Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2023 19:03
Static task
static1
Behavioral task
behavioral1
Sample
SystemUpdate.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SystemUpdate.exe
Resource
win10v2004-20230220-en
General
-
Target
SystemUpdate.exe
-
Size
62KB
-
MD5
09a29f3b529c5e9ab25a47973bb0900a
-
SHA1
b8dce851d01dbe0335f11fa8449b52a2270776e6
-
SHA256
33035a718f5445742b82707f0ba6aff80337cac1e89b6b3b8b51177c7f9f578a
-
SHA512
35e92a26fc392b15eb7fd78ca1f6a6c08afe42ed535fd020237215d7f4db0f66fa0676eb70d646f8790c9724c30c605a99b33cf6a6c84c3de78f6061f1a48efb
-
SSDEEP
1536:s2JbaiIZApuLzOgkx9MbEze4g3ViceSITKdU:dbahZApuL1kx9MbEze4g3ViceYO
Malware Config
Signatures
-
XMRig Miner payload 4 IoCs
Processes:
resource yara_rule C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig C:\ProgramData\Dllhost\winlogson.exe family_xmrig C:\ProgramData\Dllhost\winlogson.exe xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
dllhost.exewinlogson.exepid process 2728 dllhost.exe 1468 winlogson.exe -
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
dllhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe / file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 11 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4200 schtasks.exe 4776 schtasks.exe 5064 schtasks.exe 2512 schtasks.exe 3984 schtasks.exe 2540 schtasks.exe 2240 schtasks.exe 3300 schtasks.exe 764 schtasks.exe 2092 schtasks.exe 2252 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SystemUpdate.exepowershell.exepowershell.exepowershell.exedllhost.exepid process 2692 SystemUpdate.exe 3692 powershell.exe 3692 powershell.exe 1976 powershell.exe 1976 powershell.exe 4520 powershell.exe 4520 powershell.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe 2728 dllhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 668 -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
SystemUpdate.exepowershell.exepowershell.exepowershell.exedllhost.exewinlogson.exedescription pid process Token: SeDebugPrivilege 2692 SystemUpdate.exe Token: SeDebugPrivilege 3692 powershell.exe Token: SeDebugPrivilege 1976 powershell.exe Token: SeDebugPrivilege 4520 powershell.exe Token: SeDebugPrivilege 2728 dllhost.exe Token: SeLockMemoryPrivilege 1468 winlogson.exe Token: SeLockMemoryPrivilege 1468 winlogson.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
winlogson.exepid process 1468 winlogson.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SystemUpdate.execmd.exedllhost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2692 wrote to memory of 2404 2692 SystemUpdate.exe cmd.exe PID 2692 wrote to memory of 2404 2692 SystemUpdate.exe cmd.exe PID 2692 wrote to memory of 2404 2692 SystemUpdate.exe cmd.exe PID 2404 wrote to memory of 564 2404 cmd.exe chcp.com PID 2404 wrote to memory of 564 2404 cmd.exe chcp.com PID 2404 wrote to memory of 564 2404 cmd.exe chcp.com PID 2404 wrote to memory of 3692 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 3692 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 3692 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 1976 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 1976 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 1976 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 4520 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 4520 2404 cmd.exe powershell.exe PID 2404 wrote to memory of 4520 2404 cmd.exe powershell.exe PID 2692 wrote to memory of 2728 2692 SystemUpdate.exe dllhost.exe PID 2692 wrote to memory of 2728 2692 SystemUpdate.exe dllhost.exe PID 2692 wrote to memory of 2728 2692 SystemUpdate.exe dllhost.exe PID 2728 wrote to memory of 2880 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2880 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2880 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1336 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1336 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1336 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4464 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4464 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4464 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1588 