92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2022 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe
Size

718KB
MD5

eaf78e43754a15b7b9852a039c6ebc61
SHA1

14d7619085f3dfc8d97a5e29666f27904706bc9e
SHA256

92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d
SHA512

ec06971e9127f75e8e19c1cc0ebbeb918e1581f81a803bba9bfe4985ba152cd4cd56e3604792dad9c69d2611acd6e21ac20d6e37156c6a2d432c1be890e525ef
SSDEEP

768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1748	dllhost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1544	schtasks.exe
3844	schtasks.exe
2588	schtasks.exe
3068	schtasks.exe
2972	schtasks.exe
956	schtasks.exe
2396	schtasks.exe
4340	schtasks.exe
3084	schtasks.exe
4176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4624	powershell.exe
4624	powershell.exe
4300	powershell.exe
4300	powershell.exe
1964	powershell.exe
1964	powershell.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe
1748	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeDebugPrivilege	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	1748	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2200	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe	79
PID 1080 wrote to memory of 2200	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe	79
PID 1080 wrote to memory of 2200	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe	79
PID 2200 wrote to memory of 4708	2200	cmd.exe	81
PID 2200 wrote to memory of 4708	2200	cmd.exe	81
PID 2200 wrote to memory of 4708	2200	cmd.exe	81
PID 2200 wrote to memory of 4624	2200	cmd.exe	82
PID 2200 wrote to memory of 4624	2200	cmd.exe	82
PID 2200 wrote to memory of 4624	2200	cmd.exe	82
PID 2200 wrote to memory of 4300	2200	cmd.exe	88
PID 2200 wrote to memory of 4300	2200	cmd.exe	88
PID 2200 wrote to memory of 4300	2200	cmd.exe	88
PID 2200 wrote to memory of 1964	2200	cmd.exe	91
PID 2200 wrote to memory of 1964	2200	cmd.exe	91
PID 2200 wrote to memory of 1964	2200	cmd.exe	91
PID 1080 wrote to memory of 1748	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe	92
PID 1080 wrote to memory of 1748	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe	92
PID 1080 wrote to memory of 1748	1080	92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe	92
PID 1748 wrote to memory of 3916	1748	dllhost.exe	93
PID 1748 wrote to memory of 3916	1748	dllhost.exe	93
PID 1748 wrote to memory of 3916	1748	dllhost.exe	93
PID 1748 wrote to memory of 4652	1748	dllhost.exe	94
PID 1748 wrote to memory of 4652	1748	dllhost.exe	94
PID 1748 wrote to memory of 4652	1748	dllhost.exe	94
PID 1748 wrote to memory of 1968	1748	dllhost.exe	97
PID 1748 wrote to memory of 1968	1748	dllhost.exe	97
PID 1748 wrote to memory of 1968	1748	dllhost.exe	97
PID 1748 wrote to memory of 1984	1748	dllhost.exe	98
PID 1748 wrote to memory of 1984	1748	dllhost.exe	98
PID 1748 wrote to memory of 1984	1748	dllhost.exe	98
PID 1748 wrote to memory of 2772	1748	dllhost.exe	99
PID 1748 wrote to memory of 2772	1748	dllhost.exe	99
PID 1748 wrote to memory of 2772	1748	dllhost.exe	99
PID 1748 wrote to memory of 1508	1748	dllhost.exe	100
PID 1748 wrote to memory of 1508	1748	dllhost.exe	100
PID 1748 wrote to memory of 1508	1748	dllhost.exe	100
PID 1748 wrote to memory of 764	1748	dllhost.exe	104
PID 1748 wrote to memory of 764	1748	dllhost.exe	104
PID 1748 wrote to memory of 764	1748	dllhost.exe	104
PID 1748 wrote to memory of 2404	1748	dllhost.exe	106
PID 1748 wrote to memory of 2404	1748	dllhost.exe	106
PID 1748 wrote to memory of 2404	1748	dllhost.exe	106
PID 1748 wrote to memory of 4136	1748	dllhost.exe	107
PID 1748 wrote to memory of 4136	1748	dllhost.exe	107
PID 1748 wrote to memory of 4136	1748	dllhost.exe	107
PID 1748 wrote to memory of 4292	1748	dllhost.exe	109
PID 1748 wrote to memory of 4292	1748	dllhost.exe	109
PID 1748 wrote to memory of 4292	1748	dllhost.exe	109
PID 1748 wrote to memory of 3248	1748	dllhost.exe	111
PID 1748 wrote to memory of 3248	1748	dllhost.exe	111
PID 1748 wrote to memory of 3248	1748	dllhost.exe	111
PID 1748 wrote to memory of 4376	1748	dllhost.exe	112
PID 1748 wrote to memory of 4376	1748	dllhost.exe	112
PID 1748 wrote to memory of 4376	1748	dllhost.exe	112
PID 1984 wrote to memory of 2396	1984	cmd.exe	117
PID 1984 wrote to memory of 2396	1984	cmd.exe	117
PID 1984 wrote to memory of 2396	1984	cmd.exe	117
PID 1968 wrote to memory of 2588	1968	cmd.exe	120
PID 1968 wrote to memory of 2588	1968	cmd.exe	120
PID 1968 wrote to memory of 2588	1968	cmd.exe	120
PID 4652 wrote to memory of 4340	4652	cmd.exe	119
PID 4652 wrote to memory of 4340	4652	cmd.exe	119
PID 4652 wrote to memory of 4340	4652	cmd.exe	119
PID 3916 wrote to memory of 3844	3916	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe
"C:\Users\Admin\AppData\Local\Temp\92e8bced883bf6804c959326f1903fc700ac5e6211dc4bb4a7fae5f14f7d722d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\ProgramData\Dllhost\dllhost.exe
  "C:\ProgramData\Dllhost\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3844
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4340
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2772
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1508
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:764
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9536" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk9536" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7096" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4292
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk7096" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:956
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8519" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8519" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3840" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4376
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3840" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:2484
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:4856
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:5096
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:4012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
896KB

MD5
41975b6b87e8a0544c192f7472a37f71

SHA1
d4108196c53d4cbf1b7fe8bda2082ee3605b84e8

SHA256
c4b020304bf90df479f88a4802717181ecabbc7545f6027d2381f2ec2cbb558a

SHA512
25f576afbe56885d7b9817daffff4aabcfa54f8e2b778f1c07ef38614af3b112ed4b77e911339d333c4383c266d5510496acd96c912023d59ec28fb8a95c7c94

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
896KB

MD5
41975b6b87e8a0544c192f7472a37f71

SHA1
d4108196c53d4cbf1b7fe8bda2082ee3605b84e8

SHA256
c4b020304bf90df479f88a4802717181ecabbc7545f6027d2381f2ec2cbb558a

SHA512
25f576afbe56885d7b9817daffff4aabcfa54f8e2b778f1c07ef38614af3b112ed4b77e911339d333c4383c266d5510496acd96c912023d59ec28fb8a95c7c94

Download Submit
C:\ProgramData\HostData\logs.uce

Filesize
497B

MD5
13fda2ab01b83a5130842a5bab3892d3

SHA1
6e18e4b467cde054a63a95d4dfc030f156ecd215

SHA256
76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

SHA512
c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
fb229d62aa94f1ae72f17cd66f814820

SHA1
e8272821cd69ec0a501d76d894e0a3c3e6fad2c3

SHA256
c3ddff3882df4a9a69ff5f3fc2c4f5683bfc595285846b5fbbdf70e259d75130

SHA512
42d9bbc8d02c2984d0ad7aee586014c61dce1356ba6513ee14c7d7d5bf551b650408e372881daf0b93d2ed44d369402bae5d554a73856af8bfbcdfa0f653be66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
5539273296df11d4645f17db8b47e51c

SHA1
d2abd0b2d3615f049ca0b4480a14b08648389cdc

SHA256
6279693cb00abed3362f86df3b7db547468ecd05074fe3d5aab18f5ebe012ce1

SHA512
5eb8bd8c3133e39d00f7e86c7cd333f831ba19d097c2f2ef3f3d67fb2b42d0990f261b5a7b4ad5e90561d2737cfeada0cbf5d1fff976b9fca97df208eb2f26f5

Download Submit
memory/764-171-0x0000000000000000-mapping.dmp

Download
memory/956-187-0x0000000000000000-mapping.dmp

Download
memory/1080-132-0x0000000000D10000-0x0000000000DB8000-memory.dmp

Filesize
672KB

Download
memory/1080-135-0x0000000005800000-0x000000000580A000-memory.dmp

Filesize
40KB

Download
memory/1080-133-0x0000000005E20000-0x00000000063C4000-memory.dmp

Filesize
5.6MB

Download
memory/1080-134-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/1080-136-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/1268-192-0x0000000000000000-mapping.dmp

Download
memory/1508-170-0x0000000000000000-mapping.dmp

Download
memory/1544-186-0x0000000000000000-mapping.dmp

Download
memory/1748-161-0x0000000000000000-mapping.dmp

Download
memory/1748-164-0x0000000000790000-0x0000000000840000-memory.dmp

Filesize
704KB

Download
memory/1964-159-0x0000000000000000-mapping.dmp

Download
memory/1964-174-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/1968-167-0x0000000000000000-mapping.dmp

Download
memory/1984-168-0x0000000000000000-mapping.dmp

Download
memory/2200-137-0x0000000000000000-mapping.dmp

Download
memory/2396-178-0x0000000000000000-mapping.dmp

Download
memory/2404-172-0x0000000000000000-mapping.dmp

Download
memory/2484-189-0x0000000000000000-mapping.dmp

Download
memory/2588-179-0x0000000000000000-mapping.dmp

Download
memory/2772-169-0x0000000000000000-mapping.dmp

Download
memory/2972-184-0x0000000000000000-mapping.dmp

Download
memory/3068-182-0x0000000000000000-mapping.dmp

Download
memory/3084-183-0x0000000000000000-mapping.dmp

Download
memory/3248-176-0x0000000000000000-mapping.dmp

Download
memory/3844-181-0x0000000000000000-mapping.dmp

Download
memory/3916-165-0x0000000000000000-mapping.dmp

Download
memory/4012-194-0x0000000000000000-mapping.dmp

Download
memory/4136-173-0x0000000000000000-mapping.dmp

Download
memory/4176-185-0x0000000000000000-mapping.dmp

Download
memory/4292-175-0x0000000000000000-mapping.dmp

Download
memory/4300-158-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/4300-155-0x0000000000000000-mapping.dmp

Download
memory/4340-180-0x0000000000000000-mapping.dmp

Download
memory/4376-177-0x0000000000000000-mapping.dmp

Download
memory/4624-147-0x0000000006060000-0x000000000607E000-memory.dmp

Filesize
120KB

Download
memory/4624-146-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/4624-152-0x0000000007000000-0x000000000700E000-memory.dmp

Filesize
56KB

Download
memory/4624-150-0x0000000006E30000-0x0000000006E3A000-memory.dmp

Filesize
40KB

Download
memory/4624-149-0x0000000006DE0000-0x0000000006DFA000-memory.dmp

Filesize
104KB

Download
memory/4624-148-0x0000000007440000-0x0000000007ABA000-memory.dmp

Filesize
6.5MB

Download
memory/4624-151-0x0000000007060000-0x00000000070F6000-memory.dmp

Filesize
600KB

Download
memory/4624-139-0x0000000000000000-mapping.dmp

Download
memory/4624-153-0x0000000007100000-0x000000000711A000-memory.dmp

Filesize
104KB

Download
memory/4624-145-0x0000000006080000-0x00000000060B2000-memory.dmp

Filesize
200KB

Download
memory/4624-144-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

Filesize
120KB

Download
memory/4624-154-0x0000000007040000-0x0000000007048000-memory.dmp

Filesize
32KB

Download
memory/4624-143-0x0000000004BF0000-0x0000000004C56000-memory.dmp

Filesize
408KB

Download
memory/4624-142-0x00000000049D0000-0x00000000049F2000-memory.dmp

Filesize
136KB

Download
memory/4624-141-0x0000000004C80000-0x00000000052A8000-memory.dmp

Filesize
6.2MB

Download
memory/4624-140-0x00000000024F0000-0x0000000002526000-memory.dmp

Filesize
216KB

Download
memory/4652-166-0x0000000000000000-mapping.dmp

Download
memory/4708-138-0x0000000000000000-mapping.dmp

Download
memory/4856-191-0x0000000000000000-mapping.dmp

Download
memory/4884-190-0x0000000000000000-mapping.dmp

Download
memory/5096-193-0x0000000000000000-mapping.dmp

Download