xmrig | fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1

Analysis

max time kernel
300s
max time network
279s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
21/09/2022, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe
Size

56KB
MD5

a9403e3c4f99efb04d7ca8482a5fbcb5
SHA1

a37ae8c765a55a9b1ff1b52588bd5c1a8d422c28
SHA256

fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1
SHA512

b54c4c7c9af2183d1edaea4ff64d47964fa366546e11cfd8cf72dc31906dafd1a66be6587f838f48ef662dfe8db2e690ab0c9fe72fedd4e55385e06d3505a3ef
SSDEEP

768:zkP9qIGw6fCoBse9fej+POciSb2GZjWsbxeGEUfxuDe+87V4uuu09Rgyx:2qIGw6qeeaPOq5Zj9bxvEdifAGu

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000600000001a52a-1476.dat	xmrig
behavioral2/files/0x000600000001a52a-1477.dat	xmrig

Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4220	dllhost.exe
3480	winlogson.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2148	schtasks.exe
4740	schtasks.exe
2800	schtasks.exe
4484	schtasks.exe
1616	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
4552	powershell.exe
4552	powershell.exe
4552	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe
4220	dllhost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
632	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	4220	dllhost.exe
Token: SeLockMemoryPrivilege	3480	winlogson.exe
Token: SeLockMemoryPrivilege	3480	winlogson.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3480	winlogson.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 1148	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe	68
PID 2696 wrote to memory of 1148	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe	68
PID 2696 wrote to memory of 1148	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe	68
PID 1148 wrote to memory of 3484	1148	cmd.exe	69
PID 1148 wrote to memory of 3484	1148	cmd.exe	69
PID 1148 wrote to memory of 3484	1148	cmd.exe	69
PID 1148 wrote to memory of 4292	1148	cmd.exe	71
PID 1148 wrote to memory of 4292	1148	cmd.exe	71
PID 1148 wrote to memory of 4292	1148	cmd.exe	71
PID 1148 wrote to memory of 4552	1148	cmd.exe	72
PID 1148 wrote to memory of 4552	1148	cmd.exe	72
PID 1148 wrote to memory of 4552	1148	cmd.exe	72
PID 1148 wrote to memory of 2748	1148	cmd.exe	73
PID 1148 wrote to memory of 2748	1148	cmd.exe	73
PID 1148 wrote to memory of 2748	1148	cmd.exe	73
PID 2696 wrote to memory of 4220	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe	74
PID 2696 wrote to memory of 4220	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe	74
PID 2696 wrote to memory of 4220	2696	fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe	74
PID 4220 wrote to memory of 600	4220	dllhost.exe	103
PID 4220 wrote to memory of 600	4220	dllhost.exe	103
PID 4220 wrote to memory of 600	4220	dllhost.exe	103
PID 4220 wrote to memory of 920	4220	dllhost.exe	75
PID 4220 wrote to memory of 920	4220	dllhost.exe	75
PID 4220 wrote to memory of 920	4220	dllhost.exe	75
PID 4220 wrote to memory of 1804	4220	dllhost.exe	102
PID 4220 wrote to memory of 1804	4220	dllhost.exe	102
PID 4220 wrote to memory of 1804	4220	dllhost.exe	102
PID 4220 wrote to memory of 1188	4220	dllhost.exe	76
PID 4220 wrote to memory of 1188	4220	dllhost.exe	76
PID 4220 wrote to memory of 1188	4220	dllhost.exe	76
PID 4220 wrote to memory of 3960	4220	dllhost.exe	78
PID 4220 wrote to memory of 3960	4220	dllhost.exe	78
PID 4220 wrote to memory of 3960	4220	dllhost.exe	78
PID 4220 wrote to memory of 3304	4220	dllhost.exe	101
PID 4220 wrote to memory of 3304	4220	dllhost.exe	101
PID 4220 wrote to memory of 3304	4220	dllhost.exe	101
PID 4220 wrote to memory of 2348	4220	dllhost.exe	96
PID 4220 wrote to memory of 2348	4220	dllhost.exe	96
PID 4220 wrote to memory of 2348	4220	dllhost.exe	96
PID 4220 wrote to memory of 2232	4220	dllhost.exe	81
PID 4220 wrote to memory of 2232	4220	dllhost.exe	81
PID 4220 wrote to memory of 2232	4220	dllhost.exe	81
PID 4220 wrote to memory of 4004	4220	dllhost.exe	94
PID 4220 wrote to memory of 4004	4220	dllhost.exe	94
PID 4220 wrote to memory of 4004	4220	dllhost.exe	94
PID 4220 wrote to memory of 1932	4220	dllhost.exe	84
PID 4220 wrote to memory of 1932	4220	dllhost.exe	84
PID 4220 wrote to memory of 1932	4220	dllhost.exe	84
PID 4220 wrote to memory of 1484	4220	dllhost.exe	85
PID 4220 wrote to memory of 1484	4220	dllhost.exe	85
PID 4220 wrote to memory of 1484	4220	dllhost.exe	85
PID 4220 wrote to memory of 2624	4220	dllhost.exe	86
PID 4220 wrote to memory of 2624	4220	dllhost.exe	86
PID 4220 wrote to memory of 2624	4220	dllhost.exe	86
PID 600 wrote to memory of 2148	600	cmd.exe	95
PID 600 wrote to memory of 2148	600	cmd.exe	95
PID 600 wrote to memory of 2148	600	cmd.exe	95
PID 2232 wrote to memory of 4740	2232	cmd.exe	97
PID 2232 wrote to memory of 4740	2232	cmd.exe	97
PID 2232 wrote to memory of 4740	2232	cmd.exe	97
PID 1804 wrote to memory of 2800	1804	cmd.exe	98
PID 1804 wrote to memory of 2800	1804	cmd.exe	98
PID 1804 wrote to memory of 2800	1804	cmd.exe	98
PID 1188 wrote to memory of 4484	1188	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe
"C:\Users\Admin\AppData\Local\Temp\fdd5608a073b30d1b875dec0de277613e2627e5b4ec6b17c225d1df5575eabc1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:3484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\ProgramData\Dllhost\dllhost.exe
  "C:\ProgramData\Dllhost\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:920
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3960
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2004" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1430" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk8719" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk1593" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4004
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3304
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:600
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
    3⤵
    PID:3916
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
    3⤵
    PID:4592
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:4116
  - - C:\ProgramData\Dllhost\winlogson.exe
      C:\ProgramData\Dllhost\winlogson.exe -c config.json
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:3480

