Analysis
-
max time kernel
300s -
max time network
177s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 04:47
Static task
static1
Behavioral task
behavioral1
Sample
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe
Resource
win10-20230220-en
General
-
Target
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe
-
Size
63KB
-
MD5
6790f5477fd0f2c8fedba93d7c3a366d
-
SHA1
51b8c2a24460823c650464f47cf6362b156a732d
-
SHA256
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064
-
SHA512
bb0222c528aae62d666521bd8b4668de337a6a7de8b58c8f252410695e374f829f82602e839dbb610228db7abfc1b2dc000fd0ba0207cd89418b62546f60b874
-
SSDEEP
768:fGsKfzI7wLgHFz/tJtSsBaC2x0T7VvgLLSzMbEJskwMj7ttGUAKS0RGRQz:fHGsacFTtSTC2x0gLQMbETZMUbRGI
Malware Config
Signatures
-
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
dllhost.exewinlogson.exewinlogson.exewinlogson.exewinlogson.exewinlogson.exepid process 712 dllhost.exe 1416 winlogson.exe 1348 winlogson.exe 2136 winlogson.exe 2432 winlogson.exe 2128 winlogson.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 9 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4664 schtasks.exe 2628 schtasks.exe 3060 schtasks.exe 2364 schtasks.exe 2836 schtasks.exe 2200 schtasks.exe 4224 schtasks.exe 4424 schtasks.exe 4064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exepowershell.exepowershell.exedllhost.exepid process 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe 4388 powershell.exe 4388 powershell.exe 4388 powershell.exe 1788 powershell.exe 1788 powershell.exe 1788 powershell.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe 712 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exepowershell.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe Token: SeDebugPrivilege 4388 powershell.exe Token: SeDebugPrivilege 1788 powershell.exe Token: SeDebugPrivilege 712 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.execmd.exedllhost.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2932 wrote to memory of 5040 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe cmd.exe PID 2932 wrote to memory of 5040 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe cmd.exe PID 2932 wrote to memory of 5040 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe cmd.exe PID 5040 wrote to memory of 2120 5040 cmd.exe chcp.com PID 5040 wrote to memory of 2120 5040 cmd.exe chcp.com PID 5040 wrote to memory of 2120 5040 cmd.exe chcp.com PID 5040 wrote to memory of 4388 5040 cmd.exe powershell.exe PID 5040 wrote to memory of 4388 5040 cmd.exe powershell.exe PID 5040 wrote to memory of 4388 5040 cmd.exe powershell.exe PID 5040 wrote to memory of 1788 5040 cmd.exe powershell.exe PID 5040 wrote to memory of 1788 5040 cmd.exe powershell.exe PID 5040 wrote to memory of 1788 5040 cmd.exe powershell.exe PID 2932 wrote to memory of 712 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe dllhost.exe PID 2932 wrote to memory of 712 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe dllhost.exe PID 2932 wrote to memory of 712 2932 76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe dllhost.exe PID 712 wrote to memory of 196 712 dllhost.exe cmd.exe PID 712 wrote to memory of 196 712 dllhost.exe cmd.exe PID 712 wrote to memory of 196 712 dllhost.exe cmd.exe PID 712 wrote to memory of 308 712 dllhost.exe cmd.exe PID 712 wrote to memory of 308 712 dllhost.exe cmd.exe PID 712 wrote to memory of 308 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1276 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1276 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1276 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2192 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2192 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2192 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2168 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2168 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2168 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1536 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1536 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1536 712 dllhost.exe cmd.exe PID 712 wrote to memory of 668 712 dllhost.exe cmd.exe PID 712 wrote to memory of 668 712 dllhost.exe cmd.exe PID 712 wrote to memory of 668 712 dllhost.exe cmd.exe PID 712 wrote to memory of 4428 712 dllhost.exe cmd.exe PID 712 wrote to memory of 4428 712 dllhost.exe cmd.exe PID 712 wrote to memory of 4428 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1560 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1560 712 dllhost.exe cmd.exe PID 712 wrote to memory of 1560 712 dllhost.exe cmd.exe PID 712 wrote to memory of 648 712 dllhost.exe cmd.exe PID 712 wrote to memory of 648 712 dllhost.exe cmd.exe PID 712 wrote to memory of 648 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2112 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2112 712 dllhost.exe cmd.exe PID 712 wrote to memory of 2112 712 dllhost.exe cmd.exe PID 712 wrote to memory of 752 712 dllhost.exe cmd.exe PID 712 wrote to memory of 752 712 dllhost.exe cmd.exe PID 712 wrote to memory of 752 712 dllhost.exe cmd.exe PID 648 wrote to memory of 4664 648 cmd.exe schtasks.exe PID 648 wrote to memory of 4664 648 cmd.exe schtasks.exe PID 648 wrote to memory of 4664 648 cmd.exe schtasks.exe PID 308 wrote to memory of 4424 308 cmd.exe schtasks.exe PID 308 wrote to memory of 4424 308 cmd.exe schtasks.exe PID 308 wrote to memory of 4424 308 cmd.exe schtasks.exe PID 1536 wrote to memory of 4224 1536 cmd.exe schtasks.exe PID 1536 wrote to memory of 4224 1536 cmd.exe schtasks.exe PID 1536 wrote to memory of 4224 1536 cmd.exe schtasks.exe PID 4428 wrote to memory of 2200 4428 cmd.exe schtasks.exe PID 4428 wrote to memory of 2200 4428 cmd.exe schtasks.exe PID 4428 wrote to memory of 2200 4428 cmd.exe schtasks.exe PID 2168 wrote to memory of 3060 2168 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe"C:\Users\Admin\AppData\Local\Temp\76ee151db592d2d4fc40090d29377b79edbc33f1445ed63566a7f6892dc0d064.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6801" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5142" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk5142" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2994" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk2994" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk4006" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\SystemFiles\sys_rh.binFilesize
1KB
MD597cb4e611d7c3ebbd116ee64d617c2fb
SHA13680bf194e7bf67d1ae106a462a4f72e9c8c22ae
SHA2566af1260adf835ebad980382fb597957c7bbbb1ba3a14e4f152c2ea9c9a35cca6
SHA5125061ddf2496f5cd7b84c76580faadcef90a225d2809cf79decf16f09d15bae09878148d0aa16674b3ef52aa8d051071bc5646036fa2f9512f07adae571b1e35e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5bf7f0b8a556ada0f81724160d474aa0c
SHA15c3fd25b85d88fef9602b8f10570fe804d2b62ed
SHA256ada76a645662bd5e7b0e595b2e8e8a8599f01ec11fc23349e08151dec270bc57
SHA5123758577c98f09c434402decffac2c306907f214dbc13fd98504967947fe73a3b8e39f5ee8e00a47195b0710966515c920db1fecc8b3b653cf5eea35156301074
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2plgy0er.jsq.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/712-659-0x0000000005780000-0x0000000005790000-memory.dmpFilesize
64KB
-
memory/712-394-0x0000000000FA0000-0x0000000000FAC000-memory.dmpFilesize
48KB
-
memory/712-405-0x0000000005780000-0x0000000005790000-memory.dmpFilesize
64KB
-
memory/1416-666-0x000002A31C480000-0x000002A31C4A0000-memory.dmpFilesize
128KB
-
memory/1788-417-0x0000000008E80000-0x0000000008F25000-memory.dmpFilesize
660KB
-
memory/1788-388-0x00000000040C0000-0x00000000040D0000-memory.dmpFilesize
64KB
-
memory/1788-488-0x00000000040C0000-0x00000000040D0000-memory.dmpFilesize
64KB
-
memory/1788-389-0x00000000040C0000-0x00000000040D0000-memory.dmpFilesize
64KB
-
memory/1788-416-0x000000007F470000-0x000000007F480000-memory.dmpFilesize
64KB
-
memory/2932-125-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2932-158-0x0000000004B70000-0x0000000004B80000-memory.dmpFilesize
64KB
-
memory/2932-121-0x00000000002C0000-0x00000000002D6000-memory.dmpFilesize
88KB
-
memory/2932-123-0x00000000097A0000-0x0000000009C9E000-memory.dmpFilesize
5.0MB
-
memory/2932-122-0x0000000000D40000-0x0000000000D46000-memory.dmpFilesize
24KB
-
memory/2932-126-0x0000000004B40000-0x0000000004B4A000-memory.dmpFilesize
40KB
-
memory/2932-127-0x0000000005E50000-0x0000000005EB6000-memory.dmpFilesize
408KB
-
memory/2932-124-0x0000000004D20000-0x0000000004DB2000-memory.dmpFilesize
584KB
-
memory/4388-134-0x00000000077A0000-0x00000000077C2000-memory.dmpFilesize
136KB
-
memory/4388-369-0x0000000008AF0000-0x0000000008AF8000-memory.dmpFilesize
32KB
-
memory/4388-364-0x0000000009B60000-0x0000000009B7A000-memory.dmpFilesize
104KB
-
memory/4388-239-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4388-170-0x0000000009C80000-0x0000000009D14000-memory.dmpFilesize
592KB
-
memory/4388-169-0x000000007F590000-0x000000007F5A0000-memory.dmpFilesize
64KB
-
memory/4388-168-0x0000000009970000-0x0000000009A15000-memory.dmpFilesize
660KB
-
memory/4388-162-0x0000000009910000-0x000000000992E000-memory.dmpFilesize
120KB
-
memory/4388-161-0x0000000009930000-0x0000000009963000-memory.dmpFilesize
204KB
-
memory/4388-139-0x0000000008870000-0x00000000088E6000-memory.dmpFilesize
472KB
-
memory/4388-138-0x00000000085A0000-0x00000000085EB000-memory.dmpFilesize
300KB
-
memory/4388-137-0x0000000007FD0000-0x0000000007FEC000-memory.dmpFilesize
112KB
-
memory/4388-136-0x00000000081D0000-0x0000000008520000-memory.dmpFilesize
3.3MB
-
memory/4388-135-0x0000000007EB0000-0x0000000007F16000-memory.dmpFilesize
408KB
-
memory/4388-133-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4388-132-0x0000000007240000-0x0000000007250000-memory.dmpFilesize
64KB
-
memory/4388-131-0x0000000007880000-0x0000000007EA8000-memory.dmpFilesize
6.2MB
-
memory/4388-130-0x0000000005080000-0x00000000050B6000-memory.dmpFilesize
216KB