Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 10:14
Static task
static1
Behavioral task
behavioral1
Sample
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe
Resource
win10v2004-20220414-en
General
-
Target
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe
-
Size
152KB
-
MD5
2274dba9c4d0861b407c428a8eb13a07
-
SHA1
c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
-
SHA256
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
-
SHA512
c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 6 IoCs
Processes:
wmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exepid process 976 wmpntk32.exe 1544 wmpntk32.exe 1728 wmpntk32.exe 840 wmpntk32.exe 836 wmpntk32.exe 316 wmpntk32.exe -
Processes:
resource yara_rule behavioral1/memory/1232-56-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-58-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-59-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-64-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-65-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-66-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-67-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1232-74-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1544-88-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1544-89-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1544-90-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1544-91-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/1544-96-0x0000000002DD0000-0x0000000002E0D000-memory.dmp upx behavioral1/memory/1544-98-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/840-113-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/840-114-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/840-120-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/316-133-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/316-134-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/316-135-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral1/memory/316-136-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmpntk32.exepid process 1544 wmpntk32.exe -
Loads dropped DLL 12 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exepid process 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 976 wmpntk32.exe 976 wmpntk32.exe 1544 wmpntk32.exe 1544 wmpntk32.exe 1728 wmpntk32.exe 1728 wmpntk32.exe 840 wmpntk32.exe 840 wmpntk32.exe 836 wmpntk32.exe 836 wmpntk32.exe -
Maps connected drives based on registry 3 TTPs 8 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpntk32.exewmpntk32.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe -
Drops file in System32 directory 10 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wmpntk32.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe File created C:\Windows\SysWOW64\wmpntk32.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exedescription pid process target process PID 1912 set thread context of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 976 set thread context of 1544 976 wmpntk32.exe wmpntk32.exe PID 1728 set thread context of 840 1728 wmpntk32.exe wmpntk32.exe PID 836 set thread context of 316 836 wmpntk32.exe wmpntk32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exepid process 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 1544 wmpntk32.exe 1544 wmpntk32.exe 840 wmpntk32.exe 840 wmpntk32.exe 316 wmpntk32.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exedescription pid process target process PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1912 wrote to memory of 1232 1912 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1232 wrote to memory of 976 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 1232 wrote to memory of 976 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 1232 wrote to memory of 976 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 1232 wrote to memory of 976 1232 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 976 wrote to memory of 1544 976 wmpntk32.exe wmpntk32.exe PID 1544 wrote to memory of 1728 1544 wmpntk32.exe wmpntk32.exe PID 1544 wrote to memory of 1728 1544 wmpntk32.exe wmpntk32.exe PID 1544 wrote to memory of 1728 1544 wmpntk32.exe wmpntk32.exe PID 1544 wrote to memory of 1728 1544 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 1728 wrote to memory of 840 1728 wmpntk32.exe wmpntk32.exe PID 840 wrote to memory of 836 840 wmpntk32.exe wmpntk32.exe PID 840 wrote to memory of 836 840 wmpntk32.exe wmpntk32.exe PID 840 wrote to memory of 836 840 wmpntk32.exe wmpntk32.exe PID 840 wrote to memory of 836 840 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe PID 836 wrote to memory of 316 836 wmpntk32.exe wmpntk32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Users\Admin\AppData\Local\Temp\110841~1.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Users\Admin\AppData\Local\Temp\110841~1.EXE4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe8⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
memory/316-136-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/316-133-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/316-135-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/316-134-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/316-128-0x0000000000454790-mapping.dmp
-
memory/836-117-0x0000000000000000-mapping.dmp
-
memory/836-119-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/836-131-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/840-113-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/840-120-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/840-114-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/840-106-0x0000000000454790-mapping.dmp
-
memory/976-86-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/976-70-0x0000000000000000-mapping.dmp
-
memory/976-73-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1232-65-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-64-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-55-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-56-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-58-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-60-0x0000000000454790-mapping.dmp
-
memory/1232-74-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-59-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-63-0x0000000075F61000-0x0000000075F63000-memory.dmpFilesize
8KB
-
memory/1232-66-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1232-72-0x0000000002D90000-0x0000000002DCD000-memory.dmpFilesize
244KB
-
memory/1232-67-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1544-90-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1544-89-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1544-91-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1544-98-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1544-88-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1544-96-0x0000000002DD0000-0x0000000002E0D000-memory.dmpFilesize
244KB
-
memory/1544-83-0x0000000000454790-mapping.dmp
-
memory/1728-94-0x0000000000000000-mapping.dmp
-
memory/1728-109-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1728-97-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1912-61-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1912-54-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB