Resubmissions
04-06-2023 01:31
230604-bxnxmaaf43 904-06-2023 01:28
230604-bvvbmabb8t 904-06-2023 01:15
230604-bl8snabb5y 903-06-2023 01:38
230603-b2d8zsfe8x 903-06-2023 01:32
230603-bx7pqsfb26 902-06-2023 22:49
230602-2rnb1sef94 9Analysis
-
max time kernel
278s -
max time network
284s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2023 22:49
Behavioral task
behavioral1
Sample
svhost.exe
Resource
win10v2004-20230220-en
General
-
Target
svhost.exe
-
Size
5.2MB
-
MD5
8aa2bcc963f412a81961e70ca973d25c
-
SHA1
791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
-
SHA256
d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
-
SHA512
da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
SSDEEP
98304:qNN/N91h2eDZQjL7sU8I5DKBWoClkRGJewd8Y3evBQ9LtYVrEx3/o6ETgKbWyu:w9GeDVI5DKBWZlkgJedYs6LtYdEhqTgY
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
Processes:
svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svhost.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svhost.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svhost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
svhost.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation svhost.exe -
Drops startup file 2 IoCs
Processes:
svhost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk svhost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk svhost.exe -
Executes dropped EXE 5 IoCs
Processes:
svhost.exesvhost.exesvhost.exesvhost.exesvhost.exepid process 640 svhost.exe 2700 svhost.exe 1300 svhost.exe 4112 svhost.exe 4772 svhost.exe -
Loads dropped DLL 6 IoCs
Processes:
svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exepid process 4564 svhost.exe 640 svhost.exe 2700 svhost.exe 1300 svhost.exe 4112 svhost.exe 4772 svhost.exe -
Obfuscated with Agile.Net obfuscator 8 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/4564-133-0x0000000000F20000-0x0000000001464000-memory.dmp agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net C:\Users\Admin\AppData\Local\svhost.exe agile_net -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida behavioral1/memory/4564-142-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-143-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-186-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-191-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-196-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-198-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida behavioral1/memory/640-205-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-209-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/640-212-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-213-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-215-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-218-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-220-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-222-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida behavioral1/memory/2700-227-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-230-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/2700-232-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-233-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-235-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-237-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-239-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-241-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida behavioral1/memory/1300-246-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/1300-247-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-249-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/1300-251-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-252-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-254-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-256-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-258-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-260-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida behavioral1/memory/4112-264-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4112-265-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-267-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4112-269-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-270-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-272-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-274-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida behavioral1/memory/4564-276-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dll themida behavioral1/memory/4772-284-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svhost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Local\\svhost.exe" svhost.exe -
Processes:
svhost.exesvhost.exesvhost.exesvhost.exesvhost.exesvhost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com 91 api.ipify.org -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4260 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exesvhost.exepid process 3632 powershell.exe 3632 powershell.exe 220 powershell.exe 220 powershell.exe 4372 powershell.exe 4372 powershell.exe 4564 svhost.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
