Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 01:59
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
63KB
-
MD5
6790f5477fd0f2c8fedba93d7c3a366d
-
SHA1
51b8c2a24460823c650464f47cf6362b156a732d
-
SHA256
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064
-
SHA512
bb0222c528aae62d666521bd8b4668de337a6a7de8b58c8f252410695e374f829f82602e839dbb610228db7abfc1b2dc000fd0ba0207cd89418b62546f60b874
-
SSDEEP
768:fGsKfzI7wLgHFz/tJtSsBaC2x0T7VvgLLSzMbEJskwMj7ttGUAKS0RGRQz:fHGsacFTtSTC2x0gLQMbETZMUbRGI
Malware Config
Signatures
-
XMRig Miner payload 4 IoCs
Processes:
resource yara_rule C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
dllhost.exewinlogson.exepid process 1180 dllhost.exe 3292 winlogson.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2112 schtasks.exe 116 schtasks.exe 3924 schtasks.exe 1316 schtasks.exe 2912 schtasks.exe 2272 schtasks.exe 1744 schtasks.exe 3932 schtasks.exe 2280 schtasks.exe 3488 schtasks.exe 2808 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
file.exepowershell.exepowershell.exedllhost.exepowershell.exepid process 3712 file.exe 2428 powershell.exe 2428 powershell.exe 4816 powershell.exe 4816 powershell.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 764 powershell.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 764 powershell.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe 1180 dllhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
file.exepowershell.exepowershell.exedllhost.exepowershell.exewinlogson.exedescription pid process Token: SeDebugPrivilege 3712 file.exe Token: SeDebugPrivilege 2428 powershell.exe Token: SeDebugPrivilege 4816 powershell.exe Token: SeDebugPrivilege 1180 dllhost.exe Token: SeDebugPrivilege 764 powershell.exe Token: SeLockMemoryPrivilege 3292 winlogson.exe Token: SeLockMemoryPrivilege 3292 winlogson.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winlogson.exepid process 3292 winlogson.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.execmd.exedllhost.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3712 wrote to memory of 2092 3712 file.exe cmd.exe PID 3712 wrote to memory of 2092 3712 file.exe cmd.exe PID 3712 wrote to memory of 2092 3712 file.exe cmd.exe PID 2092 wrote to memory of 1512 2092 cmd.exe chcp.com PID 2092 wrote to memory of 1512 2092 cmd.exe chcp.com PID 2092 wrote to memory of 1512 2092 cmd.exe chcp.com PID 2092 wrote to memory of 2428 2092 cmd.exe powershell.exe PID 2092 wrote to memory of 2428 2092 cmd.exe powershell.exe PID 2092 wrote to memory of 2428 2092 cmd.exe powershell.exe PID 2092 wrote to memory of 4816 2092 cmd.exe powershell.exe PID 2092 wrote to memory of 4816 2092 cmd.exe powershell.exe PID 2092 wrote to memory of 4816 2092 cmd.exe powershell.exe PID 3712 wrote to memory of 1180 3712 file.exe dllhost.exe PID 3712 wrote to memory of 1180 3712 file.exe dllhost.exe PID 3712 wrote to memory of 1180 3712 file.exe dllhost.exe PID 1180 wrote to memory of 3940 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3940 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3940 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4164 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4164 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4164 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 2580 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 2580 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 2580 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4316 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4316 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4316 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4012 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4012 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 4012 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1912 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1912 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1912 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3144 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3144 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3144 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1784 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1784 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1784 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3176 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3176 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3176 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1352 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1352 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 1352 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 2592 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 2592 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 2592 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3108 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3108 1180 dllhost.exe cmd.exe PID 1180 wrote to memory of 3108 1180 dllhost.exe cmd.exe PID 3940 wrote to memory of 1316 3940 cmd.exe schtasks.exe PID 3940 wrote to memory of 1316 3940 cmd.exe schtasks.exe PID 3940 wrote to memory of 1316 3940 cmd.exe schtasks.exe PID 3144 wrote to memory of 2272 3144 cmd.exe schtasks.exe PID 3144 wrote to memory of 2272 3144 cmd.exe schtasks.exe PID 3144 wrote to memory of 2272 3144 cmd.exe schtasks.exe PID 2580 wrote to memory of 2912 2580 cmd.exe schtasks.exe PID 2580 wrote to memory of 2912 2580 cmd.exe schtasks.exe PID 2580 wrote to memory of 2912 2580 cmd.exe schtasks.exe PID 4164 wrote to memory of 2112 4164 cmd.exe schtasks.exe PID 4164 wrote to memory of 2112 4164 cmd.exe schtasks.exe PID 4164 wrote to memory of 2112 4164 cmd.exe schtasks.exe PID 4012 wrote to memory of 3924 4012 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5706" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk5706" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6978" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6978" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3195" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk3195" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2529" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2529" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\SystemFiles\config.jsonFilesize