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1588 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1588 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2384 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2384 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2384 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4620 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4620 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4620 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4984 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4984 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4984 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2168 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2168 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2168 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2300 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2300 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 2300 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1144 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1144 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 1144 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4944 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4944 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4944 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4612 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4612 2728 dllhost.exe cmd.exe PID 2728 wrote to memory of 4612 2728 dllhost.exe cmd.exe PID 1336 wrote to memory of 3300 1336 cmd.exe schtasks.exe PID 1336 wrote to memory of 3300 1336 cmd.exe schtasks.exe PID 1336 wrote to memory of 3300 1336 cmd.exe schtasks.exe PID 1588 wrote to memory of 2512 1588 cmd.exe schtasks.exe PID 1588 wrote to memory of 2512 1588 cmd.exe schtasks.exe PID 1588 wrote to memory of 2512 1588 cmd.exe schtasks.exe PID 4620 wrote to memory of 3984 4620 cmd.exe schtasks.exe PID 4620 wrote to memory of 3984 4620 cmd.exe schtasks.exe PID 4620 wrote to memory of 3984 4620 cmd.exe schtasks.exe PID 4464 wrote to memory of 2540 4464 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SystemUpdate.exe"C:\Users\Admin\AppData\Local\Temp\SystemUpdate.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12513⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\SystemData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3456" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5928" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk5928" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1607" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk1607" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5844" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk5844" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json3⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵
-
C:\ProgramData\Dllhost\winlogson.exeC:\ProgramData\Dllhost\winlogson.exe -c config.json4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\dllhost.exeFilesize
24KB
MD5acf4152befc5768daaf11c92fd3899b0
SHA1f8a210a2a00876f15008f275063988e5cf534722
SHA25664c80419e5ca81a5bfee32e223b5676aac6d47c4aa8168ceae6247f766c291d6
SHA51215bdde54be38e7ed0828f238bd2f0bcdc1a73671118225b731760fe4beb568a72570bad9b1a97a237291b394f1d3155aa6fcac209f6ae0a3db6608e0036c56d1
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\Dllhost\winlogson.exeFilesize
5.2MB
MD56c454e10bbea489cfc96253fe55ec282
SHA122fd5c79495ad06036635eff26a31c76d859e3b7
SHA256a12c34fef1d6475d99aa9af2e8bf1fd55bca83982a0ee2a9131ffd9fd15cb2a7
SHA51281f45ebeffc0205e4132db3f29584e267f986dc8b5e02f3d444a8470e24e073259cb2075af8a832aa09da1dc20b0609e2e4b3ec68284232ce86547e6bf794562
-
C:\ProgramData\SystemFiles\config.jsonFilesize
310B
MD5ed14dd820f7a202af04496de4b86cedd
SHA10b9440d08060f4d45fbb6f35c8dbdc60f135fd7f
SHA2560d09f312bb2722572c6efe16c989a9cd52fb54d2f5faf04a05ddb88e64e0f4ef
SHA512002749f33f789aed6a27594fef7259bfe9dcd36b84433e7f1be9e173217dfa3adf2180b7d0623fc10a1e1466c7002532884f45784c4c6652d504eefadc6d8482
-
C:\ProgramData\SystemFiles\sys_rh.binFilesize
1KB
MD59bc83276af97842def832a8e4a57ff89
SHA1f9412e836938d2e67b1681ef562955218568bd74
SHA25633f0be926c68f749a4fbede88a55ee546e00dd9041ec762a6d491d30b2286492
SHA512161c14dcc27cd66ee2c77dc959308a7c5aa1d94da356cd663cf93e4aa47b3eb54e1f799f9e4f202bc9fea2af84043899ce829954e85f50deb320a7ce9ec3d9ac
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c216baebaa56c5a909a4a87527e5f1e6
SHA1583f2cfe75498462f2d671dee1c4bf92c1bcbee1
SHA25616b85a713bd33384ea6b738e482f9d41ac17b1c907fa28fab024e346fce01071
SHA512bfdcea23ea62baa15c8d5aa871af0c5dcd663b80e7de12f3d6d8a4207472ffcea076e3e640411f115bc8f02b2e003d9f2efab5ed1b9020042cbcf1d79e2ab969
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5c0bf5f61663d77e252aa977b7be14e43
SHA11402c2b557b3a5e14620806e176b4016b68f521d
SHA256d304a74b1df01749a427293ab0da87d55c37b86af5e5b1784fb68d8695765b5a
SHA512fe954bcdf1be6a41bb46d6ef696c2f37e99d98ac023b37da1b13d59e8ee9d2088e82d5b5483dbb81a65ec4a42cb537bfc7e090c099192266833592688f40dab5
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ulcrb52e.tk5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1468-249-0x000001AC4D530000-0x000001AC4D550000-memory.dmpFilesize
128KB
-
memory/1468-253-0x000001AC4EF30000-0x000001AC4EF50000-memory.dmpFilesize
128KB
-
memory/1468-252-0x000001AC4EF30000-0x000001AC4EF50000-memory.dmpFilesize
128KB
-
memory/1468-251-0x000001AC4EEF0000-0x000001AC4EF30000-memory.dmpFilesize
256KB
-
memory/1976-207-0x000000007F2E0000-0x000000007F2F0000-memory.dmpFilesize
64KB
-
memory/1976-206-0x0000000004850000-0x0000000004860000-memory.dmpFilesize
64KB
-
memory/1976-196-0x00000000701C0000-0x000000007020C000-memory.dmpFilesize
304KB
-
memory/1976-195-0x0000000004850000-0x0000000004860000-memory.dmpFilesize
64KB
-
memory/2692-135-0x000000000A770000-0x000000000A802000-memory.dmpFilesize
584KB
-
memory/2692-136-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2692-137-0x000000000A900000-0x000000000A90A000-memory.dmpFilesize
40KB
-
memory/2692-138-0x000000000BD90000-0x000000000BDF6000-memory.dmpFilesize
408KB
-
memory/2692-134-0x000000000AB00000-0x000000000B0A4000-memory.dmpFilesize
5.6MB
-
memory/2692-133-0x0000000000630000-0x0000000000646000-memory.dmpFilesize
88KB
-
memory/2692-194-0x00000000050C0000-0x00000000050D0000-memory.dmpFilesize
64KB
-
memory/2728-237-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/2728-238-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/2728-242-0x0000000004CE0000-0x0000000004CF0000-memory.dmpFilesize
64KB
-
memory/3692-174-0x0000000007850000-0x000000000786A000-memory.dmpFilesize
104KB
-
memory/3692-180-0x0000000007AB0000-0x0000000007AB8000-memory.dmpFilesize
32KB
-
memory/3692-176-0x0000000007AD0000-0x0000000007B66000-memory.dmpFilesize
600KB
-
memory/3692-175-0x00000000078A0000-0x00000000078AA000-memory.dmpFilesize
40KB
-
memory/3692-140-0x0000000005680000-0x0000000005CA8000-memory.dmpFilesize
6.2MB
-
memory/3692-172-0x0000000007EB0000-0x000000000852A000-memory.dmpFilesize
6.5MB
-
memory/3692-143-0x0000000005480000-0x00000000054A2000-memory.dmpFilesize
136KB
-
memory/3692-139-0x0000000004F90000-0x0000000004FC6000-memory.dmpFilesize
216KB
-
memory/3692-154-0x0000000006520000-0x000000000653E000-memory.dmpFilesize
120KB
-
memory/3692-155-0x0000000006AE0000-0x0000000006B12000-memory.dmpFilesize
200KB
-
memory/3692-142-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/3692-144-0x0000000005DB0000-0x0000000005E16000-memory.dmpFilesize
408KB
-
memory/3692-179-0x0000000007B70000-0x0000000007B8A000-memory.dmpFilesize
104KB
-
memory/3692-141-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/3692-168-0x000000007F110000-0x000000007F120000-memory.dmpFilesize
64KB
-
memory/3692-167-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/3692-178-0x0000000007A70000-0x0000000007A7E000-memory.dmpFilesize
56KB
-
memory/3692-166-0x0000000006AC0000-0x0000000006ADE000-memory.dmpFilesize
120KB
-
memory/3692-156-0x00000000701C0000-0x000000007020C000-memory.dmpFilesize
304KB
-
memory/4520-231-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4520-221-0x00000000701C0000-0x000000007020C000-memory.dmpFilesize
304KB
-
memory/4520-220-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4520-219-0x0000000004F60000-0x0000000004F70000-memory.dmpFilesize
64KB
-
memory/4520-232-0x000000007F760000-0x000000007F770000-memory.dmpFilesize
64KB