Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 01:36
Static task
static1
Behavioral task
behavioral1
Sample
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe
Resource
win10v2004-20230220-en
General
-
Target
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe
-
Size
63KB
-
MD5
6790f5477fd0f2c8fedba93d7c3a366d
-
SHA1
51b8c2a24460823c650464f47cf6362b156a732d
-
SHA256
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064
-
SHA512
bb0222c528aae62d666521bd8b4668de337a6a7de8b58c8f252410695e374f829f82602e839dbb610228db7abfc1b2dc000fd0ba0207cd89418b62546f60b874
-
SSDEEP
768:fGsKfzI7wLgHFz/tJtSsBaC2x0T7VvgLLSzMbEJskwMj7ttGUAKS0RGRQz:fHGsacFTtSTC2x0gLQMbETZMUbRGI
Malware Config
Signatures
-
XMRig Miner payload 4 IoCs
Processes:
resource yara_rule C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
dllhost.exewinlogson.exepid process 3440 dllhost.exe 1616 winlogson.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4464 schtasks.exe 4344 schtasks.exe 3336 schtasks.exe 1692 schtasks.exe 2620 schtasks.exe 3420 schtasks.exe 4568 schtasks.exe 4964 schtasks.exe 3484 schtasks.exe 3908 schtasks.exe 3144 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exepowershell.exepowershell.exepowershell.exedllhost.exepid process 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe 3892 powershell.exe 3892 powershell.exe 1732 powershell.exe 1732 powershell.exe 1752 powershell.exe 1752 powershell.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe 3440 dllhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exepowershell.exepowershell.exepowershell.exedllhost.exewinlogson.exedescription pid process Token: SeDebugPrivilege 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe Token: SeDebugPrivilege 3892 powershell.exe Token: SeDebugPrivilege 1732 powershell.exe Token: SeDebugPrivilege 1752 powershell.exe Token: SeDebugPrivilege 3440 dllhost.exe Token: SeLockMemoryPrivilege 1616 winlogson.exe Token: SeLockMemoryPrivilege 1616 winlogson.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winlogson.exepid process 1616 winlogson.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.execmd.exedllhost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1648 wrote to memory of 1772 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe cmd.exe PID 1648 wrote to memory of 1772 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe cmd.exe PID 1648 wrote to memory of 1772 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe cmd.exe PID 1772 wrote to memory of 3024 1772 cmd.exe chcp.com PID 1772 wrote to memory of 3024 1772 cmd.exe chcp.com PID 1772 wrote to memory of 3024 1772 cmd.exe chcp.com PID 1772 wrote to memory of 3892 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 3892 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 3892 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1732 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1732 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1732 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1752 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1752 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1752 1772 cmd.exe powershell.exe PID 1648 wrote to memory of 3440 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe dllhost.exe PID 1648 wrote to memory of 3440 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe dllhost.exe PID 1648 wrote to memory of 3440 1648 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe dllhost.exe PID 3440 wrote to memory of 4908 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4908 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4908 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4744 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4744 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4744 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4736 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4736 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4736 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4980 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4980 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4980 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 2504 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 2504 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 2504 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4772 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4772 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4772 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4104 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4104 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 4104 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 3620 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 3620 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 3620 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 1412 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 1412 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 1412 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 1324 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 1324 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 1324 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 2920 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 2920 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 2920 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 3940 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 3940 3440 dllhost.exe cmd.exe PID 3440 wrote to memory of 3940 3440 dllhost.exe cmd.exe PID 4980 wrote to memory of 1692 4980 cmd.exe schtasks.exe PID 2504 wrote to memory of 4568 2504 cmd.exe schtasks.exe PID 4980 wrote to memory of 1692 4980 cmd.exe schtasks.exe PID 4980 