c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2022, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe
Size

717KB
MD5

434e74d8541af2a5f3a5573a53077e42
SHA1

780bdede9640d95338eca0c7ad8d46d40756fca4
SHA256

c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e
SHA512

025e6cdc2cb8b92a2a4b2ed8a13d45e5f25224e88c4c3f85b1ba2ee1aa66a50473b7fae0733ae06df9da18c863e16ea318454044f6e92f3d10c9d80542d08457
SSDEEP

768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4200	dllhost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4624	schtasks.exe
4976	schtasks.exe
4960	schtasks.exe
3404	schtasks.exe
1480	schtasks.exe
60	schtasks.exe
4512	schtasks.exe
1284	schtasks.exe
3664	schtasks.exe
3568	schtasks.exe
4220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
224	powershell.exe
224	powershell.exe
2724	powershell.exe
2724	powershell.exe
4040	powershell.exe
4040	powershell.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe
4200	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	powershell.exe
Token: SeDebugPrivilege	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	4040	powershell.exe
Token: SeDebugPrivilege	4200	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3928	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe	85
PID 540 wrote to memory of 3928	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe	85
PID 540 wrote to memory of 3928	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe	85
PID 3928 wrote to memory of 116	3928	cmd.exe	87
PID 3928 wrote to memory of 116	3928	cmd.exe	87
PID 3928 wrote to memory of 116	3928	cmd.exe	87
PID 3928 wrote to memory of 224	3928	cmd.exe	88
PID 3928 wrote to memory of 224	3928	cmd.exe	88
PID 3928 wrote to memory of 224	3928	cmd.exe	88
PID 3928 wrote to memory of 2724	3928	cmd.exe	89
PID 3928 wrote to memory of 2724	3928	cmd.exe	89
PID 3928 wrote to memory of 2724	3928	cmd.exe	89
PID 3928 wrote to memory of 4040	3928	cmd.exe	90
PID 3928 wrote to memory of 4040	3928	cmd.exe	90
PID 3928 wrote to memory of 4040	3928	cmd.exe	90
PID 540 wrote to memory of 4200	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe	93
PID 540 wrote to memory of 4200	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe	93
PID 540 wrote to memory of 4200	540	c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe	93
PID 4200 wrote to memory of 4736	4200	dllhost.exe	94
PID 4200 wrote to memory of 4736	4200	dllhost.exe	94
PID 4200 wrote to memory of 4736	4200	dllhost.exe	94
PID 4200 wrote to memory of 4356	4200	dllhost.exe	95
PID 4200 wrote to memory of 4356	4200	dllhost.exe	95
PID 4200 wrote to memory of 4356	4200	dllhost.exe	95
PID 4200 wrote to memory of 4328	4200	dllhost.exe	97
PID 4200 wrote to memory of 4328	4200	dllhost.exe	97
PID 4200 wrote to memory of 4328	4200	dllhost.exe	97
PID 4200 wrote to memory of 5104	4200	dllhost.exe	99
PID 4200 wrote to memory of 5104	4200	dllhost.exe	99
PID 4200 wrote to memory of 5104	4200	dllhost.exe	99
PID 4200 wrote to memory of 2296	4200	dllhost.exe	102
PID 4200 wrote to memory of 2296	4200	dllhost.exe	102
PID 4200 wrote to memory of 2296	4200	dllhost.exe	102
PID 4200 wrote to memory of 2000	4200	dllhost.exe	103
PID 4200 wrote to memory of 2000	4200	dllhost.exe	103
PID 4200 wrote to memory of 2000	4200	dllhost.exe	103
PID 4200 wrote to memory of 4480	4200	dllhost.exe	104
PID 4200 wrote to memory of 4480	4200	dllhost.exe	104
PID 4200 wrote to memory of 4480	4200	dllhost.exe	104
PID 4200 wrote to memory of 1252	4200	dllhost.exe	110
PID 4200 wrote to memory of 1252	4200	dllhost.exe	110
PID 4200 wrote to memory of 1252	4200	dllhost.exe	110
PID 4200 wrote to memory of 4556	4200	dllhost.exe	107
PID 4200 wrote to memory of 4556	4200	dllhost.exe	107
PID 4200 wrote to memory of 4556	4200	dllhost.exe	107
PID 4200 wrote to memory of 1456	4200	dllhost.exe	108
PID 4200 wrote to memory of 1456	4200	dllhost.exe	108
PID 4200 wrote to memory of 1456	4200	dllhost.exe	108
PID 4200 wrote to memory of 3420	4200	dllhost.exe	112
PID 4200 wrote to memory of 3420	4200	dllhost.exe	112
PID 4200 wrote to memory of 3420	4200	dllhost.exe	112
PID 4200 wrote to memory of 4636	4200	dllhost.exe	114
PID 4200 wrote to memory of 4636	4200	dllhost.exe	114
PID 4200 wrote to memory of 4636	4200	dllhost.exe	114
PID 4356 wrote to memory of 4512	4356	cmd.exe	123
PID 4356 wrote to memory of 4512	4356	cmd.exe	123
PID 4356 wrote to memory of 4512	4356	cmd.exe	123
PID 1252 wrote to memory of 3404	1252	cmd.exe	118
PID 1252 wrote to memory of 3404	1252	cmd.exe	118
PID 1252 wrote to memory of 3404	1252	cmd.exe	118
PID 4556 wrote to memory of 1284	4556	cmd.exe	124
PID 4556 wrote to memory of 1284	4556	cmd.exe	124
PID 4556 wrote to memory of 1284	4556	cmd.exe	124
PID 4328 wrote to memory of 1480	4328	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe
"C:\Users\Admin\AppData\Local\Temp\c68e8fb9d36147ab6b1fde372d2e1cf5b6130ba01c7151de6c26bde26440667e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- C:\ProgramData\Dllhost\dllhost.exe
  "C:\ProgramData\Dllhost\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4736
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3568
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4512
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:5104
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:60
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2000
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4480
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4976
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1344" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1344" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8517" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1456
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk8517" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1252
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1344" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3420
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1344" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3664
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5982" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4636
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5982" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:1232
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:1904
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:5040
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:3108
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:3360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
892KB

