d4d
SHA256f008a1bbc9a8ab34149baf444cb8bf55875459f51cb7fe48dc525c232ffca22f
SHA5128e70d184275521518c61e293d1b71ab298c193aad9e4e486846e202b8f0cd54879f3c3252da11119fc60e5b3069906c6f446af662a3918cbd6d602f9aed759a2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD58936a2df780583b4ee1fa932a88435fd
SHA1eb80ba235acad90a0a0e57adbfa00c27b4edadbf
SHA256744c81dd0694820d5f04c78f6358b84f7ec04a0b1270df10eb41ec4f4503140d
SHA5120da00c7b9637248d57caf67aa6f89ed29f996bbc92b460f48863b0701c361296a68afae8131a78dbb510c543573f1f3034e7c76a0caaeeb0a7bee5f5dc101e40
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD58936a2df780583b4ee1fa932a88435fd
SHA1eb80ba235acad90a0a0e57adbfa00c27b4edadbf
SHA256744c81dd0694820d5f04c78f6358b84f7ec04a0b1270df10eb41ec4f4503140d
SHA5120da00c7b9637248d57caf67aa6f89ed29f996bbc92b460f48863b0701c361296a68afae8131a78dbb510c543573f1f3034e7c76a0caaeeb0a7bee5f5dc101e40
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD554944f8acfbead68a940b96426a434c3
SHA14768b9e21eb3a1009ab2347b15cfbe93dd660a66
SHA256b1280646eaab131e7f818051001cceb7845e9fffa6eb27e4b34c658347532bc1
SHA51224238d42c144f4a5ced7b97c643162227dda7750123c4b1bb13cd2bfc83f299b1d68088ba0918bd03703eb4a5e0c30ff2d0d76e51fcb13d075344c32b0059df8
-
memory/632-142-0x00000000068A0000-0x00000000068BE000-memory.dmpFilesize
120KB
-
memory/632-161-0x000000006FBA0000-0x000000006FBEC000-memory.dmpFilesize
304KB
-
memory/632-135-0x0000000000000000-mapping.dmp
-
memory/632-184-0x0000000007C10000-0x0000000007C1A000-memory.dmpFilesize
40KB
-
memory/1600-133-0x0000000006A20000-0x0000000006A86000-memory.dmpFilesize
408KB
-
memory/1600-132-0x0000000006F60000-0x0000000007504000-memory.dmpFilesize
5.6MB
-
memory/1600-131-0x00000000056E0000-0x000000000577C000-memory.dmpFilesize
624KB
-
memory/1600-130-0x0000000000C20000-0x0000000000DA2000-memory.dmpFilesize
1.5MB
-
memory/1756-140-0x0000000004E20000-0x0000000004E42000-memory.dmpFilesize
136KB
-
memory/1756-136-0x0000000000000000-mapping.dmp
-
memory/1756-163-0x0000000006490000-0x00000000064AE000-memory.dmpFilesize
120KB
-
memory/1756-258-0x0000000007510000-0x0000000007518000-memory.dmpFilesize
32KB
-
memory/1756-251-0x0000000007530000-0x000000000754A000-memory.dmpFilesize
104KB
-
memory/1756-240-0x0000000007420000-0x000000000742E000-memory.dmpFilesize
56KB
-
memory/1756-158-0x000000006FBA0000-0x000000006FBEC000-memory.dmpFilesize
304KB
-
memory/2260-173-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-192-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-143-0x0000000000000000-mapping.dmp
-
memory/2260-439-0x0000000005060000-0x00000000050F2000-memory.dmpFilesize
584KB
-
memory/2260-144-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-147-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-149-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-151-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-165-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-167-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-169-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-171-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-155-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-217-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-215-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-177-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-179-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-181-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-183-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-153-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-186-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-188-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-190-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-160-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-194-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-196-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-213-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-199-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-201-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-203-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-205-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-207-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-209-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2260-211-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2896-197-0x0000000007C00000-0x0000000007C96000-memory.dmpFilesize
600KB
-
memory/2896-176-0x0000000007FD0000-0x000000000864A000-memory.dmpFilesize
6.5MB
-
memory/2896-139-0x0000000005750000-0x0000000005D78000-memory.dmpFilesize
6.2MB
-
memory/2896-141-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/2896-137-0x00000000050D0000-0x0000000005106000-memory.dmpFilesize
216KB
-
memory/2896-134-0x0000000000000000-mapping.dmp
-
memory/2896-162-0x000000006FBA0000-0x000000006FBEC000-memory.dmpFilesize
304KB
-
memory/2896-157-0x0000000006C50000-0x0000000006C82000-memory.dmpFilesize
200KB
-
memory/3788-175-0x00000000077F0000-0x000000000780A000-memory.dmpFilesize
104KB
-
memory/3788-159-0x000000006FBA0000-0x000000006FBEC000-memory.dmpFilesize
304KB
-
memory/3788-138-0x0000000000000000-mapping.dmp