2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2022, 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe
Size

727KB
MD5

e1653bab4c5f23c59db82331042fa221
SHA1

f4393e5f07da72c99cf601f1faa92f6b8dcf5192
SHA256

2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc
SHA512

af382868707144625aa3ff9c629e151bdaab3fe341e89f73689bd4065522ccc9a61959898b63265c39139dda13091e2c25c2b4ebde65425a2a62ce1ff1a2e726
SSDEEP

768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
5100	dllhost.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe"	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3284	schtasks.exe
4936	schtasks.exe
3808	schtasks.exe
4824	schtasks.exe
628	schtasks.exe
3324	schtasks.exe
1160	schtasks.exe
4968	schtasks.exe
3432	schtasks.exe
3220	schtasks.exe
4556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4380	powershell.exe
4380	powershell.exe
3904	powershell.exe
3904	powershell.exe
2368	powershell.exe
2368	powershell.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe
5100	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	5100	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 624	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe	84
PID 3096 wrote to memory of 624	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe	84
PID 3096 wrote to memory of 624	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe	84
PID 624 wrote to memory of 1428	624	cmd.exe	86
PID 624 wrote to memory of 1428	624	cmd.exe	86
PID 624 wrote to memory of 1428	624	cmd.exe	86
PID 624 wrote to memory of 4380	624	cmd.exe	87
PID 624 wrote to memory of 4380	624	cmd.exe	87
PID 624 wrote to memory of 4380	624	cmd.exe	87
PID 624 wrote to memory of 3904	624	cmd.exe	92
PID 624 wrote to memory of 3904	624	cmd.exe	92
PID 624 wrote to memory of 3904	624	cmd.exe	92
PID 624 wrote to memory of 2368	624	cmd.exe	95
PID 624 wrote to memory of 2368	624	cmd.exe	95
PID 624 wrote to memory of 2368	624	cmd.exe	95
PID 3096 wrote to memory of 5100	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe	96
PID 3096 wrote to memory of 5100	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe	96
PID 3096 wrote to memory of 5100	3096	2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe	96
PID 5100 wrote to memory of 3744	5100	dllhost.exe	97
PID 5100 wrote to memory of 3744	5100	dllhost.exe	97
PID 5100 wrote to memory of 3744	5100	dllhost.exe	97
PID 5100 wrote to memory of 4256	5100	dllhost.exe	98
PID 5100 wrote to memory of 4256	5100	dllhost.exe	98
PID 5100 wrote to memory of 4256	5100	dllhost.exe	98
PID 5100 wrote to memory of 4276	5100	dllhost.exe	99
PID 5100 wrote to memory of 4276	5100	dllhost.exe	99
PID 5100 wrote to memory of 4276	5100	dllhost.exe	99
PID 5100 wrote to memory of 4536	5100	dllhost.exe	102
PID 5100 wrote to memory of 4536	5100	dllhost.exe	102
PID 5100 wrote to memory of 4536	5100	dllhost.exe	102
PID 5100 wrote to memory of 4652	5100	dllhost.exe	115
PID 5100 wrote to memory of 4652	5100	dllhost.exe	115
PID 5100 wrote to memory of 4652	5100	dllhost.exe	115
PID 5100 wrote to memory of 896	5100	dllhost.exe	104
PID 5100 wrote to memory of 896	5100	dllhost.exe	104
PID 5100 wrote to memory of 896	5100	dllhost.exe	104
PID 5100 wrote to memory of 704	5100	dllhost.exe	106
PID 5100 wrote to memory of 704	5100	dllhost.exe	106
PID 5100 wrote to memory of 704	5100	dllhost.exe	106
PID 5100 wrote to memory of 384	5100	dllhost.exe	108
PID 5100 wrote to memory of 384	5100	dllhost.exe	108
PID 5100 wrote to memory of 384	5100	dllhost.exe	108
PID 5100 wrote to memory of 3160	5100	dllhost.exe	110
PID 5100 wrote to memory of 3160	5100	dllhost.exe	110
PID 5100 wrote to memory of 3160	5100	dllhost.exe	110
PID 5100 wrote to memory of 1444	5100	dllhost.exe	113
PID 5100 wrote to memory of 1444	5100	dllhost.exe	113
PID 5100 wrote to memory of 1444	5100	dllhost.exe	113
PID 5100 wrote to memory of 2308	5100	dllhost.exe	116
PID 5100 wrote to memory of 2308	5100	dllhost.exe	116
PID 5100 wrote to memory of 2308	5100	dllhost.exe	116
PID 5100 wrote to memory of 4284	5100	dllhost.exe	117
PID 5100 wrote to memory of 4284	5100	dllhost.exe	117
PID 5100 wrote to memory of 4284	5100	dllhost.exe	117
PID 4256 wrote to memory of 4968	4256	cmd.exe	121
PID 4256 wrote to memory of 4968	4256	cmd.exe	121
PID 4256 wrote to memory of 4968	4256	cmd.exe	121
PID 4652 wrote to memory of 3284	4652	cmd.exe	128
PID 4652 wrote to memory of 3284	4652	cmd.exe	128
PID 4652 wrote to memory of 3284	4652	cmd.exe	128
PID 896 wrote to memory of 3324	896	cmd.exe	127
PID 896 wrote to memory of 3324	896	cmd.exe	127
PID 896 wrote to memory of 3324	896	cmd.exe	127
PID 3744 wrote to memory of 3808	3744	cmd.exe	122

C:\Users\Admin\AppData\Local\Temp\2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe
"C:\Users\Admin\AppData\Local\Temp\2fc18ac1f71c88d3d83819c9fa6910690e93b6351d01c0a5727731ccba8c06dc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\ProgramData\Dllhost\dllhost.exe
  "C:\ProgramData\Dllhost\dllhost.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3808
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4968
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4276
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3220
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:704
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:384
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2752" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:3160
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk2752" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3808" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:1444
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk3808" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:4936
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:3284
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5655" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:2308
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5655" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:628
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4970" /TR "C:\ProgramData\Dllhost\dllhost.exe"
    3⤵
    PID:4284
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk4970" /TR "C:\ProgramData\Dllhost\dllhost.exe"
      4⤵
      Creates scheduled task(s)
      PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:2780
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:4248
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
    3⤵
    PID:4156
  - - C:\Windows\SysWOW64\chcp.com
      chcp 1251
      4⤵
      PID:256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Dllhost\dllhost.exe

Filesize
930KB

MD5
f45ae21e6655436407f15696442d1934

SHA1
4469d31dbc669bc24a3c3f100ffdadfb2b76c0ed

SHA256
12405ee617062da53dc55194dc1652d3541b6fbb6eb65d10b8831e6f15abff43

SHA512
dffdeabd11158f4881d4a9b7b3f51336fe93a1c2d0b3211122f05705132504eb1f1d6f68027591505a39dc7bda7998a08be62dbcafcf19b08785330ddeda289d

Download Submit
C:\ProgramData\Dllhost\dllhost.exe

Filesize
930KB

MD5
f45ae21e6655436407f15696442d1934

SHA1
4469d31dbc669bc24a3c3f100ffdadfb2b76c0ed

SHA256
12405ee617062da53dc55194dc1652d3541b6fbb6eb65d10b8831e6f15abff43

SHA512
dffdeabd11158f4881d4a9b7b3f51336fe93a1c2d0b3211122f05705132504eb1f1d6f68027591505a39dc7bda7998a08be62dbcafcf19b08785330ddeda289d

Download Submit
C:\ProgramData\HostData\logs.uce

Filesize
497B

MD5
13fda2ab01b83a5130842a5bab3892d3

SHA1
6e18e4b467cde054a63a95d4dfc030f156ecd215

SHA256
76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

SHA512
c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
59a57cd814bf471ec4be0ea19bf71aa2

SHA1
e40fc442ee03ad1f437fcf5d4aa6c401066595ec

SHA256
d7737c62c55f5e59dd10c84cfa16cff90ec763fd1d9be6e82ebb4b9c21101434

SHA512
3307d7f465a77604b2754950df557be6bdf46a43cafffcf6d18951c4c68e184f3cc870dba479aea006b89dba8341167305bb878fc4f7eab3f5663a774f30302e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c3ed78211abed7eebf5f775693e30f43

SHA1
76e7a7ee81844489c2654626605a596e788e2462

SHA256
acc5f739883a788909d6b5b2fe801a04ceef3b4b828ec8d8a7d587d3876b2e0a

SHA512
2dd7eed75cd629677dda6b7ed4a2ddae7510fdd45b628c67d905a2b0890a45cc059c5b629c549a8f89491b9758bcc3db90b4ce45b6f8c7cd54ee8390e87960ad

Download Submit
memory/2368-161-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

Filesize
304KB

Download
memory/3096-135-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Filesize
40KB

Download
memory/3096-136-0x0000000005130000-0x0000000005196000-memory.dmp

Filesize
408KB

Download
memory/3096-132-0x0000000000460000-0x0000000000508000-memory.dmp

Filesize
672KB

Download
memory/3096-134-0x0000000004F70000-0x0000000005002000-memory.dmp

Filesize
584KB

Download
memory/3096-133-0x0000000005480000-0x0000000005A24000-memory.dmp

Filesize
5.6MB

Download
memory/3904-158-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

Filesize
304KB

Download
memory/4380-141-0x0000000005950000-0x0000000005F78000-memory.dmp

Filesize
6.2MB

Download
memory/4380-144-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/4380-150-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/4380-149-0x0000000007A40000-0x0000000007A5A000-memory.dmp

Filesize
104KB

Download
memory/4380-148-0x00000000080A0000-0x000000000871A000-memory.dmp

Filesize
6.5MB

Download
memory/4380-153-0x0000000007D60000-0x0000000007D7A000-memory.dmp

Filesize
104KB

Download
memory/4380-145-0x00000000076F0000-0x0000000007722000-memory.dmp

Filesize
200KB

Download
memory/4380-147-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

Filesize
120KB

Download
memory/4380-146-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

Filesize
304KB

Download
memory/4380-151-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Filesize
600KB

Download
memory/4380-154-0x0000000007CA0000-0x0000000007CA8000-memory.dmp

Filesize
32KB

Download
memory/4380-143-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/4380-140-0x0000000005170000-0x00000000051A6000-memory.dmp

Filesize
216KB

Download
memory/4380-152-0x0000000007C60000-0x0000000007C6E000-memory.dmp

Filesize
56KB

Download
memory/4380-142-0x0000000005840000-0x0000000005862000-memory.dmp

Filesize
136KB

Download
memory/5100-165-0x0000000000CB0000-0x0000000000D60000-memory.dmp

Filesize
704KB

Download