MD5
c7c292d1658dde84e5de840a5b987f82

SHA1
0f82384272b26fbc571583aea280a2afa65260c4

SHA256
a4a7da7ef112cc068aba265c7bc0a737c0f264c6d16324e1250ed8b23b0c0158

SHA512
5336086147b4a6f16a595b246ac091cca5cdd19f61a02064df5b804a0e53afc1a4413592ec7f65ce3005b16c7d1aef1f77bf588dad8437d3dea6510afd080a4c

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
892KB

MD5
c7c292d1658dde84e5de840a5b987f82

SHA1
0f82384272b26fbc571583aea280a2afa65260c4

SHA256
a4a7da7ef112cc068aba265c7bc0a737c0f264c6d16324e1250ed8b23b0c0158

SHA512
5336086147b4a6f16a595b246ac091cca5cdd19f61a02064df5b804a0e53afc1a4413592ec7f65ce3005b16c7d1aef1f77bf588dad8437d3dea6510afd080a4c

Download Submit
C:\ProgramData\HostData\logs.uce

Filesize
497B

MD5
13fda2ab01b83a5130842a5bab3892d3

SHA1
6e18e4b467cde054a63a95d4dfc030f156ecd215

SHA256
76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

SHA512
c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
517c5656dee8f2cd6f9568b914d45bdb

SHA1
75e1a100ef767474823a53aa24bc7b612b3a32fe

SHA256
2269f4f0ab0650a0d49ed65e1da36f01b998bfce91941122ea34583907ecb14f

SHA512
a7d6da77c1319ea004fe524f0c6d786a29b090e4ff61cdb82efd6da2e0bb681a5a54f7d5c60d2dc33ee239de11f7274c6f10a5dca02989c22857eaedcd153812

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
40fd2d14c9f98d43e301f1324337ebca

SHA1
b23d44720afa81bf0dd79875ea1e3a7ec18a16ca

SHA256
7ad3ec2b2553bdbfa1777c705e8d9ad69757dbf20e3452022229da3e4b3af827

SHA512
560b1156bb9a1283ccb027b558f83a7a0c5d8c298c33d9442d01b5a3c09d239916f8ed950468d38d31ac8b20b2c5a5af00b90fa3e1400ef17ec271cf14ad2e40

Download Submit
memory/224-148-0x0000000007510000-0x0000000007B8A000-memory.dmp

Filesize
6.5MB

Download
memory/224-151-0x0000000007130000-0x00000000071C6000-memory.dmp

Filesize
600KB

Download
memory/224-142-0x0000000004BB0000-0x0000000004BD2000-memory.dmp

Filesize
136KB

Download
memory/224-143-0x0000000004C50000-0x0000000004CB6000-memory.dmp

Filesize
408KB

Download
memory/224-144-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/224-145-0x0000000006B50000-0x0000000006B82000-memory.dmp

Filesize
200KB

Download
memory/224-146-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Filesize
304KB

Download
memory/224-147-0x0000000006130000-0x000000000614E000-memory.dmp

Filesize
120KB

Download
memory/224-141-0x0000000004D50000-0x0000000005378000-memory.dmp

Filesize
6.2MB

Download
memory/224-149-0x0000000006EB0000-0x0000000006ECA000-memory.dmp

Filesize
104KB

Download
memory/224-150-0x0000000006F00000-0x0000000006F0A000-memory.dmp

Filesize
40KB

Download
memory/224-152-0x00000000070D0000-0x00000000070DE000-memory.dmp

Filesize
56KB

Download
memory/224-153-0x00000000071D0000-0x00000000071EA000-memory.dmp

Filesize
104KB

Download
memory/224-154-0x0000000007110000-0x0000000007118000-memory.dmp

Filesize
32KB

Download
memory/224-140-0x0000000000DC0000-0x0000000000DF6000-memory.dmp

Filesize
216KB

Download
memory/540-136-0x0000000005360000-0x00000000053C6000-memory.dmp

Filesize
408KB

Download
memory/540-133-0x0000000005790000-0x0000000005D34000-memory.dmp

Filesize
5.6MB

Download
memory/540-132-0x00000000006C0000-0x0000000000768000-memory.dmp

Filesize
672KB

Download
memory/540-134-0x0000000005100000-0x0000000005192000-memory.dmp

Filesize
584KB

Download
memory/540-135-0x00000000051B0000-0x00000000051BA000-memory.dmp

Filesize
40KB

Download
memory/2724-158-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Filesize
304KB

Download
memory/4040-161-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Filesize
304KB

Download
memory/4200-165-0x00000000004B0000-0x0000000000560000-memory.dmp

Filesize
704KB

Download