svhost.exepowershell.exepowershell.exepowershell.exesvhost.exesvhost.exesvhost.exesvhost.exetaskkill.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4564 svhost.exe Token: SeDebugPrivilege 3632 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 4372 powershell.exe Token: SeDebugPrivilege 4564 svhost.exe Token: SeDebugPrivilege 640 svhost.exe Token: SeDebugPrivilege 2700 svhost.exe Token: SeDebugPrivilege 1300 svhost.exe Token: SeDebugPrivilege 4112 svhost.exe Token: SeDebugPrivilege 4260 taskkill.exe Token: SeShutdownPrivilege 1848 explorer.exe Token: SeCreatePagefilePrivilege 1848 explorer.exe Token: SeShutdownPrivilege 1848 explorer.exe Token: SeCreatePagefilePrivilege 1848 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
svhost.exepid process 4564 svhost.exe 4564 svhost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svhost.exepid process 4564 svhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
svhost.exeCMD.EXEdescription pid process target process PID 4564 wrote to memory of 3632 4564 svhost.exe powershell.exe PID 4564 wrote to memory of 3632 4564 svhost.exe powershell.exe PID 4564 wrote to memory of 220 4564 svhost.exe powershell.exe PID 4564 wrote to memory of 220 4564 svhost.exe powershell.exe PID 4564 wrote to memory of 4372 4564 svhost.exe powershell.exe PID 4564 wrote to memory of 4372 4564 svhost.exe powershell.exe PID 4564 wrote to memory of 4320 4564 svhost.exe schtasks.exe PID 4564 wrote to memory of 4320 4564 svhost.exe schtasks.exe PID 4564 wrote to memory of 2780 4564 svhost.exe CMD.EXE PID 4564 wrote to memory of 2780 4564 svhost.exe CMD.EXE PID 2780 wrote to memory of 1768 2780 CMD.EXE curl.exe PID 2780 wrote to memory of 1768 2780 CMD.EXE curl.exe PID 2780 wrote to memory of 3860 2780 CMD.EXE curl.exe PID 2780 wrote to memory of 3860 2780 CMD.EXE curl.exe PID 2780 wrote to memory of 3200 2780 CMD.EXE curl.exe PID 2780 wrote to memory of 3200 2780 CMD.EXE curl.exe PID 4564 wrote to memory of 4260 4564 svhost.exe taskkill.exe PID 4564 wrote to memory of 4260 4564 svhost.exe taskkill.exe PID 4564 wrote to memory of 1848 4564 svhost.exe explorer.exe PID 4564 wrote to memory of 1848 4564 svhost.exe explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\svhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\svhost.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Local\svhost.exe"2⤵
- Creates scheduled task(s)
PID:4320 -
C:\Windows\SYSTEM32\CMD.EXE"CMD.EXE"2⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\system32\curl.execurl api.ipfly.com3⤵PID:1768
-
C:\Windows\system32\curl.execurl api.ipfly.org3⤵PID:3860
-
C:\Windows\system32\curl.execurl http://api.ipify.org/3⤵PID:3200
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4260 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
PID:1848
-
C:\Users\Admin\AppData\Local\svhost.exeC:\Users\Admin\AppData\Local\svhost.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:640
-
C:\Users\Admin\AppData\Local\svhost.exeC:\Users\Admin\AppData\Local\svhost.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
C:\Users\Admin\AppData\Local\svhost.exeC:\Users\Admin\AppData\Local\svhost.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
C:\Users\Admin\AppData\Local\svhost.exeC:\Users\Admin\AppData\Local\svhost.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Users\Admin\AppData\Local\svhost.exeC:\Users\Admin\AppData\Local\svhost.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4772
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1912
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4976
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svhost.exe.logFilesize
1KB
MD53982d6d16fd43ae609fd495bb33433a2
SHA16c33cd681fdfd9a844a3128602455a768e348765
SHA2569a0a58776494250224706cbfbb08562eec3891fb988f17d66d0d8f9af4253cf9
SHA5124b69315f5d139b8978123bebd417231b28f86b6c1433eb88105465a342339c6c6b8c240a2ca8d2a9c1fca20136c8c167b78a770ab0664231f6e1742291cbf1aa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD52bb005f08e40b9d8c31f1c09da44565d
SHA18a7097ecaeca704b6d653bfedea449cfbe79072f
SHA256d7c96f73a5074bd88297839f5e749996eb91510490acd18d16edd5751f087943
SHA5123da328cd8050288fcd5e9545812f5b0767aa9c19674d6f6f5dc35e92d436b2690056018910ff5a90f33c1f6d9602c70a256637d52498f1794efc8617fea6cbe3
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhp1ky2l.w3c.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\Temp\e8b5fa5e-ee66-4326-ba03-366f19085478\AgileDotNetRT64.dllFilesize
2.9MB
MD59bb6ed08af544d3738e60200d2804180
SHA15a40b484ca56b1ce59add4ec283e21d60070be02
SHA25686d49f3894cc3de038abcde03803de8b6f239c237f34930ce5c41ab725c26cb7
SHA51263e6b90457c3e3e6e419e30fe57e35c66e08059611fbe4ffb60d28acd6ee8d9f0ccfa31d7b27e9af44ab13512490f3b7b7f5130df947c5de50a937dcee0a91a5
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
C:\Users\Admin\AppData\Local\svhost.exeFilesize
5.2MB
MD58aa2bcc963f412a81961e70ca973d25c
SHA1791e2d2f9fc5bbf9f149aaace2cbf1b3ea263eb8
SHA256d8ccea5c925de65f4604ec7b632aaf3d6bab3a9930e4708530f17f9891f8ba84
SHA512da47fd38845006bb884230996e499a6d42f5a78a2cd6fcc7be8e1b2cd3cc3623d0b579ab8eab67ee11eee294feb21729a9f23d5f51180525ad0e425b9283c7bb
-
memory/220-172-0x0000020527950000-0x0000020527960000-memory.dmpFilesize
64KB
-
memory/220-171-0x0000020527950000-0x0000020527960000-memory.dmpFilesize
64KB
-
memory/220-170-0x0000020527950000-0x0000020527960000-memory.dmpFilesize
64KB
-
memory/640-212-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/640-207-0x00007FFB1E330000-0x00007FFB1E47E000-memory.dmpFilesize
1.3MB
-
memory/640-205-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/640-206-0x000000001B940000-0x000000001B950000-memory.dmpFilesize
64KB
-
memory/1300-244-0x000000001B5A0000-0x000000001B5B0000-memory.dmpFilesize
64KB
-
memory/1300-246-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/1300-247-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/1300-248-0x00007FFB1E330000-0x00007FFB1E47E000-memory.dmpFilesize
1.3MB
-
memory/1300-251-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/2700-229-0x00007FFB1E330000-0x00007FFB1E47E000-memory.dmpFilesize
1.3MB
-
memory/2700-227-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/2700-232-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/2700-228-0x000000001B5D0000-0x000000001B5E0000-memory.dmpFilesize
64KB
-
memory/3632-145-0x0000020AC4DC0000-0x0000020AC4DE2000-memory.dmpFilesize
136KB
-
memory/3632-155-0x0000020AC4E30000-0x0000020AC4E40000-memory.dmpFilesize
64KB
-
memory/3632-156-0x0000020AC4E30000-0x0000020AC4E40000-memory.dmpFilesize
64KB
-
memory/4112-265-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4112-264-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4112-269-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4112-266-0x00007FFB1E330000-0x00007FFB1E47E000-memory.dmpFilesize
1.3MB
-
memory/4564-233-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-277-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-186-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-223-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-252-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-198-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-197-0x000000001C050000-0x000000001C060000-memory.dmpFilesize
64KB
-
memory/4564-215-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-214-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-249-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-230-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-231-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-213-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-216-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-234-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-235-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-236-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-237-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-238-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-239-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-240-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-241-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-242-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-196-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-191-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-188-0x000000001C050000-0x000000001C060000-memory.dmpFilesize
64KB
-
memory/4564-250-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-200-0x000000001C050000-0x000000001C060000-memory.dmpFilesize
64KB
-
memory/4564-253-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-133-0x0000000000F20000-0x0000000001464000-memory.dmpFilesize
5.3MB
-
memory/4564-222-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-221-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-199-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-210-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-254-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-255-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-256-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-257-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-258-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-259-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-260-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-261-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-144-0x00007FFB1E330000-0x00007FFB1E47E000-memory.dmpFilesize
1.3MB
-
memory/4564-143-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-220-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-208-0x000000001C050000-0x000000001C060000-memory.dmpFilesize
64KB
-
memory/4564-219-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-267-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-268-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-218-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-270-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-271-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-272-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-273-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-274-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-275-0x000000001E830000-0x000000001E9D9000-memory.dmpFilesize
1.7MB
-
memory/4564-276-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-209-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-142-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB
-
memory/4564-134-0x000000001C050000-0x000000001C060000-memory.dmpFilesize
64KB
-
memory/4772-283-0x0000000001570000-0x0000000001580000-memory.dmpFilesize
64KB
-
memory/4772-284-0x00007FFB18A10000-0x00007FFB191C2000-memory.dmpFilesize
7.7MB