312B
MD5f530d564d5158e996c3e605ba4ffd15b
SHA1aef32822ace720311592570b20849ba789e4ed70
SHA2568481d2b661a36ea5e0c64b7d0f18cbb6c893b537b1aac57950b093036cec01ad
SHA512e82a48c5ac8dcf0b38ceb8ef9e91b49d9216f23e57d0e7f1f6c6d727542a97eef404fdae14566ca115bbc9cdae423bca9ba3403a04beeaa35461c1cbb0160970
-
C:\ProgramData\SystemFiles\sys_rh.binFilesize
1KB
MD597cb4e611d7c3ebbd116ee64d617c2fb
SHA13680bf194e7bf67d1ae106a462a4f72e9c8c22ae
SHA2566af1260adf835ebad980382fb597957c7bbbb1ba3a14e4f152c2ea9c9a35cca6
SHA5125061ddf2496f5cd7b84c76580faadcef90a225d2809cf79decf16f09d15bae09878148d0aa16674b3ef52aa8d051071bc5646036fa2f9512f07adae571b1e35e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ad8b02a3ce4f639365bbf1ba0d270288
SHA10450a7c9de5bcdc4a74d047a5a3c0d3c6bb11f4d
SHA256dc6f839406d10f54fe57288c6702f84e4f174a425a69f9adb01711983a13170a
SHA512623e6f4c0974537a9e9678e4dc85387dbe8703be80888980c04a2c0bd6a4804b426e4f2ca7314f2c995fa17a831e20923e545008aa8575c15761b18c989bd672
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5ef5cda5205f1d84435ee5a9628bf39be
SHA10d38b333ea3a852731f9dc53a36dc0c42bac5fad
SHA2567929d3cbc4b22defb3547d7670bc66ea40cc2dfc8435b17fe85c34605feb89bc
SHA512b6f6ca09b8537120749168efce978cdacb008f22afecc0f506b2ef42aa8ff2d0f7ae92773c1db3adcbbe774c2c2ed54ede7caae130982b99b5caa6e1d1e4406b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_moqmeejr.vsy.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/764-226-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/764-225-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/764-229-0x0000000004FA0000-0x0000000004FB0000-memory.dmpFilesize
64KB
-
memory/764-230-0x000000007FC50000-0x000000007FC60000-memory.dmpFilesize
64KB
-
memory/764-231-0x00000000701B0000-0x00000000701FC000-memory.dmpFilesize
304KB
-
memory/1180-213-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB
-
memory/1180-212-0x0000000000A80000-0x0000000000A8C000-memory.dmpFilesize
48KB
-
memory/1180-243-0x0000000005550000-0x0000000005560000-memory.dmpFilesize
64KB
-
memory/2428-154-0x00000000063E0000-0x00000000063FE000-memory.dmpFilesize
120KB
-
memory/2428-160-0x0000000007390000-0x00000000073C2000-memory.dmpFilesize
200KB
-
memory/2428-172-0x0000000007D70000-0x00000000083EA000-memory.dmpFilesize
6.5MB
-
memory/2428-176-0x0000000007760000-0x000000000776A000-memory.dmpFilesize
40KB
-
memory/2428-140-0x0000000004E10000-0x0000000004E46000-memory.dmpFilesize
216KB
-
memory/2428-178-0x0000000007990000-0x0000000007A26000-memory.dmpFilesize
600KB
-
memory/2428-179-0x0000000007930000-0x000000000793E000-memory.dmpFilesize
56KB
-
memory/2428-180-0x0000000007A30000-0x0000000007A4A000-memory.dmpFilesize
104KB
-
memory/2428-181-0x0000000007970000-0x0000000007978000-memory.dmpFilesize
32KB
-
memory/2428-173-0x000000007F6F0000-0x000000007F700000-memory.dmpFilesize
64KB
-
memory/2428-171-0x00000000069A0000-0x00000000069BE000-memory.dmpFilesize
120KB
-
memory/2428-139-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2428-141-0x0000000005480000-0x0000000005AA8000-memory.dmpFilesize
6.2MB
-
memory/2428-142-0x0000000005410000-0x0000000005432000-memory.dmpFilesize
136KB
-
memory/2428-143-0x0000000005B20000-0x0000000005B86000-memory.dmpFilesize
408KB
-
memory/2428-153-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/2428-161-0x00000000701B0000-0x00000000701FC000-memory.dmpFilesize
304KB
-
memory/2428-174-0x0000000007710000-0x000000000772A000-memory.dmpFilesize
104KB
-
memory/2428-159-0x0000000004DC0000-0x0000000004DD0000-memory.dmpFilesize
64KB
-
memory/3292-250-0x000001E266650000-0x000001E266670000-memory.dmpFilesize
128KB
-
memory/3292-254-0x000001E2666F0000-0x000001E266710000-memory.dmpFilesize
128KB
-
memory/3292-253-0x000001E2666F0000-0x000001E266710000-memory.dmpFilesize
128KB
-
memory/3292-252-0x000001E2666B0000-0x000001E2666F0000-memory.dmpFilesize
256KB
-
memory/3712-137-0x00000000057E0000-0x00000000057EA000-memory.dmpFilesize
40KB
-
memory/3712-177-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3712-138-0x00000000069E0000-0x0000000006A46000-memory.dmpFilesize
408KB
-
memory/3712-133-0x0000000000D00000-0x0000000000D16000-memory.dmpFilesize
88KB
-
memory/3712-136-0x0000000005800000-0x0000000005892000-memory.dmpFilesize
584KB
-
memory/3712-135-0x0000000005750000-0x0000000005760000-memory.dmpFilesize
64KB
-
memory/3712-134-0x000000000A290000-0x000000000A834000-memory.dmpFilesize
5.6MB
-
memory/4816-196-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/4816-195-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/4816-197-0x00000000701B0000-0x00000000701FC000-memory.dmpFilesize
304KB
-
memory/4816-207-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/4816-208-0x000000007F5F0000-0x000000007F600000-memory.dmpFilesize
64KB