Analysis
-
max time kernel
11s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-05-2024 11:25
Static task
static1
Behavioral task
behavioral1
Sample
2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe
Resource
win10v2004-20240426-en
General
-
Target
2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe
-
Size
4.1MB
-
MD5
731dee2c856aae4bdebe7b6512ce5dce
-
SHA1
d13315ae49ec18974173c88a79b8913a86181e25
-
SHA256
2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310
-
SHA512
d121a98892475d9268f2e3577e2858c3e2068ff1707265873efac6b837777ddb10daab6de06b8b4b8e7c6a1dd2e77080f8c4bbad3f735aca9359439578fc094f
-
SSDEEP
98304:laldxVYbeltggr6p7qKtgoJu9O6Qxc6qPeInuZKahKn+3Q6:qxq6ggrt/os9O/WxuFhK+A6
Malware Config
Signatures
-
Glupteba payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4968-2-0x0000000004A80000-0x000000000536B000-memory.dmp family_glupteba behavioral2/memory/4968-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4968-52-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4968-51-0x0000000000400000-0x000000000295D000-memory.dmp family_glupteba behavioral2/memory/4968-53-0x0000000004A80000-0x000000000536B000-memory.dmp family_glupteba -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Processes:
powershell.exepowershell.exepid process 1748 powershell.exe 1544 powershell.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exe2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exepowershell.exepid process 1748 powershell.exe 1748 powershell.exe 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe 1544 powershell.exe 1544 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exe2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exepowershell.exedescription pid process Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Token: SeImpersonatePrivilege 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe Token: SeDebugPrivilege 1544 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exedescription pid process target process PID 4968 wrote to memory of 1748 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe powershell.exe PID 4968 wrote to memory of 1748 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe powershell.exe PID 4968 wrote to memory of 1748 4968 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe powershell.exe PID 5084 wrote to memory of 1544 5084 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe powershell.exe PID 5084 wrote to memory of 1544 5084 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe powershell.exe PID 5084 wrote to memory of 1544 5084 2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe"C:\Users\Admin\AppData\Local\Temp\2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe"C:\Users\Admin\AppData\Local\Temp\2c6de375b41208a38554ccd39528d17443f57cfc195534a81e7632263bcc7310.exe"2⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pb5wupwy.mnw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1544-77-0x0000000007500000-0x0000000007515000-memory.dmpFilesize
84KB
-
memory/1544-76-0x00000000074B0000-0x00000000074C1000-memory.dmpFilesize
68KB
-
memory/1544-66-0x0000000070E90000-0x00000000711E7000-memory.dmpFilesize
3.3MB
-
memory/1544-75-0x0000000007180000-0x0000000007224000-memory.dmpFilesize
656KB
-
memory/1544-65-0x0000000070CF0000-0x0000000070D3C000-memory.dmpFilesize
304KB
-
memory/1544-64-0x0000000005FB0000-0x0000000005FFC000-memory.dmpFilesize
304KB
-
memory/1544-63-0x0000000005A90000-0x0000000005DE7000-memory.dmpFilesize
3.3MB
-
memory/1748-36-0x0000000007D80000-0x0000000007D9E000-memory.dmpFilesize
120KB
-
memory/1748-41-0x0000000007F10000-0x0000000007F1A000-memory.dmpFilesize
40KB
-
memory/1748-11-0x0000000005D60000-0x0000000005DC6000-memory.dmpFilesize
408KB
-
memory/1748-9-0x0000000005A50000-0x0000000005A72000-memory.dmpFilesize
136KB
-
memory/1748-20-0x0000000006510000-0x0000000006867000-memory.dmpFilesize
3.3MB
-
memory/1748-21-0x0000000006900000-0x000000000691E000-memory.dmpFilesize
120KB
-
memory/1748-22-0x0000000006E80000-0x0000000006ECC000-memory.dmpFilesize
304KB
-
memory/1748-23-0x0000000006ED0000-0x0000000006F16000-memory.dmpFilesize
280KB
-
memory/1748-25-0x0000000070BE0000-0x0000000070C2C000-memory.dmpFilesize
304KB
-
memory/1748-24-0x0000000007D40000-0x0000000007D74000-memory.dmpFilesize
208KB
-
memory/1748-26-0x0000000070D60000-0x00000000710B7000-memory.dmpFilesize
3.3MB
-
memory/1748-37-0x0000000007DA0000-0x0000000007E44000-memory.dmpFilesize
656KB
-
memory/1748-4-0x000000007497E000-0x000000007497F000-memory.dmpFilesize
4KB
-
memory/1748-38-0x0000000074970000-0x0000000075121000-memory.dmpFilesize
7.7MB
-
memory/1748-35-0x0000000074970000-0x0000000075121000-memory.dmpFilesize
7.7MB
-
memory/1748-39-0x0000000008510000-0x0000000008B8A000-memory.dmpFilesize
6.5MB
-
memory/1748-40-0x0000000007ED0000-0x0000000007EEA000-memory.dmpFilesize
104KB
-
memory/1748-10-0x0000000005BF0000-0x0000000005C56000-memory.dmpFilesize
408KB
-
memory/1748-42-0x0000000008020000-0x00000000080B6000-memory.dmpFilesize
600KB
-
memory/1748-43-0x0000000007F30000-0x0000000007F41000-memory.dmpFilesize
68KB
-
memory/1748-44-0x0000000007F80000-0x0000000007F8E000-memory.dmpFilesize
56KB
-
memory/1748-45-0x0000000007F90000-0x0000000007FA5000-memory.dmpFilesize
84KB
-
memory/1748-46-0x0000000007FE0000-0x0000000007FFA000-memory.dmpFilesize
104KB
-
memory/1748-47-0x0000000008000000-0x0000000008008000-memory.dmpFilesize
32KB
-
memory/1748-50-0x0000000074970000-0x0000000075121000-memory.dmpFilesize
7.7MB
-
memory/1748-5-0x0000000003430000-0x0000000003466000-memory.dmpFilesize
216KB
-
memory/1748-6-0x0000000074970000-0x0000000075121000-memory.dmpFilesize
7.7MB
-
memory/1748-7-0x0000000005E10000-0x000000000643A000-memory.dmpFilesize
6.2MB
-
memory/1748-8-0x0000000074970000-0x0000000075121000-memory.dmpFilesize
7.7MB
-
memory/4968-53-0x0000000004A80000-0x000000000536B000-memory.dmpFilesize
8.9MB
-
memory/4968-51-0x0000000000400000-0x000000000295D000-memory.dmpFilesize
37.4MB
-
memory/4968-52-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4968-1-0x0000000004670000-0x0000000004A73000-memory.dmpFilesize
4.0MB
-
memory/4968-3-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4968-2-0x0000000004A80000-0x000000000536B000-memory.dmpFilesize
8.9MB