wrote to memory of 1692 4980 cmd.exe schtasks.exe PID 2504 wrote to memory of 4568 2504 cmd.exe schtasks.exe PID 2504 wrote to memory of 4568 2504 cmd.exe schtasks.exe PID 2920 wrote to memory of 4464 2920 cmd.exe schtasks.exe PID 2920 wrote to memory of 4464 2920 cmd.exe schtasks.exe PID 2920 wrote to memory of 4464 2920 cmd.exe schtasks.exe PID 1412 wrote to memory of 3484 1412 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe"C:\Users\Admin\AppData\Local\Temp\76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk7938" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8808" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk8808" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5113" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5113" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6042" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk6042" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\SystemFiles\config.jsonFilesize
312B
MD5f530d564d5158e996c3e605ba4ffd15b
SHA1aef32822ace720311592570b20849ba789e4ed70
SHA2568481d2b661a36ea5e0c64b7d0f18cbb6c893b537b1aac57950b093036cec01ad
SHA512e82a48c5ac8dcf0b38ceb8ef9e91b49d9216f23e57d0e7f1f6c6d727542a97eef404fdae14566ca115bbc9cdae423bca9ba3403a04beeaa35461c1cbb0160970
-
C:\ProgramData\SystemFiles\sys_rh.binFilesize
1KB
MD597cb4e611d7c3ebbd116ee64d617c2fb
SHA13680bf194e7bf67d1ae106a462a4f72e9c8c22ae
SHA2566af1260adf835ebad980382fb597957c7bbbb1ba3a14e4f152c2ea9c9a35cca6
SHA5125061ddf2496f5cd7b84c76580faadcef90a225d2809cf79decf16f09d15bae09878148d0aa16674b3ef52aa8d051071bc5646036fa2f9512f07adae571b1e35e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD57e88a9e04852964605d81b3142a3af45
SHA15ce8f9bf254b29f0a35560c2f102e7c692d908e9
SHA256d0ec3490dcefb974ebaddfa67f530fdf44ca3302c7ae38a1c509e84f1ac6e2c7
SHA512a1e74d09020d7c13af5a947b116c25e1a2dd8c4ce8f429d7550893608d071d11785799e054f6dd1be5fb1c420cbbb408e39bbd305fa8bb1e1cea144a0b723396
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD558a9cacd8944d490c80a78ab64c9b1e9
SHA1f2774f6232693c4d1c033bf2880a742184575cb3
SHA256464bc1eb29d022babff2e5e587942882265af65d97352b6983c7d21c876acfa9
SHA5125905c89714bcc9aca595ba67da4ba3211930a7266fe002bb6d1f28dc8d697c919d7c22fdf3b17273997d26c4c36dde7ca37c16e58fe6dab7ac88a5a7fdd76180
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0caqg0mo.fwk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1616-252-0x000001A092BC0000-0x000001A092C00000-memory.dmpFilesize
256KB
-
memory/1616-250-0x000001A092B70000-0x000001A092B90000-memory.dmpFilesize
128KB
-
memory/1616-253-0x000001A092C00000-0x000001A092C20000-memory.dmpFilesize
128KB
-
memory/1616-254-0x000001A092C00000-0x000001A092C20000-memory.dmpFilesize
128KB
-
memory/1648-133-0x0000000000110000-0x0000000000126000-memory.dmpFilesize
88KB
-
memory/1648-137-0x000000000A150000-0x000000000A15A000-memory.dmpFilesize
40KB
-
memory/1648-136-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1648-138-0x000000000B8C0000-0x000000000B926000-memory.dmpFilesize
408KB
-
memory/1648-184-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1648-135-0x000000000A190000-0x000000000A222000-memory.dmpFilesize
584KB
-
memory/1648-134-0x000000000A6A0000-0x000000000AC44000-memory.dmpFilesize
5.6MB
-
memory/1732-208-0x000000007F370000-0x000000007F380000-memory.dmpFilesize
64KB
-
memory/1732-207-0x00000000029F0000-0x0000000002A00000-memory.dmpFilesize
64KB
-
memory/1732-197-0x000000006FE10000-0x000000006FE5C000-memory.dmpFilesize
304KB
-
memory/1732-196-0x00000000029F0000-0x0000000002A00000-memory.dmpFilesize
64KB
-
memory/1732-195-0x00000000029F0000-0x0000000002A00000-memory.dmpFilesize
64KB
-
memory/1752-223-0x000000006FE10000-0x000000006FE5C000-memory.dmpFilesize
304KB
-
memory/1752-211-0x00000000033B0000-0x00000000033C0000-memory.dmpFilesize
64KB
-
memory/1752-233-0x000000007F580000-0x000000007F590000-memory.dmpFilesize
64KB
-
memory/1752-222-0x00000000033B0000-0x00000000033C0000-memory.dmpFilesize
64KB
-
memory/1752-210-0x00000000033B0000-0x00000000033C0000-memory.dmpFilesize
64KB
-
memory/3440-243-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3440-237-0x00000000007B0000-0x00000000007BC000-memory.dmpFilesize
48KB
-
memory/3440-239-0x0000000005140000-0x0000000005150000-memory.dmpFilesize
64KB
-
memory/3892-177-0x0000000007830000-0x000000000783E000-memory.dmpFilesize
56KB
-
memory/3892-169-0x0000000007C70000-0x00000000082EA000-memory.dmpFilesize
6.5MB
-
memory/3892-168-0x000000007FA40000-0x000000007FA50000-memory.dmpFilesize
64KB
-
memory/3892-170-0x0000000007610000-0x000000000762A000-memory.dmpFilesize
104KB
-
memory/3892-167-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/3892-178-0x0000000007930000-0x000000000794A000-memory.dmpFilesize
104KB
-
memory/3892-166-0x0000000006880000-0x000000000689E000-memory.dmpFilesize
120KB
-
memory/3892-156-0x000000006FE10000-0x000000006FE5C000-memory.dmpFilesize
304KB
-
memory/3892-171-0x0000000007660000-0x000000000766A000-memory.dmpFilesize
40KB
-
memory/3892-172-0x0000000007890000-0x0000000007926000-memory.dmpFilesize
600KB
-
memory/3892-155-0x00000000068A0000-0x00000000068D2000-memory.dmpFilesize
200KB
-
memory/3892-179-0x0000000007870000-0x0000000007878000-memory.dmpFilesize
32KB
-
memory/3892-154-0x00000000062E0000-0x00000000062FE000-memory.dmpFilesize
120KB
-
memory/3892-149-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/3892-148-0x0000000002F30000-0x0000000002F40000-memory.dmpFilesize
64KB
-
memory/3892-142-0x0000000005BC0000-0x0000000005C26000-memory.dmpFilesize
408KB
-
memory/3892-141-0x0000000005420000-0x0000000005442000-memory.dmpFilesize
136KB
-
memory/3892-140-0x0000000005590000-0x0000000005BB8000-memory.dmpFilesize
6.2MB
-
memory/3892-139-0x0000000002990000-0x00000000029C6000-memory.dmpFilesize
216KB