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
1⤵
- Creates scheduled task(s)
PID:2148

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
1⤵
- Creates scheduled task(s)
PID:2800

C:\Windows\SysWOW64\chcp.com
chcp 1251
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
60KB

MD5
f7f7f2ae6258243cb403855a5e5c98e2

SHA1
d1d2b7efecb8065cdee21c0deef97ccff397a7a8

SHA256
3be57a7082ef64696aec16217c25377593338c9bd8d4847cb418d75bfb689219

SHA512
fabdc5df8980cd5b91a65a3794195e26461257099e0956ae226e55c75dc781169e858f60468124cf651cbc60a163e9c535d62b31a5a3cc078ed9195a166e3b0e

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
60KB

MD5
f7f7f2ae6258243cb403855a5e5c98e2

SHA1
d1d2b7efecb8065cdee21c0deef97ccff397a7a8

SHA256
3be57a7082ef64696aec16217c25377593338c9bd8d4847cb418d75bfb689219

SHA512
fabdc5df8980cd5b91a65a3794195e26461257099e0956ae226e55c75dc781169e858f60468124cf651cbc60a163e9c535d62b31a5a3cc078ed9195a166e3b0e

Download Submit
C:\ProgramData\Dllhost\winlogson.exe

Filesize
5.1MB

MD5
2a0d26b8b02bb2d17994d2a9a38d61db

SHA1
889a9cb0a044c1f675e63ea6ea065a8cf914e2ab

SHA256
3c54646213638e7bd8d0538c28e414824f5eaf31faf19a40eec608179b1074f1

SHA512
07245fb329b5fc9b68e1e88a52b7ab464bafd45442193e4b61cf6788ec0e10cdec2cfa2f59f49fe4a3f8a78a205d62ec0701a3b82a5e8f4257016821fee524ee

Download Submit
C:\ProgramData\Dllhost\winlogson.exe

Filesize
5.1MB

MD5
2a0d26b8b02bb2d17994d2a9a38d61db

SHA1
889a9cb0a044c1f675e63ea6ea065a8cf914e2ab

SHA256
3c54646213638e7bd8d0538c28e414824f5eaf31faf19a40eec608179b1074f1

SHA512
07245fb329b5fc9b68e1e88a52b7ab464bafd45442193e4b61cf6788ec0e10cdec2cfa2f59f49fe4a3f8a78a205d62ec0701a3b82a5e8f4257016821fee524ee

Download Submit
C:\ProgramData\SystemFiles\config.json

Filesize
313B

MD5
36bbcf8d2d2b5cccc53b86c7bafe362a

SHA1
8404f49f6e9b4dd5b71e75505f0a0832657bdad9

SHA256
9389db008d81d34bfdca9476ac83e7e8d18929ba0884a9f37caf389e96c60559

SHA512
11e5bc031d83e011e580cd7a0907f567539879fc477b32443709c2c3caed314cbab37c0ff73e382462dd2429f813ed70780cfe2edfc99e419e620c8bfb302aab

Download Submit
C:\ProgramData\SystemFiles\sys_rh.bin

Filesize
1KB

MD5
59a97a38dcac287f0c7f2a4cb64026af

SHA1
8f520f4aeab6ed0f176fc2deaad5608c92b76505

SHA256
cc9cffbe9e6cd74ebf26e5541ae8d3ffdc0de3a63bdff4afe1872eb83c6c7e7b

SHA512
8a3bb169fa87b8c80b3bc08ac902ee89ed6d4479030b41848a6550efbc55147ffeb46e5d6b0231bcdc02767fadf183b1199d0a5ef7558a9cf9a98635b305327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
94669697ec4aa9fc8b0c6197828bd2c1

SHA1
0e263be11bc9b689000330d15144ff2dc4478d11

SHA256
b20fb4ec5927d8ba98e9f3daf0cb1f70aa44166b97ea95961053689aa2a6b371

SHA512
99e06bba3d362114bb56b0b0edd8fd150e2488841d831ef49b2e5aa799e1eb63ebc80ea501e8a89bfad072dd3ade4d2ff16361b09eea4c9e1ca946cc8a9c73a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
cf9c4cdb40a8546c0d089da4288fa2de

SHA1
1c5b469d0fc504bde9fcbb9c3410baebb0b59ab5

SHA256
bf8262a98c8a6ae1c7a1ebd0e79e418a06801957a2fe3c8c8234986d8f6e1380

SHA512
385a86e71668ecf89c7bc4364adee82b4548f8720369055f2678090a7b87679d01de98dbe9c57cab6f9b68e8586dd9706b8741c12c6dc9abddfddde49f70217a

Download Submit
memory/2696-150-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-132-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-142-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-143-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-145-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-144-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-146-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-147-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-148-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-149-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-120-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-151-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-152-0x0000000000330000-0x0000000000344000-memory.dmp

Filesize
80KB

Download
memory/2696-153-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-154-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-156-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-158-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-159-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Filesize
24KB

Download
memory/2696-157-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-155-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-160-0x000000000A630000-0x000000000AB2E000-memory.dmp

Filesize
5.0MB

Download
memory/2696-161-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-162-0x0000000004D00000-0x0000000004D92000-memory.dmp

Filesize
584KB

Download
memory/2696-163-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-164-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-165-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-166-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-168-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-170-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-171-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-169-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-172-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-173-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-174-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-167-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-175-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-176-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-178-0x0000000004BE0000-0x0000000004BEA000-memory.dmp

Filesize
40KB

Download
memory/2696-177-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-179-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-180-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-181-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-182-0x000000000C3C0000-0x000000000C426000-memory.dmp

Filesize
408KB

Download
memory/2696-183-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-184-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-186-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-187-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-185-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-188-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-141-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-121-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-119-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-122-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-123-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-124-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-125-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-126-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-127-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-128-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-130-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-129-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-131-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-140-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-133-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-134-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-136-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-137-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-139-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-138-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/2696-135-0x0000000077840000-0x00000000779CE000-memory.dmp

Filesize
1.6MB

Download
memory/3480-1482-0x00000152BC8C0000-0x00000152BC8E0000-memory.dmp

Filesize
128KB

Download
memory/3480-1481-0x00000152BC8C0000-0x00000152BC8E0000-memory.dmp

Filesize
128KB

Download
memory/3480-1480-0x00000152BC880000-0x00000152BC8C0000-memory.dmp

Filesize
256KB

Download
memory/4220-1433-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Filesize
40KB

Download
memory/4220-1045-0x0000000000890000-0x0000000000896000-memory.dmp

Filesize
24KB

Download
memory/4220-1027-0x0000000000220000-0x0000000000236000-memory.dmp

Filesize
88KB

Download
memory/4292-270-0x0000000008190000-0x00000000081AC000-memory.dmp

Filesize
112KB

Download
memory/4292-289-0x0000000009AB0000-0x0000000009ACE000-memory.dmp

Filesize
120KB

Download
memory/4292-534-0x0000000009D50000-0x0000000009D58000-memory.dmp

Filesize
32KB

Download
memory/4292-267-0x00000000083C0000-0x0000000008710000-memory.dmp

Filesize
3.3MB

Download
memory/4292-265-0x0000000008030000-0x0000000008096000-memory.dmp

Filesize
408KB

Download
memory/4292-261-0x0000000007840000-0x0000000007862000-memory.dmp

Filesize
136KB

Download
memory/4292-246-0x0000000007A00000-0x0000000008028000-memory.dmp

Filesize
6.2MB

Download
memory/4292-271-0x0000000008750000-0x000000000879B000-memory.dmp

Filesize
300KB

Download
memory/4292-275-0x0000000008A00000-0x0000000008A76000-memory.dmp

Filesize
472KB

Download
memory/4292-529-0x0000000009DA0000-0x0000000009DBA000-memory.dmp

Filesize
104KB

Download
memory/4292-318-0x0000000009E20000-0x0000000009EB4000-memory.dmp

Filesize
592KB

Download
memory/4292-288-0x0000000009AF0000-0x0000000009B23000-memory.dmp

Filesize
204KB

Download
memory/4292-304-0x0000000009B30000-0x0000000009BD5000-memory.dmp

Filesize
660KB

Download
memory/4292-241-0x0000000007230000-0x0000000007266000-memory.dmp

Filesize
216KB

Download