77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099

Analysis

max time kernel
151s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2022, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe
Size

717KB
MD5

fa6d7ed344ef7efa7dd965ec4a35be51
SHA1

9e12d0df1283e00cadc8ecdd7e85985df6eec34a
SHA256

77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099
SHA512

b19b242eb27ca5946665edd9638e0d3d33dc8d81c605cfa52787587529f46636ae416e4845e0917bb30374396568eda05c777d49d5461a1e246379e3f8acf6d6
SSDEEP

768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1112	dllhost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4076	schtasks.exe
3756	schtasks.exe
2356	schtasks.exe
4464	schtasks.exe
4276	schtasks.exe
3992	schtasks.exe
2360	schtasks.exe
2260	schtasks.exe
1680	schtasks.exe
3980	schtasks.exe
3108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	powershell.exe
2096	powershell.exe
2836	powershell.exe
2836	powershell.exe
4400	powershell.exe
4400	powershell.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe
1112	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	1112	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 3116	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe	84
PID 1748 wrote to memory of 3116	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe	84
PID 1748 wrote to memory of 3116	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe	84
PID 3116 wrote to memory of 2360	3116	cmd.exe	86
PID 3116 wrote to memory of 2360	3116	cmd.exe	86
PID 3116 wrote to memory of 2360	3116	cmd.exe	86
PID 3116 wrote to memory of 2096	3116	cmd.exe	87
PID 3116 wrote to memory of 2096	3116	cmd.exe	87
PID 3116 wrote to memory of 2096	3116	cmd.exe	87
PID 3116 wrote to memory of 2836	3116	cmd.exe	88
PID 3116 wrote to memory of 2836	3116	cmd.exe	88
PID 3116 wrote to memory of 2836	3116	cmd.exe	88
PID 3116 wrote to memory of 4400	3116	cmd.exe	90
PID 3116 wrote to memory of 4400	3116	cmd.exe	90
PID 3116 wrote to memory of 4400	3116	cmd.exe	90
PID 1748 wrote to memory of 1112	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe	91
PID 1748 wrote to memory of 1112	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe	91
PID 1748 wrote to memory of 1112	1748	77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe	91
PID 1112 wrote to memory of 5084	1112	dllhost.exe	92
PID 1112 wrote to memory of 5084	1112	dllhost.exe	92
PID 1112 wrote to memory of 5084	1112	dllhost.exe	92
PID 1112 wrote to memory of 2384	1112	dllhost.exe	115
PID 1112 wrote to memory of 2384	1112	dllhost.exe	115
PID 1112 wrote to memory of 2384	1112	dllhost.exe	115
PID 1112 wrote to memory of 4672	1112	dllhost.exe	113
PID 1112 wrote to memory of 4672	1112	dllhost.exe	113
PID 1112 wrote to memory of 4672	1112	dllhost.exe	113
PID 1112 wrote to memory of 3400	1112	dllhost.exe	93
PID 1112 wrote to memory of 3400	1112	dllhost.exe	93
PID 1112 wrote to memory of 3400	1112	dllhost.exe	93
PID 1112 wrote to memory of 3464	1112	dllhost.exe	104
PID 1112 wrote to memory of 3464	1112	dllhost.exe	104
PID 1112 wrote to memory of 3464	1112	dllhost.exe	104
PID 1112 wrote to memory of 1656	1112	dllhost.exe	94
PID 1112 wrote to memory of 1656	1112	dllhost.exe	94
PID 1112 wrote to memory of 1656	1112	dllhost.exe	94
PID 1112 wrote to memory of 4320	1112	dllhost.exe	95
PID 1112 wrote to memory of 4320	1112	dllhost.exe	95
PID 1112 wrote to memory of 4320	1112	dllhost.exe	95
PID 1112 wrote to memory of 2808	1112	dllhost.exe	101
PID 1112 wrote to memory of 2808	1112	dllhost.exe	101
PID 1112 wrote to memory of 2808	1112	dllhost.exe	101
PID 1112 wrote to memory of 3484	1112	dllhost.exe	97
PID 1112 wrote to memory of 3484	1112	dllhost.exe	97
PID 1112 wrote to memory of 3484	1112	dllhost.exe	97
PID 1112 wrote to memory of 3440	1112	dllhost.exe	98
PID 1112 wrote to memory of 3440	1112	dllhost.exe	98
PID 1112 wrote to memory of 3440	1112	dllhost.exe	98
PID 1112 wrote to memory of 1040	1112	dllhost.exe	107
PID 1112 wrote to memory of 1040	1112	dllhost.exe	107
PID 1112 wrote to memory of 1040	1112	dllhost.exe	107
PID 1112 wrote to memory of 4568	1112	dllhost.exe	108
PID 1112 wrote to memory of 4568	1112	dllhost.exe	108
PID 1112 wrote to memory of 4568	1112	dllhost.exe	108
PID 4568 wrote to memory of 2260	4568	cmd.exe	116
PID 2384 wrote to memory of 4276	2384	cmd.exe	120
PID 4568 wrote to memory of 2260	4568	cmd.exe	116
PID 4568 wrote to memory of 2260	4568	cmd.exe	116
PID 2384 wrote to memory of 4276	2384	cmd.exe	120
PID 2384 wrote to memory of 4276	2384	cmd.exe	120
PID 5084 wrote to memory of 4464	5084	cmd.exe	119
PID 5084 wrote to memory of 4464	5084	cmd.exe	119
PID 5084 wrote to memory of 4464	5084	cmd.exe	119
PID 3400 wrote to memory of 2356	3400	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe
"C:\Users\Admin\AppData\Local\Temp\77eb8b9ed8217c72d9432fb569bbd2a941a6fb98cd2276f0691eecb4037c0099.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:2360
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\ProgramData\Dllhost\dllhost.exe
  "C:\ProgramData\Dllhost\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2356
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1656
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3980
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6742" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3484
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6742" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4825" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3440
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk4825" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3464
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk772" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1040
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk772" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9311" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk9311" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4672
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:3276
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:3724
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:860
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:4632
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:2396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
893KB

