6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0

Analysis

max time kernel
151s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2022, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe
Size

719KB
MD5

547bbdcefbaadcae5756077a95a44eb8
SHA1

35e1168233ba8d2784027653cf3203b7401856d4
SHA256

6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0
SHA512

d236fbb1706b5775b4911e36c7b538343b9e88c60c39a6eb2a1215208475212ca61664dc033956cfedfda9d402137e32429aff531f03c9372e46f8df6c88bb92
SSDEEP

768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3816	dllhost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4288	schtasks.exe
1520	schtasks.exe
4220	schtasks.exe
2124	schtasks.exe
212	schtasks.exe
4620	schtasks.exe
4316	schtasks.exe
4012	schtasks.exe
4360	schtasks.exe
216	schtasks.exe
3556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
340	powershell.exe
340	powershell.exe
4080	powershell.exe
4080	powershell.exe
824	powershell.exe
824	powershell.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe
3816	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	340	powershell.exe
Token: SeDebugPrivilege	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe
Token: SeDebugPrivilege	4080	powershell.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	3816	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4676	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe	85
PID 2296 wrote to memory of 4676	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe	85
PID 2296 wrote to memory of 4676	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe	85
PID 4676 wrote to memory of 220	4676	cmd.exe	87
PID 4676 wrote to memory of 220	4676	cmd.exe	87
PID 4676 wrote to memory of 220	4676	cmd.exe	87
PID 4676 wrote to memory of 340	4676	cmd.exe	88
PID 4676 wrote to memory of 340	4676	cmd.exe	88
PID 4676 wrote to memory of 340	4676	cmd.exe	88
PID 4676 wrote to memory of 4080	4676	cmd.exe	93
PID 4676 wrote to memory of 4080	4676	cmd.exe	93
PID 4676 wrote to memory of 4080	4676	cmd.exe	93
PID 4676 wrote to memory of 824	4676	cmd.exe	96
PID 4676 wrote to memory of 824	4676	cmd.exe	96
PID 4676 wrote to memory of 824	4676	cmd.exe	96
PID 2296 wrote to memory of 3816	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe	97
PID 2296 wrote to memory of 3816	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe	97
PID 2296 wrote to memory of 3816	2296	6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe	97
PID 3816 wrote to memory of 1220	3816	dllhost.exe	98
PID 3816 wrote to memory of 1220	3816	dllhost.exe	98
PID 3816 wrote to memory of 1220	3816	dllhost.exe	98
PID 3816 wrote to memory of 4880	3816	dllhost.exe	99
PID 3816 wrote to memory of 4880	3816	dllhost.exe	99
PID 3816 wrote to memory of 4880	3816	dllhost.exe	99
PID 3816 wrote to memory of 1984	3816	dllhost.exe	100
PID 3816 wrote to memory of 1984	3816	dllhost.exe	100
PID 3816 wrote to memory of 1984	3816	dllhost.exe	100
PID 3816 wrote to memory of 2200	3816	dllhost.exe	121
PID 3816 wrote to memory of 2200	3816	dllhost.exe	121
PID 3816 wrote to memory of 2200	3816	dllhost.exe	121
PID 3816 wrote to memory of 4432	3816	dllhost.exe	104
PID 3816 wrote to memory of 4432	3816	dllhost.exe	104
PID 3816 wrote to memory of 4432	3816	dllhost.exe	104
PID 3816 wrote to memory of 2280	3816	dllhost.exe	106
PID 3816 wrote to memory of 2280	3816	dllhost.exe	106
PID 3816 wrote to memory of 2280	3816	dllhost.exe	106
PID 3816 wrote to memory of 780	3816	dllhost.exe	111
PID 3816 wrote to memory of 780	3816	dllhost.exe	111
PID 3816 wrote to memory of 780	3816	dllhost.exe	111
PID 3816 wrote to memory of 3044	3816	dllhost.exe	107
PID 3816 wrote to memory of 3044	3816	dllhost.exe	107
PID 3816 wrote to memory of 3044	3816	dllhost.exe	107
PID 3816 wrote to memory of 3536	3816	dllhost.exe	109
PID 3816 wrote to memory of 3536	3816	dllhost.exe	109
PID 3816 wrote to memory of 3536	3816	dllhost.exe	109
PID 3816 wrote to memory of 1828	3816	dllhost.exe	113
PID 3816 wrote to memory of 1828	3816	dllhost.exe	113
PID 3816 wrote to memory of 1828	3816	dllhost.exe	113
PID 3816 wrote to memory of 5032	3816	dllhost.exe	114
PID 3816 wrote to memory of 5032	3816	dllhost.exe	114
PID 3816 wrote to memory of 5032	3816	dllhost.exe	114
PID 3816 wrote to memory of 2548	3816	dllhost.exe	115
PID 3816 wrote to memory of 2548	3816	dllhost.exe	115
PID 3816 wrote to memory of 2548	3816	dllhost.exe	115
PID 4880 wrote to memory of 2124	4880	cmd.exe	125
PID 4880 wrote to memory of 2124	4880	cmd.exe	125
PID 4880 wrote to memory of 2124	4880	cmd.exe	125
PID 2200 wrote to memory of 216	2200	cmd.exe	122
PID 2200 wrote to memory of 216	2200	cmd.exe	122
PID 2200 wrote to memory of 216	2200	cmd.exe	122
PID 1984 wrote to memory of 212	1984	cmd.exe	126
PID 1984 wrote to memory of 212	1984	cmd.exe	126
PID 1984 wrote to memory of 212	1984	cmd.exe	126
PID 5032 wrote to memory of 1520	5032	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe
"C:\Users\Admin\AppData\Local\Temp\6d60dba9e7482c7b79e7577124ded592c0ab0336c7f68961ea54c45c408204f0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:220
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\ProgramData\Dllhost\dllhost.exe
  "C:\ProgramData\Dllhost\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1220
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:212
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4432
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4288
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2280
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3044
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7461" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk7461" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:780
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9388" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1828
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk9388" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7216" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk7216" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7389" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2548
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7389" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:216
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:3324
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:4068
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:3948
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:860
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:1780
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
899KB

MD5
b6361c8b00398894c6d57d7c1daf333a

SHA1
0dbc97c711175cb77de64f29c1ebaac3e07ddf62

SHA256
e71f4b202583f2938e1b3b57d8073bae932a22f61e03cad97be5a1edc6016ccc

SHA512
960dc85a8759ef6e4421dbd54b22c1edd61c1d4c2f49b2937ab1de13beddbbd4df6df4fc979f9863622e330e4ffb889e6567ab980fff80d57bad8d3e481b45df

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
899KB

MD5
b6361c8b00398894c6d57d7c1daf333a

SHA1
0dbc97c711175cb77de64f29c1ebaac3e07ddf62

SHA256
e71f4b202583f2938e1b3b57d8073bae932a22f61e03cad97be5a1edc6016ccc

SHA512
960dc85a8759ef6e4421dbd54b22c1edd61c1d4c2f49b2937ab1de13beddbbd4df6df4fc979f9863622e330e4ffb889e6567ab980fff80d57bad8d3e481b45df

Download Submit
C:\ProgramData\HostData\logs.uce

Filesize
497B

MD5
13fda2ab01b83a5130842a5bab3892d3

SHA1
6e18e4b467cde054a63a95d4dfc030f156ecd215

SHA256
76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

SHA512
c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
35bc1d09199c7fbd2f289086c1b96579

SHA1
427a2789ae1c3068664702b53746f6b14d623c03

SHA256
a2c8626b6c1d9e70a8934a395e9df2cbaae6f588c1b5b831613514b90667cf3b

SHA512
84a739d8bdf9314319ba6e73cd9fe5785d6e6ad271fcba4bb1b4f1832801f4c18a75937eebd5b94c171cd137f20f09a2d73edee8fa50882078eb4f3b4526888b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
62bd58bf85849d141a9309e63c99c8ae

SHA1
8bfbae682ccd08df47a9af881e828b108775edde

SHA256
7142fc48821729ad5922223fef1f8d3038eaaec8577642b2a1e3088d95bda030

SHA512
f198fda10e4fdd18bb1f7f4cc9bbb5524916482196330af0cae88bc5218ba7dc0eb024b5ba96eeefc365141a44b64062d1c9b5d72c9e9b9763904156bf636e71

Download Submit
memory/340-148-0x00000000079C0000-0x000000000803A000-memory.dmp

Filesize
6.5MB

Download
memory/340-143-0x0000000005190000-0x00000000051F6000-memory.dmp

Filesize
408KB

Download
memory/340-144-0x0000000006020000-0x000000000603E000-memory.dmp

Filesize
120KB

Download
memory/340-145-0x0000000006610000-0x0000000006642000-memory.dmp

Filesize
200KB

Download
memory/340-146-0x0000000070800000-0x000000007084C000-memory.dmp

Filesize
304KB

Download
memory/340-147-0x00000000065D0000-0x00000000065EE000-memory.dmp

Filesize
120KB

Download
memory/340-142-0x0000000005070000-0x0000000005092000-memory.dmp

Filesize
136KB

Download
memory/340-149-0x0000000007360000-0x000000000737A000-memory.dmp

Filesize
104KB

Download
memory/340-150-0x00000000073B0000-0x00000000073BA000-memory.dmp

Filesize
40KB

Download
memory/340-151-0x00000000075D0000-0x0000000007666000-memory.dmp

Filesize
600KB

Download
memory/340-152-0x0000000007570000-0x000000000757E000-memory.dmp

Filesize
56KB

Download
memory/340-153-0x0000000007670000-0x000000000768A000-memory.dmp

Filesize
104KB

Download
memory/340-154-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download
memory/340-140-0x0000000002A40000-0x0000000002A76000-memory.dmp

Filesize
216KB

Download
memory/340-141-0x0000000005340000-0x0000000005968000-memory.dmp

Filesize
6.2MB

Download
memory/824-161-0x0000000070800000-0x000000007084C000-memory.dmp

Filesize
304KB

Download
memory/2296-133-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/2296-134-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/2296-132-0x00000000005E0000-0x0000000000688000-memory.dmp

Filesize
672KB

Download
memory/2296-136-0x00000000052D0000-0x0000000005336000-memory.dmp

Filesize
408KB

Download
memory/2296-135-0x00000000050F0000-0x00000000050FA000-memory.dmp

Filesize
40KB

Download
memory/3816-165-0x0000000000FB0000-0x0000000001060000-memory.dmp

Filesize
704KB

Download
memory/4080-158-0x0000000070800000-0x000000007084C000-memory.dmp

Filesize
304KB

Download