Analysis
-
max time kernel
2699s -
max time network
2695s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
11-05-2024 11:03
Static task
static1
Behavioral task
behavioral1
Sample
beren.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
beren.exe
Resource
win7-20240215-en
Behavioral task
behavioral3
Sample
beren.exe
Resource
win10v2004-20240508-en
General
-
Target
beren.exe
-
Size
5.0MB
-
MD5
b1ac2ea973651a70ea72597e13a10f0a
-
SHA1
07e7cdedc54067a46b1d42cdf8a2c9050c3d3419
-
SHA256
e2cb500c902da55ac07cbfbe30b8d1cef8781e55f0439ed601672636c3ab8c47
-
SHA512
02b0dbc8a31ca440027a6c07d618a92bb520567ccd338c28dfcb86faa5b56c866564cf1a05b1754dcfeb252d12d76da57fd2de87804454f0ef1097431764c1f0
-
SSDEEP
98304:9l68nO7ed9W+WzUU3a7G9kzPupfguX8WpWY/FwWCghYjuFRx20iZGZ1:9UdedpWzUmuPeghvY9wvonVsE
Malware Config
Signatures
-
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/4716-223-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-221-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-222-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-220-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-219-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-217-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-216-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-226-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-227-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-228-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-230-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral1/memory/4716-229-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 688 powershell.exe 1876 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
lhhsgwktkatl.exepid process 4448 lhhsgwktkatl.exe -
Processes:
resource yara_rule behavioral1/memory/4716-211-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-212-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-223-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-221-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-222-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-220-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-219-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-217-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-215-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-214-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-216-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-213-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-226-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-227-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-228-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-230-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral1/memory/4716-229-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
lhhsgwktkatl.exeberen.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe lhhsgwktkatl.exe File opened for modification C:\Windows\system32\MRT.exe beren.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lhhsgwktkatl.exedescription pid process target process PID 4448 set thread context of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 set thread context of 4716 4448 lhhsgwktkatl.exe conhost.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1008 sc.exe 2320 sc.exe 2308 sc.exe 1532 sc.exe -
Modifies data under HKEY_USERS 47 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
beren.exepowershell.exelhhsgwktkatl.exepowershell.execonhost.exepid process 4404 beren.exe 688 powershell.exe 688 powershell.exe 688 powershell.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4404 beren.exe 4448 lhhsgwktkatl.exe 1876 powershell.exe 1876 powershell.exe 1876 powershell.exe 4448 lhhsgwktkatl.exe 4448 lhhsgwktkatl.exe 4448 lhhsgwktkatl.exe 4448 lhhsgwktkatl.exe 4448 lhhsgwktkatl.exe 4448 lhhsgwktkatl.exe 4448 lhhsgwktkatl.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe 4716 conhost.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 688 powershell.exe Token: SeIncreaseQuotaPrivilege 688 powershell.exe Token: SeSecurityPrivilege 688 powershell.exe Token: SeTakeOwnershipPrivilege 688 powershell.exe Token: SeLoadDriverPrivilege 688 powershell.exe Token: SeSystemProfilePrivilege 688 powershell.exe Token: SeSystemtimePrivilege 688 powershell.exe Token: SeProfSingleProcessPrivilege 688 powershell.exe Token: SeIncBasePriorityPrivilege 688 powershell.exe Token: SeCreatePagefilePrivilege 688 powershell.exe Token: SeBackupPrivilege 688 powershell.exe Token: SeRestorePrivilege 688 powershell.exe Token: SeShutdownPrivilege 688 powershell.exe Token: SeDebugPrivilege 688 powershell.exe Token: SeSystemEnvironmentPrivilege 688 powershell.exe Token: SeRemoteShutdownPrivilege 688 powershell.exe Token: SeUndockPrivilege 688 powershell.exe Token: SeManageVolumePrivilege 688 powershell.exe Token: 33 688 powershell.exe Token: 34 688 powershell.exe Token: 35 688 powershell.exe Token: 36 688 powershell.exe Token: SeShutdownPrivilege 4916 powercfg.exe Token: SeCreatePagefilePrivilege 4916 powercfg.exe Token: SeShutdownPrivilege 3628 powercfg.exe Token: SeCreatePagefilePrivilege 3628 powercfg.exe Token: SeShutdownPrivilege 