MD5
aa2b130e83abfe1a904cea0b10e70f86

SHA1
33600c39054646f35bf69544ea78f0e8fe745c9c

SHA256
608226ec7362c8edf2652fb588180d0558cf4e2188ed1e7d3fde1faa196d0cea

SHA512
65ea35420290d04d24b050a2fb2aebb2716b9e22c3750fc34859aa7383b49f1bfa7cf53433cf578dc7fab8c1c851aa917ce7d8c98d79a01b5529c0081237580c

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
893KB

MD5
aa2b130e83abfe1a904cea0b10e70f86

SHA1
33600c39054646f35bf69544ea78f0e8fe745c9c

SHA256
608226ec7362c8edf2652fb588180d0558cf4e2188ed1e7d3fde1faa196d0cea

SHA512
65ea35420290d04d24b050a2fb2aebb2716b9e22c3750fc34859aa7383b49f1bfa7cf53433cf578dc7fab8c1c851aa917ce7d8c98d79a01b5529c0081237580c

Download Submit
C:\ProgramData\HostData\logs.uce

Filesize
497B

MD5
13fda2ab01b83a5130842a5bab3892d3

SHA1
6e18e4b467cde054a63a95d4dfc030f156ecd215

SHA256
76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

SHA512
c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
17a8b7b5efed654c8cfcfd8eba81d6fb

SHA1
6953f333e1affe2622733f6bf6184468218e4a64

SHA256
213404893d317463c5d7d99976d45abce2ff88e85966ac7c23a2a23cb2e2e9ac

SHA512
eb3eb54d9ba584290cf2a708278f52661c1eb87e5b8eb4520f8796853cc3a14662898c63f3abb1b26c39441b3ae3798ac9b5f1c48bd5f7248e14296a769b8f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
44cda8e80a0df47fe8105ec7549ad230

SHA1
20015eb4af999033b0bb78319b96a61eaee472ed

SHA256
6645fc680d93d0c5bc37217ab7bad1b7337a06deb0f5633b0d93f32e79a7900f

SHA512
c24d0b0ef095d9cc9f82547783b3da0c857fee34e205c1194e773474c3fe0c780a38a039f15319bccbf2544130dda18793572cf8145451ac53a6048f2759d56c

Download Submit
memory/1112-165-0x0000000000170000-0x0000000000220000-memory.dmp

Filesize
704KB

Download
memory/1748-136-0x0000000005690000-0x00000000056F6000-memory.dmp

Filesize
408KB

Download
memory/1748-135-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/1748-134-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/1748-133-0x00000000059C0000-0x0000000005F64000-memory.dmp

Filesize
5.6MB

Download
memory/1748-132-0x0000000000950000-0x00000000009F8000-memory.dmp

Filesize
672KB

Download
memory/2096-148-0x0000000007C10000-0x000000000828A000-memory.dmp

Filesize
6.5MB

Download
memory/2096-143-0x0000000005B00000-0x0000000005B66000-memory.dmp

Filesize
408KB

Download
memory/2096-151-0x0000000007830000-0x00000000078C6000-memory.dmp

Filesize
600KB

Download
memory/2096-152-0x00000000077D0000-0x00000000077DE000-memory.dmp

Filesize
56KB

Download
memory/2096-153-0x00000000078D0000-0x00000000078EA000-memory.dmp

Filesize
104KB

Download
memory/2096-154-0x0000000007810000-0x0000000007818000-memory.dmp

Filesize
32KB

Download
memory/2096-149-0x00000000075B0000-0x00000000075CA000-memory.dmp

Filesize
104KB

Download
memory/2096-147-0x0000000006820000-0x000000000683E000-memory.dmp

Filesize
120KB

Download
memory/2096-140-0x0000000004CE0000-0x0000000004D16000-memory.dmp

Filesize
216KB

Download
memory/2096-150-0x0000000007600000-0x000000000760A000-memory.dmp

Filesize
40KB

Download
memory/2096-146-0x0000000070270000-0x00000000702BC000-memory.dmp

Filesize
304KB

Download
memory/2096-141-0x00000000053D0000-0x00000000059F8000-memory.dmp

Filesize
6.2MB

Download
memory/2096-145-0x0000000006840000-0x0000000006872000-memory.dmp

Filesize
200KB

Download
memory/2096-144-0x0000000004FE0000-0x0000000004FFE000-memory.dmp

Filesize
120KB

Download
memory/2096-142-0x00000000052E0000-0x0000000005302000-memory.dmp

Filesize
136KB

Download
memory/2836-158-0x0000000070270000-0x00000000702BC000-memory.dmp

Filesize
304KB

Download
memory/4400-161-0x0000000070270000-0x00000000702BC000-memory.dmp

Filesize
304KB

Download