192 powercfg.exe Token: SeCreatePagefilePrivilege 192 powercfg.exe Token: SeShutdownPrivilege 4444 powercfg.exe Token: SeCreatePagefilePrivilege 4444 powercfg.exe Token: SeDebugPrivilege 1876 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1876 powershell.exe Token: SeIncreaseQuotaPrivilege 1876 powershell.exe Token: SeSecurityPrivilege 1876 powershell.exe Token: SeTakeOwnershipPrivilege 1876 powershell.exe Token: SeLoadDriverPrivilege 1876 powershell.exe Token: SeSystemtimePrivilege 1876 powershell.exe Token: SeBackupPrivilege 1876 powershell.exe Token: SeRestorePrivilege 1876 powershell.exe Token: SeShutdownPrivilege 1876 powershell.exe Token: SeSystemEnvironmentPrivilege 1876 powershell.exe Token: SeUndockPrivilege 1876 powershell.exe Token: SeManageVolumePrivilege 1876 powershell.exe Token: SeLockMemoryPrivilege 4716 conhost.exe Token: SeShutdownPrivilege 4992 powercfg.exe Token: SeCreatePagefilePrivilege 4992 powercfg.exe Token: SeShutdownPrivilege 2868 powercfg.exe Token: SeCreatePagefilePrivilege 2868 powercfg.exe Token: SeShutdownPrivilege 3420 powercfg.exe Token: SeCreatePagefilePrivilege 3420 powercfg.exe Token: SeShutdownPrivilege 2928 powercfg.exe Token: SeCreatePagefilePrivilege 2928 powercfg.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exelhhsgwktkatl.execmd.exedescription pid process target process PID 4400 wrote to memory of 2236 4400 cmd.exe wusa.exe PID 4400 wrote to memory of 2236 4400 cmd.exe wusa.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 2940 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 4716 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 4716 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 4716 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 4716 4448 lhhsgwktkatl.exe conhost.exe PID 4448 wrote to memory of 4716 4448 lhhsgwktkatl.exe conhost.exe PID 3940 wrote to memory of 5024 3940 cmd.exe wusa.exe PID 3940 wrote to memory of 5024 3940 cmd.exe wusa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\beren.exe"C:\Users\Admin\AppData\Local\Temp\beren.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QHRAJGDI"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QHRAJGDI"2⤵
- Launches sc.exe
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeC:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\conhost.execonhost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeFilesize
5.0MB
MD5b1ac2ea973651a70ea72597e13a10f0a
SHA107e7cdedc54067a46b1d42cdf8a2c9050c3d3419
SHA256e2cb500c902da55ac07cbfbe30b8d1cef8781e55f0439ed601672636c3ab8c47
SHA51202b0dbc8a31ca440027a6c07d618a92bb520567ccd338c28dfcb86faa5b56c866564cf1a05b1754dcfeb252d12d76da57fd2de87804454f0ef1097431764c1f0
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dzfficyj.jih.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
memory/688-7-0x00007FFC1AAA0000-0x00007FFC1B48C000-memory.dmpFilesize
9.9MB
-
memory/688-3-0x00007FFC1AAA3000-0x00007FFC1AAA4000-memory.dmpFilesize
4KB
-
memory/688-10-0x000001B357330000-0x000001B3573A6000-memory.dmpFilesize
472KB
-
memory/688-6-0x00007FFC1AAA0000-0x00007FFC1B48C000-memory.dmpFilesize
9.9MB
-
memory/688-39-0x00007FFC1AAA0000-0x00007FFC1B48C000-memory.dmpFilesize
9.9MB
-
memory/688-46-0x00007FFC1AAA0000-0x00007FFC1B48C000-memory.dmpFilesize
9.9MB
-
memory/688-49-0x00007FFC1AAA0000-0x00007FFC1B48C000-memory.dmpFilesize
9.9MB
-
memory/688-5-0x000001B357180000-0x000001B3571A2000-memory.dmpFilesize
136KB
-
memory/1876-75-0x00000239F2300000-0x00000239F231C000-memory.dmpFilesize
112KB
-
memory/1876-81-0x00000239F2620000-0x00000239F26D9000-memory.dmpFilesize
740KB
-
memory/1876-114-0x00000239F2320000-0x00000239F232A000-memory.dmpFilesize
40KB
-
memory/2940-210-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2940-206-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2940-205-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2940-204-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2940-203-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2940-207-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4716-220-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-215-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-223-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-221-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-222-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-211-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-219-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-218-0x000001D81EAA0000-0x000001D81EAC0000-memory.dmpFilesize
128KB
-
memory/4716-217-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-212-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-214-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-216-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-213-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-226-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-227-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-228-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-230-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4716-229-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB